Leaked documents from Israel’s finance ministry, which include a finalised version of the Nimbus agreement, suggest the secret code would take the form of payments – referred to as “special compensation” – made by the companies to the Israeli government.
According to the documents, the payments must be made “within 24 hours of the information being transferred” and correspond to the telephone dialing code of the foreign country, amounting to sums between 1,000 and 9,999 shekels.
If either Google or Amazon provides information to authorities in the US, where the dialing code is +1, and they are prevented from disclosing their cooperation, they must send the Israeli government 1,000 shekels.
If, for example, the companies receive a request for Israeli data from authorities in Italy, where the dialing code is +39, they must send 3,900 shekels.
If the companies conclude the terms of a gag order prevent them from even signaling which country has received the data, there is a backstop: the companies must pay 100,000 shekels ($30,000) to the Israeli government.
Never worked for either company, but there's a zero percent chance. Legal agrees to bespoke terms and conditions on contracts (or negotiates them) for contracts. How flexible they are to agreeing to exotic terms depends on the dollar value of the contract, but there is no chance that these terms (a) weren't outlined in the contract and (b) weren't heavily scrutinized by legal (and ops, doing paybacks in such a manner likely require work-arounds for their ops and finance teams).
You mean like in financing a ball room?
You could argue that it's against something like the OECD Anti‑Bribery Convention, but that would be a much more difficult case, given that this isn't a particular foreign official, but essentially a central body of the foreign government.
Just to clarify, not saying that it's ok, but just that accusing it of being a "crime" might be a category error.
It's kind of like how everything can be securities fraud[0]
bloomberg article: https://archive.is/ixwRi
> Yesterday New York State Attorney General Barbara Underwood filed a securities-fraud lawsuit against Exxon Mobil Corp. “alleging that the company misled investors regarding the risk that climate change regulations posed to its business.”
Blatant lying
> if you are a public company that suffers a massive data breach and exposes sensitive data about millions of customers without their consent, and that data is then used for nefarious purposes, and you find out about the breach, and then you wait for years to disclose it, and when you do disclose it your stock loses tens of billions of dollars of market value, then shareholders are going to sue you for not telling them earlier
Blatant lying
The fact that most of this lying (see Exxon) is done under some kind of "nudge nudge, wink wink, we all know what's really going in" doesn't stop it from knowingly lying.
That knowingly lying is securities fraud seems very logical, and nothing like "everything".
This is all moot anyway now that the US is no longer interested in upholding any laws against large companies whatsoever.
Blatant lying also?
> Yesterday New York State Attorney General Barbara Underwood filed a securities-fraud lawsuit against Exxon Mobil Corp. “alleging that the company misled investors regarding the risk that climate change regulations posed to its business.”
>Blatant lying
Can you elaborate? Looking at the case it seems pretty clear that Exxon did not lie, especially not in any "blatant" manner.
1. Alerting a country to secret actions taken by a third party government (my nation of citizenship, the US, definitely has rules against that)
2. Passing money to commit a crime. See money laundering.
Honestly, the second crime seems aggravated and stupid. Just pass random digits in an API call if you want to tell Israel you did something.
A government can compel Amazon to avoid notifying a target (Israel in this case) that their information has been subpoenaed, but can't compel Amazon to lie and say it hasn't sent their info.
Or is the concept of a canary pretty much useless now?
I'm personally one of the "activists" who is trying to avoid Amazon and Google to a practical degree, due to project Nimbus, so I'd be more than happy if their data could be accessed, and even happier to see Amazon and Google just cut ties with them altogether.
US rules are, unfortunately, nortoriously and outlandishly broken whenever it comes to Israel: Foreign Agent Registration Act, the Leahy Law, and probably a bunch of others as well.
Who exactly here is the victim that gets it legal rights deprived or what is the gain at the expense of the victim?
1. You work for AWS, probably in account management or billing operations.
2. Your "buddy" in legal tells you that a subpeona has been processed that effects an Israeli government affiliated account.
3. Your buddy is breaking work rules and the law. You don't report it, as you are required to do. You're now a party to a criminal conspiracy.
4. Instead, you arrange for a payment to be made from AWS to an account in some pre-determined amount to communicate the confidential or legally sealed information that you conspired to steal.
