Spying Fears Abroad Hurt U.S. Tech Firms

The Wall Street Journal, Michael Hickins, Feb. 3, 2014

Google has said a potential law in Brazil could bar it from doing business
there. Pictured, its California headquarters. Getty Images

Revelations about the National Security Agency's eavesdropping on electronic communications have given governments overseas an opening to restrict U.S. technology companies, which some foreign politicians have depicted as too compliant with or complicit in the spying.

Germany's new governing coalition has issued a policy document that includes a call for using more technology developed in Europe, as well as open-source software, which is harder for potential eavesdroppers to penetrate.

Lawmakers in Brazil have been debating a bill that would require data about Brazilians to be stored within that country's borders. "There is a serious problem of storage databases abroad," Brazilian President Dilma Rousseff said recently. "That certain situation we will no longer accept."

On Monday, Google Inc., GOOG +0.49% Microsoft Corp., Yahoo Inc., YHOO +0.69% LinkedIn Corp. LNKD +0.09%  and Facebook Inc. FB +1.20%  released figures on how many requests for user information they received from U.S. intelligence agencies in the first half of last year. The reports followed an agreement by the Justice Department last week that allows such releases of broad figures with a six-month lag. Companies with popular email services–such as Google, Microsoft and Yahoo—had the most affected accounts.

If Brazil adopts its proposed new law, U.S. computer-services providers could be forced to build costly new data centers in that country to continue doing business there. Google, for example, the most popular Internet service provider in Brazil, may store emails and other data from its users on servers in the U.S., where it is subject to U.S. law.

Richard Salgado, Google's director of law enforcement and information security, told a Senate hearing in November that under the new law Brazil is considering Google could be "barred from doing business in one of the world's most significant markets or be obligated to pay hundreds of millions of dollars in fines."

Several U.S. tech companies have said the threat of such initiatives and privacy measures already on the books in countries such as Germany, France and Canada are hurting their business. Some of them have said they would build local data centers to help customers comply with new data-residency rules, but in many cases they will pass along the cost.

Meanwhile, some U.S.-based multinationals are worried that new laws abroad meant to shield personal data from spying could prevent them from moving their own business data from foreign affiliates to their home offices.

Daren Orzechowski, a partner at law firm White & Case LLC in New York, said "there is a concern that countries will put up barriers like this," and said they would come at a price. "It's going to weaken the benefit of the technology and impact the ability of people to conduct global e-commerce and to collaborate internationally," he said.

Daniel Castro, an analyst with the Information Technology and Innovation Foundation, a Washington-based think tank, said data-privacy rules and other restrictions now in force in some countries could slow the growth of the U.S. technology-services industry by as much as 4%.

In cloud computing, companies like Google's could be particularly vulnerable, because they constantly move their customers' data to server locations with excess capacity to get the most out of their networks. Corporate clients hire these companies to provide Web-based software and services like email and data storage. That strategy often allows businesses to cut costs or to add or subtract their computing resources as needed.

But some foreign cloud-computing clients are beginning to reassess their relationships with U.S. providers, responding to their own customers' concerns that private data could fall into U.S. government hands. Detlev Gabel, a White & Case partner in Frankfurt who advises clients on data privacy, said in an email that German companies are stepping up their scrutiny of potential IT providers and are looking more to European vendors.

Mr. Castro says new regulations could cost U.S. IT services companies up to $35 billion in revenue over the next three years.

Keller Williams Realty Inc., a U.S.-based real-estate franchising company with 700-plus offices in the U.S. and Canada, is building out its computing infrastructure to support an international expansion planned over the next 12 to 24 months, beginning with Turkey. The company relies on Google Apps to simplify email and data-management operations for its network's 95,000 users. It also uses Salesforce.com Inc. CRM -3.40%  's cloud platform for business applications that help brokers manage offers and steps required for closings.

Cary Sylvester, the company's vice president of technology innovation and communication, said cloud computing makes it easier to manage applications for Keller Williams's far-flung business but that the company might not be able to get by with just a single system world-wide.

"It would be a big annoyance" to have to find local vendors to comply with local regulations, she said. "That's part of the reason we chose to partner with Google and Salesforce, because they're going to have to solve that problem rfor themselves," she said.

Marc Benioff, chief executive of Salesforce.com, which markets sales-account-management, or CRM, software, said he hasn't "had a lot of inquiries from customers." He said that the data in the company's system belongs to its customers, and that his company "would never let a government or anyone else access that data without getting [customers'] permission. We do not provide any government with access to our servers, either directly or indirectly."

Mr. Benioff pointed out, however, that the type of data in many business databases, such as next quarter's projected sales to a given customer, would be of little interest to intelligence analysts. "CRM is boring," he said.

International Business Machines Corp. plans to open 15 new data centers in 2014, including one in China, to help its customers comply with local laws prohibiting data about their citizens from leaving the country.

A spokesman for Amazon.com Inc. AMZN -0.15%  's Amazon Web Services unit said its customers can choose to have their data reside in any of the company's 10 infrastructure regions world-wide, and that it will "continue to build out new regions regularly."

Mr. Benioff said that if customers asked Salesforce.com to open new data centers to comply with local regulations, the company would do so, but might charge them extra as a result.

That prospect troubles people like Ken Grady, chief information officer of New England Biolabs Inc., which supplies biotech labs. Mr. Grady said his company is planning to use Salesforce.com's service, beginning in April, and expects to be able to use the cloud-based application in all its locations, which include sites in Canada, Europe and Asia.

"It should be seamless, and it should be transparent to our organization in terms of use, with no change in functionality and scope."But he recognizes that things may not pan out that way. Mr. Grady said Salesforce.com has told him it is working to ensure that its facilities comply with applicable local laws abroad, but the company hasn't been able to tell him if this will add to his costs. "I expect it to be low. I'm going to push for it to be low, if at all," he said.

U.S.-based multinationals face another problem: figuring out how to move their own customer and employee data from overseas to their home offices.

"What if we're running Microsoft Dynamics and Brazil shuts it down, and we can't get the data out of there; what can Microsoft do to help us get the data out of that country?" said John Milazzo, CIO of KodakAlaris, a privately held document imaging company spun out of Eastman Kodak Co. Dynamics is used to manage financial and human-resources data such as revenues and payroll data.

Microsoft declined to comment, but pointed to an open letter signed by several large cloud vendors and a blog post by its chief legal officer, Brad Smith, which call on governments to curb electronic eavesdropping.

Andrew Bartels, an analyst with Forrester Research Inc., takes a more sanguine view of the spying revelations: "The NSA has given a particular face for that, but the risk [of data loss in the cloud] was already there through different means. Is this a bad thing for people to be aware that using cloud software poses risks? The answer is no," he said.

Mr. Bartels said that the revelations have given foreign countries the chance to foster rivals to Amazon.com or Google. "It will have and is having some reduction in growth rates for cloud vendors." But he added that cloud spending will simply shift elsewhere. "I don't think these U.S. technology firms have a God-given right to dominate," he said.

Corrections & Amplifications

An earlier version of this article incorrectly described Eastman Kodak Co., which has reorganized as a commercial-imaging company, as defunct. It also reported incorrectly that Amazon.com Inc.'s Amazon Web Services unit is among the cloud-computing companies that constantly move their customers' data to server locations with excess capacity to get the most out of their networks; in fact, its customers can pick the region in which their data will reside.

—Danny Yadron and Rachael King contributed to this article.

Write to Michael Hickins at michael.hickins@wsj.com