Foreign Influence on Americans' Data Through the CLOUD Act

Chairman Andy Biggs (R-AZ)SPEAKER_06

Subcommittee will come to order. Without objection, the chair is authorized to declare recess at any time. We welcome everyone to today's hearing on the CLOUD Act and foreign influence on Americans' data. I now recognize the the gentleman from Texas, Mr. Nehls, to lead us in the Pledge of Allegiance. Thank you, thank you, Mr. Nehls. I now recognize myself for an opening statement. I welcome my colleagues to this important hearing and welcome our our audience and our our witnesses today. I thank each of our witnesses for being here today, with special recognition for one of our witnesses who flew all the way from the UK to testify today. Thank you. Given advances in technology and the heightened interconnectivity of the digital era, personal data, business information, and sensitive communications are sent, received, and stored all over the world. Often during an investigation, law enforcement needs to acquire this information from U.S. companies. Until 2018, if this information was held in another country—for example, a data server in Ireland—it wasn't clear whether U.S. law enforcement would be able to obtain it, even though it was requesting the data from a U.S. company. In 2018, Congress passed the Clarifying Lawful Overseas Use of Data Act, or the CLOUD Act, to address this gap in the law. Under the CLOUD Act, U.S. law enforcement, pursuant to a lawful court order, can obtain data held by U.S.-based service providers but stored outside of the United States. The CLOUD Act also provides avenues for our allies to enter into bilateral agreements with the United States to similarly obtain their citizens' data from these same service providers to assist with their own law enforcement investigations. Unfortunately, one of our closest allies, the United Kingdom, is taking advantage of its authorities under the CLOUD Act and is attacking America's data security and privacy. In February of this year, The Washington Post reported that the UK had secretly ordered Apple to build a backdoor into its devices to enable UK law enforcement to access to access a user's data stored on the cloud, including encrypted data. The CLOUD Act requires that a country entering into a data access agreement with the United States have laws that include robust protections for privacy and civil liberties. The UK's order, however, threatens the privacy and security rights not only of those living in the UK, but of Apple users all over the world, including Americans. This order sets a dangerous precedent and, if not stopped now, could lead to future orders by other countries. The UK's Investigatory Powers Act permits it to issue orders to tech companies compelling them to weaken encryption or halt security updates for users around the world. This broad extraterritorial order highlights the tension between national security and individual rights. These interests are not mutually exclusive, and it is possible to protect both national security and individual rights. Providing law enforcement with the tools to conduct investigations is a laudable, important goal, but the UK, seemingly emboldened by its agreement with the United States under the CLOUD Act, has issued an order that will affect people all over the world, and this is a step too far. Encryption is a critical tool to maintain the privacy and security of digital information and communications. Efforts to weaken or even break encryption makes us all less secure. The U.S.-U.K. relationship must be built on trust. If the U.K. is attempting to undermine this foundation of U.S. cybersecurity, it is breaching that trust. If companies are forced to build backdoors to encryption, that simultaneously opens a backdoor to privacy rights, or an invasion of privacy rights. And it is impossible to limit a backdoor to just the good guys. Just last year, Chinese hackers known as Salt Typhoon penetrated lawfully mandated backdoors, gaining access to wiretap systems used by U.S. law enforcement. The hackers also were able to access the private data of President Trump and Vice President Vance. This attack is a clear example of the dangers of surveillance backdoors. This should concern everyone. I've long had concerns about the CLOUD Act and the bilateral agreements it enables that could allow foreign governments to spy on Americans. Given the recent actions by the UK, I am concerned that the CLOUD Act is failing to adequately protect the privacy and security of Americans. In the wake of the UK's order, I've called on this administration to act decisively to protect Americans' communications. I continue to urge our government, including the Justice Department, to evaluate whether the CLOUD Act and our agreement with the United Kingdom are working as intended. If they are not, we should renegotiate the agreement to ensure that our rights are protected, and we should do so by invoking the 30-day termination clause. After years of senior U.S. government officials pushing for weaker encryption and surveillance backdoors, it seems the tide has shifted. Indeed, after the Salt Typhoon hack, our government publicly recommended the use of end-to-end encrypted communications tools. Director of National Intelligence Tulsi Gabbard stated at her confirmation hearing that backdoors lead down a dangerous path that can undermine Americans' Fourth Amendment rights and civil liberties. This hearing provides an opportunity to build on the momentum toward greater respect for privacy and evaluate whether and what changes are needed to ensure Americans' rights are protected. I'm looking forward to hearing from our witnesses today, and again, thank you for being here and discussing how we can best move forward. I now recognize the ranking member, Mr. Raskin, for his opening statement.

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

Mr. Chairman, thank you very much, and welcome to our witnesses. I appreciate your being here with us. Living in the digital age in America means that much of our connection with other people takes place over the internet. We message with friends and family and coworkers over our cellphone apps, we store documents in the cloud, and we share materials over email. End-to-end encrypted services promise that no one—not Apple, not Google, not the government, federal, state, or local—can access the messages that we send. And these platforms are increasingly counted upon by users wishing for the privacy of a protected face-to-face conversation in the new era of technology that we inhabit. Imagine pulling out your phone, opening up an app you've been told is secure, and sending a message to a friend. Now imagine learning that the app is not end-to-end encrypted as promised. Instead, the government has ordered the service provider to make its security weaker so the government can demand access to your message. Imagine the government told the platform that they couldn't tell a soul about this arrangement. Well, that's exactly what the United Kingdom secretly ordered Apple to do recently, and that's the reason that we're here today. Requiring Apple to secretly build a so-called backdoor into its Advanced Data Protection service would make users' end-to-end encrypted documents no longer secure as expected. Law enforcement officers, not just in the UK, but also in the US, could demand Apple produce users' content and metadata from the cloud, and cybercriminals would be able to exploit this system weakness introduced by the backdoor to target Americans for espionage, consumer fraud, and ransomware. Backdoors to encrypted technology are not capable, as the chairman said, only of letting good guys in while keeping the bad guys out. Backdoors are intentional, designed weaknesses in an encrypted technology's mathematical formula. These design weaknesses can be exploited by foreign governments seeking to compromise our national security, steal our intellectual property, and monitor us in our daily lives and workplaces. Congress passed the CLOUD Act in 2018 to allow for data-sharing agreements between the US and countries that meet required standards. Through its negotiated agreement with the US, UK law enforcement can access non-encrypted data transmitted by US providers that is relevant to their law enforcement investigations. While secret orders, like the technical capability notice the Home Office placed on Apple, have nothing to do with the data-sharing agreement or the CLOUD Act, they are only worthwhile to the UK because of the data that is made available through the agreement. I, for one, believe that the CLOUD Act and the US-UK Data-Sharing Agreement thus far have been beneficial, both to US companies and to our country. But I also believe that forcing companies to circumvent their own encrypted services in the name of security is the beginning of a dangerous, slippery slope, and I look forward to hearing from the witnesses as to what, if anything, we need to do to change to prevent future, similar orders against other companies. Some argue that privacy is passé, yesterday's news. Cookies monitor which websites we click on. Our devices already track every step we take, and data brokers take anonymized data and reidentify it in portfolios available to the highest bidder. But I disagree with the idea that privacy is no longer valuable or meaningful to the American citizenry. In a country where visa holders are being detained simply for opinions they've expressed or an op-ed they wrote, where criticism of the administration can result in a visit from the Secret Service, and where the staff of members of Congress can be arrested and handcuffed just for doing their jobs, Americans' security from government intrusion has never been more urgent or important. The deluge of ways new technology enables the government to spy on their citizens makes it even more important that Americans stand up to increases in state surveillance. Thomas Jefferson wrote in 1788 that the natural progress of things is for liberty to yield and for government to gain ground. Well, we have to resist that natural tendency. A week ago, the Trump administration announced it would hire Palantir to consolidate Americans' data into dossiers on all U.S. citizens. The plan to use Palantir's Foundry project to organize and analyze data across agencies into one big, beautiful dossier is chilling. It's the beginning of an effort to create a national citizen database, which would be vulnerable to manipulation, not just by outside actors, but by inside political actors. From bank account numbers and student debt totals to medical claims and disability status, the administration today is taking information that was previously siloed into different categories, as required under the law, and using it to create one big, beautiful surveillance apparatus that can be used to crush resistance, to profile Americans, and to silence dissent. We're here today to discuss the CLOUD Act. I recognize this, but we should also recognize none of these issues exist in a vacuum. All government surveillance curtails all citizens' liberties. It is not always immediate. Often it's a slow decay and erosion. But every chip in our civil liberties foundation brings us that much closer to a government that no longer has its foundational and necessary ideological checks against total control of the citizenry. Surveillance databases like the one contemplated by the Trump administration should remain the stuff of science fiction and authoritarian governments, not a reality for a country founded on the principles of democratic self-government and freedoms and rights for the people. In the case of the UK order, we can start with an easy first step. We don't need legislation to pass in the divided House or frozen Senate. The Trump DOJ can just do its job. The US should not sit idly by and watch the Home Office issue perhaps more secret orders against US companies. But thus far, that's exactly what the DOJ has done. I sincerely hope that we move quickly to change that. I thank Chairman Biggs and Chairman Jordan for holding a second bipartisan surveillance hearing, and I look forward to working across the aisle with my friends as we prepare for the expiration of FISA Section 702 next year. And I yield back to you, Mr. Chairman.

