HN Reader

> Several experts described the mechanism as a “clever” workaround that could comply with the letter of the law but not its spirit. “It’s kind of brilliant, but it’s risky,” said a former senior US security official.

If it wasn't Amazon, Google and Israel government, there wouldn't be people pretending it comply with the 'letter of the law'. It is simple treason, selling your own country secret to another.

And the way it's done isn't that 'brilliant'. Oh yes they aren't writing on paper that x country asked for Israel data, they are instead using the country phone index and making payment based on that...

Initially, I suspected the cloud contracts were for general government operations, to have geo-distributed backups and continuity, in event of regional disaster (natural or human-made).

But could it instead/also be for international spy operations, like surveillance, propaganda, and cyber attacks? A major cloud provider has fast access at scale in multiple regions, is less likely to be blocked than certain countries, and can hide which customer the traffic is for.

If it were for international operations, two questions:

1. How complicit would the cloud providers be?

2. For US-based providers, how likely that US spy agencies would be consulted before signing the contracts, and consciously allow it to proceed (i.e., let US cloud providers facilitate the foreign spy activity), so that US can monitor the activity?

Is managing servers really such a lost art that even governments with sensitive data must cede to AWS/Azure/GCP?

Now that the trick is out the gag order will say explicitly not to make the payment. Or specifically to make a “false flag” payment, tell them it’s the Italians.

>Microsoft, which provides a range of cloud services to Israel’s military and public sector, bid for the Nimbus contract but was beaten by its rivals. According to sources familiar with negotiations, Microsoft’s bid suffered as it refused to accept some of Israel’s demands.

So Microsoft is now more ethical than Google and Amazon? What times we live in!

> suggest the secret code would take the form of payments – referred to as “special compensation” – made by the companies to the Israeli government.

This seems like a very dumb way to communicate in a criminal conspiracy: it's more traceable than a simple message, with permanent record, and more people are involved to enact the communication.

Is there any benefit?

He is Mr Nimbus, he controls the police!

Amazon already publishes transparency reports indicating which country requested data[1]. It's not clear in the article what kinds of data requests are communicated by the alleged payments (subpoena, warrant, court order?), but the whole thing seems so unbelievable as to be.... made up

[1] https://d1.awsstatic.com/Security/pdfs/Amazon_AWS_Informatio...

The method is buried about 60% through the article, but it's interesting. It seems incredibly risky for the cloud companies to do this. Was it agreed by some salespeople without the knowledge of legal / management?

Leaked documents from Israel’s finance ministry, which include a finalised version of the Nimbus agreement, suggest the secret code would take the form of payments – referred to as “special compensation” – made by the companies to the Israeli government.

According to the documents, the payments must be made “within 24 hours of the information being transferred” and correspond to the telephone dialing code of the foreign country, amounting to sums between 1,000 and 9,999 shekels.

If either Google or Amazon provides information to authorities in the US, where the dialing code is +1, and they are prevented from disclosing their cooperation, they must send the Israeli government 1,000 shekels.

If, for example, the companies receive a request for Israeli data from authorities in Italy, where the dialing code is +39, they must send 3,900 shekels.

If the companies conclude the terms of a gag order prevent them from even signaling which country has received the data, there is a backstop: the companies must pay 100,000 shekels ($30,000) to the Israeli government.

>Under the terms of the deal, the mechanism works like this:

> If either Google or Amazon provides information to authorities in the US, where the dialing code is +1, and they are prevented from disclosing their cooperation, they must send the Israeli government 1,000 shekels.

This sounds like warrant canaries but worse. At least with warrant canaries you argue that you can't compel speech, but in this case it's pretty clear to any judge that such payments constitute disclosure or violation of gag order, because you're taking a specific action that results in the target knowing the request was made.

So if a government agency or court (presumably the US government) makes a data request with a non disclosure order (FBI NSL, FISA, SCA) - Google and Amazon would break that non disclosure order and tell Israel.

Wouldn't those involved be liable to years in prison?

I wonder if Google's plan here is to just not actually make the "special payments" if a gag order applies. Possibly they think that the contract doesn't actually require those payments (most contracts have a provision about not contradicting the law), or just ignore the contract provision when a gag order comes (how would Israel know, and what would they do about it anyway).

I don’t think this contract would be enforceable. Google/Amazon had no incentive to say no, other than self-respect. Also, how would Israel even know if Google/Amazon failed to “wink”? If they have a way of knowing that, then they don’t need the “wink.”

Google/Amazon could just say yes until the contract is signed, and then just not comply. Israeli government would have no recourse since they can’t go to a US court, and file charges for a US company NOT breaking the law or for complying with a court order. Israel also would not want this to come to light.

It’s like a criminal’s promise. The only recourse is taking your business elsewhere, which Israel would do when they’re tipped off anyways. But at least if Google/Amazon fail to wink, contract lasts a little longer.

