The U.S. National Security Agency’s eavesdropping on foreign heads of state from Angela Merkel to Dilma Rousseff is poised to produce its first high-profile corporate casualty: Google Inc.’s operations in Brazil.
Brazilian lawmakers are under orders from President Rousseff to pause all other legislative proceedings until they hash out a proposal that would require Google and other providers of online services to keep local-user information in data centers within the country.
The measure is at the forefront of a growing backlash against American Internet companies, with allegations emerging last month and as recently as last week that the NSA gained access to e-mails between world leaders and their staffs, raising questions about the data held by U.S. Internet companies. European lawmakers are considering their own penalties for companies that share unauthorized information.
Google says the data-center requirement would hinder expansion in Brazil, the world’s sixth-largest market for Internet users, because the infrastructure would be complicated to develop. Violating the rule would cost Google 10 percent of its annual sales in Brazil, where it is the most-visited website, according to research firm ComScore Inc.
While Google doesn’t disclose its Brazilian revenue, the country is the third-largest market for the company’s Android smartphone software and the nation with the fifth-most YouTube users. On a monthly basis, 92 percent of Brazilian Internet users visit Google sites, according to ComScore.
“Brazilian users would ultimately be harmed because they couldn’t access new tools, new services,” said Marcel Leonardi, public policy director for Google in Brazil, in a telephone interview from Sao Paulo. “Companies would choose to implement those services at a much later stage, if at all.”
Rousseff’s support for the measure underscores the tendency toward protectionism in Brazil, which has raised taxes on foreign investment and car imports under her administration. It also provides a way for her to show she’s fighting on behalf of Brazilians amid nationwide protests against political corruption and the government’s spending priorities.
Yet she’s far from alone in calling for greater scrutiny of the NSA’s practices. German Chancellor Merkel and French President Francois Hollande called last week for closer cooperation on espionage after documents gathered by former NSA contractor Edward Snowden revealed U.S. authorities hacked Merkel’s mobile phone in 2010. Mexico is probing allegations of U.S. eavesdropping on former President Felipe Calderon.
The 28-nation European Union is debating a complete overhaul of its data protection rules dating back to 1995. A proposal put forward last year by the European Commission, the EU’s regulator, would also hold U.S. companies such as Google, Facebook Inc. and Apple Inc. liable for violations such as unauthorized transfers of data on EU citizens to non-EU countries. Fines could be as high as 100 million euros ($138 million), according to draft rules backed last week by a European Parliament committee.The EU plans need the support of lawmakers and national governments before they can become law.
Brazil’s data-center requirement would be tacked onto a bill called Marco Civil that establishes legal guidelines for Internet providers, such as neutrality in the services consumers can access on their networks. Rousseff marked the bill as urgent on Sept. 11, less than two weeks after documents leaked by Snowden revealed the agency monitored her communication with her staff. The urgent designation means lawmakers must set aside all other business to consider the measure, which would get similar priority in the Senate if it’s approved in the lower house.
The bill will be discussed in the lower house on Nov. 5 and will be voted the following day, said Alessandro Molon, its sponsor, in an interview today. He attributed the weeklong wait more to a separate debate over Internet neutrality. Whether the proposal will include the data-center measure is undecided, he said. He is scheduled to meet with Rousseff this week.
In an interview last week with Radio Itatiaia of Belo Horizonte, Brazil, Rousseff said Marco Civil “clearly shows Brazil’s position” that data should be stored within the country, not “in the United States as it is today.”
Google said in an e-mailed statement that it supports the broader Marco Civil law while opposing the data-center proposal. Google rose 2.1 percent to $1,036.24 at the close in New York.
Internet trade associations and the International Chamber of Commerce said in an open letter to the Brazilian congress that the data-center proposal would hurt the country’s competitiveness, increase the cost of doing business, lead to slower growth and make Brazilian Internet users more vulnerable to hacking.
Even if it were possible to identify users based on nationality or location, isolating their data would make them less -- not more -- secure, said Zahid Jamil, a lawyer who works with the International Chamber of Commerce and other groups on cybercrime and technology in emerging markets. Part of Google’s security strategy to protect user data from computer crashes and cyber attacks is to “chunk and replicate the data over multiple systems to avoid a single point of failure,” according to the company’s website.
A hacker targeting a Brazilian would know exactly where to look for information if it were confined to one data center, said Jamil, the chairman of the Developing Countries Center for Cyber Crime Law, a Pakistan-based group.
“Localization of data has no relevance whatsoever on security or fighting cyber crime,” Jamil said from Karachi in an Oct. 15 telephone interview. “The argument that data is this one thing, and you only have one copy in Brazil and therefore it’s safe, is a false argument based on a 20th century understanding of physical things.”
Molon, the bill’s sponsor, said the priority of the data-center measure is to make Internet companies subject to Brazilian law, which safeguards citizens against monitoring. Storing data locally gives Brazil legal control of user information, he said.
Unlike emerging markets China, Russia and South Korea, Brazil doesn’t have a well-developed domestic Internet industry. Rousseff’s local data-center proposal would protect Brazilian citizens while encouraging the growth of local companies to challenge Google, said Pablo Ortellado, a public-policy professor at the University of Sao Paulo.
“Considering the implications of the spying allegations, I think it’s preferable that we develop a national industry, even if it’s not initially of the same quality as the American market,” Ortellado said.
Google has clashed with governments before, leading the company to make choices to adapt to local laws while still pursuing its mission to make information universally accessible. In China, where officials can block websites that don’t comply with media regulations, Google decided in 2010 to stop altering its search results, redirecting users to a Hong Kong site, limiting its ability to expand in China.
In Latin America, Google is building a $150 million data center in Chile, on the outskirts of Santiago. The facility will be operating by the end of this year. Chile was chosen for Google’s first data center in the region because of “an ideal combination of reliable infrastructure, a skilled workforce and a commitment to transparent and business friendly regulations,” according to a company statement.
Google isn’t the only company affected by Brazil’s response to the NSA spying allegations. Government agencies won’t renew their contracts with Microsoft Corp. to use Outlook e-mail services, Communications Minister Paulo Bernardo told reporters Oct. 14. Government-controlled Telecomunicacoes Brasileiras SA is working on its third version of a domestically developed e-mail service called Expresso, which will be ready for full adoption in November. Mimi Newman, a Microsoft spokeswoman, had no immediate comment.
Even as it pursues the data-center measure, Brazil plans to use Google’s technology for education and Web access, including a project to blanket the Amazon with Internet coverage using balloons.
The contentious relationship with Google puts Brazil’s image as an investment destination at stake, testing the government’s ability to attract foreign companies while protecting local businesses and its own industry secrets.
“Google becomes the devil when it comes to data security, but we’re also relying on the same company to bring Internet to remote areas,” said Monica Rosina, an intellectual-property professor at the Fundacao Getulio Vargas Law School in Sao Paulo. “That’s a bit bipolar.”