vali_111 - Fotolia

CLOUD Act stirs tension between privacy advocates and big tech

Privacy advocates criticize Congress for passing the CLOUD Act as part of the omnibus spending bill, while big tech companies have expressed support for the controversial legislation.

Congress has come under fire for passing the controversial CLOUD Act as part of the omnibus spending bill, rather than through traditional methods, with review and open hearings.

The aim of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was to allow the president to enter into agreements with foreign governments to facilitate information and data sharing across international borders in law enforcement investigations. The CLOUD Act has been controversial, because although it would put in place a standardized process for sharing communication data across borders, some say it lacks oversight and infringes on user privacy.

The CLOUD Act (H.R. 4943) had wider support from big tech companies. Apple, Facebook, Google, Microsoft and Oath all signed a letter in February urging Congress to pass the CLOUD Act, because they saw it as a way to "create a concrete path for the U.S. government to enter into modern bilateral agreements with other nations that better protect customers."

"The legislation would require baseline privacy, human rights and rule of law standards in order for a country to enter into an agreement. That will ensure customers and data holders are protected by their own laws and that those laws are meaningful. The legislation would further allow law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts," the companies wrote in the letter. "The CLOUD Act encourages diplomatic dialogue, but also gives the technology sector two distinct statutory rights to protect consumers and resolve conflicts of law if they do arise. The legislation provides mechanisms to notify foreign governments when a legal request implicates their residents, and to initiate a direct legal challenge when necessary."

However, privacy advocates -- including the American Civil Liberties Union (ACLU), Electronic Frontier Foundation (EFF) and Amnesty International -- have widely panned the CLOUD Act for lacking oversight and due process.

The EFF and ACLU have charged that the CLOUD Act is unconstitutional, and it would allow foreign governments to wiretap U.S. citizens without complying with U.S. law and give the president the power to enter into agreements without congressional approval.

Jennifer Daskal, associate professor of law at American University Washington College of Law, and Peter Swire, chair of law and ethics at the Georgia Tech Scheller College of Business, said this view of the CLOUD Act was not accurate. Daskal and Swire wrote on the Lawfare blog that the CLOUD Act would make the process of sharing data on non-U.S. citizens easier and would allow the "U.S. government to review what foreign governments do with data once it is turned over."

"If the foreign government wants to request the data of a U.S. citizen or resident, it still needs to employ the Mutual Legal Assistance (MLA) system. The bill sets forth a long list of privacy and human rights criteria as to the contours of those requests," Daskal and Swire wrote. They added that governments naturally seek to sidestep the MLA system, and the inevitable result will be data localization laws forcing storage in those countries.

No debate allowed

Privacy advocates were angered Thursday because Congress sidestepped the potential for debate on these issues by passing the CLOUD Act as a rider on page 2,212 of the 2,232-page omnibus spending bill -- similar to what Congress did with the controversial Cybersecurity Information Sharing Act in 2015. The House of Representatives approved the spending bill with a 256-167 vote, and the Senate passed the bill with a 65-32 vote. President Donald Trump has already promised to sign the bill into law.

Sens. Ron Wyden (D-Ore.) and Rand Paul (R-Ky.) both spoke out against including the CLOUD Act in the omnibus bill prior to the vote and expressed unhappiness with the process following the vote on Thursday.

"Tucked away in the omnibus spending bill is a provision that allows Trump, and any future president, to share Americans' private emails and other information with countries he personally likes," Wyden wrote in a public statement. "It is legislative malpractice that Congress, without a minute of Senate debate, is rushing through the CLOUD Act on this must-pass spending bill."

Paul expressed a similar concern on Twitter.

Dig Deeper on Security operations and management

Enterprise Desktop
  • Understanding how GPOs and Intune interact

    Group Policy and Microsoft Intune are both mature device management technologies with enterprise use cases. IT should know how to...

  • Comparing MSI vs. MSIX

    While MSI was the preferred method for distributing enterprise applications for decades, the MSIX format promises to improve upon...

  • How to install MSIX and msixbundle

    IT admins should know that one of the simplest ways to deploy Windows applications across a fleet of managed desktops is with an ...

Cloud Computing