Cybersecurity Policy Report, Wyden Bill Would Help U.S. Tech Firms Challenge Surveillance Orders From Foreign Nations, (Feb 14, 2025)
Organizations Mentioned:Apple
The ability of authorities in the United Kingdom to issue a secret order to Apple, Inc., requiring Apple to provide backdoor access to users’ communications worldwide requires a legislative fix, Sen. Ron Wyden (D., Ore.) said today.
Sen. Wyden released a discussion draft of a bill that he said would subject such orders to judicial review by overseas courts and empower tech companies to challenge them in a U.S. court.
The legislation responds to a Washington Post report last week that U.K. authorities had secretly “demanded that Apple create a back door allowing them to retrieve all the content any Apple user worldwide has uploaded to the cloud.”
Apple is obliged to comply with those sorts of orders from some foreign authorities because of a 2018 law, the Clarifying Lawful Overseas Use of Data (CLOUD) Act, Sen. Wyden said in a news release.
“The U.K. was apparently able to secretly issue the order to Apple, rather than seeking assistance from the Department of Justice (DOJ), because of the CLOUD Act,” Sen. Wyden said.
“The CLOUD Act, enacted in 2018, enables foreign countries to obtain data directly from U.S. firms, bypassing the U.S. legal system once they enter into an agreement with the Justice Department,” he explained.
“However, the CLOUD Act failed to require foreign countries to adopt the same due process requirements long guaranteed under U.S. law, enabling foreign governments to demand that U.S. technology companies weaken the security of products used by Americans and putting global trust in U.S. firms at risk,” he said.
His proposed Global Trust in American Online Services Act would address “serious flaws in the CLOUD Act, to ensure that U.S. technology companies can continue to maintain the trust of their international customers, and that the U.S. can compete, globally, as a safe place for data,” according to a summary of the bill.
The legislation would, among other things, “prevent foreign governments from using the CLOUD Act to require U.S. providers to adopt specific designs for products, reduce the security of a product, or deliver malware to a customer,” he said.
It would also allow U.S. providers to challenge foreign CLOUD Act orders in U.S. federal court and require congressional approval of CLOUD Act agreements “rather than the current disapproval mechanism,” he added.
“Foreign governments shouldn’t get a cheat code to undermine the security of American technology,” Sen. Wyden said. “My bill would fix the loopholes in the CLOUD Act, and modernize the law so American allies can request the information they need to investigate serious crimes without sacrificing the security of Americans’ communications services.”
MainStory: TopStory FederalLegislation InternationalLegislation DataPrivacy