Is there a US law requiring companies to provide the government with access to their users' information?

Question

So I've heard some people (even in media, I think) say that in the United States, there's some law (or regulation) about digital/technology companies saying that they must provide access to their users' information to the government (i.e., a backdoor) no matter what. But I can't find any reliable references to that. Can someone please provide me reliable information about any such laws or regulations that exist?

Answer 1

There are a couple of US laws that form the basis of effectively warrantless surveillance, including through tech companies:

• Under Executive Order 12333, US intelligence agencies issue National Security Letters. These letters compel the recipient to provide requested data. These letters do not require a warrant, and typically include a gag order for the recipient.

• Under Section 702 FISA, US intelligence agencies enjoy substantial powers for foreign surveillance. This surveillance has to be authorized by the FISA court, but it has been criticized for rubber-stamping requests. Proceedings at the FISA court are ex parte and lack representation for the surveillance subjects.

• FISA and the National Security Letters mechanism where expanded through the Patriot Act.

• US intelligence agencies often have creative interpretations of the governing laws. Judicial review tends to defer to executive branch interpretation if that interpretation is reasonable. Thus, there exists a secret body of quasi-law where intelligence agencies can interpret the existence of further powers.

These laws have very limited checks and balances. While Americans enjoy some protections, there are basically none for non-Americans. Subjects have extremely limited options to fight this surveillance in court. FISA has to be re-authorized every few years.

The true scope of surveillance under these laws became publicly known through the Snowden leaks. For example, intelligence agencies ran the PRISM program based on section 702 FISA that compelled companies to supply all data matching a “selector”.

A bit of outside perspective: In 2020, the European Court of Justice ruled that EO 12333 and other laws mean that the United States do not have an adequate level of data protection, effectively forbidding further transfers of personal data into the US. While the EU's GDPR does recognize surveillance measures that are “necessary and proportionate in a democratic society”, the lack of judicial remedies for surveillance subjects are especially troubling. The ECJ wrote in its judgement (case C‑311/18):

As regards judicial protection, the referring court states that EU citizens do not have the same remedies as US citizens in respect of the processing of personal data by the US authorities, since the Fourth Amendment to the Constitution of the United States, which constitutes, in United States law, the most important cause of action available to challenge unlawful surveillance, does not apply to EU citizens. In that regard, the referring court states that there are substantial obstacles in respect of the causes of action open to EU citizens, in particular that of locus standi, which it considers to be excessively difficult to satisfy. Furthermore, according to the findings of the referring court, the NSA’s activities based on E.O. 12333 are not subject to judicial oversight and are not justiciable. […]

It follows therefore that neither Section 702 of the FISA, nor E.O. 12333, read in conjunction with PPD‑28, correlates to the minimum safeguards resulting, under EU law, from the principle of proportionality, with the consequence that the surveillance programmes based on those provisions cannot be regarded as limited to what is strictly necessary.