3 ms·
You're misreading it, but the reality goes further than you're imagining. Section 702 allows data collection for non-US persons, regardless of what they're comm
by AlanYx 3y ago
You're misreading it, but the reality goes further than you're imagining. Section 702 allows data collection for non-US persons, regardless of what they're communicating about. Sometimes those collections also vacuum up names of US persons; basically incidental collections. There's apparently a process called "targeting and minimization" to strike the names of US persons gathered in this manner, unless a warrant is obtained.
What may really blow your mind is that s.702 also authorizes collection of foreign data held by subsidiaries of US companies. Foreigners making decisions about data residency need to understand this, but many don't. It is not sufficient to avoid s.702 to just store data in a foreign datacentre, if that datacentre is owned by a subsidiary of a US company.
- redavni 3y ago> What may really blow your mind is that s.702 also authorizes collection of foreign data held by subsidiaries of US companies. The only thing that strikes me as possibly uncommon about this is that the US publicly encodes it as law. How is this mind blowing? There is no place on earth where the sitting government does not have access to the things on it's territory.
- AlanYx 3y agoThe effect I'm referring to is extraterritorial. It's sometimes a surprise to foreigners because there can be a mistaken belief that specifying a particular non-US datacentre for cloud services places the data stored therein under the domestic (local, non-US) legal system and outside of US jurisdiction with respect to s.702 monitoring. Section 702 requests are still used, even for countries like the UK and Australia who have signed their own executive agreements under the US CLOUD Act. (The new Trans-Atlantic Data Privacy Framework and its Data Protection Review Court is a different ball of wax.)