Let's review. You're engaging in a criminal conspiracy to share restricted, sealed legal information with a foreign government. You are doing so by fraudulently stealing/embezzling money from your employer in a predetermined amount.
If that's not clearly understandable to you as a "bad thing" and a fraudulent activity, you're overthinking, lack any sense of law and ethics, are lacking cognitive ability, are a troll, or are just a schill for whatever team you're rooting for.
In this scenario Amazon is contractually obligated to pay Israel (unless they determine that they can't legally). If this employee is dutifully fulfilling that obligation in compliance with any relevant company approval process or other policies, then it's certainly not theft or embezzlement.
You seem to be adding a twist of "what if this is some random employee, not the one authorized to make the payments"? In that case sure, they might be defrauding their employer, but that has very little to do with the contract that this story was about.
It's like saying "what if instead of making the authorized payment to Israel, they keep the cash for themselves, then steal some monitors and assault some colleagues"? We've come up with a hypothetical where crimes are committed, yes, but it's hard to see how Israel would be to blame or would even be relevant.
In many/most? cases, a customer can be notified and can attempt to block such information gathering, but there are also many where it's not permitted.
Really most crimes don’t require deception.
The victims are the people being deprived of their legal protections.
Not everyone agrees which information should be protected but sending information can be a form of harm. If I break into your bank, find all your financial transactions, and post it on Facebook, I have harmed you.
Courts imposing gag orders over criminal or civil matters is a critical protection, and attempting to violate those gag orders is harm. The specific victims aren’t known, but they intend for there to be victims.
There is wide latitude in the criminal code to charge financial crimes. This reminds me a bit of Trump's hush money conviction. IIRC, a central issue was how the payment was categorized in his books. In this case, there would be a record of this payment to Israel in the books, but the true nature of the payment would be concealed. IANAL, but I believe that is legally problematic.
[1] If they actually violated a gag order, which realistically they won't. In all likelihood there's language to ensure they're not forced to commit crimes. Even if that wasn't explicit, the illegality doctrine covers them anyway, and they can just ignore any provisions which would require them to commit crimes.
It can very well be, and it's called obstruction of justice.
Though in this case, the real crime is treason. Those companies collaborate with a foreign government against their own.
Possibly, depending on intent. But even if so, obstruction of justice is not fraud.
> the real crime is treason
This hypothetical crime (which I'd say is highly unlikely to occur) would definitely not be treason, which has a narrow legal definition. We're not at war with Israel.
Sure, but it's a crime still. Not just something neutral.
>This hypothetical crime (which I'd say is highly unlikely to occur) would definitely not be treason, which has a narrow legal definition. We're not at war with Israel.
No, just on several on behalf of them.
Which one feels should also have been part of this "narrow legal definition".
Almost all crime requires some form of lying, at least by omission and often of the explicit sort. Fraud though, is much more narrow than "they deceived but also crimed"... and anyone saying otherwise should be so embarrassed that we never have to hear their halfwittery ever again.
Other countries provide legal protections for other bits of information because disclosure of that information is considered harmful to the individual, it’s that protection they are trying to breach which thus harms the person.
Same deal as most illegal things public companies do also being SEC violations.
Here we don’t know which specific laws were broken because we lack details, but the companies definitely signed a contract agreeing to commit fraud.
Anyway, the comment I responded to had “require an intention to harm to a victim” it’s that aspect I was addressing. My point was the transmission of information itself can be harmful to someone other than the recipient of that information. So the same act fulfills both aspects of fraud (deception + criminal intent), and also breaks some other law.
I could send your username and password using similar methods, the medium doesn’t matter here but the signal and their attempt to hide it does.
The act of communicating privileged or sealed information on itself is at minimum contempt of court and perhaps theft of government property, wire fraud or other crimes. Typically accounts payable aren’t aware of evidence gathering or discovery, so the actor is also facing conspiracy or other felonies.
No laws require prosecution and enforcement. Western countries shield Israel from all of that.
its a buggy method, considering canada also uses +1, and a bunch of countries look like they use +1 but dont, like barbados +1(246) using what looks like an area code as part of the country code.