Chairman Andy Biggs (R-AZ)SPEAKER_06

The gentleman yields back. Thank you. I now recognize the chairman of the full committee, Mr. Jordan, for his opening statement.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

I just— no opening statement. I just want to thank the chairman for having this hearing, thank our witnesses for being here, and appreciate the remarks by both the chairman and the ranking member on this subject, and the ranking member's reference to the work we have to do as 702 and the FISA Act comes up for reauthorization less than a year from now. With that, I would yield back to the chairman and again thank our witnesses for being here.

Chairman Andy Biggs (R-AZ)SPEAKER_06

thank the chairman. Chairman yields back. Without objection, all other opening statements will be included in the record, and I'll now introduce today's witnesses. With us today is Professor Susan Landau. Ms. Landau is a professor of cybersecurity and policy in the Department of Computer Science at Tufts University. Professor Landau's research focuses on privacy, surveillance, cybersecurity, and law. She has previously worked or held faculty appointments at Google, Sun Microsystems, the Worces— Worcester— Worcester— Worcester. I'm from Arizona, man, I'm not a that northeas— yeah, that Northeast stuff, who knows, you know? Worcester Polytechnic Institute, the University of Massachusetts Amherst, Wesleyan University, the National Academies of Sciences, Engineering, and Medicine, the National Science Foundation, and the National Institute of Standards and Technology. Welcome, Professor. Thank you for being here. Ms. Caroline Wilson Palow. Ms. Wilson Palow is the legal director and general counsel at Privacy International, a nonprofit organization based in the UK. Ms. Wilson Palow leads the organization's legal advocacy and advises its programs on legal strategy and risk. Prior to joining Privacy International, she was an attorney with Wilson Sonsini Goodrich & Rosati, where her practice focused on privacy and intellectual property. Thank you for joining us. Thanks for coming all this way, too. Mr. Richard Salgado is the founder of Salgado Strategies, a consulting firm that advises clients on geopolitical, cybersecurity, and surveillance issues. He also serves as a lecturer at both Harvard Law School and Stanford Law School. Mr. Salgado previously was the director of law enforcement and information security at Google for more than 13 years, worked on international security and law enforcement compliance at Yahoo, and served in the Department of Justice. Thank you, Mr. Salgado, for being with us. And Mr. Gregory Nojeim— Nojeim, okay. Mr. Nojeim is a senior counsel and director of the Security and Surveillance Project at the Center for Democracy and Technology, a nonprofit organization that advocates for civil rights and civil liberties in an increasingly digital world. He previously served as the associate director and chief legislative counsel of the ACLU's Washington office, where he focused on the civil liberties implications of terrorism, national security, and information privacy legislation. All of you we welcome. Thank you for being here today. We will begin now by swearing you in. Would you please rise and raise your right hand? Do each of you swear or affirm under penalty of perjury that the testimony you are about to give is true and correct to the best of your knowledge, information, and belief, so help you God? Let the record reflect that the witness— witnesses have all answered in the affirmative, and you may now be seated. Thank you. I want you to know that we've read your— I don't know, I won't guarantee everybody, but I've read your statements. And those will be entered into the record in their entirety. Accordingly, we ask that you summarize your testimony in five minutes. And at four minutes, the light should go yellow before you. And when it's almost five minutes, I will just tap this little bit so you'll know it's time to kind of wrap up. And I don't want to— I don't want to cut you off too much, but we do want to remind you of that. So we thank you so much for being here. And now, Professor Landau, I recognize you for your 5 minutes.