Surprised that Israel didn't just decide to go it alone and build their own infra given the multiple reservations they clearly had. They have a vibrant tech ecosystem so could presumably pull it off

> The idea that we would evade our legal obligations to the US government as a US company, or in any other country, is categorically wrong

Not a lawyer. Can this statement hold in a US court of law? To me it sounds sleazy and ambiguous. To say if an “idea is wrong” could mean it’s a bad idea, an immoral one or a false “idea”. But in any case, an idea is not a statement or a fact. I have a hundred ideas everyday. Some are right, some are wrong and others in between.

History repeating itself: https://en.wikipedia.org/wiki/IBM_and_the_Holocaust

Israel and the USA already coordinate, so I doubt this story. Other countries should stop selling data of their citizens to these two countries.

> Was it agreed by some salespeople without the knowledge of legal / management?

LOL. No. That is not how it works. Legal combs through every contract, negotiates, and gates the process, while revenue officers act very self-entitled to having the contract signed ASAP. Legal has to do their job, or they're a liability.

That's wild. Sounds like a sketchy legal loophole for big tech.

All aspect of this disgust me and I don’t know what to do about it

We know already that Google and Amazon are morally bankrupt. (My brain is spinning that Microsoft are the "good guys" here).

But I do not think we knew that Google and Amazon would engage in criminal conspiracy for profit

One thing I don't understand. Israel probably have huge amount of data in Google and Amazon. What is the gain from telling Israel that there is a country that issue an order about some of their data. What data? What's the order about? Etc, many crucial details are missing for Israel be able to do something....

If the US government asked Google and amazon for data using specific legal authorities and the companies tipped off the Israeli government, there's a chance they may have broken the law....

If you or I did this, we'd go to jail for a very long time.

Israel just can't get any more shittier.

I don't trust any of these cloud providers with my data specifically because of their ties to Israel and the Trump administration. They will always acquiesce to the bully in the room. I've received too many notices from both Amazon and Google about how my data was leaked already. Their motto, "Don't be evil", should have included a wink wink in it.

"The idea that we would evade our legal obligations to the US government as a US company, or in any other country, is categorically wrong,"

I can imagine that this Alphabet General Counsel-approved language could be challenged in court.

This is basically just the warrant canaries from the FISA prism days. Which at the time hacker news was in favor of. Both companies deny doing this though

Nothing to say any money has actually been sent.

> According to sources familiar with negotiations, Microsoft’s bid suffered as it refused to accept some of Israel’s demands.

MS/Azure being the good guys for once? Colour me surprised.

The WWW = Western Wall Wink.

This is almost certainly just for show (as in, they would have no reliance on it and not expect it to ever be triggered).

They will have agents both known and unknown operating at those companies. A company cannot as a policy set out to violate the law (if it's smart). It would be trivial for individuals to have covert channels set up.

If we take "Israel" out of the equation to remove much of controversy, i dont understand why wouldnt any actor, especially government actor, take every possible step that their data remains under their sole control.

In other words, im curious why would Israel not invest in making sure that the their were storing in third-party vendor clouds was not encrypted at rest and in transit by keys not stored in that cloud.

This seems like a matter of national security for any government, not to have their data accessible by other parties at the whims of different jurisdiction where that cloud vendor operates.

So many unanswered questions. Why would Israel move sensitive data into Amazon and Google servers off this was a concern? How would this scheme protect Israel's data or help them at all? Why would these very wealthy companies agree to this? Why would Israel assume or verify they would comply? Why and how would an obscure Palestinian magazine acquire these documents?

Why is this characterized as a "demand"? Amazon and Google have the freedom that Microsoft does to decline.

This story stinks.

Imagine if someone asked for the data for money laundering investigations. The cloud provider could get prosecuted for "tipping off".

> Microsoft said that using Azure in this way violated its terms of service and it was “not in the business of facilitating the mass surveillance of civilians”. Under the terms of the Nimbus deal, Google and Amazon are prohibited from taking such action as it would “discriminate” against the Israeli government. Doing so would incur financial penalties for the companies, as well as legal action for breach of contract.

Insane. Obeying the law or ToS, apparently, is discriminatory when it comes to Israel.

Greatest democracy in the middle east everyone!

Microsoft of all companies were the ones who had backbone here? What the heck

Here's the corresponding article in +972.

https://www.972mag.com/project-nimbus-contract-google-amazon...

This is a good opportunity to make money from helping corporations migrate off these services and onto alternatives with better data protection regulations and weaker ties to the zionist atrocity factory.

[flagged]

Are google and amazon liable for conspiracy to commit a federal crime ?

I'm not gonna say anything because if I say something I'm gonna be in trouble.

Setting aside the legalities of the "wink" payments, I'm fascinated to know what is the purpose of the country-specific granularity? At most Israel would learn that some order was being sought in country X, but they wouldn't receive knowledge of the particular class of data being targeted.

I wonder if there's a national security aspect here, in that knowing the country would prompt some form of country-specific espionage (signals intelligence, local agents on the inside at these service providers, etc.) to discover what the targeted data might be.