Australia and US sign Cloud Act deal to help law enforcement agencies demand data from tech giants
Australia and the US have signed a deal to speed up information sharing about criminal suspects between law enforcement agencies and tech companies, including social media giants.
The deal under the US Clarifying Lawful Overseas Use of Data (Cloud) Act will allow Australian and US law enforcement agencies to use existing warrants to demand information from overseas-based companies to prevent, detect, investigate and prosecute serious crime.
The agreement allows authorities to demand data from communications service providers operating in the other’s jurisdiction, reducing the time taken to obtain information.
It means companies including email providers, telcos, social media platforms, and cloud storage services could soon find themselves answering warrants from law enforcement agencies based in the US or Australia rather than their home jurisdiction.
Questions remain about the practical effects of the deal, given the drive towards encryption of information that keeps data at arm’s length from the tech companies themselves, such as Facebook’s provision of end-to-end encryption for its users on WhatsApp.
In October 2019 the former home affairs minister, Peter Dutton, publicly lobbied Facebook not to roll out encryption, which he said would put users’ messages out of reach of police “even with a court-ordered warrant”.
Facebook responded that people “have the right to have a private conversation online” and the Cloud Act “allows for companies to provide available information when they receive valid legal requests [but] does not require companies to build backdoors”.
The home affairs minister, Karen Andrews, said the Cloud Act agreement included “important safeguards” reflecting the two countries’ “respect for the rule of law and for human rights”.
“As we saw in Operation Ironside … the Australian federal police and the Federal Bureau of Investigation are already capable of smashing serious, organised crime networks using sophisticated digital techniques,” Andrews said in a statement.
“This agreement brings that partnership to new heights.”
The US attorney general, Merrick Garland, said the deal would ensure “more efficient cross-border transfers of data … so that our governments can more effectively counter serious crime, including terrorism, while adhering to the privacy and civil liberties values that we both share”.
Sign up to receive an email with the top stories from Guardian Australia every morning
Andrews, who is in Washington, flagged that she will meet senior officials and law enforcement partners to discuss collaboration on cybersecurity, protecting critical infrastructure, countering terrorism and preventing serious and organised crime.
The Cloud Act agreement will now undergo parliamentary and congressional review processes in both countries. No further legislation is required, after the international production orders bill passed in July pave the way for the deal, although parliament will still be able to disallow it.
The safeguards in the Australia-US deal are still unclear. The US’s first Cloud Act deal with the UK mandated that each country would gain permission before using the data for death penalty prosecutions in the US, or cases implicating freedom of speech in the UK.
In 2019 Labor welcomed Cloud Act negotiations but questioned whether a deal would require the Coalition to amend encryption legislation.
That legislation attempts to overcome the problem of encrypted messaging by co-opting technology companies, device manufacturers and service providers into building the functionality needed for police to do their spying.
The Law Council and tech firms warned the law could prevent Australia qualifying for a Cloud Act agreement because it may breach the US requirement that foreign countries have robust data privacy protections to receive data from US firms.