Ms. Susan LandauSPEAKER_03

Thank you, Chairman Biggs, Ranking Member Raskin, and members of the committee for the opportunity to testify today. I have no need to remind you of the damage caused by Salt Typhoon, but I want to touch on the hackers' access to the databases of wiretap targets. This enabled the Chinese government to learn which spies we had discovered. It appears to have been made easier by the technical requirements mandates imposed by the Communications Assistance for Law Enforcement Act. Introducing such access to complex systems—and communication systems are complex systems—increases security vulnerabilities. At the same time, the Salt Typhoon hackers could not read communications sent through WhatsApp, Signal, and or on Apple's network. These were end-to-end encrypted, as the chairman mentioned, a form of cryptography in which, as long as the communications device itself has not been hacked, only the sender and receiver can read the encrypted communication. We all use end-to-end encryption daily. You almost always use it when you visit a webpage. You always do when you're sending credit card information. You use it on Signal, on WhatsApp, on multiple other applications. Apple's Advanced Data Protection secures users' files by treating them as end-to-end encrypted messages sent from the user to themselves. Files are delivered when the user downloads them. Meanwhile, they reside on the iCloud. Since only the user has the encryption key, the files cannot be decrypted while stored in the iCloud. It is a terrific form of security. If there is ever a breach of the iCloud, the users' data is secure. Who needs it? All of us: journalists, human rights workers, members of civil society organizations—the latter are particularly targeted by Russia and China—remote workers, businesspeople while traveling, members of your family with files they'd like to keep private, like healthcare proxies, wills, financial information, members of your staff, all of us. Around the time the U.S. government loosened export controls on encryption back in 2000, the NSA began encouraging wider use of strong encryption domestically. The FBI was less enthusiastic and began pressing about going dark, its increasing inability to understand communications and later read files due to encryption. The issue came to a head with the San Bernardino case involving a locked iPhone. Unable to open the device due to Apple's security protections, the FBI and DOJ sought to have Apple undo those protections. Doing so was not nearly as straightforward as the FBI sought to portray. Requests for access were likely to be frequent, while information on obtaining access had to be stored for both legal and technical reasons. This created a serious security vulnerability, and Apple refused to do it. The case ended, by the way, when an FBI consultant was able to unlock the device. The real point, though, is whether you're looking at CALEA, the 2016 fight over the locked iPhone, or the purported UK technical capability notice served on Apple, these attempts at mandating lawful access to be built into complex communication systems creates vulnerabilities in these systems that's dangerous for Americans and for U.S. national security. Protecting the private data of Americans is a critical aspect of protecting U.S. national security. This is because protecting the private communications of the CEO's son-in-law, the files of an American who has family working in China, the draft research papers of a graduate student in genomics who has not yet filed a patent on her work, is protecting both the individuals and the economic and national security of our nation. That's why former NSA directors Mike McConnell and Michael Hayden, former DHS Secretary Michael Chertoff, former FBI General Counsel Jim Baker, and multiple other national security and law enforcement leaders support widespread public use of end-to-end encryption. And it's why, as the chairman mentioned, the joint guidance of the governments of Australia, Canada, New Zealand, and the United States post-Salt Typhoon recommended that end-to-end encryption be used whenever possible, and for communications traffic to be used to the maximal extent possible. By refusing to sign, the UK is a real outlier. It has become a Four Eyes statement. Apple's advanced data encryption protects people's data. It's an important and needed technology. I urge you to ensure that the UK's efforts to improve its own investigatory capabilities do not come at its expense. The technology that Apple developed protects our national security and the security and privacy of ordinary Americans. It should be widely used and widely available. Please ensure that it continues to be so. Thanks very much.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Thank you. Now I recognize you, Ms. Wilson Palow, for your 5 minutes.

Ms. Caroline Wilson PalowSPEAKER_00

Chairman Biggs, Ranking Member Raskin, and members of the subcommittee, thank you for the opportunity to testify today on behalf of Privacy International. I'm here to tell you about a troubling surveillance power that allows the United Kingdom's government to secretly order a US company to undermine the security, privacy, and free speech rights of Americans. Indeed, due to the global reach of US companies, these orders threaten the security and fundamental rights of users worldwide. This power can be found in the UK's technical capability notice regime, which is part of the Investigatory Powers Act 2016. Under this law, the UK can order a telecommunications service provider to build or modify its systems so that in the future the UK can access data on those systems through other lawful processes, such as warrants authorizing the interception of content or overseas production orders permitted under the CLOUD Act. More on that later. I've provided a more detailed description of these notices in my written statement, but in brief, the most salient aspects of them are that they are ill-defined, secret, and extraterritorial. An American company subject to a UK order cannot reveal even its existence to US officials and oversight bodies, much less users, investors, or anyone else who plays a crucial role in vetting the legality and wisdom of such notices. But why are we concerned about a UK surveillance power affecting American companies? Because these notices can be given to companies outside of the UK so long as the company offers, provides, or controls services used by people in the UK. This small nexus is sufficient for the UK to demand a company change its systems worldwide, affecting all of its users, whether in the UK, the US, or elsewhere. We are here today because in February, The Washington Post revealed that a US company, Apple, received a secret notice requiring it to undermine the security of its Advanced Data Protection service, as Ms. Landau, Professor Landau has described, which is an optional security feature for Apple's users providing end-to-end encryption of iCloud storage that only the iCloud user, not Apple itself, can unlock. The Washington Post reporting and the significant press follow-up have provided us with a potentially unique opportunity to have a public debate about a specific application of these types of orders because of their inherent secrecy. Seizing this opportunity, my organization, Privacy International, has filed a case challenging the notices regime at the UK's Investigatory Powers Tribunal. Apple has filed a similar challenge. Privacy International is devoting significant resources to opposing the Apple order because it exemplifies the potential for the notice regime to have far-reaching consequences that threaten our security and rights. That is because it appears that Apple has been ordered to deliberately weaken an end-to-end encrypted service. We are concerned that this means that these notices are now being used against encryption services, and the UK will not stop with Apple. My understanding from technical experts, including Professor Landau, is that it is technologically infeasible to have both effective end-to-end encryption and mechanisms for third-party access, which the UK seems to be demanding. That is because to enable such third-party access creates an inherent vulnerability that can be exploited by bad actors, including hostile states and criminal networks. That is why government security and privacy experts on both sides of the Atlantic, including in the US, the UK, and the EU, strongly recommend using end-to-end encryption. If the UK government succeeds in maintaining this order against Apple, it is likely further such orders targeting end-to-end encryption may follow. Other American companies, given their global reach, will be targets. Notices might also be used to force a company to do many other things that could undermine our security, such as send false security updates or refrain from fixing a vulnerability in its systems. Considering the notices regime's significant impact on fundamental rights and American companies, questions have been raised about the interaction of these orders with the CLOUD Act. In some ways, the notices regime and the CLOUD Act operate independently of each other, as the UK claims the ability to serve an order directly on a US company irrespective of the CLOUD Act. And the CLOUD Act itself steers clear of encryption, with the Department of Justice declaring the act encryption-neutral. But once a US company is ordered to create a backdoor in its end-to-end encrypted services, the UK could then serve a production order on that company for information that would have been previously inaccessible, tying the notices regime and the CLOUD Act back together. These secret orders also significantly impact fundamental rights such as privacy and freedom of speech, and the CLOUD Act was intended to protect these rights as well as US companies. The only other country with a CLOUD Act data access agreement, Australia, also has a technical capability notices regime. And the European Union, which is negotiating a data access agreement, has been considering measures that would undermine end-to-end encryption. More countries, therefore, might soon be targeting US companies and undermining the security and privacy of their users worldwide while also taking advantage of CLOUD Act processes. This squarely raises the question of whether the CLOUD Act's encryption neutrality is truly sustainable, which I suspect my fellow panelists are now eager to answer. Thank you.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Thank you, Ms. Wilson Palow. Now I'd like to turn to Mr. Salgado. You have 5 minutes for your testimony.

