Remarks by Deputy Assistant Attorney General Josh Goldfoot of the Justice Department's Criminal Division at the International Symposium on Cybercrime Response

Seoul, Republic of Korea

Remarks as Prepared for Delivery: Building Trust and Mutual Respect to Better Protect our Countries: the CLOUD Act

I am honored to be joining this major international event that has collected so many of the very best cybercrime fighters in the world. Thank you for allowing me to share some thoughts.

Our Shared Challenge

At the U.S. Department of Justice, I serve as the Deputy Assistant Attorney General in the Criminal Division. In that role, I oversee prosecutors who specialize in cybercrime, intellectual property offenses, and child exploitation crimes. You might say that my job involves dealing with the troubles the internet brings. Perhaps I can speak for all of us when I say that the police and prosecutors who address internet crime understand profoundly that the world is dangerous in ways others do not understand. If you work on cybercrime, you will eventually see small businesses ruined by ransomware. You will see large companies, or government agencies, lose control of their most important information. And you will see how people, even children, may be profoundly harmed by perpetrators they have never met.

These are not only offenses against our laws. These are offenses against values held in common everywhere. While the internet is relatively new in world history, it is notable that people in all nations have, independently, concluded that computer intrusions are offensive to moral values. Of course, a similar moral judgment denouncing crimes against children is even older. While different nations address these cybercrime problems in different ways, we in the United States have found, over and over, common values and understandings when we raise these concerns with our law enforcement counterparts.

Our task at this conference is to share experiences and insights about how we may address the shared problem of cybercrime. My task today is to explore one subject in depth: How law enforcement agencies cooperate, and how legal mechanisms championed by the United States stand to improve cooperation even further.

Of all the work we have done in the United States to fight cybercrime, the work that I am most proud of involved international cooperation. It is not a coincidence. Our work has the most impact when it ends criminal groups’ abilities to operate: When we disrupt their malware, seize their money, and, of course, arrest and convict as many of them as possible. To be effective, this work cannot occur in one country alone. Decades of experience have shown it is too easy for criminals to spread their crimes across borders. Victims, witnesses, perpetrators, and especially evidence can be located across the globe. We cannot be effective unless we can work together across jurisdictions. In fact, I believe no one country can or should even try to dismantle major criminal networks on its own. We must find new and better ways to use our powers collectively against transnational threats.

A cyber threat never really affects only one country. When cybercrime is easy and profitable it becomes more common. Thus, all of us benefit when a cyber threat is addressed. The more that we can cooperate to create an internet that promotes commerce and other mutually beneficial endeavors, the better all nations will be.

Obtaining Evidence Across Borders.

While technology has greatly increased criminals’ access to victims, our access to necessary evidence has been hampered. First, criminals can hide electronic evidence and store it far away from the victims, perpetrators, and places where crimes occur. Second, electronic evidence frequently is held by companies with transnational operations. Their customers, company offices, and data storage facilities might all be located in different countries. These companies and the data they control may be subject to more than one country’s laws, creating conflicting legal obligations when a company receives an order from one government requiring the disclosure of data but another government restricts disclosure of that same data. 

These potential legal conflicts present significant challenges to governments’ ability to acquire electronic evidence that may be vital to pursuing criminal investigations in a timely, efficient manner. 

The First Step – Mutal Legal Assistance Treaties

For decades, agreements called Mutual Legal Assistance Treaties, or MLATs, allowed law enforcement agencies in one country to seek the assistance of foreign counterparts who can obtain evidence within their jurisdiction. The foreign counterpart reviews a request under its own legal standards and may need a court order under its law to obtain the evidence. This has been the primary mechanism for facilitating international law enforcement cooperation for decades. But this process has many steps, and depending on the country and the complexity of the request, can take many months or even years to complete. 

This system worked when the number of times it was needed was small. But the number of MLAT requests has increased dramatically in recent years, as nations have requested data from each other’s online providers. A system that could work for few requests has been strained during the internet age.

