Can cloud services providers be asked to turn over data from foreign countries?

Question

Can cloud providers be asked to provide data from other countries to the government/law enforcement for security purposes? Can Amazon be asked to provide data from non-US countries for any security reason, substantiated or not?

Answer 1

Generally speaking a business can be subpoenaed to provide any records, electronic or otherwise, by any court with jurisdiction over that business. Most subpoenas are issued in the context of pending lawsuits or criminal cases, some can be issues by certain regulatory or criminal law enforcement agencies.

There are defenses to a subpoena which can be asserted to quash the subpoena before the information is provided by the business. The main defense is that the information is privileged, for example, because it contains attorney-client confidences, or it is protected as a trade secret which could be disclosed to a competitor or lose its trade secret status if access to the information is not controlled.

But, generally speaking, ordinary business records of dealings that a company like Amazon has with its customers are not privileged or otherwise exempt from disclosure pursuant to a subpoena.

Another process which is available but less common when dealing with a third-party is a search warrant. In general, a business is not exempt from disclosing records pursuant to a criminal search warrant simply because the records involve non-U.S. persons.

There are also special procedures similar to, but not identical to, subpoenas under the Patriot Act such as "national security letters" that can be issued when national security is at issue. Unlike a typical subpoena, the process involved in a national security letter information request must generally be kept secret from the public and from the target of the investigation. National security information requests are overseen the the FISA (Foreign Intelligence Surveillance Act) Court which is a non-adversarial court that operates much like a judge or magistrate to whom a criminal search warrant application is made, except that attorneys that practice before it must have security clearances and its proceedings operate with a much higher level of secrecy. National security inquiries are still subject to legal limitations which the FISA court evaluates, although the FISA court has a reputation for being something of a rubber stamp (there is debate over whether this reputation is well earned).

There is a detailed body of law describing what justifications are necessary for various types of record requests and what exceptions to the duty to disclose exist, but without more specifics in the question, an answer in this forum is not a place for a comprehensive treatise reviewing all of them which could fill several law review articles.

Answer 2

You may want to look into cases such as "Microsoft Corp v United States", which covers this exact scenario.

In 2013, Microsoft was served a warrant to hand over data stored in one of its data centres in Ireland to a New York District court - Microsoft challenged this in court, and lost in two District Court cases but succeeded on the Second Circuit.

Ultimately, the US Government appealed to the US Supreme Court, where the case became moot when the Clarifying Lawful Overseas Use of Data Act was introduced and subsequently signed into law by President Trump in 2018.

The CLOUD Act regulates US government access to data held by American companies in foreign countries.

The Department of Justice applied for a new warrant under the CLOUD Act and was granted access to the data.

Answer 3

Yes

According to US law, the US government can ask US companies to turn over data those companies hold for foreign clients, and not even tell those clients or offer them effective legal remedies. That is the reason why e.g. the Safe Harbor and Privacy Shield agreements between the US and EU were struck down by EU courts.

It remains an interesting question just how safe the EU subsidiaries of US companies are from secret inquiries by their parent companies at the request of US agencies. For instance, AWS has regions. A customer could specify that data is held in Stockholm or Sydney, in one of the availability zones of that region, but is that a shield?