EFF denounces ‘covert’ introduction of US data access law

The American civil rights organization EFF is critical of the way a bill called the Cloud Act has been passed by the US Congress. The law deals with access to data by governments in criminal investigations.

The EFF writes that the law now only requires President Trump’s signature to be approved. Congress’ approval of the Cloud Act came about because it was added to a 2,232-page bill on $1.3 trillion in government spending, which Congress has now passed. The law in question was “tucked away” in the last pages of this package. As a result, the Cloud Act would never have received the attention it deserves, the organization writes.

The law, whose name stands for ‘Clarifying Overseas Use of Data’, deals with access to data in criminal investigations. The EFF fears that this will give American and international investigative services more opportunities to ‘request data all over the world’. For example, foreign investigative services would be able to request data stored in the US without the intervention of a judge, and the same would be possible for the American police in countries outside the US, without the need for data from an American person.

TechCrunch explains that the retrieval of criminal data is currently done via so-called MLAs, which are covered with guarantees. In addition to the EFF, the site also cites other civil rights organizations that believe that the new law circumvents the protection measures in those treaties. However, they also admit that the Cloud Act introduces important new safeguards. Tech companies are positive about the new law, so said Microsoft that this ‘is an important step forward’ and ‘constitutes a modern legal framework for the way in which investigative services can access data outside their national borders’.

Google, among others, criticized Mlats in the past, because they would delay the retrieval of data from companies too much. For example, this could take an average of ten months, making countries feel that their own laws also apply across the border. That would then throw companies back into a bind, violating the laws of the requesting country or the laws of the country where their headquarters are located.