You are correct that ITU code is not specific enough to identify a country, but I'm sorry, +1 is the ITU country code for the North American Numbering Plan Area. 246 is the NANPA area code for Barbados (which only has one area code) but as a NANPA member, Barbados' country code is +1, same as the rest of the members. There is no '+1246' country code.
There's not a lot of countries that are in a shared numbering plan other than NANPA, but for example, Khazakstan and Russia share +7 (Of course, the USSR needed a single digit country code, or there would have been a country code gap), and many of the former Netherland Antilles share +599, although Aruba has +297, and Sint Maarten is in +1 (with NANPA Area code 721)
To spy on law enforcement that is trying to fight crime is not a good thing. Israel is not the world police.
People use the country = government metaphor as a shortcut for communication, but this one takes it further than usual.
This will probably never be particularly useful, but this figure of speech is a "synecdoche" (a "metonymy" instead of a "metaphor")
Saying the US did something when referring to the government is metonymy, but not synecdoche.
I think it’s valid to consider the US government a part of the US. Thus, referring to the US government when saying that the US did something is a synecdoche
This is criminal conspiracy. It's fucking insane that they not only did this, but put the crime in writing.;
The mob tried your argument generations ago. It never worked.
Uhm doesn't that mean that Google and Amazon can easily comply with US law despite this agreement?
There must be more to it though, otherwise why use this super suss signaling method?
(Australia apparently outlaws the practice, see: <https://boingboing.net/2015/03/26/australia-outlaws-warrant-...>.)
https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...
This is directly violating gag orders. Passing a message, even if it's encrypted or obfuscated is absolutely illegal. The article is a little BS as this sort of thing has been tested in court.
The only reason warrant canaries are in the gray zone is because they are specifically crafted that the business has to remove their cooperation clause to keep the ToS contract valid.
There's nothing like that at play here. It's literally "Just break the gag order, here's our secret handshake".
https://www.politico.com/story/2019/09/12/israel-white-house...
> The U.S. government concluded within the past two years that Israel was most likely behind the placement of cellphone surveillance devices that were found near the White House and other sensitive locations around Washington, according to three former senior U.S. officials with knowledge of the matter.
> If either Google or Amazon provides information to authorities in the US, where the dialing code is +1, and they are prevented from disclosing their cooperation, they must send the Israeli government 1,000 shekels.
This sounds like warrant canaries but worse. At least with warrant canaries you argue that you can't compel speech, but in this case it's pretty clear to any judge that such payments constitute disclosure or violation of gag order, because you're taking a specific action that results in the target knowing the request was made.
> This sounds like warrant canaries
A warrant canary works by removing information, not by transmitting it. You put up a sign like "The FBI has not issued a warrant" and then remove it if they do, even if there is a gag order stating you cannot disclose that they issued you a warrant. This only works because you have not told anyone that a warrant has been issued but they must infer that the missing canary implies such a warrant has been dispatched.
> but in this case it's pretty clear to any judge that such payments constitute disclosure
I think what is funniest is that it could have been much more secret. When I saw the reference in the intro to payments I was thinking "don't tell me they're so dumb they're coding info like Costco". That they'd use the cents to detail access. Like .99 for all clear and .98 for access. But that's not "clever" at all lol
You transmit information by changing the content of the transmission, basically just like any communication works
> This only works
do you know that? Haven't heard of it actually working in any high profile case.
> because you have not told anyone that a warrant has been issued
you have told them explicitly by agreeing to a scheme both parties understand and by enacting the message change under said scheme. You basically just used some encoding to hide the plain message
> You transmit information by changing the content of the transmission
First off, you're using the word in the definition. You can't use "transmit" to define "transmit". A transmission is the noun variation of transmit (verb).
Second off, a transmission is *active*
Think about radio. If I am constantly producing a 440kHz signal then I'm transmitting a signal. If I'm not producing the signal, I'm not transmitting.
You are not considered to be transmitting unless you are holding down the button to send the signal.
That's how a canary works. You're constantly transmitting a signal (the canary is constantly singing) and then all of a sudden it goes quiet. You have stopped transmission.
