Tech companies and app developers have traveled a long and winding road awaiting legislation that would clarify when and how U.S. law enforcement agencies can access data stored abroad. We find ourselves in the middle of the journey to achieve these desperately needed reforms, caught between competing policy interests. In the absence of clear guidance defining lawful access to data, our members have encountered snags and obstacles around every bend. Fortunately, efforts to update the law benefit from strong leadership in Congress. Senators Orrin Hatch, Chris Coons, and several other policymakers and their staff are to thank for the significant progress in clearing a path for the International Communications Policy Act (ICPA) this year.
In a May hearing hosted by Senate Judiciary Subcommittee on Crime, Terrorism, Homeland Security, and Investigations, the Department of Justice’s (DoJ) Brad Wiegmann acknowledged that current law outlining law enforcement access to data creates conflicts for American companies doing business overseas. Senator Hatch noted that Brazilian law prevents the disclosure of communications data pertaining to Brazilian citizens to foreign, including American, law enforcement bodies. When asked if a company would be subject to conflicting laws if U.S. law enforcement sought communications data pertaining to a Brazilian citizen, Mr. Wiegmann affirmatively noted, “that’s when we would have to figure out what the resolution is.” This interaction reveals that despite their differing opinions, DoJ and Senator Hatch want essentially the same thing: to resolve legal conflicts with foreign countries over data requests.
Furthermore, Senator Lindsey Graham, chairman of the subcommittee hosting the hearing, thoroughly questioned Microsoft President and Chief Legal Officer Brad Smith to determine the disparity between the DoJ and tech community’s positions. Chairman Graham and DoJ maintain concerns regarding law enforcement access to data for important domestic and international investigations. To address these valid concerns, Senators Hatch and Coons introduced legislation, which includes measured amendments to last year’s ICPA bill, to better merge the paths and interests of DoJ and tech.
First, the new bill will reduce the timeframe during which a foreign country can object to a U.S. law enforcement request for communications data, from 60 days to 14 days. This change responds to reasonable criticism from DoJ that giving a country too much time to respond to communications data requests could jeopardize their investigation.
Second, the bill provides exceptions to the requirement that U.S. law enforcement notify foreign governments of their requests for communications involving those foreign governments’ citizens. Specifically, in urgent circumstances, the timeframe countries have to object to law enforcement requests for data could be shortened from the amended 14 days to 7 days. In cases where there is reason to believe that providing notice would jeopardize national security or undermine the investigation, U.S. law enforcement agencies could delay notice to the foreign government by 90 days. This 90-day delay could be renewed upon subsequent showings of the same conditions.
Third, the new ICPA legislation would require the U.S. Attorney General to determine whether a country meets due process, privacy, and civil rights requirements before they may qualify to receive notifications from U.S. law enforcement. This measured approach responds to various criticisms that countries with bad human rights records could unilaterally block important U.S. investigations.
Fourth, the legislation would enable U.S. law enforcement to refuse foreign countries’ or communications service providers’ objections to provide communications data if those objections lack a reasonable basis in fact or law. Specifically, the legislation would authorize U.S. law enforcement to challenge such an objection in court, and would outline the factors a court must consider to determine which party prevails. Among other requirements, the bill would direct the court to consider the location of the offense, the seriousness of the offense, the ability to access the data through other means, and the significance of the requested data to law enforcement’s investigation. This change would provide a safety valve in response to the concern that, under the previous bill, countries could unilaterally block U.S. law enforcement investigations. If this “comity” analysis reveals an overwhelming U.S. interest in obtaining the data, the objecting entity is overcome—and the company subject to the data request can be assured it’s following the right law.
Despite these measured amendments to assuage DoJ’s concerns, DoJ declined to support the renewed ICPA legislation and continues to push for a reversal of the Second Circuit Court’s decision in the Microsoft lawful access to data case. In that case, the Second Circuit ultimately sided with Microsoft in finding that current statute does not authorize U.S. law enforcement to obtain data pertaining to foreign persons stored abroad as part of an investigation. Nonetheless, as articulated in this letter, the same broad set of industry representatives that supported the previous ICPA bill also support the new legislation that incorporates DoJ’s requests. Perhaps DoJ feels it has stronger chances in the Supreme Court with the addition of Justice Gorsuch—who many commenters argue is inclined to side with law enforcement—but while waiting for the court to decide whether to act, America’s tech innovators continue to lose out without clarity and agreement on this issue.
ACT | The App Association remains hopeful that Chairman Graham’s stated goal of getting the U.S.-UK agreement authorization on lawful access across the finish line is strong motivation to bring DoJ negotiators back to the table. Congress plays a vital role in ensuring a timely and effective resolution to the ambiguity in access to data stored overseas, especially as foreign countries continue to enact “blocking statutes” that prohibit the disclosure of data to U.S. law enforcement. The road is long, but the destination is crucial.