After a five-year fight to protect its user's privacy rights, Microsoft has praised the CLOUD Act, which passed yesterday. President Brad Smith calls it “an important day for privacy rights around the world,” but the Electronic Frontier Foundation agrees only in a negative context.
The essential promise of the Cloud Act is to clarify the law surrounding data requests. Microsoft's initial lawsuit arose when the DoJ requested information housed on an Irish server. The company argued that the DoJ should request via an Irish warrant, as the data is physically stored in that country.
The DoJ's case hinged on a 1986 law, making it abundantly clear that an update was needed. However, while the Cloud Act may be a good compromise for Microsoft, it could negatively affect the privacy of citizens across the globe.
Warrantless Data Requests
The legislation lets governments use internal warrants for overseas data, but lets companies flag them if such a request breaks that country's laws. Smith says it contains “appropriate protections for privacy and human rights,” but the EFF disagrees.
“Because of this failure, U.S. and foreign police will have new mechanisms to seize data across the globe,” says the privacy organization. “Because of this failure, your private emails, your online chats, your Facebook, Google, Flickr photos, your Snapchat videos, your private lives online, your moments shared digitally between only those you trust, will be open to foreign law enforcement without a warrant and with few restrictions on using and sharing your information. Because of this failure, U.S. laws will be bypassed on U.S. soil.”
Basically, the only thing standing in the way of law enforcement is the companies that house the data. In its post, the EFF uses Slack as an example.
Under the Cloud Act, UK investigators could request the messages of a UK citizen by going directly to Slack, a US company. To do so, they wouldn't need a probable cause warrant, and possibly no judicial review. They could do so without notifying the US government, and the data could contain messages from US citizens. It could then provide that information to US law enforcement, who could charge the US citizen without ever needing a warrant.
A Good End for Microsoft?
The EFF notes that this act passed without review, hearing, or a standalone floor vote, tacked on the end of a government spending bill. For Microsoft, though, its satisfactory resolution to a long and expensive legal battle.
However, it's not truly the resolution the company fought for. Last month, Microsoft took its overseas data case to the Supreme Court. Apparently, court justices weren't buying Microsoft's proposal, so it makes sense that Smith would praise the resolution.
“Microsoft appreciates the bipartisan work of congressional leaders in the House and Senate, as well as leadership at the White House and elsewhere to address these important issues and to advance the CLOUD Act toward enactment,” he ends.