Does this communicate? Yes. But what it communicates is ambiguous. Maybe the canary just went to sleep. Maybe it starved to death instead of getting carbon dioxide poisoning. It does not provide an unambiguous truth.
That reasonable deniability is the reason a canary works. You can claim it was taken down for other reasons, such as an accident. Those reasons have to be believable and justifiable. Mind you, a warrant canary can work like going down in one commit and up in the next, happening over a small period of time. A canary does not need to work by continuous existence or continuous absence.
Canaries also frequently work by having expirations (which is closer to how you're thinking, but still follow the same abstraction discussed above). It has to be manually updated or modified. For example I could add the canary "godelski hasn't been raided by the FBI: signed 31 oct 2025 expires 7 Nov 2025". Were that message to still exist exactly on Nov 7th (and it will because I can't edit comments outside a time window) then you can conclude that my canary expired. You can't conclude I was raided by the FBI. You should be suspicious, but you can't be positive. Maybe I just can't update comments...
This isn't to be conflated with the way we transmit information is through variation, such as high and low in binary. Technically while you're talking you make pauses and "stop talking" several times while saying a single word. But we say you're talking until you stop "transmitting" or complete. If this pause wasn't included then the dead would still speak and your annoying uncle would never shut up
I’ve always wondered. It seems just as easy for authorities to forbid removing canaries as it is to forbid telling someone something.
EDIT: ah, this is explained downthread: https://news.ycombinator.com/item?id=45763032
I guess you can technically be compelled to update your canary. But the main idea is to make it hard to compel the action that results in the canary existing. But don't ask me, like most HN users IANAL
> Several experts described the mechanism as a “clever” workaround that could comply with the letter of the law but not its spirit.
It's not clear to me how it could comply with the letter of the law, but evidently at least some legal experts think it can? That uncertainty is probably how it made it past the legal teams in the first place.
This, being an active process, if found out, is violating a gag order by direct action.
you update your canary to say that nothing has changed, at a known cadence.
if you ever dont make the update, readers know that the canary has expired, and so you have been served a gag order warrant.
changing or removing the canary in response to a warrant is illegal. not changing it is legal.
for an equivalent cloudwatch setup, its checking the flag for "alarm when there's no points"
I suspect they didn't go for this route as it is too slow.
As I understand, this theory wouldn’t even hold up in other countries where you could be compelled to make such a false update.
It's a choice you make and action you take either way, be it not updating a canary or sending a covert financial transaction
That it has not been tested in court is why it's still a "theory" (hypothesis?)
My hope is that a jury of our peers would stay closer to the spirit than the letter of the law
No, they can simply not publish a warrant canary in the future, which will tip people off if they've been publishing it regularly in the past.
However, if a judge dodesn't want to find someone guilty, "not violating the letter of the law" can provide a fig leaf for the friendly judge.
I can't imagine any "legal expert" dumb enough to say you can violate a gag order if you use numbers instead of words.
Is there any evidence he was helped in his escape by anyone? Genuinely asking (and genuinely seeking hard facts and data).
I do think it’s kind of a different situation though because apparently the employees of Facebook could have gotten into legal trouble in those other countries they were trying to expand into.
Yeap...they would never do it ....
"Tech, crypto, tobacco, other companies fund Trump’s White House ballroom" - https://www.politico.com/news/2025/10/23/trump-ballroom-dono...
I trust The Guardian. So I agree It was unlikely. I find it very sad
Very sad
And while 'anti-terrorism' is the pretext for these secret courts, secret orders, and other nonsense - in reality I expect they've done extremely little to actually stop terrorists. Yet it's certainly created a system where even a defacto Western/allied bloc government is worried that their data is going to be secretly seized. It's quite dystopic, all done in the name of errorism.
I mean, why pay the money? Why not just skip the payment and email a contact "1,000"? Or perhaps "Interesting article about in the Times about the USA, wink wink"?
This method is deliberately communicating information in a way that (I assume) is prohibited. It doesn't seem like it would take a judge much time to come to the conclusion that the gag order prohibits communication.
Creating a secret code is still communication, whether that's converting letters A=1, B=2, sending a video of someone communicating it in sign language, a painting of the country, writing an ethereum contract, everyday sending a voicemail with a list of all the countries in the world from A to Z, but omitting the one(s) that have the gag / warrant...
