US senators have demanded the release of a secret court ruling on a surveillance law that lets American authorities obtain foreign companies’ and citizens’ data without telling them – one of two key laws that can undermine data sovereignty for overseas citizens and organisations.
Section 702 of the Foreign Intelligence Surveillance Act (FISA 702) lapsed in June 2026, but data gathering can continue to March 2027 because of a 17 March court opinion that the senators said contains “serious abuses of Americans’ rights” – and which the Trump administration has still not declassified more than a month past its legal deadline.
Senators Ron Wyden of Oregon and Adam Schiff of California wrote to director of national intelligence Jay Clayton and attorney general Todd Blanche on 26 October. They demanded release of the Foreign Intelligence Surveillance Court opinion and the names of officials who had withheld it, with a written response due by 6 November.
FISA 702 expired after the House of Representatives rejected a reauthorisation bill in June, with 19 Republicans joining Democrats to vote it down. Surveillance and data gathering continue because the same March opinion that found the abuses also permitted another year of activity.
The consequences reach further than Washington. Section 702 lets the US government compel a cloud provider to provide “technical assistance” to run a search with no protection for foreign citizens who are targeted by the act. That assistance could potentially arrive as compiled code in a software update that exfiltrates data, unreadable to the engineers who push it.
The second law is the US Cloud Act, passed in 2018 after Microsoft refused to hand over customer data held in an Irish datacentre. It compels US companies to provide data in their “possession, custody, or control” even where it sits overseas, and lets US courts attach a non-disclosure order that stops the provider from telling the data subject their data has been shared.
Together the two laws open several routes into overseas data:
- Follow-the-sun support terms route data and metadata to global hubs, and the metadata alone can be enough for a Section 702 investigation.
- US-authored software updates can carry “technical assistance” as compiled code that UK staff cannot inspect.
- Data must be decrypted to be processed, so it can be scraped from memory mid-compute.
- Even confidential computing breaks: side-channel attacks can listen to the CPU and measure power draw or timing fluctuations to guess the data being processed.
That reach is why data sovereignty matters for UK organisations. As US companies, the hyperscalers are potentially subject to US court orders that can compel them to exfiltrate overseas citizens’ data.
The UK public sector is extremely exposed. In the 2023/2024 financial year, 95% of central and local public sector organisations spent budget on hyperscale cloud services, across more than 1,100 public sector bodies. The European Court of Justice has twice struck down data sharing agreements between the EU and the US – Schrems I and Schrems II – because Section 702 offers no equivalent protection to EU citizens.
The senators are not alone. A coalition of more than 20 civil liberties and accountability groups, led by Demand Progress and signed by the Center for Democracy & Technology, the American Civil Liberties Union and the Electronic Frontier Foundation, told congressional leaders the opinion must be public before any reauthorisation debate.
The dispute turns on a statutory transparency rule. Under US law, the director of national intelligence and the attorney general must complete a declassification review of significant FISA court opinions within 180 days. Senate intelligence committee chair Tom Cotton and vice-chair Mark Warner pressed for the opinion’s release in the spring, and Blanche said in July he would declassify it. The 13 September deadline passed in silence.
The senators wrote: “If this administration won’t follow this simple statutory directive, it is unclear why Congress or the American people should trust this administration to follow any of the other legal limits to Section 702.”
