1 Agreement on Access to Electronic Data for the Purpose of Countering Serious Crime [hereinafter UK–U.S. CLOUD Act Agreement], UK–U.S., Oct. 3, 2019.

2 Treaty on Mutual Legal Assistance in Criminal Matters, UK–U.S., Jan. 6, 1994, T.I.A.S. No. 96-1202 (entered into force Dec. 2, 1996). See also Instrument as contemplated by Article 3(2) of the Agreement on Mutual Legal Assistance, U.S.–EU, June 25, 2003, as to the application of the Treaty on Mutual Legal Assistance in Criminal Matters of January 6, 1994, Dec. 16, 2004, T.I.A.S. No. 10-201.48 (entered into force, Feb. 1, 2010).

3 A recent European Commission study estimated that a very large majority (85%) of member state criminal investigations today require electronic evidence in some form, and in two-thirds of the cases such evidence is in the hands of online service providers based in another jurisdiction. See European Commission Staff Working Document, Impact Assessment Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters and Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceeding (2018), https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52018SC0118&from=EN.

4 Liberty and Security in a Changing World, President's Review Group on Intelligence and Communications Technology, p. 227 (Dec. 12, 2013).

5 Clarifying Lawful Overseas Use of Data Act, contained in Consolidated Appropriations Act, 2018, P.L. 115–141, div. V [herenafter CLOUD Act].

6 As a matter of U.S. treaty law, CLOUD Act agreements are considered to be executive agreements. The U.S. executive must submit to Congress a series of certifications that a CLOUD Act agreement fulfills certain privacy and due process requirements, and the Congress is afforded a mandatory period to review the agreement before it may enter into force. CLOUD Act, id., § 105 (adding 18 U.S.C. 2523(d)). See Theodore Christakis & Kenneth Propp, The Legal Nature of the UK–US CLOUD Agreement, Cross-Border Data Forum (Apr. 20, 2020), https://www.crossborderdataforum.org/the-legal-nature-of-the-uk-us-cloud-agreement.

7 CLOUD Act, supra note 5, § 105 (adding 18 U.S.C. 2523(b)).

8 For a fuller discussion of the significant features of the agreement, see Jennifer Daskal & Peter Swire, The UK–US CLOUD Act Agreement is Finally Here, Containing New Safeguards, Lawfare and Just Security (Oct. 8, 2019), https://www.lawfareblog.com/uk-us-cloud-act-agreement-finally-here-containing-new-safeguards.

9 UK-U.S. CLOUD Act Agreement, supra note 1, art. 8(4).

10 The UK's internal explanatory memorandum bluntly states that “(t)he UK–U.S. Mutual Legal Assistance Treaty is not changed by the Agreement and remains in place.” This reflects that there may well be circumstances in which limitations contained in the CLOUD Act agreement—targeting limitations, or restrictions on the scope of covered offenses, for example—compel law enforcement authorities in the United States or United Kingdom to resort to the MLAT instead. See Explanatory Memorandum to the UK–U.S. Agreement on Access to Electronic Data for the Purpose of Countering Serious Crime, Cm. 178 (2019).

11 The United States possesses such powers under a separate part of the CLOUD Act itself, which clarified that a provider of electronic communications services is obliged to disclose to the U.S. Government, pursuant to warrant, content data within its possession, custody or control, even if located outside the United States. CLOUD Act, supra note 5, § 103 (amending 18 U.S.C. 2713).

12 The Department of Justice has taken a subsequent administrative step relating to designation of the United Kingdom under the Agreement, a prerequisite to bringing the agreement into force. See 85 Fed. Reg. 67568 (Oct. 23, 2020).

13 CLOUD Act, supra note 5, § 104 (amending 18 U.S.C. 2511(2)).

14 Crime (Overseas Production Orders) Act 2019, Chapter 5. The UK Secretary of State subsequently designated the UK–U.S. Agreement under the powers conferred by the 2019 law. See Overseas Production Orders and Requests for Interception (Designation of Agreement) Regulations 2020, c. 38 (UK) (Jan. 16, 2020).

15 U.S. Dep't Just., Joint Statement Announcing United States and Australian Negotiation of a CLOUD Act Agreement by U.S. Attorney General William Barr and Minister for Home Affairs Peter Dutton (Oct. 7, 2019), https://www.justice.gov/opa/pr/joint-statement-announcing-united-states-and-australian-negotiation-cloud-act-agreement-us.

16 See Peter Swire, EU and U.S. Negotiations on Cross-Border Data, Within and Outside of the Cloud Act Framework, Lawfare (Apr. 13, 2019), https://www.crossborderdataforum.org/eu-and-u-s-negotiations-on-cross-border-data-within-and-outside-of-the-cloud-act-framework. The EU simultaneously is in the process of developing its own e-evidence legislation, and it may prefer that an agreement on this subject with the United States not be an executive agreement within the framework of the CLOUD Act.

17 For example, a recent study by a major EU policy think-tank calls for the European Union to rely solely on mutual legal assistance treaties to govern evidentiary matters with the United States, and to abandon pursuit of an e-evidence agreement. See Sergio Carrera, Marco Stefan, Vatsamis Mitsilegas (rapporteurs), Cross-border data access in criminal proceedings and the future of digital justice, Center for European Policy Studies (Oct. 2020) 77.