The second part of the CLOUD Act, codified by the 18 U.S.C agreement, allows a supplier to jointly use the content of the communication with a qualified foreign government. As a general rule, the United States allows the exchange of such information with foreign governments only on the basis of a Mutual Legal Assistance Agreement (MLAT), a system of agreements that allows law enforcement agencies to formally request data from other countries. In the United States, all MLAT applications are reviewed by the Criminal Division of the Department of Justice and the U.S. Attorney in the district where the witness is located; the U.S. attorney must then apply for an arrest warrant or court order from a federal judge. This is a complex and time-consuming process due to the number of audit levels and, therefore, the average time required to meet a properly executed MLAT requirement was 10 months from 2013. U.S. requests for data from foreign governments may take even longer, or perhaps not trigger a response. While current legislation already paves the way for such an exchange, the data collection process can take up to two years.
The executive agreement accelerates this timetable. On 7 October, the United Kingdom and the United States published the text of the long-awaited data exchange agreement – the first of the executive agreements under the CLOUD Act, passed in May 2018, to facilitate cross-border access to data in serious offences investigations. At the time of its adoption, there was a lively debate as to whether these executive agreements would reduce or increase privacy and other civil liberties protections – and we both agree that they have kept their promise to undertake reforms to improve data protection. Partners working directly with Amazon Web Services, Google Cloud Platform, Microsoft Azure and other similar public cloud providers should be less to be feared. Part of the purpose of these executive agreements is to enable partner states to conduct investigations within U.S. borders and remove barriers to U.S. prosecutions abroad. Such harmonisation of efforts is also taking place in Europe: the European Commission announced in February that it was describing the process of negotiating a cross-border system of access to electronic evidence at EU level, which it described as an “e-emptince framework”. The United States announced the launch of a similar negotiation process with the European Union in September and with Australia in October.