Mr. Richard SalgadoSPEAKER_01

Thank you, Mr. Congressman, and thank you, Chairman Biggs, Ranking Member McBath, Chairman Jordan, and Ranking Member Raskin for inviting me here today to participate in this hearing on these important issues and for your leadership on this. My name's Richard Salgado. The chairman summarized my more than 35 years of experience as a lawyer, mostly dealing with government surveillance and network security issues. It was almost exactly 8 years ago that I testified about the need for changes that were ultimately included in the CLOUD Act signed into law by President Trump in 2018, and I'm honored to be here again now that we've gained some experience with the Act and the agreement that the UK entered pursuant to it. Even in these relatively early days, it's clear that the Act provides a framework for advancing U.S. interests and public safety. It underscores the importance of finalizing agreements with Canada and the European Union and beginning negotiations with other countries. Deeply concerning is the report by The Washington Post in February that the UK is secretly seeking to compel Apple to disable a global security feature in one of its products in order to expand its surveillance capabilities. But it also illustrates the value of the CLOUD Act framework. When a foreign government coerces an American company to compromise or withhold security protections intended to safeguard users worldwide, the impact reaches everyone, including Americans. The harm is magnified when such mandates are imposed in closed, secret proceedings with outcomes concealed. These actions threaten core U.S. interests in cybersecurity and erode the global competitiveness of American technology providers in the light of serious competition from China. If there's still a real debate about whether security should yield to government surveillance, it doesn't belong behind closed doors in a foreign country. It shouldn't be settled in secret proceedings run by foreign officials and with outcomes unknown even to U.S. government. That debate belongs in public, before the United States Congress, led by officials elected by the American people, acting with the interests of this country at heart. It must be decided here, not imposed there. Regardless of the outcome in the reported Apple matter, which we may never know, this experience reflects the broader threat of foreign efforts to covertly undermine the security of products and services offered by American companies. We are now tasked with identifying and implementing solutions. Fortunately, the CLOUD Act provides an ideal framework for this. The CLOUD Act provisions at issue today were enacted to address problems created by U.S. blocking statutes. Before the Act, U.S. providers were broadly and presumptively barred from disclosing certain user data to foreign governments, even when the requests came from a jurisdiction that respects human law, human rights, and the rule of law, and in a legitimate case. As a result, countries had to rely on diplomatic tools like mutual legal assistance treaties, which are often too slow in practice. Frustrated, some would resort to unilateral measures to circumvent U.S. law, including tactics that undermine security. The CLOUD Act addresses this by conditionally lifting the blocking statutes for any country that qualifies for and signs an executive agreement with the U.S. To qualify, a government must demonstrate respect for civil liberties and due process, among other requirements. Once an agreement is in place, a U.S. provider may honor data requests from that country without risking running afoul of the blocking statutes. With a few surgical changes, the CLOUD Act is well-suited to address the U.K.'s reported actions and similar moves by other foreign governments. I've outlined several improvements in my written testimony and will briefly summarize only a few here. First, the U.S. government should press the UK to end its reported effort against Apple and commit to refraining from similar actions against other American companies. That commitment should be a condition for continued participation in the agreement. Second, Congress should amend the CLOUD Act to declare cybersecurity a national interest that, like free speech, must be respected. Third, Congress should require that to qualify for an agreement, a foreign government must not impose surveillance or anti-security obligations on American companies. With these targeted changes and a few others, the Act can better advance cybersecurity and help American companies continue offering trusted, secured services worldwide. We should treat the lamentable U.K. episode as a lesson and improve the Act. Too much is at stake otherwise. Thank you for the opportunity to discuss these issues.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Yeah, thank you, Mr. Salgado. Mr. Nojeim, you have 5 minutes for your testimony.

Mr. Gregory T. NojeimSPEAKER_08

Thank you so much, Acting Chairman Tiffany, Ranking Member Raskin, members of the subcommittee. My name is Greg Nojeim, and I direct the Security and Surveillance Project at the Center for Democracy and Technology. And I'm proud to say that our awesome intern class is here and showed up. Thank you for identifying yourselves.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Welcome.

Mr. Gregory T. NojeimSPEAKER_08

CDT is a nonprofit, nonpartisan organization, and as the chairman mentioned, we defend civil rights, civil liberties, and democratic values in the digital age. We're calling on Congress to act with the DOJ to protect privacy and security of Americans' data against threats from countries that benefit from CLOUD Act agreements. Congress enacted the CLOUD Act in 2018 by tacking it on to the end of a 2,322-page omnibus spending bill. It empowers the DOJ to enter into executive agreements without congressional approval with foreign countries through which the U.S. providers can disclose user data from storage and in real time. Disclosures are made directly to foreign states under the laws of the foreign states, and the U.S. warrant requirement that would otherwise pertain does not apply. The U.K. has availed itself of this opportunity in spades, issuing over 20,000 demands under the CLOUD Act. In contrast, the U.S. has issued 63. The benefits of the agreement to the U.S., while real, are limited. CLOUD Act agreements are supposed to preserve the privacy of Americans and of other people in the United States. The foreign country cannot target those people with CLOUD Act orders. But things haven't quite worked out as Congress planned. Instead, the U.K. has ordered Apple—as the other witnesses have said, under the authority of U.K. law, not under the authority of the CLOUD Act—to build in a back door to its encrypted cloud backup service so Apple can fulfill the U.K.'s CLOUD Act demands. If Apple had fully complied, it would have compromised the communications security of its users in the U.S. and worldwide. U.K. law, the TCNs, are super extraterritorial. The U.K. authorities can issue orders on companies headquartered outside the U.K., order them to alter their equipment that is outside the U.K., so they can wiretap people who are outside the U.K. We don't know how many other U.S. providers have received one of these orders. If they have received one, they are gagged and can't say so. Other countries assert the authority to compel this type of provider assistance. Australia is the only other country to have a CLOUD Act agreement. It has a similar law, similar to the U.K.'s, but it includes a vague exception that may protect encryption. Canada, which is negotiating a CLOUD Act agreement with the U.S. right now, has a provision almost identical to the Australian law provision. Acting Chairman Tiffany, if you are an iPhone user and you go to London and you try to back up your iMessages with the cloud backup service that Apple provides, you wouldn't be able to do it in encrypted form. The reason you wouldn't be able to do it is because Apple has withdrawn that service from the U.K. under the pressure of this order that it's received. The U.K. would have Apple withdraw the service worldwide or compromise its protections so that no matter where you went, even to your office next door in the Cannon Building, if you downloaded your iMessages, you wouldn't be able to protect them with encryption. This situation is intolerable. The DOJ and Congress should put an end to it by taking three steps. First, DOJ should invoke Article 12.3 of the agreement and declare that it is ineffective with respect to CLOUD Act orders issued to a provider that has received an order like the one served on Apple. Such a declaration would have immediate effect. DOJ should also persuade the U.K. to publicly withdraw the order to Apple, so that under threat under threat of terminating the agreement unless the U.K. agrees. This has the benefit of a negotiated result with more predictable public effect that sends a message to other countries that seek CLOUD Act agreements. Finally, Congress should back up the DOJ by amending the CLOUD Act to prohibit CLOUD Act agreements with countries whose laws or practices permit such orders, and to require CLOUD Act agreements that they explicitly prohibit such orders. We look forward to working with you on such solutions.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Thank you, Mr. Nojeim. We're now going to proceed under the 5-minute rule with questions. First of all, I'd like to recognize the gentleman from Texas, Mr. Nehls.

Rep. Troy Nehls (R-TX)SPEAKER_07

Thank you, Mr. Chairman. Thank you to all the witnesses that are here today. I want to start posing a question to all of you. In your opinion, does the CLOUD Act and the executive agreements we have under it with the UK and Australia sufficiently protect American communications from foreign surveillance? And please explain why or why not. Mr. Salgado, I'll start with you, Mr. Salgado.

Mr. Richard SalgadoSPEAKER_01

Apologies. No, they do not, and for several reasons, but the primary one that I think the UK matter exposes is that they don't do anything to dissuade a foreign government from imposing technical capabilities like we've seen in the UK, but a whole host of other potential efforts to undermine security—backdoors, contaminated apps. There's a whole host of things that a creative investigator could come up with, all that undermine the security of American services, and that would also compromise Americans' data. And the CLOUD Act is a framework that we could use to protect that.

