Leaked Documents Expose Google & Amazon’s Secret “Winking Mechanism” with Israel
Newly leaked Israeli government files (via The Guardian, +972 Magazine, and Local Call) reveal that Google and Amazon built a covert alert system for Tel Aviv under their $1.2 billion Project Nimbus cloud contract.
Whenever either company was forced to hand over Israeli data to a foreign authority, they allegedly sent a “special compensation payment” — the amount matching that country’s dialing code — within 24 hours.
A discreet signal, or wink, to alert Israel without breaking gag orders.
Legal experts called it a “clever but dangerous” tactic that may breach U.S. and international law.
‘No restrictions’ and a secret ‘wink’: Inside Israel’s deal with Google, Amazon
To secure the lucrative Project Nimbus contract, the tech giants agreed to disregard their own terms of service and sidestep legal orders by tipping Israel off if a foreign court demands its data, a joint investigation reveals.
In 2021, Google and Amazon signed a $1.2 billion contract with the Israeli government to provide it with advanced cloud computing and AI services — tools that were used during Israel’s two-year onslaught on the Gaza Strip. Details of the lucrative contract, known as Project Nimbus, were kept under wraps.
But an investigation by +972 Magazine, Local Call, and The Guardian can now reveal that Google and Amazon submitted to highly unorthodox “controls” that Israel inserted into the deal, in anticipation of legal challenges over its use of the technology in the occupied West Bank and Gaza.
Leaked Israeli Finance Ministry documents obtained by The Guardian — including a finalized version of the contract — and sources familiar with the negotiations reveal two stringent demands that Israel imposed on the tech giants as part of the deal. The first prohibits Google and Amazon from restricting how Israel uses their products, even if this use breaches their terms of service. The second obliges the companies to secretly notify Israel if a foreign court orders them to hand over the country’s data stored on their cloud platforms, effectively sidestepping their legal obligations.
Running for an initial seven years with the possibility of extension, Project Nimbus was designed to enable Israel to transfer vast quantities of data belonging to its government agencies, security services, and military units onto the two companies’ cloud servers: Amazon Web Services and Google Cloud Platform. But even two years before October 7, Israeli officials drafting the contract had already anticipated the potential for legal cases to be brought against Google and Amazon regarding the use of their technology in the occupied territories.
One scenario that particularly concerned officials was if the companies were ordered by a court in one of their countries of operation to hand over Israel’s data to police, prosecutors, or security agencies to assist with an investigation — if, for example, Israel’s use of their products were linked to human rights abuses against Palestinians.
The CLOUD Act (2018) allows American law enforcement agencies to compel U.S.-based cloud providers to hand over data, even if it is stored on servers abroad; in the European Union, due diligence laws can require companies to identify and address human rights violations in their global supply chains, and courts may intervene if these obligations are not met.
Crucially, companies receiving an order to hand over data are often gagged by the court or law enforcement agency from disclosing details of the request to the affected customer. To address this perceived vulnerability, the documents reveal, Israeli officials demanded a clause in the contract requiring the companies to covertly warn Israel if ever they were forced to surrender its data but were prohibited by law from revealing this fact.
According to The Guardian, this signaling is carried out through a secret code — part of an arrangement that would become known as the “winking mechanism,” but referred to in the contract as “special compensation” — by which the companies are obliged to send the Israeli government four-digit payments in Israeli shekels (NIS) corresponding to the relevant country’s international dialing code followed by zeros.
For example, if Google or Amazon were compelled to share data with U.S. authorities (dialing code +1) and were barred from revealing that action by a U.S. court, they would transfer NIS 1,000 to Israel. If a similar request were to occur in Italy (dialing code +39), they would instead send NIS 3,900. The contract states that these payments must be made “within 24 hours of the information being transferred.”
Thousands of people protest Google’s contract with Israel that provides facial recognition and other technologies, amid the Gaza war, outside Google’s offices in San Francisco, Thursday, December 14, 2023.
If Google or Amazon conclude that the terms of a gag order prevent them from even signaling which country has received the data, there is a backstop: They must pay the Israeli government NIS 100,000 ($30,000).
Legal experts, including several former U.S. prosecutors, described this arrangement to The Guardian as highly unusual, explaining that the coded messages could violate the companies’ legal obligations in the United States to keep a subpoena secret. “It seems awfully cute and something that if the U.S. government or, more to the point, a court were to understand, I don’t think they would be particularly sympathetic,” one former U.S. government lawyer said.
Several other experts described the mechanism as a “clever” workaround that could comply with the letter of the law but not its spirit.
Israeli officials appear to have acknowledged this. According to the documents, they noted that their demands as to how Google and Amazon should respond to a U.S.-issued order “might collide” with U.S. law, and the companies would have to make a choice between “violating the contract or violating their legal obligations.”
Neither Google nor Amazon responded to questions about whether they had used the secret code since the Nimbus contract came into effect.