Significant Steps Forward – The Budapest Convention

A significant step forward came with the negotiation of the Council of Europe Convention on Cybercrime, commonly known as the “Budapest Convention.” The Budapest Convention remains the gold standard multi-lateral international treaty for addressing cybercrime and electronic evidence. Parties to the Convention agree to amend their domestic law to do three things. First, they agree to criminalize a common set of computer-related crimes. Second, parties must have the domestic criminal procedural law powers necessary for the investigation and prosecution of those crimes, as well as other criminal offences committed by means of a computer system, and the ability to collect evidence in electronic form of any criminal offence. Third, they agree to cooperate with each other. The Convention provides a platform for transnational law enforcement cooperation in investigations, evidence sharing, and extradition. 

While the Convention was negotiated at the Council of Europe, it is open to all countries. Currently 82 countries – from every corner of the globe – are party to the Budapest Convention. 

I want to congratulate our hosts, the Republic of Korea, on its invitation to accede to the Convention. I know that it has been a lot of work preparing to ratify the Budapest Convention. The Republic of Korea is already playing an active role as an observer at Convention meetings, and we look forward to very soon having you participate as a full party. I am confident you will be pleased with the benefits the treaty will bring to your international collaborations on cybercrime.

The Budapest Convention is a remarkable achievement. It is the foundation of an international community united against cybercrime. While its members might have very different legal systems, they are able to collaborate because of shared principles and values. The Budapest Convention’s collaborative approach brings to mind a quote by Thomas Jefferson: “Every difference of opinion, is not a difference of principle.” 

Even though the Budapest Convention opened for signature over 25 years ago, it is still vital today and changing to meet new challenges. A number of parties, including the United States, have signed the Second Additional Protocol to the Budapest Convention. The protocol, which opened for signature in 2022, provides new pathways to obtain basic subscriber information and even, in some cases, traffic data, from providers located in other countries outside of the mutual legal assistance process. There is also a provision to provide a clear pathway to request content and other stored data in emergencies. 

The Second Additional Protocol will further accelerate cooperation among parties to protect our citizens and hold criminals accountable. This Protocol is specifically designed to help our law enforcement authorities obtain direct access to evidence held in other countries under their own laws, while ensuring that these transfers are subject to appropriate protections and safeguards. This is an important innovation. 

The Next Step - Building Further Trust and Mutual Respect

Despite all that I have just discussed, we as an international law enforcement community continue to be hampered by a system that still fails to provide access to electronic evidence at the speed and scale needed to protect public safety. We continue to search for new ways to conduct modern investigations more effectively. This will require respect for sovereignty, yes, but also increased trust among rights-respecting governments whose systems and laws may be different, but each legitimate nonetheless. 

Criminal investigators in the United States have long taken the position that, with a search warrant, a U.S. company can be compelled to produce the e-mail of someone under criminal investigation. We held this view at the dawn of the internet. When U.S. companies began to store some users’ e-mail outside the United States, we retained the view. In this we adhered to an international consensus that those charged with keeping a country’s people safe must have domestic authority to compel providers within the country’s jurisdiction to disclose electronic records within the providers’ possession, custody, or control. This important authority applies to the provider and so cannot be defeated by choices about where the providers might store such records. Absent this authority, criminal investigations could be derailed merely because a company rented server space abroad. 

To resolve this problem, while at the same time creating an international pathway to obtain evidence outside the MLA process, the United States Congress reversed that court holding by enacting the CLOUD Act. The CLOUD Act does two things:

First, it restored U.S. law to the international consensus. It made explicit in U.S. law the long-established U.S. and international principle that a company subject to a country’s jurisdiction can be required to produce data the company controls, regardless of where it is stored at any point in time. The CLOUD Act simply clarified existing U.S. law and the requirements of the Budapest Convention on this issue; it did not change the existing high standards under U.S. law that must be met before law enforcement agencies can require disclosure of electronic data. 

