1. U.S. Intelligence Oversight Reforms & the Cloud Act
Peter Swire
International Intelligence Oversight Forum 2018
Valetta, Malta
November 30, 2018

2. Overview Swire background
U.S. Intelligence oversight and reforms since Snowden
Mutual Legal Assistance reform, cross-border data and the Cloud Act
Role of nationality in intelligence activities
Theme – published resources online that describe and analyze these issues in great detail

3. US, EU, and Global Data Flows
1998 book from the Brooking Institution
on US/EU privacy disputes

4. Background President Clinton’s Chief Counselor for Privacy
Negotiation of US/EU “Safe Harbor” for privacy
Chaired White House Working Group on updating wiretap and intelligence law for the Internet
“The System of Foreign Intelligence Law” (2004) – FISA and needed oversight reforms
President Obama’s Review Group on Intelligence and Communications Technology (2013) (“NSA Review Group”)

5. The Situation Room: December 2013

6. U.S. Intelligence Oversight & Reform Since 2013
Review Group: 46 recommendations
White House in 2014 reported 70% had been adopted
PPD-28, privacy protections for non-US persons in signals intelligence
NSA created Privacy and Civil Liberties Office
Transparency reporting ensured under law
More since then, notably USA Freedom Act (2015)

7. present
Intelligence reforms have stayed in place under the Trump Administration
Updates at IC on the Record:
One recent development:
Amicus curiae for the Foreign Intelligence Surveillance Court, both legal and technological
First technological amici named last month
Professor Annie Antón and 2 others

8. Revised System for Oversight of U.S. Intelligence
Intelligence oversight reforms described in detail in Swire sworn testimony (300 pages) in Schrems SCC case (2017)
Safeguards for U.S. intelligence
Corrected facts on PRISM and Upstream programs
Details to supplement list of oversight measures
Safeguards for U.S. law enforcement
Comparisons with other nations
Review of declassified FISC opinions

9. MLA & Cross-Border Government Access to Data
Technology/market changes
Before, evidence for serious crime in Valetta was in Valetta
Now, , social network, and other content often held in a different nation
E-Evidence report: 55% of cases have evidence across borders
U.S. Electronic Communications Privacy Act
Criminal offense for a U.S. “service provider” to provide content except with U.S. probable cause warrant
Large frustration for non-U.S. law enforcement

10. How to Assist Non-U.S. Requests?
Status quo was a Mutual Legal Assistance Treaty request
10 months average to provide evidence (2013)
2015 proposal:
Non-U.S. law enforcement can make content request directly to U.S. “service provider”
If, strong set of privacy and human rights protections in the requesting country
Authority for these executive agreements was enacted in the CLOUD Act (2018)

11. US Access & the Microsoft Ireland Case
Long-standing rule for U.S. access for law enforcement purposes:
Evidence if “possession, custody, or control” by the entity receiving order
Microsoft claim: no legal authority if data stored in Ireland
January, 2018 – the case was argued in the U.S. Supreme Court
March, 2018: Congress passed the CLOUD Act
Reaffirmed “possession, custody, or control” rule
Service provider can go to court (sometimes) if subject to conflicting laws

12. Implementing the Cloud Act
New Cross-Border Data Forum for discussion of Cloud Act, E-Evidence, and related issues

14. Goals of Cross-Border Data Forum
Fulfill legitimate law enforcement requests for data relevant to the investigation of serious crimes.   
Protect and promote privacy and human rights as essential to new legal approaches. 
Provide a workable regime for the companies holding data of interest to law enforcement. 
Safeguard the internet by resisting calls to localize data and splinter the internet. 
We invite you to subscribe to updates, and to write submissions for publication.

15. Concerns/myths about the Cloud Act
“A New Patriot Act?” No. Access for law enforcement only, not for intelligence.
“Sweeping expansion of US authorities?” No, reaffirmed existing law on US access.
“Tool for U.S. to steal trade secrets?” No. Prohibited under U.S. law.
“Tool for U.S. real-time intercepts abroad?” No.
“Executive agreements lower privacy protections?” No, incentives for strong protections in non-U.S. countries to gain access.

16. Last item:
“The Important, Justifiable, and Constrained Role of Nationality in Foreign Intelligence Surveillance”
To be published online, perhaps next week, by Hoover Institute
Topic: ever permitted under human rights law to have different rules for surveillance based on nationality?
Ongoing research: would appreciate so much if you could provide information on your country’s approach on this topic!
Thank you so much.