Secret code Israel's Amazon and Google deal included means to sidestep law

When Google and Amazon negotiated a major $1.2bn (£0.91bn) cloud computing deal in 2021, their customer - the Israeli government - had an unusual demand: agree to use a secret code as part of an arrangement that would become known as the "winking mechanism".

- Harry Davies Yuval Abraham Jerusalem

The demand, which would require Google and Amazon in effect to sidestep legal obligations in countries around the world, was born out of Israel's concerns that data it moved into the global corporations' cloud platforms could end up in the hands of foreign law enforcement authorities.

Like other big tech companies, Google and Amazon's cloud businesses routinely comply with requests from police, prosecutors and security services to hand over customer data to assist investigations.

This process is often cloaked in secrecy. The companies are frequently gagged from alerting the affected customer that their information has been turned over. This is either because the law enforcement agency has the power to demand this or a court has ordered them to stay silent.

For Israel, losing control of its data to authorities overseas was a significant concern. So to deal with the threat, officials created a secret warning system: the companies must send signals hidden in payments to the Israeli government, tipping it off when it has disclosed Israeli data to foreign courts or investigators.

To clinch the lucrative contract, Google and Amazon agreed to the so-called winking mechanism, according to leaked documents seen by the Guardian, as part of a joint investigation with the Israeli-Palestinian publication +972 Magazine and the Hebrewlanguage outlet Local Call.

Based on the documents and descriptions of the contract by Israeli officials, the investigation reveals how the companies bowed to a series of stringent and unorthodox "controls" contained within the 2021 deal, known as Project Nimbus.

Google and Amazon's cloud businesses have denied evading any legal obligations.

The strict controls include measures that prohibit the US companies from restricting how an array of Israeli government agencies, security services and military units use their cloud services.