Cyberattacks present a new challenge to the concept of jurisdiction. Attackers can commit devastating crimes in countries that they will never visit in person. Targeting systems outside of one\u2019s home country is advantageous: it makes reprisal from the owners of those systems difficult for jurisdictional reasons. Extraditing criminals is not easy; investigating criminals who reside outside of one\u2019s jurisdiction is even less so. <\/p>\n\n\n\n
The US has attempted to tackle this problem with a piece of legislation known as the CLOUD (\u201cClarifying Lawful Overseas Use of Data\u201d) Act. Passed in 2018, this Act was inspired by Microsoft\u2019s refusal in 2016 to obey a warrant from US law enforcement authorities to share a subscriber\u2019s email messages that were stored in Ireland [1]. The CLOUD Act makes US access to data within another country with which the US has signed a COUD Act agreement more streamlined and efficient. The converse is also true: countries with which the US has signed a CLOUD agreement have the same access to US data. The Act also enables law enforcement authorities to conduct real-time surveillance on individuals in another country if a suitable warrant has been provided. So far, the US has entered into agreements with Australia and the UK. It is now beginning negotiations with Canada.
<\/p>\n\n\n\n
The primary function of the Act is to facilitate the work of law enforcement agencies. Warrants produced by law enforcement in one country will (generally) have legal force in the other country. However, the Act does allow challenges to warrants issued from a foreign government when the warrant violate the legally enshrined privacy rights of the country in which it is served [2]. Another safeguard in the CLOUD Act is its requirement that the US Attorney General certify to Congress that the law of any viable partner country contains \u201crobust substantive and procedural protections for privacy and civil liberties\u201d [3]. In other words, the US is unlikely to sign a CLOUD agreement with Russia any time soon.
<\/p>\n\n\n\n
While the details of Canada\u2019s agreement have yet to be fleshed out, many experts are already concerned about the form that the agreement may take. They cite flaws and ambiguities already present in the CLOUD Act. Stephen Smith argues that the CLOUD Act is overly vague and ambiguous in its sections on surveillance of individuals in foreign countries. Thus, Canada would do well to make sure that these ambiguities are cleared up in any agreement that it signs with the US [4].
<\/p>\n\n\n\n
Privacy lawyers have also expressed concerns about the effects that pressure from Canadian law enforcement may have on the agreement. As David Fraser argues, the RCMP\u2019s longstanding \u201clawful access\u201d agenda may have an influence on Canada\u2019s side of the negotiations.
<\/p>\n\n\n\n
Negotiations have just begun. It will be some time before we have a clear idea of the shape that the agreement will take. Implementing this new agreement will no doubt require amendments to Canada\u2019s existing privacy laws. Hopefully those amendments will not be drastic.
Sources:
[1] https:\/\/www.theregister.com\/2022\/03\/23\/us_canada_cloud_act\/?td=rt-3a.
[2] https:\/\/blog.privacylawyer.ca.
[3] https:\/\/www.itworldcanada.com\/post\/canada-u-s-to-negotiate-treaty-to-speed-up-police-data-access-requests
[4] https:\/\/www.thestar.com\/politics\/2022\/03\/25\/a-bilateral-data-sharing-deal-with-us-better-than-status-quo-says-privacy-watchdog.html.
<\/p>\n\n\n\n
Text of the US CLOUD Act: https:\/\/www.congress.gov\/bill\/115th-congress\/senate-bill\/2383\/text<\/p>\n","protected":false},"excerpt":{"rendered":"
Cyberattacks present a new challenge to the concept of jurisdiction. Attackers can commit devastating crimes in countries that they will never visit in person. Targeting systems outside of one\u2019s home country is advantageous: it makes reprisal from the owners of those systems difficult for jurisdictional reasons. Extraditing criminals is not easy; investigating criminals who reside … <\/p>\n