MENU

Reason.com

Free Minds & Free Markets

Supreme Court Punts on Data Privacy Case, Thanks to the Terrible CLOUD Act

Lawmakers passed a bill requiring American firms to comply with warrants for data stored overseas, ending a legal fight.

Supreme CourtGerald Mothes / Dreamstime.comThanks to a broad new law granting the feds access to American data stored in foreign countries, the Supreme Court just punted a case that was supposed to address the question.

In United States v. Microsoft, federal drug-trafficking investigators were trying to force Microsoft to comply with a warrant demanding access to a customer's emails and other private data. But the data they wanted were stored on a server in Ireland. Microsoft fought the warrant, arguing that the government's demands couldn't reach that far under the Stored Communications Act.

The Supreme Court agreed to take on the case last fall and heard arguments in February. But in March, legislation buried deep in the federal omnibus spending bill granted the feds access to data and communications from Americans being held on servers in foreign countries. So today the Supreme Court ruled that the case was moot and kicked it back down to the lower courts for dismissal.

That bill, the Clarifying Lawful Overseas Use of Data (CLOUD) Act, did not get much attention outside of privacy and civil liberties quarters. (We covered it here at Reason.) The CLOUD Act not only gives the feds access to Americans' data being held overseas, but also allows other countries to demand access to their citizens' private data when it's stored here in America. The American Civil Liberties Union warned that poor and limited oversight of the cooperation system could have significant human rights consequences in countries with despotic leaders:

The bill would give the attorney general and the secretary of State the authority to enter into data exchange agreements with foreign governments without congressional approval. The country they enter into agreements with need not meet strict human rights standards—the bill only stipulates that the executive branch consider as a factor whether a government "demonstrates respect" for human rights and is similarly vague as to what practices would exclude a particular country from consideration. In addition, the bill requires that countries adopt procedures to protect Americans' information, but provides little specificity as to what these standards must include. Moreover, it would allow countries to wiretap on U.S. soil for the first time, including conversations that foreign targets may have with people in the U.S., without complying with Wiretap Act requirements.

But none of that was connected to the case the Supreme Court was considering. They were just examining the limits of what the feds could request. The CLOUD Act was passed specifically for the purpose of making it clear that the feds could demand American tech companies pass along data no matter where it was stored. So the case is indeed moot, even if the underlying concerns and fears are still very relevant.

Photo Credit: Gerald Mothes / Dreamstime.com

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  • Fist of Etiquette||

    But in March, legislation buried deep in the federal omnibus spending bill granted the feds access to data and communications from Americans being held on servers in foreign countries.

    Look, do you want Congress to pass huge pieces of unread legislation in a hurry or don't you?

  • MatthewSlyfield||

    No, I don't.

    In point of fact, if I were in charge, I would require that every bill be read out loud in it's entirety on the floor of the House/Senate before they can hold a vote on it.

    Oh, and any Rep/Senator who doesn't sit through the entire reading doesn't get to vote on the bill.

  • Fist of Etiquette||

    Someone's been reading my manifesto.

  • Citizen X - #6||

    Of course, Fist's manifesto consists of first posts on Reason articles. Of course.

  • Fist of Etiquette||

    Cream rises to the top.

  • MatthewSlyfield||

    So does scum.

  • Mr. Gus||

    Sarcasm meter failure, or clarification of position?

  • Rossami||

    Seconded.

  • Cyto||

    I'm not sure exactly how the case is moot, if it turned on constitutional issues.

    OK, so you passed a law that says you can subpoena stuff in other countries. Does that give you jurisdiction in other countries? I'm not sure exactly how it does.

    I suppose they could hang their hat on Americans and American companies.

    But what of a multinational with international divisions, partnerships, partially owned subsidiaries, etc.? How exactly is US law supposed to apply to a company that is headquartered in Seattle, but they have their "headquarters" in Ireland for tax reasons, but they have their Cloud Computing division in Germany, but the data is stored in Belarus on servers controlled by a joint venture partnership owned by the government of Belarus and a data center subsidiary?

    Just because "we say so", suddenly this entity is beholden to US law enforcement?

  • sarcasmic||

    Looks to me more like a reciprocal deal where the governments in other countries will collect information for Uncle Sam, and in exchange Uncle Sam will collect information for other countries.

  • Jerryskids||

    Wait until Ireland weighs in on the issue of whether or not data held on an Irish server is subject to US law. I have my fingers crossed that some jurisdiction somewhere has or will pass a privacy law that makes it illegal to share data without authorization from that jurisdiction.

  • Citizen X - #6||

    I've said this before, but i cannot wait to see what happens when CLOUD runs afoul of GDPR, and vice versa.

  • Ken Shultz||

    I suggest investigating pCloud.

    As I understand it, their servers are all in Switzerland. In order to get a warrant in Switzerland, they have to go through Swiss courts and comply with Swiss privacy laws.

    Last I checked, they give you 8 gigs free of charge. The service is especially good for portable devices because, unlike DropBox, the content isn't also stored locally--so If you have a Chromebook, or something else with a small hard drive, that gives you more storage.

    P.S. If you've got a Chromebook, take a look at GalliumOS. Even if you don't give a crap about privacy, buying a Chromebook, dumping ChromeOS, and installing Gallium OS is probably the least expensive, most powerful, most functional computer you can buy.

  • Ken Shultz||

    P.S. Veracrypt

    If you're using Google or Microsoft or some other American company for your cloud storage, encrypt you data locally with Veracrypt.

    They can't turn over encryption keys that they don't have, so you if you encrypt it yourself . . . all they can hand over is an encrypted file.

    It's a good way to protect your cloud data from hackers, anyway--and you can download and use the program for free.

    It's bad news that we can't depend on the courts to protect our rights, but the good news is that we don't need to depend on the courts to protect our rights in this way.

  • loveconstitution1789||

    Did you hear that the US Government has jurisdiction over every country in the World because Americans breathe the same air that is located over Bulgaria?

  • gormadoc||

    No, the Bulgarians are merely breathing American air that we have graciously decided to lend them.

  • Curt||

    "The country they enter into agreements with need not meet strict human rights standards—the bill only stipulates that the executive branch consider as a factor whether a government "demonstrates respect" for human rights and is similarly vague as to what practices would exclude a particular country from consideration"

    At first legislators tried to introduce such provisions into the law, but ended up having difficulty defining appropriate human rights standards that weren't already violated by the US.

  • BYODB||

    Next Up:


    Congress grants itself the authority to pass laws in Iran.

  • ace_m82||

    That's called a "war". We haven't technically seen one of those since the 1940s.

  • prediksi singapore||

    Apakah Anda mendengar bahwa Pemerintah AS memiliki yurisdiksi atas setiap negara di Dunia karena orang Amerika menghirup udara yang sama yang terletak di atas Bulgaria?

  • turco||

    F*ck Paul Ryan for passing this monstrosity.

GET REASON MAGAZINE

Get Reason's print or digital edition before it’s posted online