Leaked Documents Expose Google & Amazon’s Secret “Winking Mechanism” with Israel
Newly leaked Israeli government files (via The Guardian, +972 Magazine, and Local Call) reveal that Google and Amazon built a covert alert system for Tel Aviv under their $1.2 billion Project Nimbus cloud contract.
Whenever either company was forced to hand over Israeli data to a foreign authority, they allegedly sent a “special compensation payment” — the amount matching that country’s dialing code — within 24 hours.
A discreet signal, or wink, to alert Israel without breaking gag orders.
Legal experts called it a “clever but dangerous” tactic that may breach U.S. and international law.
‘No restrictions’ and a secret ‘wink’: Inside Israel’s deal with Google, Amazon
To secure the lucrative Project Nimbus contract, the tech giants agreed to disregard their own terms of service and sidestep legal orders by tipping Israel off if a foreign court demands its data, a joint investigation reveals.
In 2021, Google and Amazon signed a $1.2 billion contract with the Israeli government to provide it with advanced cloud computing and AI services — tools that were used during Israel’s two-year onslaught on the Gaza Strip. Details of the lucrative contract, known as Project Nimbus, were kept under wraps.
But an investigation by +972 Magazine, Local Call, and The Guardian can now reveal that Google and Amazon submitted to highly unorthodox “controls” that Israel inserted into the deal, in anticipation of legal challenges over its use of the technology in the occupied West Bank and Gaza.
Leaked Israeli Finance Ministry documents obtained by The Guardian — including a finalized version of the contract — and sources familiar with the negotiations reveal two stringent demands that Israel imposed on the tech giants as part of the deal. The first prohibits Google and Amazon from restricting how Israel uses their products, even if this use breaches their terms of service. The second obliges the companies to secretly notify Israel if a foreign court orders them to hand over the country’s data stored on their cloud platforms, effectively sidestepping their legal obligations.
Running for an initial seven years with the possibility of extension, Project Nimbus was designed to enable Israel to transfer vast quantities of data belonging to its government agencies, security services, and military units onto the two companies’ cloud servers: Amazon Web Services and Google Cloud Platform. But even two years before October 7, Israeli officials drafting the contract had already anticipated the potential for legal cases to be brought against Google and Amazon regarding the use of their technology in the occupied territories.
One scenario that particularly concerned officials was if the companies were ordered by a court in one of their countries of operation to hand over Israel’s data to police, prosecutors, or security agencies to assist with an investigation — if, for example, Israel’s use of their products were linked to human rights abuses against Palestinians.
The CLOUD Act (2018) allows American law enforcement agencies to compel U.S.-based cloud providers to hand over data, even if it is stored on servers abroad; in the European Union, due diligence laws can require companies to identify and address human rights violations in their global supply chains, and courts may intervene if these obligations are not met.
Crucially, companies receiving an order to hand over data are often gagged by the court or law enforcement agency from disclosing details of the request to the affected customer. To address this perceived vulnerability, the documents reveal, Israeli officials demanded a clause in the contract requiring the companies to covertly warn Israel if ever they were forced to surrender its data but were prohibited by law from revealing this fact.
According to The Guardian, this signaling is carried out through a secret code — part of an arrangement that would become known as the “winking mechanism,” but referred to in the contract as “special compensation” — by which the companies are obliged to send the Israeli government four-digit payments in Israeli shekels (NIS) corresponding to the relevant country’s international dialing code followed by zeros.
For example, if Google or Amazon were compelled to share data with U.S. authorities (dialing code +1) and were barred from revealing that action by a U.S. court, they would transfer NIS 1,000 to Israel. If a similar request were to occur in Italy (dialing code +39), they would instead send NIS 3,900. The contract states that these payments must be made “within 24 hours of the information being transferred.”
Thousands of people protest Google’s contract with Israel that provides facial recognition and other technologies, amid the Gaza war, outside Google’s offices in San Francisco, Thursday, December 14, 2023.
If Google or Amazon conclude that the terms of a gag order prevent them from even signaling which country has received the data, there is a backstop: They must pay the Israeli government NIS 100,000 ($30,000).
Legal experts, including several former U.S. prosecutors, described this arrangement to The Guardian as highly unusual, explaining that the coded messages could violate the companies’ legal obligations in the United States to keep a subpoena secret. “It seems awfully cute and something that if the U.S. government or, more to the point, a court were to understand, I don’t think they would be particularly sympathetic,” one former U.S. government lawyer said.
Several other experts described the mechanism as a “clever” workaround that could comply with the letter of the law but not its spirit.
Israeli officials appear to have acknowledged this. According to the documents, they noted that their demands as to how Google and Amazon should respond to a U.S.-issued order “might collide” with U.S. law, and the companies would have to make a choice between “violating the contract or violating their legal obligations.”
Neither Google nor Amazon responded to questions about whether they had used the secret code since the Nimbus contract came into effect.
“We have a rigorous global process for responding to lawful and binding orders for requests related to customer data,” Amazon’s spokesperson said. “We do not have any processes in place to circumvent our confidentiality obligations on lawfully binding orders.”
A Google spokesperson said it was “false” to “imply that we somehow were involved in illegal activity, which is absurd.” The spokesperson added: “The idea that we would evade our legal obligations to the U.S. government as a U.S. company, or in any other country, is categorically wrong.”
A spokesperson for Israel’s Finance Ministry said: “The article’s insinuation that Israel compels companies to breach the law is baseless.”
‘Acceptable use’
According to the leaked documents and sources with knowledge of internal discussions, Israeli officials were also concerned that access to Google or Amazon’s cloud services could be restricted or cut off altogether — either as a result of a foreign court ruling, or a unilateral decision by the companies themselves in response to employee or shareholder pressure.
The officials were especially worried that activists and human rights organizations might leverage laws in certain European countries to sue the companies and push for an end to their business ties with Israel, particularly if their products were linked to human rights violations.
Google and Amazon workers protest against their companies’ collaboration with the Israeli military at the annual Amazon Web Services summit in New York, July 26, 2023.
Last month, after +972, Local Call, and The Guardian revealed that Israel had violated Microsoft’s terms of service by using its cloud platform to store a vast trove of intercepted phone calls made by Palestinians, the tech giant revoked the Israeli military’s access to some of its products.
Original source: https://www.972mag.com/project-nimbus-contract-google-amazon-israel/
