What a CLOUD Act subpoena actually looks like in practice

The mechanism: 18 USC §2713

The CLOUD Act, signed in March 2018, added section 2713 to title 18 of the United States Code. The text is short and consequential:

"A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."

Three operative phrases matter:

• "Possession, custody, or control" — the provider's physical control over the data is sufficient; ownership of the underlying account is not required.
• "Regardless of whether…located within or outside of the United States" — the extraterritorial reach is explicit.
• "Provider" — defined broadly to include any "electronic communication service or remote computing service." Cloud storage, SaaS, IaaS, PaaS — all in scope.

Who can be served

Any US-incorporated provider. Any US subsidiary of a foreign provider, where the subsidiary has operational control over the data. Any non-US provider that maintains a sufficient US presence (the "purposeful availment" test from civil-procedure case law).

In practice, this includes every major cloud platform. AWS, Azure, GCP, Cloudflare, Akamai, Backblaze, Dropbox, OneDrive, GitHub — all are reachable. The presence of a regional data centre in another country does not change the analysis.

What the document looks like

A CLOUD Act request typically arrives as one of three instruments:

• A subpoena issued under the Stored Communications Act for non-content records (subscriber information, transaction logs)
• A search warrant under Rule 41, supported by probable cause, for content data (the files themselves)
• A National Security Letter (NSL) under 18 USC §2709 for limited categories, with a built-in non-disclosure provision

The non-disclosure provisions are often what unnerves customers most. An NSL recipient is typically prohibited, under criminal penalty, from informing the customer that the request has been served. Customers may never know.

What providers can challenge

Providers can move to quash on:

• Compliance burden (rarely successful)
• Conflict with foreign law (the "international comity" analysis)
• Constitutional grounds (First and Fourth Amendment, occasionally successful)

The international-comity analysis was thought to be the major brake on CLOUD Act reach: if compliance with the US order would force the provider to violate, say, GDPR, the court should weigh that conflict. In practice, US courts have given providers limited relief on this ground. The 2020 In re Search Warrant decisions in the Second Circuit set a fairly high bar.

Why customer-managed keys don't defeat this

The intuitive answer — "we hold our own keys" — runs into the realities of cloud KMS architecture. If your key sits in AWS KMS or Azure Key Vault, the provider's compute plane has operational access to it during normal workload reads. A court can compel the provider's compute plane to perform the unwrap. The key never literally leaves the customer in legal terms; but the unwrapped value does materialise within the provider's reach at read time.

The only key topology that defeats this is one where the unwrap operation cannot, by construction, be performed within the provider's environment.

Why SkyeConnex's architecture defeats this

SkyeConnex's User Master Key is derived on the client device from the user's password (via scrypt) or recovery key, and never reaches the server in unwrapped form. There is no API path on the server that returns plaintext. A US court order to SkyeConnex Inc. can compel access logs, metadata, and ciphertext shards — but the platform genuinely does not possess the capability to decrypt.

To compel decryption, the requesting authority would need to compel five different storage providers, located in as many jurisdictions as the customer configured, to surrender their shard sets simultaneously — and then would still face the AES-256-GCM + ML-KEM-1024 hybrid wrap.

Make compelled disclosure mathematically incomplete

Book a briefing and we will walk you through how SkyeConnex defeats this specific attack class, live, with a real signed audit log demonstrating non-repudiation. 45 minutes.

---

Published May 30, 2026 · Written by SkyeConnex Inc. · More from the SkyeConnex blog