U.S. Intelligence Oversight Reforms & the Cloud Act

1. U.S. Intelligence Oversight Reforms & the Cloud Act Peter Swire International Intelligence Oversight Forum 2018 Valetta, Malta November 30, 2018

2. Overview • Swire background • U.S. Intelligence oversight and reforms since Snowden • Mutual Legal Assistance reform, cross-border data and the Cloud Act • Role of nationality in intelligence activities • Theme – published resources online that describe and analyze these issues in great detail

3. US, EU, and Global Data Flows 1998 book from the Brooking Institution on US/EU privacy disputes

4. Background • President Clinton’s Chief Counselor for Privacy • Negotiation of US/EU “Safe Harbor” for privacy • Chaired White House Working Group on updating wiretap and intelligence law for the Internet • “The System of Foreign Intelligence Law” (2004) – FISA and needed oversight reforms • President Obama’s Review Group on Intelligence and Communications Technology (2013) (“NSA Review Group”)

5. The Situation Room: December 2013

6. U.S. Intelligence Oversight & Reform Since 2013 • Review Group: 46 recommendations • White House in 2014 reported 70% had been adopted • PPD-28, privacy protections for non-US persons in signals intelligence • NSA created Privacy and Civil Liberties Office • Transparency reporting ensured under law • More since then, notably USA Freedom Act (2015)

7. 2016 - present • Intelligence reforms have stayed in place under the Trump Administration • Updates at IC on the Record: • http://icontherecord.tumblr.com • One recent development: • Amicus curiae for the Foreign Intelligence Surveillance Court, both legal and technological • First technological amici named last month • Professor Annie Antón and 2 others

8. Revised System for Oversight of U.S. Intelligence • Intelligence oversight reforms described in detail in Swire sworn testimony (300 pages) in Schrems SCC case (2017) • https://www.alston.com/en/resources/peter-swire-irish-high-court-case-testimony • Safeguards for U.S. intelligence • Corrected facts on PRISM and Upstream programs • Details to supplement list of oversight measures • Safeguards for U.S. law enforcement • Comparisons with other nations • Review of declassified FISC opinions

9. MLA & Cross-Border Government Access to Data • Technology/market changes • Before, evidence for serious crime in Valetta was in Valetta • Now, email, social network, and other content often held in a different nation • E-Evidence report: 55% of cases have evidence across borders • U.S. Electronic Communications Privacy Act • Criminal offense for a U.S. “service provider” to provide content except with U.S. probable cause warrant • Large frustration for non-U.S. law enforcement

10. How to Assist Non-U.S. Requests? • Status quo was a Mutual Legal Assistance Treaty request • 10 months average to provide evidence (2013) • 2015 proposal: • Non-U.S. law enforcement can make content request directly to U.S. “service provider” • If, strong set of privacy and human rights protections in the requesting country • http://www.iisp.gatech.edu/cross-border-data-project • Authority for these executive agreements was enacted in the CLOUD Act (2018)

11. US Access & the Microsoft Ireland Case • Long-standing rule for U.S. access for law enforcement purposes: • Evidence if “possession, custody, or control” by the entity receiving order • Microsoft claim: no legal authority if data stored in Ireland • January, 2018 – the case was argued in the U.S. Supreme Court • March, 2018: Congress passed the CLOUD Act • Reaffirmed “possession, custody, or control” rule • Service provider can go to court (sometimes) if subject to conflicting laws

12. Implementing the Cloud Act • New Cross-Border Data Forum for discussion of Cloud Act, E-Evidence, and related issues

13. www.crossborderdataforum.org

14. Goals of Cross-Border Data Forum • Fulfill legitimate law enforcement requests for data relevant to the investigation of serious crimes.    • Protect and promote privacy and human rights as essential to new legal approaches. • Provide a workable regime for the companies holding data of interest to law enforcement. • Safeguard the internet by resisting calls to localize data and splinter the internet.  • We invite you to subscribe to updates, and to write submissions for publication.

15. Concerns/myths about the Cloud Act • “A New Patriot Act?” No. Access for law enforcement only, not for intelligence. • “Sweeping expansion of US authorities?” No, reaffirmed existing law on US access. • “Tool for U.S. to steal trade secrets?” No. Prohibited under U.S. law. • “Tool for U.S. real-time intercepts abroad?” No. • “Executive agreements lower privacy protections?” No, incentives for strong protections in non-U.S. countries to gain access.

16. Last item: • “The Important, Justifiable, and Constrained Role of Nationality in Foreign Intelligence Surveillance” • To be published online, perhaps next week, by Hoover Institute • Topic: ever permitted under human rights law to have different rules for surveillance based on nationality? • Ongoing research: would appreciate so much if you could provide information on your country’s approach on this topic! • peter@peterswire.net • Thank you so much.