Wouldn't those involved be liable to years in prison?
I find it hard to imagine a federal US order wouldn’t proscribe this cute “wink” payment. (Although who knows? If a state or locality takes it upon themselves to raid a bit barn, can their local courts bind transnational payments or is that federal jurisdiction?)
But from the way it’s structured—around a specific amount of currency corresponding to a dialing code of the requesting nation—it sure sounds like they’re thinking more broadly.
I could more easily imagine an opportunistic order—say, from a small neighboring state compelling a local contractor to tap an international cable as it crosses their territory—to accommodate the “winking” disclosure: by being either so loosely drafted or so far removed from the parent company’s jurisdiction as to make the $billions contract worth preserving this way.
In my opinion that's extremely unlikely. This was probably set up for other kinds of countries
This means that they can read even the personal email of Supreme Court justices, congressmen and senators.
However they have a gentleman’s agreement to not do that.
“Wink”
Trying to remember back to Snowden, I think I recall that not only DON'T they have such an agreement, but the intelligence folks consider this a feature. The US government is Constitutionally forbidden from reading "US persons" communications, but our Constitution has no such restriction on third parties. So if those third parties do the spying for us, and then tell our intelligence folks about it, everybody wins. Well, except for the people.
I think it's just more likely that we send them whatever they ask for when they ask for it.
It's cute, really. Country A turns a blind eye and even helps country B vacuum all of it's citizen's data. Then country B gifts back to A. And vice versa.
Since country A didn't do the surveillance, it didn't break any laws. Furthermore, it's legal to accept data from third parties.
As to why country A would allow even its senators and congressmen to be spied on by B? That's obvious - country A's intel agencies are most interested in their budget!
But this is a special case. It's Israel.
And laws are also written extremely broadly, which gives the intelligence agencies extreme leeway in interpreting them as they see fit. And even if they go beyond that, it's not like there are any consequences. For one of the most overt - James Clapper indisputably lied under oath and absolutely nothing happened. Furthermore politicians are generally ignorant on most topics, especially on anything remotely technically related. But revealing that ignorance is politically damaging, so they turn into yes men on most of these topics.
> Since country A didn't do the surveillance, it didn't break any laws.
Of course it did, that's where the data came from!
2. The power of the constitution ends at the border.
It's pretty sick, but that's what it amounts to. The CIA can't operate within US borders but it can operate at and outside borders. That means sending messages internationally are fair game for warrant-less searches.
Spy on, insert or recruit an asset from the pool of employees who are involved in any "Should we tell Israel?" discussion. That way, even if an answer is "No, don't alert them", the mere existence of the mechanism provides an actionable intelligence signal.
Either Israel already knows about the subpoena, in which case the discussion doesn't matter, or they don't, in which case their asset wouldn't be in on the discussion.
But is there an Israeli law that states contracts must be in concordance with foreign law... When the damages of an Israeli contract get evaluated in an Israeli court and they include the loss of Israeli intelligence assets will the costs not be significant? Yes google can pull out of Israel but they literally built datacentres there for these contracts so there are sizeable seizable assets.
And yes google may also get fined for breaking foreign law by foreign courts. The question is if the architecture of the system is set up so the only way data can be "secretly" exfiltrated by other governments is to go through local Israeli employees and they're the one's breaking the foreign law (and they were told explicitly by foreign bosses that they can't share this information wink) is there any punishment for google other than fines dwarfed by the contract and having to fire an employee who is strangely ok with that, who is replaced by a equally helpful local employee.
Also, I can't believe that Google or Amazon would sign a contract that doesn't specify the judicial jurisdiction. If the contract says "this contract will be governed by the courts of Santa Clara County California" and the Israelis agreed to that, then they won't have a claim in Israeli courts. If an Israeli court concluded that they have jurisdiction when both parties agreed they don't have jurisdiction, it'd create a very problematic precedent for doing business with Israeli companies.
