Section 1 Short title
This Act may be cited as the “The Law Enforcement Access to Data Stored Abroad Act”.
The Law Enforcement Access to Data Stored Abroad Act
A BILL
To amend title 18, United States Code, to safeguard data stored abroad from improper government access, and for other purposes.
Sec. 2 Findings
Congress finds the following:
The Electronic Communications Privacy Act of 1986 (Public Law 99–508; 100 Stat. 1848) (referred to in this section as “ECPA”) was intended to protect the privacy of electronic communications stored with providers of electronic communications services and remote computing services, while balancing the legitimate needs of law enforcement to access records stored by such providers.
To strike this balance, ECPA authorized governmental entities to obtain certain categories of communications data from providers using established, pre-existing forms of process—warrants and subpoenas. It also created a new form of court order, in section 2703(d) of title 18, United States Code, that governmental entities could use to obtain additional types of communications data.
It has been well established that courts in the United States lack the power to issue warrants authorizing extraterritorial searches and seizures, and neither ECPA nor subsequent amendments extended the warrant power of courts in the United States beyond the territorial reach of the United States.
Nevertheless, Congress also recognizes the legitimate needs of law enforcement agencies in the United States to obtain, through lawful process, electronic communications relevant to criminal investigations related to United States persons wherever that content may be stored. Therefore, this Act authorizes the use of search warrants extraterritorially only where the Government seeks to obtain the contents of electronic communications belonging to a United States person.
Sec. 3 Scope and clarification of warrant requirement
In general— Chapter 121 of title 18, United States Code, is amended—
in section 2702(a), by amending paragraph (3) to read as follows:
“(3) a provider of remote computing service or electronic communication service to the public shall not knowingly divulge to any governmental entity the contents of any communication described in section 2703(a), or any record or other information pertaining to a subscriber or customer of such service.”
in section 2703—
by striking subsections (a) and (b) and inserting the following:
“(a) Contents of wire or electronic communication in electronic storage—A governmental entity may require the disclosure by a provider of electronic communication service or remote computing service of the contents of a wire or electronic communication that is in electronic storage with or otherwise stored, held, or maintained by the provider only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction. Subject to subsection (b), a warrant issued pursuant to this subsection may be used to require the disclosure of contents of a wire or electronic communication that are in the provider’s electronic storage within the United States or otherwise stored, held, or maintained within the United States by the provider.
“(b) Warrant requirements—A warrant issued under subsection (a) may require the disclosure of the contents of a wire or electronic communication, regardless of where such contents may be in electronic storage or otherwise stored, held, or maintained by the provider, if the account-holder whose contents are sought by the warrant is a United States person. A court issuing a warrant pursuant to this subsection, on a motion made promptly by the service provider, shall modify or vacate such warrant if the court finds that the warrant would require the provider of an electronic communications or remote computing service to violate the laws of a foreign country.”
in subsection (d), in the first sentence—
by striking “(b) or”;
by striking “the contents of a wire or electronic communication, or”; and
by striking “sought, are” and inserting “sought are”; and
by adding at the end the following:
“(h) Rule of construction—Nothing in this section or in section 2702 shall be construed to limit the authority of a governmental entity to use an administrative subpoena authorized under a Federal or State statute or to use a Federal or State grand jury, trial, or civil discovery subpoena to—
“(1) require an originator, addressee, or intended recipient of an electronic communication to disclose the contents of the electronic communication to the governmental entity; or
“(2) require an entity that provides electronic communication services to the officers, directors, employees, or agents of the entity (for the purpose of carrying out their duties) to disclose the contents of an electronic communication to or from an officer, director, employee, or agent of the entity to a governmental entity, if the electronic communication is held, stored, or maintained on an electronic communications system owned or operated by the entity.
“(i) Notice—Except as provided in section 2705, not later than 10 business days after a governmental entity receives the contents of a wire or electronic communication of a subscriber or customer from a provider of electronic communication service or remote computing service under subsection (a), the governmental entity shall serve upon, or deliver to by registered or first-class mail, electronic mail, or other means reasonably calculated to be effective, as specified by the court issuing the warrant, the subscriber or customer—
“(1) a copy of the warrant; and
“(2) notice that informs the customer or subscriber—
“(A) of the nature of the law enforcement inquiry with reasonable specificity; and
“(B) that information maintained for the customer or subscriber by the provider of electronic communication service or remote computing service named in the process or request was supplied to, or requested by, the governmental entity.”
in section 2704(a)(1), by striking “section 2703(b)(2)” and inserting “section 2703”;
in section 2705—
in subsection (a), by striking paragraph (1) and inserting the following:
“(1) A governmental entity that is seeking a warrant under section 2703 may include in the application for the warrant a request, which the court shall grant, for an order delaying the notification required under section 2703(i) for a period of not more than 90 days, if the court determines that there is reason to believe that notification of the existence of the warrant may have an adverse result described in paragraph (2) of this subsection.”
in subsection (b), in the matter preceding paragraph (1), by striking “under section 2703(b)(1)”; and
in section 2711—
in paragraph (3)(B) by striking “warrants; and” and inserting “warrants”;
in paragraph (4) by striking “thereof.” and inserting “thereof; and”; and
by adding at the end the following:
“(5) the term United States person means a citizen or permanent resident alien of the United States, or an entity or organization organized under the laws of the United States or a State or political subdivision thereof.”
Sec. 4 Mutual legal assistance treaty reforms
Mutual Legal Assistance Treaty Transparency and Efficiency—
In general— Not later than 180 days after the date of enactment of this Act, the Attorney General shall establish—
a form for use by a foreign government filing a mutual legal assistance treaty request (referred to in this section as an “MLAT request”), which shall—
be made available on the website of the Department of Justice; and
require sufficient information and be susceptible for use by a foreign government to provide all the information necessary for the MLAT request; and
an online docketing system for all MLAT requests, which shall allow a foreign government to track the status of an MLAT request filed by the foreign government.
Annual publication— Beginning not later than 1 year after the date of enactment of this Act, and each year thereafter, the Attorney General shall publish on the website of the Department of Justice statistics on—
the number of MLAT requests made by the Department of Justice to foreign governments for the purpose of obtaining the contents of an electronic communication or other information or records from a provider of electronic communications or remote computing services; and
the average length of time taken by foreign governments to process the MLAT requests described in clause (i); and
the number of MLAT requests made to the Department of Justice by foreign governments for the purpose of obtaining the contents of an electronic communication or other information or records from a provider of electronic communications or remote computing services; and
the average length of time taken by the Department of Justice to process the MLAT requests described in clause (i).
Notice to Department of State— The Attorney General shall notify the Secretary of State not later than 7 days after the date on which disclosure of electronic communications content to a foreign government is made pursuant to an MLAT request.
Preservation of Records— The Attorney General may issue a request pursuant to section 2703(f) of title 18, United States Code, upon receipt of an MLAT request that appears to be facially valid.
Notification to Provider of MLAT request— When the Attorney General makes use of the process provided in section 2703 of title 18, United States Code, to obtain information from an electronic communications provider or a remote computing provider based on an MLAT request, the Attorney General shall notify that provider in writing that the request has been made pursuant to a mutual legal assistance treaty.
Sec. 5 Sense of congress
It is the sense of Congress that—
data localization requirements imposed by foreign governments on data providers are—
incompatible with the borderless nature of the Internet;
an impediment to online innovation; and
unnecessary to meet the needs of law enforcement; and
the Department of Justice, the Department of State, and the United States Trade Representatives should pursue open data flow policies with foreign nations.