The Wall Street Journal, Michael Hickins, Feb. 3, 2014
 |
Google has said a potential law in Brazil could bar it from doing business
there. Pictured, its California headquarters. Getty Images |
Revelations
about the National Security Agency's eavesdropping on electronic communications
have given governments overseas an opening to restrict U.S. technology
companies, which some foreign politicians have depicted as too compliant with
or complicit in the spying.
Germany's
new governing coalition has issued a policy document that includes a call for
using more technology developed in Europe, as well as open-source software,
which is harder for potential eavesdroppers to penetrate.
Lawmakers
in Brazil have been debating a bill that would require data about Brazilians to
be stored within that country's borders. "There is a serious problem of
storage databases abroad," Brazilian President Dilma Rousseff said
recently. "That certain situation we will no longer accept."
On Monday,
Google Inc., GOOG +0.49% Microsoft Corp., Yahoo Inc., YHOO +0.69% LinkedIn
Corp. LNKD +0.09% and Facebook Inc. FB
+1.20% released figures on how many
requests for user information they received from U.S. intelligence agencies in
the first half of last year. The reports followed an agreement by the Justice
Department last week that allows such releases of broad figures with a
six-month lag. Companies with popular email services–such as Google, Microsoft
and Yahoo—had the most affected accounts.
If Brazil
adopts its proposed new law, U.S. computer-services providers could be forced
to build costly new data centers in that country to continue doing business
there. Google, for example, the most popular Internet service provider in
Brazil, may store emails and other data from its users on servers in the U.S.,
where it is subject to U.S. law.
Richard
Salgado, Google's director of law enforcement and information security, told a
Senate hearing in November that under the new law Brazil is considering Google
could be "barred from doing business in one of the world's most
significant markets or be obligated to pay hundreds of millions of dollars in
fines."
Several
U.S. tech companies have said the threat of such initiatives and privacy
measures already on the books in countries such as Germany, France and Canada
are hurting their business. Some of them have said they would build local data
centers to help customers comply with new data-residency rules, but in many
cases they will pass along the cost.
Meanwhile,
some U.S.-based multinationals are worried that new laws abroad meant to shield
personal data from spying could prevent them from moving their own business
data from foreign affiliates to their home offices.
Daren
Orzechowski, a partner at law firm White & Case LLC in New York, said
"there is a concern that countries will put up barriers like this,"
and said they would come at a price. "It's going to weaken the benefit of
the technology and impact the ability of people to conduct global e-commerce
and to collaborate internationally," he said.
Daniel
Castro, an analyst with the Information Technology and Innovation Foundation, a
Washington-based think tank, said data-privacy rules and other restrictions now
in force in some countries could slow the growth of the U.S.
technology-services industry by as much as 4%.
In cloud
computing, companies like Google's could be particularly vulnerable, because
they constantly move their customers' data to server locations with excess
capacity to get the most out of their networks. Corporate clients hire these
companies to provide Web-based software and services like email and data
storage. That strategy often allows businesses to cut costs or to add or
subtract their computing resources as needed.
But some
foreign cloud-computing clients are beginning to reassess their relationships
with U.S. providers, responding to their own customers' concerns that private
data could fall into U.S. government hands. Detlev Gabel, a White & Case
partner in Frankfurt who advises clients on data privacy, said in an email that
German companies are stepping up their scrutiny of potential IT providers and
are looking more to European vendors.
Mr. Castro
says new regulations could cost U.S. IT services companies up to $35 billion in
revenue over the next three years.
Keller
Williams Realty Inc., a U.S.-based real-estate franchising company with
700-plus offices in the U.S. and Canada, is building out its computing
infrastructure to support an international expansion planned over the next 12
to 24 months, beginning with Turkey. The company relies on Google Apps to
simplify email and data-management operations for its network's 95,000 users.
It also uses Salesforce.com Inc. CRM -3.40%
's cloud platform for business applications that help brokers manage
offers and steps required for closings.
Cary
Sylvester, the company's vice president of technology innovation and
communication, said cloud computing makes it easier to manage applications for
Keller Williams's far-flung business but that the company might not be able to
get by with just a single system world-wide.
"It
would be a big annoyance" to have to find local vendors to comply with
local regulations, she said. "That's part of the reason we chose to
partner with Google and Salesforce, because they're going to have to solve that
problem rfor themselves," she said.
Marc
Benioff, chief executive of Salesforce.com, which markets
sales-account-management, or CRM, software, said he hasn't "had a lot of
inquiries from customers." He said that the data in the company's system
belongs to its customers, and that his company "would never let a
government or anyone else access that data without getting [customers'] permission.
We do not provide any government with access to our servers, either directly or
indirectly."
Mr. Benioff
pointed out, however, that the type of data in many business databases, such as
next quarter's projected sales to a given customer, would be of little interest
to intelligence analysts. "CRM is boring," he said.
International
Business Machines Corp. plans to open 15 new data centers in 2014, including
one in China, to help its customers comply with local laws prohibiting data
about their citizens from leaving the country.
A spokesman
for Amazon.com Inc. AMZN -0.15% 's
Amazon Web Services unit said its customers can choose to have their data
reside in any of the company's 10 infrastructure regions world-wide, and that
it will "continue to build out new regions regularly."
Mr. Benioff
said that if customers asked Salesforce.com to open new data centers to comply
with local regulations, the company would do so, but might charge them extra as
a result.
That
prospect troubles people like Ken Grady, chief information officer of New
England Biolabs Inc., which supplies biotech labs. Mr. Grady said his company
is planning to use Salesforce.com's service, beginning in April, and expects to
be able to use the cloud-based application in all its locations, which include
sites in Canada, Europe and Asia.
"It
should be seamless, and it should be transparent to our organization in terms
of use, with no change in functionality and scope."But he recognizes that
things may not pan out that way. Mr. Grady said Salesforce.com has told him it
is working to ensure that its facilities comply with applicable local laws
abroad, but the company hasn't been able to tell him if this will add to his
costs. "I expect it to be low. I'm going to push for it to be low, if at
all," he said.
U.S.-based
multinationals face another problem: figuring out how to move their own customer
and employee data from overseas to their home offices.
"What
if we're running Microsoft Dynamics and Brazil shuts it down, and we can't get
the data out of there; what can Microsoft do to help us get the data out of
that country?" said John Milazzo, CIO of KodakAlaris, a privately held
document imaging company spun out of Eastman Kodak Co. Dynamics is used to
manage financial and human-resources data such as revenues and payroll data.
Microsoft
declined to comment, but pointed to an open letter signed by several large
cloud vendors and a blog post by its chief legal officer, Brad Smith, which
call on governments to curb electronic eavesdropping.
Andrew
Bartels, an analyst with Forrester Research Inc., takes a more sanguine view of
the spying revelations: "The NSA has given a particular face for that, but
the risk [of data loss in the cloud] was already there through different means.
Is this a bad thing for people to be aware that using cloud software poses
risks? The answer is no," he said.
Mr. Bartels
said that the revelations have given foreign countries the chance to foster
rivals to Amazon.com or Google. "It will have and is having some reduction
in growth rates for cloud vendors." But he added that cloud spending will
simply shift elsewhere. "I don't think these U.S. technology firms have a
God-given right to dominate," he said.
Corrections
& Amplifications
An earlier
version of this article incorrectly described Eastman Kodak Co., which has
reorganized as a commercial-imaging company, as defunct. It also reported
incorrectly that Amazon.com Inc.'s Amazon Web Services unit is among the
cloud-computing companies that constantly move their customers' data to server
locations with excess capacity to get the most out of their networks; in fact,
its customers can pick the region in which their data will reside.
