Australia and US sign CLOUD Act deal for cross-border data access

Australia and the United States have signed a deal to give law enforcement agencies in both countries a streamlined way to access data held by tech companies in each jurisdiction.

The bilateral agreement under the US Clarifying Lawful Overseas Use of Data Act (the CLOUD Act) was signed on Wednesday, creating a new reciprocal cross-border data access regime.

The agreement will allow Australian and US authorities to access “certain” data directly from providers operating in the other’s jurisdiction to “prevent, detect, investigate and prosecute serious crimes”.

Terrorism, ransomware attacks, the sabotage of critical infrastructure over the internet and child sexual abuse were cited as examples of serious crimes.

The government said that the agreement would “significantly” reduce the amount of time taken to obtain data, which has proved a stumbling block in criminal investigations.

Authorities currently use the mutual legal assistance mechanism to access data from communications providers, which is considered slow and awkward.

The government said the CLOUD Act agreement also contains “strong protections for the rule of law, privacy and civil liberties”, though it did not elaborate on what these protections are.

Australia and the US have been negotiating the agreement under the CLOUD Act since at least October 2019 after first expressing interest just after the law was passed in April 2018.

A similar CLOUD ACT agreement has been in place between the US and the United Kingdom since October 2018.

Earlier this year, legislation paving the way for the agreement passed federal parliament despite lingering privacy concerns.

The Telecommunications Legislation Amendment (International Production Orders) Bill established a framework that allows “reciprocal cross-border access to communications data”.

US Attorney-General Merrick Garland said the agreement “paves the way for more efficient cross-border transfers of data between the US and Australia” to “more effectively counter serious crime”.

Home Affairs Minister Karen Andrews said the agreement would enhance law enforcement cooperation.

“As we saw in Operation Ironside [the AN0M encrypted device and app]... the Australian Federal Police and FBI are already capable of smashing serious, organised crime networks using sophisticated digital techniques,” she said.

“By strengthening both nations’ ability to fight crime, and giving our law enforcement agencies more efficient access to evidence, we’re ensuring the safety, security and prosperity of our citizens.”

The CLOUD Act agreement will now undergo parliamentary and congressional review processes in both countries.