“We have a rigorous global process for responding to lawful and binding orders for requests related to customer data,” Amazon’s spokesperson said. “We do not have any processes in place to circumvent our confidentiality obligations on lawfully binding orders.”
A Google spokesperson said it was “false” to “imply that we somehow were involved in illegal activity, which is absurd.” The spokesperson added: “The idea that we would evade our legal obligations to the U.S. government as a U.S. company, or in any other country, is categorically wrong.”
A spokesperson for Israel’s Finance Ministry said: “The article’s insinuation that Israel compels companies to breach the law is baseless.”
‘Acceptable use’
According to the leaked documents and sources with knowledge of internal discussions, Israeli officials were also concerned that access to Google or Amazon’s cloud services could be restricted or cut off altogether — either as a result of a foreign court ruling, or a unilateral decision by the companies themselves in response to employee or shareholder pressure.
The officials were especially worried that activists and human rights organizations might leverage laws in certain European countries to sue the companies and push for an end to their business ties with Israel, particularly if their products were linked to human rights violations.
Google and Amazon workers protest against their companies’ collaboration with the Israeli military at the annual Amazon Web Services summit in New York, July 26, 2023.
Last month, after +972, Local Call, and The Guardian revealed that Israel had violated Microsoft’s terms of service by using its cloud platform to store a vast trove of intercepted phone calls made by Palestinians, the tech giant revoked the Israeli military’s access to some of its products.
In contrast, the leaked documents state that the Nimbus contract specifically prohibits Google and Amazon from imposing similar sanctions on Israel, even if company policies change or if Israel’s use of the technology violates their terms of service. Doing so, according to the documents, would not only trigger legal action for breach of contract but also incur heavy financial penalties.
The two companies’ willingness to accept these conditions was reportedly part of the reason why they won the Nimbus contract over Microsoft, whose relationship with Israel’s government and military is governed by separate contracts. Indeed, intelligence sources told The Guardian that Israel planned to move its surveillance trove from Microsoft’s cloud to Amazon’s platform after the former blocked its access.
Google was seemingly aware that it would be largely giving up control over how Israel would use its technology, despite repeatedly claiming that its products are used only by Israeli government ministries that “agree to comply with our terms of service and acceptable use policy.”
The Intercept reported last year that Nimbus is governed by an “adjusted” set of policies agreed between Google and Israel, rather than the company’s general cloud computing terms of service policy. The publication cited a leaked email by a Google lawyer warning that if the company won the deal, it “will need to accept a non negotiable contract on terms favourable to the government.”
Both tech companies’ “acceptable use” policies state that their cloud platforms should not be used to violate the legal rights of others, nor should they be used to engage in or encourage activities that cause “serious harm” to people. But a source familiar with the drafting of the contract said it makes clear there can be “no restrictions” on the kind of data stored on Google and Amazon’s cloud platforms.
An analysis of the deal by Israel’s Finance Ministry states that the Nimbus contract permits Israel to “make use of any service” at will — so long as in doing so it does not breach Israeli law, infringe on copyright, or resell the companies’ technology. The terms of the deal seen by The Guardian state that Israel is “entitled to migrate to the cloud or generate in the cloud any content data they wish.”
A government memo circulated several months after the deal was signed stated that the fact the cloud providers had agreed to “subordinate” their own terms of service to those of the contract indicates “they understand the sensitivities of the Israeli government and are willing to accept our requirements.”
Google and Amazon have faced growing criticism from employees and investors over the role Nimbus has played in Israel’s devastating assault on Gaza, which numerous human rights organizations and a UN commission of inquiry have labeled a genocide. In remarks revealed by +972 and Local Call last year, a commander in the Israel’s army’s Center of Computing and Information Systems unit stated that the tech giants’ AI and cloud services had given Israel “very significant operational effectiveness” in the Strip.
Multiple Israeli security sources confirmed that the army has made extensive use of infrastructure set up through Nimbus, including big data centers that Google and Amazon built in Israel.
With the provisions outlined above, Israeli officials were anxious to avoid a situation in which the companies “decide that a certain customer is causing them damage, and therefore cease to sell them services,” one document stated.
At the time the contract was drafted, the officials viewed their chances of facing legal challenges abroad as slim. But with global public opinion increasingly turning against Israel, and as international journalists push to enter Gaza to witness the destruction left by a campaign of annihilation powered by advanced digital technology, that assumption may no longer stand.
Google declined to comment on which of Israel’s demands it had accepted in the finalized deal. “We’ve been very clear about the Nimbus contract, what it’s directed to, and the terms of service and acceptable use policy that govern it,” a spokesperson said. “Nothing has changed. This appears to be yet another attempt to falsely imply otherwise.”
An Amazon spokesperson said the company respects “the privacy of our customers, and we do not discuss our relationship without their consent, or have visibility into their workloads.”
A spokesperson for Israel’s Finance Ministry stated that both companies are “bound by stringent contractual obligations that safeguard Israel’s vital interests,” adding that “these agreements are confidential and we will not legitimize the article’s claims by disclosing private commercial terms.”
