18 U.S.C. § 2523 — Executive agreements on access to data by foreign governments

(a) Definitions: (1) "lawfully admitted for permanent residence" has the same meaning as under the Immigration and Nationality Act. (2) "United States person" means a U.S. citizen or national, a lawful permanent resident, an unincorporated group with a substantial number of members who are U.S. citizens or permanent residents, or a company incorporated in the United States. (b) Requirements for an executive agreement. An executive agreement letting a foreign government access data covered by this chapter (or chapter 121 or 206) meets this section's requirements if the Attorney General, with the Secretary of State's agreement, determines this and certifies it to Congress in writing — explaining each of the following in the certification — that: (1) the foreign government's own domestic law, as actually applied, gives strong substantive and procedural privacy and civil-liberties protections given the data collection the agreement will cover, where (A) this determination must consider credible information and expert input, and (B) the factors considered include whether the foreign government (i) has adequate cybercrime and electronic-evidence laws, shown either by being a party to the Budapest Convention on Cybercrime or by having domestic laws consistent with that Convention's key chapters; (ii) shows respect for the rule of law and nondiscrimination; (iii) follows applicable international human-rights obligations or shows respect for universal human rights, including protection from arbitrary interference with privacy, fair-trial rights, freedom of expression, association, and assembly, protection from arbitrary arrest and detention, and prohibitions on torture or cruel, inhuman, or degrading treatment; (iv) has clear legal mandates and procedures for which of its agencies can seek data under the agreement, including how they collect, keep, use, and share it, and effective oversight of those activities; (v) has adequate mechanisms for accountability and appropriate transparency about its data collection and use; and (vi) shows commitment to protecting the free flow of information and the open, interconnected nature of the internet; (2) the foreign government has adopted procedures to minimize how much information about United States persons it acquires, keeps, and shares; (3) the agreement's terms cannot require providers to be able to decrypt data, nor bar providers from decrypting data; and (4) the agreement requires that, for any order covered by it: (A) the foreign government may not intentionally target a United States person or a person located in the United States, and must adopt targeting procedures designed to prevent that; (B) it may not target a non-U.S. person located outside the U.S. if the real purpose is to get information about a U.S. person or someone in the U.S.; (C) it may not issue an order at the U.S. government's request, or to obtain information to hand to the U.S. government or a third country, and it is not required to share what it collects with the U.S. or a third country; (D) any order it issues must (i) aim at preventing, detecting, investigating, or prosecuting serious crime, including terrorism; (ii) identify a specific person, account, address, device, or other specific identifier as its target; (iii) comply with that country's own domestic law, which is the sole legal source of a provider's obligation to produce data; (iv) be based on a reasonable justification grounded in specific, credible facts, and meet standards of particularity, legality, and seriousness regarding the conduct being investigated; (v) be subject to review or oversight by a court, judge, magistrate, or other independent authority, before or during enforcement; and (vi) for wiretap-type orders (and extensions of them), be for a fixed, limited period, last no longer than reasonably necessary, and be issued only if the same information could not reasonably be obtained a less intrusive way; (E) an order may not be used to infringe freedom of speech; (F) the foreign government must promptly review collected material and store any unreviewed communications on a secure system, accessible only to trained personnel; (G) the foreign government must, using procedures that, as much as possible, match the minimization procedures defined in section 101 of the Foreign Intelligence Surveillance Act of 1978, segregate, seal, or delete, and not share, material that is not relevant (or necessary to understand what is relevant) to preventing, detecting, investigating, or prosecuting serious crime or terrorism, or to protecting against a threat of death or serious bodily harm; (H) the foreign government may not share the content of a United States person's communication with U.S. authorities unless the sharing is allowed under (G) and involves significant harm, or the threat of it, to the U.S. or U.S. persons — including national-security crimes like terrorism, serious violent crime, child exploitation, transnational organized crime, or major financial fraud; (I) the foreign government must give reciprocal data-access rights, including, where relevant, removing restrictions that would otherwise stop communications providers — even ones subject to U.S. jurisdiction — from responding to that country's valid legal requests; (J) the foreign government must agree to let the United States periodically review its compliance with the agreement; and (K) the United States government keeps the right to say the agreement cannot be used for a specific order. (c) A court or agency cannot review the Attorney General's determination or certification under (b). (d) When a certification takes effect: (1) Within 7 days after certifying an agreement, the Attorney General must notify Congress — specifically the Senate and House Judiciary Committees and the Senate Foreign Relations and House Foreign Affairs Committees — and give them a copy of the determination and the agreement. (2) The agreement cannot take effect until at least 180 days after that notice, unless Congress enacts a joint resolution of disapproval as (4) describes. (3) If the chair or