Mr. Gregory T. NojeimSPEAKER_08

I agree with that. We're focused today on the security risks that the CLOUD Act actually incents countries that have CLOUD Act agreements to demand of U.S. providers, but there's a lot of improvements that could be made to protect Americans. One improvement would be to make it so that the U.S. providers could at least tell their government when they receive an order like the one served on Apple that this has happened. Apple is gagged not only from telling the world it received an order, it can't even tell its home country.

Rep. Troy Nehls (R-TX)SPEAKER_07

You mentioned there were like 20,000

Mr. Gregory T. NojeimSPEAKER_08

20,000 of these.

Rep. Troy Nehls (R-TX)SPEAKER_07

We were at 63.

Mr. Gregory T. NojeimSPEAKER_08

Yeah, it's, uh, it's imbalanced. Yeah, it's imbalanced.

Rep. Troy Nehls (R-TX)SPEAKER_07

Thank you. Ms. Wilson.

Ms. Caroline Wilson PalowSPEAKER_00

I agree with my fellow witnesses. I would just add and re-emphasize that the CLOUD Act is designed, when engaging in executive agreements with these other countries, to make sure that these countries have a surveillance regime that respects privacy and other rights. And clearly the UK is not following that here with the the TCN, the Technical Capability Notice. It's obviously a huge invasion into privacy. It's breaking all of our security by targeting end-to-end encryption. It undermines our potential free speech rights because of the way that end-to-end encryption can be used by so many to communicate, by opposition groups around the world, by human rights defenders in really tough circumstances. So I'd say that the UK is not really in the spirit of the Act at the

Rep. Troy Nehls (R-TX)SPEAKER_07

Professor.

Ms. Susan LandauSPEAKER_03

So, this is mostly a law and policy question, but I will pose a technical version of it, which is that in the 1990s, the U.S. government proposed an encryption scheme for digital communications, digital voice communications, in which the keys would be stored with two agencies of the federal government. This did not go over well. It didn't go over well with industry. It didn't go over well with foreign countries. And it didn't go over well with buyers when AT&T implemented it. The product did not get bought. But now imagine that the UK requires that encryption use keys that are stored with the UK government. As far as I can tell, and the lawyers to my right can correct me if I'm wrong, but I don't see anything in the CLOUD Act that would prohibit such a thing. And yet, of course, no American company, no American who has any private business would want to use encryption where the keys are stored with the UK government.

Rep. Troy Nehls (R-TX)SPEAKER_07

Mr. Salgado, does the CLOUD Act or our agreements under it pose an undue or unfair burden on U.S. companies? Why or why not?

Mr. Richard SalgadoSPEAKER_01

I don't think they they impose an undue burden, other than that the companies, as as Mr. Nojeim pointed out, are barred from disclosing these things that are coming to them, and the CLOUD Act isn't there to protect them from that, and it is a good vehicle for that so that they could tell the U.S. government. And really, Congress ought to have much more information than is provided through the current reporting mechanism.

Rep. Troy Nehls (R-TX)SPEAKER_07

Yes. And could the UK's—this technical capability notice to Apple aggravate that burden?

Mr. Richard SalgadoSPEAKER_01

It could, and I think it has. I think you see the situation with Apple where they seem unable to comment on this, right?

Rep. Troy Nehls (R-TX)SPEAKER_07

What happens if other countries now, they'll follow suit with this?

Mr. Richard SalgadoSPEAKER_01

Yeah, it's— that's the problem. It just continues with more and more, and especially if it's— if it goes unaddressed by the U.S., that just creates a— an invitation to continue doing things.

Rep. Troy Nehls (R-TX)SPEAKER_07

That's one of the— 25 seconds left. Do you have any recommendations for future executive agreements or amendments to the CLOUD Act to lessen that burden on U.S. companies?

Mr. Richard SalgadoSPEAKER_01

I do. There's several of them laid out in my witness testimony, but first, and very simply, we should have a declaration in the agreement that network security and cybersecurity is an essential interest, which is a diplomatic term of art, just like free speech and some others, that carries weight with it. And we can also put some in the in the conditions to get an agreement, some restrictions on the type of technical surveillance capabilities that partner countries would be allowed to provide, among other changes.

Rep. Troy Nehls (R-TX)SPEAKER_07

Thank you all for being here.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Gentleman yields. I now turn to the ranking member, Mr. Raskin, for his 5 minutes of questions.

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

Thank you, Mr. Chairman. Mr. Nojeim, so wait, what is the argument on the other side? What is the UK's interest in doing this, and is there some other way to vindicate their interest other than the construction of the backdoor?

Mr. Gregory T. NojeimSPEAKER_08

I think their argument would be—first, I think they should be at this table and answering your questions. But I think that the argument would be that they need access to communications content in order to fight crimes and prevent crimes. And that they would say, Well, our interest in getting access trumps the privacy interests of everybody in the world. That's what they would have to say.

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

Yeah, I mean, to transpose it to the domestic context, it would mean that the government would have access to all of our private conversations, not just technologically, but in person, at a restaurant, walking in the park, right? Because there might be some information they want to get.

Mr. Gregory T. NojeimSPEAKER_08

You know, you, you might have heard that some in law enforcement argue that they're going dark because of encryption. This is the golden age of surveillance. There's never been more human thought available to law enforcement agencies around the world in the history of mankind than today. They get it from social media, they get it from data brokers, they get it from all kinds of sources.

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

Thank you. Professor Landau, could you take us through the Salt Typhoon hack on the telecom providers and show us why that episode underscores the importance of creating strong security measures?

Ms. Susan LandauSPEAKER_03

Sure. So, none of the technical details have been released by the US government, so this is a certain amount of speculation, but we do know that the telecommunications network, the phone network, has some insecurities. But one of the important aspects of the phone network is that the way that the phone systems interoperate used a model of trust where each of the phone companies knew each other. And there were few phone companies, and that worked fine. We don't have few ISPs. We have thousands of ISPs. We have tens of thousands of ISPs. And way back when ISPs started carrying phone calls, for example, E911, VoIP, and so on, there was a requirement, an appropriate requirement by the government, to have the ISPs interconnect with the phone system so that when somebody dials a 911 emergency call, the phone system can then locate where that person is. The problem is that ISPs, as we all know, the internet has a great number of insecurities, and so the hackers use the insecurities that are caused by that interconnection. At the technical level, I don't know all the different pieces. So, when you send a message, when you text, if you're texting over the phone line as opposed to texting via iMessage or an app that encrypts, if you're texting over the phone line, then your message is not encrypted. Once the hackers were into the phone system, they could read texts. They could read the CALEA centralized or more greatly centralized wiretaps. So, it used to be wiretaps were done at the phone central office, the office 5 mi down from my house or 3 mi down from my house. They're now more centralized. So, a city will have only a few CALEA sites. If you only have a few sites and you're in the phone system, and the hackers are in the phone system, they can more easily access it. So, there were all sorts of pieces that were not thought through carefully.

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

Thank you very much, Ms. Wilson Palow. So the so-called technical capability notice, which is the euphemism, I suppose, for creating this gaping back-door entryway into communications, contained a provision that the order itself was secret. And I wonder, first of all, what purpose did that secrecy condition serve for the government, and what does that do to civil liberties and people's reasonable expectations of privacy?