Second, the CLOUD Act authorized the United States to enter into executive agreements with other countries that meet certain criteria, such as respect for the rule of law. For investigations of serious crime, CLOUD agreements can be used to remove restrictions under each country’s laws so that companies can comply with qualifying, lawful orders for electronic data issued by the other country. 

When a CLOUD Act agreement is reached, each country removes legal barriers that may otherwise prohibit compliance with covered court orders issued by the other country. Both countries also agree to allow covered orders to be served directly on providers in the other country, without having to go through the other government or the MLA process. The law governing the disclosure is the law of the country issuing the order. While a provider could raise an objection about an order with the other country, the other country need not get involved or expend resources if it is not in its interest to do so. This would permit U.S.-based global companies to respond directly to foreign legal process in many circumstances.

CLOUD Act agreements, however, do not impose any new obligation on U.S.-based global companies to comply with a foreign government order; nor does the fact of an agreement establish, by itself, that a foreign government has jurisdiction over that company. The only legal effect of a CLOUD agreement is to eliminate the legal conflict for qualifying orders. 

I want to underscore just how useful that feature of CLOUD Act agreements — the use of domestic authority — has been to foreign investigators. Foreign investigators obtain their own process, pursuant to their own laws — laws that, both countries have agreed in advance, provide a level of protection that are adequate to protect privacy and human rights. You do not need to write something for a U.S. judge. Although we would love to hear from you under different circumstances, to use the CLOUD Act, you do not even need to speak to the U.S. Department of Justice. 

I should emphasize, however, that CLOUD Act agreements are not available to countries that do not respect the rule of law and fundamental human rights. The CLOUD Act does not seek to export U.S. legal standards to other countries, but it does require countries to have a high level of checks and balances in place. The CLOUD Act requires that the agreements include provisions protecting privacy and civil liberties. Orders requesting data must be lawfully obtained under the domestic system of the country seeking the data; must target specific individuals or accounts; and must be subject to review or oversight by an independent authority, such as a judge or magistrate. Bulk data collection is not permitted. Foreign orders may not target U.S. persons or persons in the United States. Agreements may be used only to obtain information relating to the prevention, detection, investigation, or prosecution of serious crime, including terrorism. They may not be used to infringe upon freedom of speech. Now, the Act does not require foreign partners to adhere to standards that perfectly match the U.S. legal system. However, to be eligible, a country must establish appropriate standards and checks-and-balances within its legal framework to protect privacy, civil liberties, and human rights. By strictly reserving the benefits of bilateral agreements for liked-minded, rights-respecting countries, the CLOUD Act ensures that efficiencies will not be pursued at the expense of privacy and civil liberties. Rather, it is a solution that allows trusted partners to advance mutual interests based on shared values.  

Clearing Up Misconceptions

Now, there has been some unfortunate misunderstandings about the CLOUD Act, and, specifically, its clarification of the scope of U.S. government authority to compel data held by U.S. service providers. As we have heard it, the concern is that the United States is able to use this part of the CLOUD Act in an unrestrained way, requiring U.S. providers to disclose government data or other sensitive information under inappropriate standards. 

This is simply not true. I will reiterate, the U.S. system has robust checks and balances, frequently requires independent review under some of the highest standards anywhere in the world, and specifically recognizes the rights of other countries. Like most other nations, we do adhere to the fundamental principle that a nation can compel the disclosure of evidence from companies subject to that nation’s jurisdiction. Experience has shown how reasonable this principle is. The simple fact that an American company has chosen to store one user’s data in a different country does not, of course, mean that user is a citizen of that country, or even that the user has any relationship to that country. We saw this in 2017, when one company revealed that it might store a single e-mail’s header, body, and attachments all in different countries. 

What matters is not whether countries compel their companies to produce foreign-stored data, but what safeguards restrict its exercise and prevent abuse. The United States has extremely strong safeguards. Foremost among them are those imposed on U.S. government searches by the Fourth Amendment of the U.S. Constitution. The Amendment requires that warrants for content of communications be based on the high evidentiary standard of demonstrating probable cause; that they particularly describe the scope of the search and seizure; and that they be approved by an independent judge. Taken together, these requirements are generally much more stringent than those imposed in other legal systems.