Even if an Israeli court would ignore all that, what would Israel get? Maybe it could seize a billion in assets within Israel, but would that be worth it? For Google or Amazon, they face steeper penalties in the US and Europe for various things. For Israel, maybe they'd be able to seize an amount of assets equivalent to 10% of their annual military budget. So while it's not a small sum, it is a small sum relative to the parties' sizes. Neither would really win or lose from the amount of money in play.
But Israel would lose big time if it went that route. It would guarantee that no one would sign another cloud deal with them once the existing contracts expired. Investment in Israel would fall off a cliff as companies worried that Israeli courts would simply ignore anything they didn't like.
The point of these agreements is that Israel needs access to cloud resources. The primary objective is probably to avoid getting cut off like Microsoft did to them. That part of the contract is likely enforceable (IANAL): Israel does something against the ToS, but they can't be cut off. I'd guess that's the thing that Israel really wanted out of these deals.
The "wink" was probably a hopeful long shot that they never expected to work. But they got what they needed: Amazon and Google can't cut them off regardless of shareholder pressure or what they're doing with the cloud no matter what anyone thinks of it. Suing Amazon or Google over a part of the contract that they knew was never going to happen would jeopardize their actual objective: stable, continued access to cloud resources.
The Cloud doesn't just mean foreign data centers it means 3rd party infrastructure and expertise, which in this case at least, some of is local to the country. The point is that any 'secret' surveillance is reported. I.e. person in US gets ordered to access data, they connect to data center with appropriate credentials, which is monitored and either questioned and billed, or get flagged locally as not reportable and so not logged (making it show up on the shadow logs installed by local Israeli intelligence assets). Foreign employees best efforts to comply with espionage orders still reveal their actions and local employees happily obey local reporting laws knowing they are outside of those jurisdictions and helping their country.
Yes it can be forced to fall apart, but it has to be done in the open (because it will require changing local data center operations) and will be time consuming unless an actual open order by the US to immediately stop working with Israel on this which is extremely unlikely to happen.
For example a tennant can sign a lease that says they have no notice period before eviction. If they’re in a state with a 30 day minimum notice period then the notice period is 30 days. It doesn’t matter what the contract says.
Google would comply with the US court order and ignore the contract it signed with Israel.
That does not help
Signing the contract was a criminal conspiracy
I am not holding my breath for prosecution, though.
If it wasn't Amazon, Google and Israel government, there wouldn't be people pretending it comply with the 'letter of the law'. It is simple treason, selling your own country secret to another.
And the way it's done isn't that 'brilliant'. Oh yes they aren't writing on paper that x country asked for Israel data, they are instead using the country phone index and making payment based on that...
> The terms of the Nimbus deal would appear to prohibit Google and Amazon from the kind of unilateral action taken by Microsoft last month, when it disabled the Israeli military’s access to technology used to operate an indiscriminate surveillance system monitoring Palestinian phone calls.
I don’t understand the connection between these two things. The article seems all over the place.
It is like if it is illegal to import more then $1000 into the country without declaring, and you (clever) give $900 each to 4 of your friends who are conveniently traveling with you, so you only walk across the border with remaining $400, not breaking any laws. Then when inside the country, your friends give you back the $900 each, meaning you just de-facto imported $4000 while technically crossing the border with less then $1000, as legally required.
If normal people tried to do this they would obviously be charged with the crime of illegally importing money, but also with something like a conspiracy to evade the law.
At least for us. For the more fortunate, maybe it’s just a “creative interpretation of law.”
> Treason against the United States, shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort.
This bar is virtually impossible to clear. You'll never get a US court to convict anybody of treason for anything concerning Israel. Espionage sure, but not treason. The last time anybody got convicted of treason for anything in America was for acts committed during WW2, which is the last time America was in a properly declared war.
If for some reason the US were storing sensitive data in US-based datacenters operated by a foreign corporation, don't you think they would try to take measures to prevent that data from being exfiltrated? It would be idiotic for Israel not to take what measures it could.
As for the idea that Amazon is acting treasonously - is warning someone that your country is spying on them treasonous? I think they should warn anyone and everyone whose data is being shared with any government, as long as they stay within the letter of the law in the places they operate.
Yes it is if you are American. Snowden revealed that the American government was spying on every single American, now he is forced to live hidden in Russia.