Ms. Caroline Wilson PalowSPEAKER_00

First, the purpose—and again, I'm speculating because the UK government also has maintained total secrecy around why this order exists, but

Full Committee Ranking Member Jamie Raskin (D-MD)SPEAKER_09

got secrecy around secrecy.

Ms. Caroline Wilson PalowSPEAKER_00

Yeah, secrecy around secrecy, exactly. But I think the UK's general idea is that, and this is actually not just in the case of TCNs, but certain other broader powers like interception, is that it really heavily tries to protect the technical capabilities that it has. And so, by making this order entirely secret, it means that users, others can't know whether or not there is a back door in in a service that is being targeted, and the UK would say that that's necessary, I think, for national security. But it completely undermines the ability of everyone else, including this Congress, including oversight bodies around the world, including users and concerned civil rights civil liberties advocates, from being able to question whether or not this is an acceptable in violation of our privacy and security.

Chairman Andy Biggs (R-AZ)SPEAKER_06

gentleman's time has expired. Thank you. And I apologize, I was having a vote in another committee that is a mile away, so I had to go get do that vote. So I apologize for missing some of your testimony. I apologize for that. Now I recognize the gentleman from Wisconsin, Mr. Tiffany, for his 5 minutes.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

And Mr. Chairman, I was happy to pinch hit.

SPEAKER_UNKNOWN

Um,

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Ms. Wilson Palow, one requirement of the CLOUD Act to enter these agreements is it has to be part of the Convention on Cybercrime. Is that correct? That's my understanding.

Ms. Caroline Wilson PalowSPEAKER_00

Yes, I believe so, although actually some of the other witnesses may be able to ask that— answer that better than I could.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

With that being the case, that convention also includes countries like Turkey and South Africa. While the concern is being most pointed towards the UK, and perhaps appropriately so, Turkey and South Africa aren't exactly exemplars of protecting people's civil rights. Shouldn't we be concerned about this extending beyond the UK?

Ms. Caroline Wilson PalowSPEAKER_00

Certainly. I mean, I think one of the most concerning aspects of this technical capability notice regime is, of course, the UK claims to be able to serve the notice actually entirely outside of the CLOUD Act provision. So even if a country like Turkey or South Africa did or did not negotiate an agreement an executive agreement under the CLOUD Act, if they had a similar regime in place, as long as that's not blocked by the CLOUD Act or some other US law provision, they similarly could serve these types of notices on US companies and may have much less respect for rights, as you suggest.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Mr. Nojeim, do you have a comment in regards to what I just asked and the comments here?

Mr. Gregory T. NojeimSPEAKER_08

So, I think a lot could be done to ensure that the U.S. doesn't enter into agreements with countries that don't respect the rule of law. For example, the CLOUD Act does not have a requirement that the U.S., that the country's laws require that there be even judicial authorization of surveillance. That seems like a very basic requirement, and yet it's not in the CLOUD Act.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

So, it strikes me as I sit here and as we once again see the that we have spies amongst us from China and the surveillance that's gone on, a spy balloon that flew over our country a few years ago. Are we whistling past the graveyard of China freedoms that—aren't they the greatest threat here?

Mr. Gregory T. NojeimSPEAKER_08

I think that China poses a huge cybersecurity threat to the United States. And if countries like the UK can force our providers to disarm by removing encryption protection, then we're more vulnerable to that kind of surveillance and that kind of attack.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

So, you're saying that we would benefit by amending the CLOUD Act to make sure that it's not abused by the UK, but perhaps other countries also? Is that what you're saying?

Mr. Gregory T. NojeimSPEAKER_08

Think of the CLOUD Act requirements in three buckets. There's the criteria that the country's laws and practices must meet—you could include a new one for protecting encryption. There are criteria that the agreement must include, things that the agreement must say. The agreement, uh, right now the statute says that the agreement, um, has to be silent on encryption, basically. It should say it has to protect encryption. Um, and then there's requirements about what the orders can and can't do. So Amendments in those 3 buckets could protect encryption.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

Mr. Salgado, were you with Google in 2018 when the CLOUD Act was enacted into law?

Mr. Richard SalgadoSPEAKER_01

I was, yes.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

So in reading your testimony, I get the impression that you are a strong advocate for the CLOUD Act at that point. Is that right?

Mr. Richard SalgadoSPEAKER_01

That's true.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

And now coming to us saying it needs to be changed, didn't you sense in 2018 that there should be, that we should be really concerned about, that we were giving away too much with that CLOUD Act in 2018? Did you have concerns at that time?

Mr. Richard SalgadoSPEAKER_01

I did. There were some changes to the CLOUD Act I would have liked to have seen, or some provisions I would have liked to have seen added. There wasn't anything quite on the horizon that we have with the UK now, but yes, there were some things that I thought we could do better with the CLOUD Act. It was pretty good as it was passed, and it's been valuable, but it could use a tune-up.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

So this is going to be a pointed question. It seems to me we have Google and Apple that are the subjects of this, in particular Apple, and we look at them in China and how they go about doing their business, where they have basically, in my terms, they've capitulated to the communist Chinese government. How do you reconcile that as someone who's a former executive with Google?

Mr. Richard SalgadoSPEAKER_01

I'm not sure I totally understand the question. It may be better directed to somebody who's currently at Google who could explain that further.

Chairman Andy Biggs (R-AZ)SPEAKER_06

I'm sorry that the gentleman's time has expired.

Rep. Thomas Tiffany (R-WI)SPEAKER_10

I yield.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Thank you. Chair now recognizes the gentleman from North Carolina, Mr. Knott.

Rep. Brad Knott (R-NC)SPEAKER_02

Thank you, Mr. Chairman. I appreciate the topic of today's important hearing. To the witnesses, I enjoyed speaking with you briefly before the hearing, and again, thank you for making the trip to Washington to discuss this important issue. And it's one that's largely unknown on a technical and a practical level to many in this country, even in Congress. And this issue is one that I assume will be abused by foreign governments and/or criminal actors, and hopefully there is a distinction still between those. Take the UK, for instance, a country with a proud history of protecting liberties, of respecting the rule of law, adhering to due process, bedrocks of Western civilization. That country today has protected and built a surveillance state. They spy on their own citizens, they arrest people for posting various things online, they monitor their own citizens' public communications and public posts. It's something that's quite concerning. And under this particular issue that we're discussing today, I do want to know, just technically speaking, Ms. Landau, can you just explain to us how the communications that are covered that we're discussing today, how are they collected, how are they stored, and then how can they be accessed in the future?

Ms. Susan LandauSPEAKER_03

So, the current Google architecture says that if I have three devices that I've made fit this Advanced Data Protection, that when I upload something to the iCloud, it's essentially a message that I am going to send to myself because I might pick it up on another one of my devices, and I've encrypted it end-to-end. All of my devices know the encryption key, and I authenticate to the devices before I pull it down from the iCloud. So, it's sort of like it's just hanging out in the iCloud, hanging out, hanging out. Apple doesn't have the key. Nobody has the key. Just I have the key. And so, that's the protection for it.

Rep. Brad Knott (R-NC)SPEAKER_02

Is the UK seeking to collect the data of two parties who are exclusively in the UK, or is it looking to protect— Okay, explain.

Ms. Susan LandauSPEAKER_03

When they're invested— well, I, I think you're probably better set.

Rep. Brad Knott (R-NC)SPEAKER_02

All right, Miss Powell.