The CLOUD Act also does not restrict a provider’s ability to seek judicial redress challenging issuance of legal demands. Indeed, providers are aware of the legal issues involved in hosting sensitive data and have established relationships with U.S. law enforcement to raise questions or concerns about whether orders they receive could create legal challenges for them. 

In recent years, another unfortunate misconception has arisen, this one concerning the CLOUD Act and encryption. Over decades it has become clear that encryption is an important way that providers can protect their users’ sensitive data from breach. As the level of cyber attacks against providers has risen, some providers have protected user data through the use of encryption. In one approach to the problem, the provider arranges things so that it only stores an encrypted copy of the user’s data, and only the user has the keys to decrypt that data. This approach has one cybersecurity advantage: If the provider is hacked, only the encrypted data can be stolen by the hacker. Some believe, incorrectly, that under the CLOUD Act, one nation may issue court orders that require another nation’s companies to deny users the benefits of encryption — that is, to modify their systems in a way that permits the requesting government to obtain the plain text of data stored with the provider, even if the provider would prefer to have access only to encrypted data and to have no ability to decrypt it. The CLOUD Act does not enable such orders. To the contrary, the CLOUD Act is explicit that CLOUD Act agreements may not create any obligation that providers be capable of decrypting data. The CLOUD Act is completely compatible with a cybersecurity policy that encourages companies to use encryption.

Experience with CLOUD Act Agreements

Let me speak now about how CLOUD Act agreements have worked in practice.

The U.S. currently has two CLOUD agreements in effect – one with the United Kingdom and another with Australia. The ability to serve domestic legal process directly to one another’s providers has made important, serious criminal investigations faster and more efficient. 

The UK was the first to use such an agreement and since then it has sent thousands of requests for data under the terms of the agreement to obtain evidence held by U.S. providers in a wide range of investigations, from child sexual exploitation to terrorism to drug investigations. Reciprocally, the United States has used U.S. legal process to obtain evidence held by providers in the UK in important U.S. investigations more quickly and easily than we could using the mutual legal assistance channel. Information obtained through the CLOUD Agreement from a UK social media platform provided U.S. authorities sufficient evidence to charge a defendant with offenses relating to the exploitation of a 12-year-old minor.

 These two agreements demonstrate how we can make meaningful progress on electronic evidence sharing with partners who are also committed to protecting privacy and human rights while protecting their people from serious crime.

It is critical to remember that these partnerships are conditioned on a shared commitment to strong and meaningful safeguards for privacy and civil liberties. Thus, by statute, the United States can only enter into CLOUD agreements with countries whose laws and practices meet the numerous, stringent safeguards required for the certification, including: adequate substantive and procedural laws on cybercrime and electronic evidence, such as those enumerated in the Budapest Convention; respect for the rule of law and principles of nondiscrimination; adherence to international human rights obligations; clear legal mandates on procedures governing the collection, retention, use, and sharing of electronic data; mechanisms for transparency regarding the collection and use of electronic data; and a demonstrated commitment to the free flow of information and a global internet.

In conclusion, our collective safety and security depend on our ability to obtain lawful and efficient access to electronic evidence wherever providers may store such data. Cross-border transfers of electronic evidence are necessary and appropriate, and they are a critical component both of operating a resilient network serving global customers and investigating crime in the 21st century. 

The CLOUD Act represents one tool in our toolbox. It is a solution that can simultaneously advance the imperatives of public safety and privacy protection in many countries. And it is a cooperative solution – enacted by the United States, but driven by concerns raised by our foreign partners about the status quo – that can deliver international benefits. The first CLOUD Act agreements have shown us that this can be an effective model for cooperation if countries can satisfy the stringent standards for human rights and due process set forth by our Congress. 

Thank you once again for the invitation, and we look forward to continuing to work together in the fight against cybercrime.