Google calls allegations of ‘secret code’ in international cloud services deal ‘absurd’

In 2021, Google and Amazon entered into a $1.2 billion agreement with Israel to provide the country’s government agencies and military with cloud computing services. New reporting released today asserts that the deal, known as Project Nimbus, came with some eyebrow-raising stipulations, including the companies’ agreement to send coded messages and language that circumvents Google’s and Amazon’s normal terms of service.

Cloud storage providers sometimes hand over customer data to investigating bodies, but are often restricted from letting those customers know as much. The Guardian reports that in order to secure the 10-figure deal with Israel, Amazon and Google both had to agree to what the publication calls a winking mechanism, a roundabout way of communicating that kind of information without actually saying anything, thereby potentially sidestepping restrictions.

Citing leaked documents from Israel’s finance ministry reviewed in a joint investigation with Hebrew-language publication Local Call and Israeli-Palestinian outlet +972 Magazine, The Guardian says that under the Project Nimbus agreement, Google and Amazon are to make specific payments to the Israeli government to communicate when Israel’s data has been handed over to an investigating body, and in what country.

These payments reportedly serve as coded messages built around telephone country codes. If authorities in the United States access Israel’s data stored by Amazon or Google, that company is to send the Israeli government a payment of 1,000 shekels, corresponding to the US’s +1 country code. If the data request came from, say, Denmark, whose code is +45, the payment would be for 4,500 shekels. If legal orders more explicitly bar Google or Amazon from hinting at the data request’s origin, the report says, the company is to make a payment of 100,000 shekels.

The report goes on to say that in an effort to preempt pressure on Google or Amazon to pull out of Project Nimbus should their technology be linked to Israel’s human rights violations, the agreement prevents the companies from withholding service, even in the event the Israeli government is found to violate either company’s terms.

Last month, following another investigative report from The Guardian, Microsoft terminated a cloud services agreement with the Israeli military after confirming that it had violated the company’s terms by storing civilian surveillance data, including recordings of Palestinian phone calls, in the Azure cloud platform. Quoting an unnamed Israeli official, today’s report says that under Nimbus, there are “no restrictions” on the type of information Israel may store within Google and Amazon’s systems. Either company pulling out of the deal for similar reasons would reportedly be subject to financial and legal penalties.

Google and Amazon have both denied wrongdoing. A Google spokesperson gave Android Authority the following statement:

“The accusations in this reporting are false, and imply that we somehow were involved in illegal activity, which is absurd. As is common in public sector agreements, an RFP does not reflect a final contract. The idea that we would evade our legal obligations to the U.S. government as a U.S. company, or in any other country, is categorically wrong.

“We’ve been very clear about the Nimbus contract, what it’s directed to, and the Terms of Service and Acceptable Use Policy that govern it. Nothing has changed. This appears to be yet another attempt to falsely imply otherwise.”

And an Amazon Web Services spokesperson told Android Authority:

“We have a rigorous global process for responding to lawful and binding orders for requests related to customer data. AWS carefully reviews each request to assess any non-disclosure obligations, and we maintain confidentiality in accordance with applicable laws and regulations. While AWS does not disclose customer information in response to government demands unless we’re absolutely required to do so, we recognize the legitimate needs of law enforcement agencies to investigate serious crimes. We do not have any processes in place to circumvent our confidentiality obligations on lawfully binding orders.”

As of publication, the Israeli Ministry of Finance hasn’t responded to a request for comment.