WASHINGTON, D.C. – U.S. Senator Alex Padilla (D-Calif.) and Representative Zoe Lofgren (D-Calif.-18) have formally requested the Department of Justice (DOJ) to investigate a recently reported notice from the United Kingdom. This notice could grant the British government access to protected Apple iCloud user data,raising meaningful concerns about international data privacy. The lawmakers’ request, made public today, centers on fears that this access could severely limit Apple’s ability to offer encrypted iCloud backups globally, impacting millions of users worldwide. The core issue revolves around potential violations of the U.S.-U.K. Agreement on Access to electronic Data to Countering Serious Crime.

This agreement is tied to the Clarifying Lawful Overseas Use of Data (CLOUD) Act. Padilla and Lofgren are urging the DOJ to reevaluate the United Kingdom’s eligibility for an agreement under the CLOUD Act. This act allows select foreign governments to directly seek data from U.S. technology companies for criminal investigations and prosecutions, bypassing individualized review by the U.S. government. The request from the lawmakers underscores growing concerns about the balance between national security interests and individual privacy rights in the digital age.

Concerns Over Encryption and Global Impact

The U.K.’s notice reportedly demands that Apple weaken the encryption of its entire global iCloud backup service. This would provide the U.K. government with a “blanket capability” to access customer data in plaintext. This has raised alarms about potential overreach and the implications for user privacy worldwide. The implications of such a demand extend far beyond the borders of the United Kingdom, potentially affecting users globally and setting a precedent for other nations to seek similar access.

reports suggest the U.K. believes its notice extends beyond domestic companies,applying across borders with global effect. This could create conflicts with the laws and public policies of other jurisdictions,infringe upon the rights of individuals globally,and considerably impede the United States’ ability to ensure that American companies adhere to responsible cybersecurity practices. Last week, Apple announced it could no longer offer encrypted cloud backup in the U.K. to new users, and that current U.K. users would eventually need to disable this security feature, highlighting the immediate impact of the situation.

The lawmakers articulated their concerns in a formal statement:

If thes press reports are true, they necessitate the Department of Justice’s review of its approval of the U.K. as a qualifying nation under the CLOUD Act, and whether the notice may violate or otherwise be inconsistent with U.S. law and public policy, and also with the Agreement.

The Importance of Encryption and National Security

Padilla and Lofgren emphasized the critical role of encryption in safeguarding national security and economic stability. they argued that weakening encryption for all users globally is a reckless action that undermines U.S. law, public policy, and data security. The debate over encryption highlights the ongoing tension between law enforcement’s desire for access to data and the need to protect sensitive information from malicious actors.

The lawmakers further stated:

Encryption is also acknowledged by all to be a critical means to secure information systems essential to the national security and economy of our country.

They added:

… It is indeed tough to see the U.K.’s notice to Apple, if the reports are accurate, as anything less than an action that undermines U.S. law, public policy, and information security by requiring U.S. companies to take such reckless action as undermining encryption for all users globally.

Call for DOJ Review and Congressional Oversight

Given the U.K.’s reported conduct and Congress’s oversight role, Padilla and Lofgren are urging the DOJ to conduct a thorough review of the U.K.’s compliance with the statutory requirements of the CLOUD Act and the terms of the Agreement. This review should consider the factual basis of the CLOUD Act, the sovereign interests of the U.S. in regulating the conduct of U.S. companies, and cybersecurity public policy imperatives. The call for a review underscores the importance of maintaining a balance between international cooperation and the protection of U.S. interests.

The lawmakers emphasized the importance of this review:

Thus, given the U.K.’s reported conduct, and Congress’s vital oversight role in these matters, we respectfully request that the DOJ conduct a review of the U.K.’s compliance with the statutory requirements of the CLOUD act and the terms of the Agreement, taking into account the factual predicates behind the CLOUD Act, the sovereign interests of the U.S.in regulating the conduct of U.S. companies, and cybersecurity public policy imperatives.

They added that the review is essential to ensure that agreements under the CLOUD Act uphold the privacy, security, and human rights standards set by Congress and will inform Congress as to whether statutory reforms are necessary to protect these strong U.S. interests.

Background on the CLOUD Act

Enacted in 2018, the CLOUD Act represented a significant update to U.S. law governing cross-border access to electronic communications held by private companies. It removes legal restrictions on certain foreign nations’ ability to seek data directly from U.S. providers in cases involving “serious crimes,” provided that the data requests do not target U.S. persons and that the Executive branch has resolute that the foreign nation’s laws adequately protect privacy and civil liberties.the CLOUD Act also empowers Congress to prevent a proposed executive agreement from entering into force through expedited congressional review.

The United Kingdom was the first country to receive a CLOUD Act agreement in 2019, which went into effect in 2022. These agreements are authorized for five years and the U.K. agreement was renewed in November 2024.

Cybersecurity Concerns and Encrypted Communications

U.S. cybersecurity officials have consistently urged Americans to use encrypted services to protect their communications, notably considering recent cybersecurity compromises, such as china’s salt Typhoon operation targeting AT&T and Verizon’s systems. The emphasis on encryption highlights the ongoing need to protect sensitive data from malicious actors and nation-state adversaries.

Questions for attorney General

Padilla and Lofgren have requested that Attorney General Pam Bondi respond to additional questions regarding the U.K.’s notice by March 5, 2025. These questions seek to clarify the DOJ’s awareness of the U.K.’s actions,its views on the consistency of the U.K.’s domestic surveillance law with the CLOUD Act, and its assessment of the extraterritorial regulations imposed by the U.K. on U.S. providers. The questions posed to the Attorney General underscore the importance of transparency and accountability in international data sharing agreements.