CLOUD Act
Definition
The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process for data they control regardless of where the data is stored. Also authorises the executive branch to negotiate bilateral executive agreements with foreign governments allowing reciprocal direct access to providers without MLAT routing.
- Full name
- Clarifying Lawful Overseas Use of Data Act
- Jurisdiction
- United States, enacted 2018
- Core rule
- US providers must honour valid US legal process regardless of data location
- Second mechanism
- Bilateral executive agreements for reciprocal direct access
Common questions
How does the CLOUD Act change things compared to relying on MLATs?+
It lets US authorities compel a US-based provider to produce data under its control even when the data sits on a server abroad, without needing to route the request through the foreign country's government first, which an MLAT would normally require.
Does the CLOUD Act give foreign governments direct access to US providers?+
Only where the US has signed a qualifying executive agreement with that country. Outside such an agreement, a foreign government still needs to use an MLAT or other formal legal process to obtain data from a US provider.
Related terms
- Mutual Legal Assistance Treaty (MLAT)
- A bilateral or multilateral treaty under which signatory states agree to assist each other in gathering evidence for criminal investigations. MLATs define...
- ADB Backup
- An Android Debug Bridge backup produced by the adb backup command. The output is a TAR archive prefixed by a small plaintext...
- allowBackup Flag
- An Android manifest attribute (android:allowBackup) that controls whether an app's data is included in ADB backups. When set to false the app's...
- Backup Keybag
- A data structure in iOS encrypted backups that holds the per-class encryption keys used to protect individual files. The keybag itself is...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Domain (iOS Backup)
- A prefix in the iOS backup manifest that identifies the origin of each backed-up file. Common domains include HomeDomain (the device home...
- Dual Criminality
- The requirement in most MLAT regimes that the conduct under investigation constitutes a crime in both the requesting and the requested state....
- European Production Order (EPO)
- A court order issued by a judicial authority in one EU member state, under Regulation (EU) 2023/1543, compelling a service provider in...
- Google Legal Investigations Support
- Google's process for handling law enforcement requests, documented at its transparency report portal. Google distinguishes between emergency disclosure requests (no legal process...
- iCloud Backup
- A daily encrypted snapshot of an iPhone or iPad stored in Apple's cloud. Includes app data the developer marks for backup, device...
- Lawful Interception
- Court-authorised real-time capture of the content of communications in transit, such as telephone calls, emails, or instant messages. Requires a higher legal...
- Manifest.db
- The SQLite database at the root of every iTunes local backup. It maps each backed-up file to its SHA-1 hash filename, recording...
Explained in these topics
- Cloud Account ForensicsThe US Clarifying Lawful Overseas Use of Data Act (2018), which allows US providers to be compelled to produce data regardless of where it is stored, and enabl...
- Device Backup ForensicsThe US Clarifying Lawful Overseas Use of Data Act (2018), which requires US-based providers to disclose stored data held abroad in response to a valid US legal...
- Lawful Access, Interception Law and Privacy Protections
- Legal and Jurisdictional Frameworks for Mobile and Network EvidenceThe US Clarifying Lawful Overseas Use of Data Act (2018). Requires US-based providers to comply with lawful US process for data stored anywhere in the world, s...