Ms. Caroline Wilson PalowSPEAKER_00

Yes, with this technical capability notice, they're seeking to open up a backdoor, so the option to collect data. And then under other surveillance powers that they have, they can collect data from anyone in the world. So they have both outward-facing powers and inward-facing to the UK.

Rep. Brad Knott (R-NC)SPEAKER_02

And then hypothetically, let's say in the future or present, could federal law enforcement request information from a foreign country like the UK to receive communication files that involve American correspondence?

Ms. Caroline Wilson PalowSPEAKER_00

Yes, I believe that is possible, although I may defer that to some of my other panelists who better understand the American regulations, because I think there are some prohibitions. I'm not talking

Rep. Brad Knott (R-NC)SPEAKER_02

about regulations. I'm talking about

Ms. Caroline Wilson PalowSPEAKER_00

practically,

Rep. Brad Knott (R-NC)SPEAKER_02

practically speaking, that, that, that, uh, action would be feasible, correct?

Ms. Caroline Wilson PalowSPEAKER_00

That's right, because the UK absolutely will have Americans' data in the intelligence that it collects.

Rep. Brad Knott (R-NC)SPEAKER_02

It could also be reasonable to assume this is a bypass of Fourth Amendment protections potentially if it was motivated by the wrong actors, correct?

Ms. Caroline Wilson PalowSPEAKER_00

Again, it potentially could be,

Rep. Brad Knott (R-NC)SPEAKER_02

uh,

Ms. Caroline Wilson PalowSPEAKER_00

in theory there's the possibility.

Rep. Brad Knott (R-NC)SPEAKER_02

Now,

Mr. Gregory T. NojeimSPEAKER_08

if I could add something here, may I?

Rep. Brad Knott (R-NC)SPEAKER_02

I was getting ready. Yeah, go to you. Yes, sir.

Mr. Gregory T. NojeimSPEAKER_08

So, the statute wouldn't permit the U.S. to task the UK to listen in on an American. That order would be illegal under the statute. But what happens is Americans communicate with people outside the United States all the time.

Rep. Brad Knott (R-NC)SPEAKER_02

It doesn't permit it, but it enables it.

Mr. Gregory T. NojeimSPEAKER_08

Through this kind of incidental collection. You're familiar with this through the 702 program. So if I'm talking to a foreigner abroad who's the target of the UK surveillance order served on Apple, my communications will be collected as well. And then there's rules about when those communications can be shared back to the United States,

Rep. Brad Knott (R-NC)SPEAKER_02

right? So let me let me follow up with that. You mentioned earlier this is the golden age of surveillance. What are ways that you believe the CLOUD Act could be reformed to ensure that imminent threats are able to be identified and stopped without eroding the civil liberties protections that we're we're discussing?

Mr. Gregory T. NojeimSPEAKER_08

So I think in addition to requiring that the foreign country have judicial authorization, that there ought to be a rule that people get notice when they've been surveilled. We have that rule in the United States, and you don't get notice that happens before the investigation is finished. You get notice when it's done. So I think that would go a long way. And also transparency and the ability of providers to tell their own government that they've received an unlawful order.

Rep. Brad Knott (R-NC)SPEAKER_02

Sure. My time's expired, Mr. Chairman. I yield back.

Chairman Andy Biggs (R-AZ)SPEAKER_06

gentleman yields back. And I, for entry into the record, a letter from Reform Government Surveillance, without objection, so ordered. And I now yield to the rank— excuse me, the chairman of the Thank you,

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

Mr. Chairman. Mr. Nojeim, should the United States government have to get a warrant before they search the 702 database on an American?

Mr. Gregory T. NojeimSPEAKER_08

Absolutely.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

Yeah, I mean, you were just there, didn't you? And this— the issue we're talking about today, I think, even underscores and highlights that reason, because this, as you point out, United States government, we spy on foreigners all the time. Okay, fine, good. I think that's, that's, that's appropriate. But they pick up all kinds of information on Americans, and then that giant haystack of information gets searched using Americans' phone number, email address, or name. If you're going to do that, Go to a separate and equal branch of government, get a warrant, and show that you have a reason to do so.

Mr. Gregory T. NojeimSPEAKER_08

Yes, I think that's an essential reform and that Congress shouldn't reauthorize Section 702 unless it achieves that reform.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

We almost achieved it last, last year, last Congress. We lost the vote 212 to 212. I'm hoping we win it this time. Mr. Salgado, do you think that's a good change that we need to make?

Mr. Richard SalgadoSPEAKER_01

I think it's not only good, I think it's constitutionally mandated. It's also good public policy.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

No kidding. How about, Ms. Wilson Palow? Do you think so?

Ms. Caroline Wilson PalowSPEAKER_00

Yes, I would agree.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

Professor, do you agree?

Ms. Caroline Wilson PalowSPEAKER_00

Absolutely.

Full Committee Chairman Jim Jordan (R-OH)SPEAKER_04

Wow. This is amazing. This is amazing. We all think we should follow the Constitution and require a warrant if you're going to go search Americans' data. So, I am hopeful it's one of the things that I think we can get bipartisan support on this committee and actually get it. We had it last Congress. Unfortunately, we didn't have quite the votes we needed, but this issue just highlights it even more why that is necessary. So again, I want to thank you all for coming today, and I appreciate the gentleman from New York allowed me to go and the chairman for doing so. And I yield back the balance of my time to the chairman.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Gentleman yields, and I now recognize the gentleman from New York, Mr. Goldman.

Rep. Daniel Goldman (D-NY)SPEAKER_05

Thank you very much, Mr. Chairman. I think you raise a very interesting point, Mr. Jordan, Chairman Jordan, wanting to make sure that a warrant is obtained to search Americans' data. So, I recognize we're here focused on the CLOUD Act, and it's an important issue. I'm I don't dispute that. But in the times we're in, this seems quaint and intellectual, academic discussion. And in reality, what we're dealing with is an administration, current administration, that is trying to categorize, gather, and streamline data of Americans given with access by a private company. Now, let me explain a little bit, and then I want to ask some questions. Many of you, I'm sure, have heard of Palantir, which is a a large data company, has a lot of connections to Elon Musk, to DOGE. And in March, Donald Trump issued an executive order that would increase the sharing of all unclassified data between and among federal agencies. It directed agency heads to authorize and facilitate both the intra- and interagency sharing and consolidation of unclassified agency records. Now, a New York Times report in May outlined in great detail how the president has employed Palantir to carry out this executive order, essentially to merge all data from all different executive branch agencies into one single database. Now, it's unclear who would control that database, who would have access to it, what searches would be done, and there seem to be no guardrails about that. Another New York Times article says that the administration that this database would have 314 different points of data about every American. Literally every American, 314 various categories of data will be consolidated into one database by a private company, Palantir. Now, my colleagues on the other side of the aisle often express concern about government surveillance, about ensuring that we get search warrants in the context of 702, which is a a small universe of already obtained information that we know are communications with people of interest from foreign nationalities. Here, we just have every American's data put into one database with no guidelines, no restrictions. We don't know what Palantir is doing. We don't know what DOGE is doing. We don't know what Elon Musk is doing. It essentially creates a one-stop shop for all Americans' data, which, as we're talking about cybersecurity, I'm sure you all agree that creates a tremendous cybersecurity risk if China or Russia were to hack this. Now, the chairman of this committee has said in the past, quote, Congress has struggled— of this subcommittee, Mr. Biggs. Congress has struggled for 4 years with a corrupt presidential administration, meaning the Biden administration, that further expanded the opportunities for the government to spy on its citizens. So, is there— I mean, there was nothing in the Biden administration that approximates this collection of data, this opportunity for the government to spy on its citizens. And I'm not even talking about breaking laws under the tax code and sharing tax information with immigration enforcement agencies. I'm not even talking about sharing the tax information or Social Security Administration information. This is just every piece of data that is out there in the government's control consolidated with one private company in one database. And so, I would ask my friend Chairman Biggs to think about whether, if you are truly worried about government surveillance, why are we not doing any oversight of Palantir, its contracts with the government, its consolidation of all Americans' personal information into one database, and the cybersecurity risks? And I really hope, in all seriousness, that you will do oversight over that if you do truly care about government surveillance of citizens. And I yield back.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Gentleman yields back. And now I yield myself 5 minutes.

