Clarifying Lawful Overseas Use of Data (CLOUD) Act

Overview

On March 23, 2018, United States Congress passed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), updating the legal framework for United States law enforcement requests for data held by telecommunications service providers. Clarifying prior law, the CLOUD Act provides a limited mechanism for United States law enforcement to request data stored in the United States and overseas. Importantly, the CLOUD Act also creates additional safeguards for cloud content, including recognizing the right of providers to challenge requests that conflict with another country’s laws or national interests and requiring that governments respect local rules of law.

FAQs

  • The CLOUD Act it is an update to United States law that clarifies the geographic scope for United States law enforcement requests and provides new means for services providers to challenge requests that conflict with another country's laws or national interests. Where we need to act to protect customers, we'll continue to do so. We have a history of challenging government requests for customer information that we believe are overbroad or otherwise inappropriate.

  • No. The CLOUD Act does not change the process or requirements for law enforcement requests for data as part of a criminal investigation. The CLOUD Act does not give United States law enforcement unlimited or unfettered access to data. United States Law enforcement may seek content from service providers in only two circumstances: (1) with the customer’s consent or (2) with a warrant issued by a United States court in accordance with United States criminal procedures. For a warrant to be issued, a United States court must be convinced that there is probable cause to believe a crime has occurred and that evidence sought under the warrant is directly related to that crime. The CLOUD Act also creates additional safeguards for cloud content, recognizing the right of cloud service providers to challenge requests that conflict with another country’s laws or national interests.

  • The CLOUD Act does not impact AWS services or how we operate our business. Historically, we have received very few United States law enforcement requests, and we are transparent about the number of requests that we receive. We are always vigilant about customer privacy and security, and we are committed to providing our customers with industry-leading privacy and security protections when using our products and services. When we receive a request for content from law enforcement, we carefully examine it to authenticate accuracy and to verify that it complies with applicable law. Where we need to act to protect customers, we’ll continue to do so. We have a history of challenging government requests for customer information that we believe are overbroad or otherwise inappropriate. If we are required to disclose customer content, we will continue to notify customers before disclosure to provide them the opportunity to seek protection from disclosure, unless prohibited by law.

  • The CLOUD Act does not impact how customers/partners can use AWS services.

  • We believe customers should maintain control of their own data, and we provide a number of advanced encryption and key management services that customers can use to protect their content. Customers can also choose from a number of supported third-party encryption solutions when using AWS services. Encrypted content is useless without the applicable decryption keys.

  • No. The CLOUD Act applies to all electronic communication service or remote computing service providers that operate in the U.S. (such as email and cloud service providers), whether those providers are established in the United States or another country.

  • No. The CLOUD Act does not change another country's local laws. In fact, the CLOUD Act recognizes the right for service providers to challenge requests that conflict with another country's laws or national interests.

CLOUD Act Resources

 AWS and the CLOUD Act  Cryptography Basics  KMS Best Practices  AWS Key Management Service Cryptographic Details Whitepaper  AWS Encryption Updates  AWS Compliance Quick Starts  Amazon Information Requests  “Don't Get Spooked by the CLOUD Act” by IDC