House Judiciary Hearing: UK's Data Access and US Privacy Concerns Under the Cloud Act

The Cloud Act and Overseas Data Access

• 💡 The Cloud Act, passed in 2018, allows US law enforcement to obtain data held by US-based service providers, even if stored outside the US, via lawful court orders.
• 🤝 It also enables allies to enter bilateral agreements with the US to access their citizens' data from US providers for their own investigations.

UK's Actions and Privacy Concerns

• ⚠️ A significant concern is the United Kingdom's alleged secret order to Apple, compelling it to create a backdoor into its devices for UK law enforcement access to user data, including encrypted data.
• 🌍 This order is seen as a threat to the privacy and security of users globally, not just in the UK or US, and sets a dangerous precedent.
• 🔒 Encryption is highlighted as a critical tool for privacy and security, and efforts to weaken or break it make everyone less secure.
• 🚨 The Salt Typhoon hack, which accessed US law enforcement wiretap systems and private data, is cited as a clear example of the dangers of surveillance backdoors.

Legal and Technical Implications

• ⚖️ Witnesses express concern that the Cloud Act and its agreements may not adequately protect American privacy and security, with calls to renegotiate agreements or invoke termination clauses.
• 🌐 The technical capability notice regime in the UK is criticized for being ill-defined, secret, and extraterritorial, allowing UK orders on US companies affecting all users worldwide.
• 🚫 It is argued that it is technologically infeasible to have both effective end-to-end encryption and mechanisms for third-party access, creating inherent vulnerabilities.

Proposed Reforms and Future Actions

• 🏛️ Several reforms are proposed, including amending the Cloud Act to declare cybersecurity a national interest and requiring foreign governments not to impose anti-security obligations on US companies.
• 📢 Calls are made for the DOJ to invoke termination clauses and for Congress to amend the Cloud Act to prohibit agreements with countries whose laws permit such orders.
• 🔍 Witnesses emphasize the need for transparency and for providers to be able to notify the US government when they receive such orders, and for Congress to receive more frequent reporting.