Rep. Daniel Goldman (D-NY)SPEAKER_05

Mr. Chairman, could I— sorry to introduce 2 unanimous consent requests.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Yeah.

Rep. Daniel Goldman (D-NY)SPEAKER_05

Thank you. One is an April 9th, 2025 New York Times article entitled, "Trump Wants to Merge Government Data. Here Are 314 Things It Might Know About You."

Chairman Andy Biggs (R-AZ)SPEAKER_06

Without objection.

Rep. Daniel Goldman (D-NY)SPEAKER_05

And the other one is a May 30th, 2025 New York Times article, Trump Taps Palantir to Compile Data on Americans.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Without objection. Thank you.

Rep. Daniel Goldman (D-NY)SPEAKER_05

Thank you.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Again, thanks to the witnesses for being here, and I'll yield myself now 5 minutes. So Mr. Salgado, in your written statement, you said one should take little solace in the provisions of the CLOUD Act. First, they will still allow for incidental and inadvertent collection of Americans' data subject to certain minimization requirements. Can you expand on that for me, please?

Mr. Richard SalgadoSPEAKER_01

Sure. We touched on that a little earlier in the hearing, and specifically Mr. Nojeim reference to inadvertent and incidental collection, where the UK can use the CLOUD Act to obtain data from American companies, and inadvertently or incidentally, that data could include U.S. persons' data or data about people in the United States. There are some As I mentioned in the written testimony, there are restrictions on the UK in its use and dissemination of that information, and it has some minimization requirements, which is a phrase you may be familiar with from Section 702 and FISA generally. So that's what I was referring to.

Chairman Andy Biggs (R-AZ)SPEAKER_06

That's what I thought you were referring to. And one of the things that I find interesting about that is having met with the UK Home Office within the last 6 weeks, I am concerned about their processes and on what they actually do and their transparency or lack of transparency with this incidentally collected data. And that's part of the problem that we have with the 702 application as well. So, Ms. Wilson Palow, you indicated that you disagree that the UK safeguards are as robust as they claim, but that is beside the point because your concern about TCNs is that once a backdoor is created, states with far less stellar records on human rights, such as Russia and China, could seek similar access through legal process. You've talked about that a little bit. I'd like you to expand on that and then ask each of the members of the panel to also expand on that.

Ms. Caroline Wilson PalowSPEAKER_00

Certainly. So once this backdoor is built, once end-to-end encryption is broken, any state using their legal process, no matter whether or not it is as rights-respecting as we would hope it would be, can then ask Apple for access to this data. Because once it's broken, it's not just broken for the UK to access the data or for the US to access the data. Any country could request it, and a lot of countries have surveillance regimes that would allow them to make these sort of requests.

Chairman Andy Biggs (R-AZ)SPEAKER_06

But it isn't just countries that would request, is it? It's also rogue actors that might be able to access those backdoors as well, right?

Ms. Caroline Wilson PalowSPEAKER_00

That's exactly right.

Chairman Andy Biggs (R-AZ)SPEAKER_06

So, rather than ask of each of you to expand on that, what I'm going to ask instead is, my position would be that DOJ, without immediate transparency and opening up of the process, the TCN that's going on with Apple, that they immediately issue the 30-day termination notice. That's just my position. Does anybody there agree with me on the panel?

Mr. Gregory T. NojeimSPEAKER_08

I think that would be a good tactic. They could issue the notice. They say, We're going to terminate in 30 days unless you withdraw this order to Apple. I think that makes a lot of sense.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Yeah, it's leverage point. Yeah, Professor,

Ms. Susan LandauSPEAKER_03

I, I absolutely agree.

SPEAKER_UNKNOWN

Yeah,

Chairman Andy Biggs (R-AZ)SPEAKER_06

Anybody? Mr. Salgado?

Mr. Richard SalgadoSPEAKER_01

No, I don't disagree with that at all. I think there's a lot of negotiating strategies here. This agreement is important to the UK, and I think they would come to the table.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Ms. Wilson Palow?

Ms. Caroline Wilson PalowSPEAKER_00

I agree that this is an important moment to pressure the UK, because if we don't push back now, then the UK may issue many more of these orders in the future entirely in secret and we won't know about them.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Yeah, I think that's that's my point, is that it's just hanging out there. We don't know enough about what's happening. We just—there's this—I think the legal term is penumbra of—there's a penumbra of information out floating around out there that that we hear about, but we need to nail it down and and really take action on it. So the next the next step is, and I'm going to ask each of you this, and we have a minute left, so you should have about 15 seconds: What what two things do you think we need to do to improve the CLOUD Act? Start with you, Mr. Nojeim.

Mr. Gregory T. NojeimSPEAKER_08

Um, amend it to make it so that no such order can be issued by another country that gets one of these agreements. Amend it to make it so that a country can't get an agreement unless its laws prohibit such orders.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Thank you. Mr.

Mr. Richard SalgadoSPEAKER_01

Salgado. Um I would adopt Mr. Nojeim and add two more, one being that the providers be allowed to notify the US government when they receive orders under this act or technical capability notices, and that Congress receive more frequent reporting from the Department of Justice on the operation of the acts that are in place.

Chairman Andy Biggs (R-AZ)SPEAKER_06

The oversight, yes. Ms. Wilson Palow.

Ms. Caroline Wilson PalowSPEAKER_00

I would adopt Mr. Salgado and Mr. Nojeim recommendations.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Thank you. Professor.

Ms. Susan LandauSPEAKER_03

I would adopt all three recommendations. I would add that, as Mr. Salgado mentioned earlier, cybersecurity and network security be part of the criteria in deciding whether or not to enter into an agreement. I don't disagree about privacy being fundamental and important, but I think there's a really strong lever about cybersecurity and national security—and network security that should be used.

Chairman Andy Biggs (R-AZ)SPEAKER_06

Thank you so much. We've exhausted our time, which is a crying shame because there's so much more to get at with this subject. I appreciate each of you and your testimony. It's important testimony. This is an important—here's the thing about Congress. If there was a bunch of money on the table, this room would be filled and everybody would be here. But on this type of issue, which is actually critical to the country and national security, you see what happens. It's a sad, sad revelation about the United States Congress today. We appreciate all of you being here. Thank you so much, and we will undertake your recommendations and move forward with those very much. Thank you. We're adjourned.