Expecting there to be law abidance and so on when dealing with Israel or israelis is a mistake that'll make you the 'freier' in that relationship. This is why Israel and israeli corporations commonly use usian and european fronts when they do business with more discerning customers than the most obvious tyrants of the world.
But could it instead/also be for international spy operations, like surveillance, propaganda, and cyber attacks? A major cloud provider has fast access at scale in multiple regions, is less likely to be blocked than certain countries, and can hide which customer the traffic is for.
If it were for international operations, two questions:
1. How complicit would the cloud providers be?
2. For US-based providers, how likely that US spy agencies would be consulted before signing the contracts, and consciously allow it to proceed (i.e., let US cloud providers facilitate the foreign spy activity), so that US can monitor the activity?
E.g. you will find references in AWS docs to Bureau of Industry/Security rulings.
https://www.theguardian.com/world/2025/aug/06/microsoft-isra...
I don't imagine Google and Amazon are any better. I.e. take boatloads of money, while sticking the head into sand and pretend it's not likely used to help the illegal occupation of Palestinians, to persecute and harm them.
Apparently, US aid to a country is usually spent on US companies; Israel is no exception: https://theintercept.com/2024/05/01/google-amazon-nimbus-isr...
That’s not “cloud > onprem always”, that’s “even given cloud providers’ many faults governments are so terrible at managing and securing infrastructure today that the cloud is preferable for them”. Whether you anre pro- or anti-particular-government, you should still support gov-moves-to-cloud. The alternative is proven unbelievably worse on every possible axis.
Google/Amazon could just say yes until the contract is signed, and then just not comply. Israeli government would have no recourse since they can’t go to a US court, and file charges for a US company NOT breaking the law or for complying with a court order. Israel also would not want this to come to light.
It’s like a criminal’s promise. The only recourse is taking your business elsewhere, which Israel would do when they’re tipped off anyways. But at least if Google/Amazon fail to wink, contract lasts a little longer.
Insane. Obeying the law or ToS, apparently, is discriminatory when it comes to Israel.
So Microsoft is now more ethical than Google and Amazon? What times we live in!
There is certainty they broke the law. Both federally and, in all likelihood, in most states.
I wonder if there's a national security aspect here, in that knowing the country would prompt some form of country-specific espionage (signals intelligence, local agents on the inside at these service providers, etc.) to discover what the targeted data might be.
Knowing the country allows an immediate diplomatic protest, threats to withdraw business, and investigation.
The payment is to be within 24 hours, which means that they can act quickly to stop the processing of the data, prevent conclusions from being drawn, etc.
If the signaled country were the US, I would expect a bunch of senators to be immediately called and pressured to look into and perhaps stop the investigation.
https://www.972mag.com/project-nimbus-contract-google-amazon...
This is a good opportunity to make money from helping corporations migrate off these services and onto alternatives with better data protection regulations and weaker ties to the zionist atrocity factory.
If you don't want your data in the hands of someone with access to the state's monopoly on violence, you're best off getting rid of all internet access in your life.
They will have agents both known and unknown operating at those companies. A company cannot as a policy set out to violate the law (if it's smart). It would be trivial for individuals to have covert channels set up.
I can imagine that this Alphabet General Counsel-approved language could be challenged in court.
Most SWEs are still 20-40-something men, which would be the same demographic being called to service (I realize women also serve in the IDF, but combat positions are generally reserved for men).
So it's possible that Israel can't rely on their own private tech industry being unaffected during high-engagement periods.
I think the government does have plenty of its own infra (and military tech sectors would be unaffected by calling in reserves), but given the size of the country (and also considering its Palestinian second-class citizens who make up 20% of the Israeli population may not be trusted to work on more sensitive portions of its infrastructure) they're probably not able to manage every part of the stack. Probably only China and the U.S. can do this.
Iran attacking US-East-1 would certainly be unusual.
More likely is it was "aid" from the US which usually comes with stipulations about what/where they can spend it - common with weapons/military kit, wouldn't be surprised if they did something similar with cloud services.
And any offsite that is "Israel's gov offsite" is an easy target even if in Cyprus or NYC.
Comingling with a bunch of bulk commercial hosts is very safe from a threat modeling perspective (in this case).