ranking member of one of those committees asks, the relevant agency head must promptly provide a summary of the factors behind the determination that the foreign government qualifies. (4) Congressional review: (A) A qualifying "joint resolution" must be introduced during the 180-day window, have no preamble, and use exactly the required title and text disapproving the named agreement. (B) If such a resolution is enacted into law within the 180-day window, the agreement cannot take effect. (C) It may be introduced in the House by the majority or minority leader, and in the Senate by the majority leader (or their designee) or the minority leader (or their designee). (5) In the House, if a committee that received the resolution has not reported it within 120 days of referral, the committee is automatically discharged from further consideration. (6) In the Senate: (A) the resolution is jointly referred to the Judiciary Committee and the Foreign Relations Committee; (B) if a committee has not reported it within 120 days, that committee is discharged and the resolution is placed on the calendar; (C) once both committees have reported it, or been discharged, a motion to take it up is always in order and points of order against it are waived, and the motion cannot be debated, postponed, or reconsidered; (D) Senate debate on the resolution and related motions is capped at 10 hours, split evenly between supporters and opponents, and a motion to further limit debate is in order and not debatable, while amendments, postponement, or recommittal motions are not allowed; (E) debate on a presidential veto message about the resolution is capped at 10 hours, split between the majority and minority leaders or their designees. (7) Special procedural rules: (A) In the House, a Senate-passed resolution (unless the House already passed its own on the same subject) is referred to committee, discharged automatically if not reported within 7 days, and then follows a fast-track process with limited debate, waived points of order, and no reconsideration of the final vote. (B) In the Senate, if it receives an identical House resolution before passing its own, the Senate's normal procedure applies but the vote on passage is taken on the House version; if it receives an identical House resolution after passing its own, that House resolution is placed on the calendar; and if a House resolution arrives with no Senate companion introduced, these same Senate procedures apply to it. (C) These fast-track procedures do not apply in the House to a resolution that counts as a revenue measure. (8) This subsection is adopted under each chamber's own constitutional rulemaking power, is treated as part of each chamber's rules, supersedes other rules only where inconsistent with them, and either chamber may change these rules for itself at any time, the same way it could change any other of its rules. (e) Renewing the determination: (1) The Attorney General, with the Secretary of State, must review the determination and may renew it every 5 years. (2) On renewal, the Attorney General must file a report with the same Judiciary, Foreign Relations, and Foreign Affairs committees, describing (A) why it is being renewed; (B) any substantive changes to the agreement, or to the foreign government's relevant laws or procedures, since the original determination (or, for later renewals, since the last renewal); and (C) how the agreement has actually been carried out and what problems or controversies, if any, have come up. (3) If a determination is not renewed, the agreement no longer counts as satisfying this section's requirements. (f) A revision to an agreement is treated as a brand-new agreement, subject to the same certification requirement and the same procedures under (d), except that for a revision, (1) the time periods under (d)(2), (d)(4)(A)(i), (d)(4)(B), and (d)(4)(C) shrink to 90 days after notice is given, and (2) the time periods under (d)(5) and (d)(6)(B) shrink to 60 days after notice is given. (g) Any determination or certification under (b) — including a termination or renewal of an agreement — must be published in the Federal Register as soon as reasonably practical. (h) A United States authority that receives the content of a communication under (b)(4)(H) from a foreign government must use procedures that, as much as possible, match the minimization procedures defined in section 101 of the Foreign Intelligence Surveillance Act of 1978, to properly protect non-publicly-available information about United States persons.

The record indicates that this section was added to Title 18 by Public Law 115-141, division V, section 105(a), enacted March 23, 2018, and published at 132 Stat. 1217. The source credit reflects no subsequent amendments, suggesting the provision has remained in its originally enacted form. Public Law 115-141 is the consolidated appropriations legislation for fiscal year 2018, and division V of that act is commonly identified as the Clarifying Lawful Overseas Use of Data Act, generally known as the CLOUD Act. The CLOUD Act is generally understood to have addressed a recognized problem in cross-border criminal investigations: law enforcement agencies, both in the United States and abroad, increasingly needed access to electronic communications data held by service providers across national borders, and existing mechanisms such as mutual legal assistance treaties were widely viewed as slow and poorly suited to modern data storage practices. The commonly cited purpose of the Act was to create a framework, including bilateral executive agreements with qualifying foreign governments, under which foreign authorities could seek data directly from U.S.-based providers, and vice versa, subject to substantive human-rights and privacy safeguards and congressional oversight. Beyond this general legislative purpose, the record does not establish the specific considerations that led Congress to draft the particular certification criteria, minimization requirements, or congressional-disapproval procedures set out in this section. Readers seeking that level of detail should consult the underlying legislative history directly.