Not a lawyer. Can this statement hold in a US court of law? To me it sounds sleazy and ambiguous. To say if an “idea is wrong” could mean it’s a bad idea, an immoral one or a false “idea”. But in any case, an idea is not a statement or a fact. I have a hundred ideas everyday. Some are right, some are wrong and others in between.
Why is this characterized as a "demand"? Amazon and Google have the freedom that Microsoft does to decline.
This story stinks.
In other words, im curious why would Israel not invest in making sure that the their were storing in third-party vendor clouds was not encrypted at rest and in transit by keys not stored in that cloud.
This seems like a matter of national security for any government, not to have their data accessible by other parties at the whims of different jurisdiction where that cloud vendor operates.
Conversely, if you don't, it's not hard to understand at all when you consider that there are oodles of American politicians, at all levels, actually publicly declaring that they put Israeli interests over US interests. What's hard to understand about _that_ is that, for some reason, it's not considered pure and simple treason.
Now maybe we can say that Israel is not a democratic system or environment, but then Microsoft would not be wholly desiring to do business serving such an entity, lest they break with US oversight.
Israel here told the vendor that whenever there is a gag on them by their government against making Israel aware of their request, the vendor is to secretly transmit a message alerting them..
No, I don't think I will.
Since when is talking about Israel controversial?
Also because no other country has the power to get cloud vendors to do this and this one special country will face no consequences (as usual).
"The demand, which would require Google and Amazon to effectively sidestep legal obligations in countries around the world"
"Like other big tech companies, Google and Amazon’s cloud businesses routinely comply with requests from police, prosecutors and security services to hand over customer data to assist investigations."
The way I interpret this is Google, Amazon operates in multiple countries under multiple jurisdictions. The security services for any of these countries(including for example Egypt where Google has offices according to....Google), can produce a legal(in Egypt) order requesting Google to produce data of another customer( for example Israeli govt) and Google has to comply or leave Egypt.
It seems to me that being under constant threat of your government sensitive data being exposed at the whims of another, potentially adversarial government is not a sustainable way of operating and Im surprised that Israel havent either found ways of storing its infrastructure locally or encrypting it five way to Sunday.
This is not a comment on the specific accusation of actions by Israel but for strange reality of being a small-country government and a customer of a multi-national cloud vendor.
If it's encrypted in the cloud, it also cannot be processed in the cloud. For AI in particular that kinda defeats the point.
Then this whole story would disintegrate.
I am baffled by the manufactured outrage this story is generating. "oh no. <country> is sidestepping the NSA which we loudly proclaim to be evil at every opportunity, and (gasp) imposing their own conditions and bullying gigantic tech companies which are even more evil."
This from the same group of people who insist that europe should host their own data.
American companies sidestepping law related to international relationships between the US and other countries in order to benefit a foreign state??
That story would disintegrate? In what universe?
Assuming it's even true, there is no side-stepping international relations between the US and other countries.
If Egypt were to issue a legal order with a gag clause ordering Amazon to release Israeli data, and Amazon were to signal that fact to Israel, how does this involve the US at all?
Seems like you did not understand the story.
This seems like a very dumb way to communicate in a criminal conspiracy: it's more traceable than a simple message, with permanent record, and more people are involved to enact the communication.
Is there any benefit?
MS/Azure being the good guys for once? Colour me surprised.
LOL. No. That is not how it works. Legal combs through every contract, negotiates, and gates the process, while revenue officers act very self-entitled to having the contract signed ASAP. Legal has to do their job, or they're a liability.
Microsoft understands at a corporate level that it's in their business interest (as a global vendor) for local lawful access regimes to be as narrow as possible. Their pushback here is understandable; if they're not seen as trustworthy by the US government, it potentially undermines a lot of the latitude they're trying to fight for.
But I do not think we knew that Google and Amazon would engage in criminal conspiracy for profit
I thought censoring and straight up brigading was not allowed here? But i guess if they do what the article is about they can easily sway a thread like this in a few minutes, and i'm sure they do when stuff becomes frontpage on various sites. Can't talk about the genocide.
[1] https://d1.awsstatic.com/Security/pdfs/Amazon_AWS_Informatio...