Google’s “Cloud region” in Saudi Arabia threatens privacy and free expression

Right groups, digital privacy rights organizations and researchers call on Google to halt its plans to establish a "Cloud region" in Saudi Arabia, pointing to the country's track record of violating privacy rights to spy on citizens.

This statement was originally published on hrw.org on 26 May 2021.

Joint Statement by Human Rights and Digital Privacy Rights Organizations

The undersigned human rights and digital rights organizations urge Google to immediately halt its plan to establish a new Google Cloud region in Saudi Arabia until the company can publicly demonstrate how it will mitigate adverse human rights impacts.

Saudi Arabia’s recent track record of repression of all public dissent, alleged espionage and infiltration of technology platforms, use of cyber surveillance software to spy on dissidents, and a notorious justice system that flagrantly violates due process rights make Saudi Arabia an unsafe country to host Google Cloud services. It is additionally concerning that Google’s Cloud region will be in partnership with a state-owned company, Saudi Aramco.

In December 2020, Google announced an agreement with Saudi Aramco to set up a Google Cloud region in Saudi Arabia and offer Enterprise Cloud services there “with a particular focus on businesses in the Kingdom.” The Google Cloud Platform is one of the largest data storage and cloud computing services in the world.

While Google publishes how it handles government requests for customer information and reports when requests are made through formal channels, there are numerous potential human rights risks of establishing a Google Cloud region in Saudi Arabia that include violations of the rights to privacy, freedom of expression and association, non-discrimination, and due process.

Saudi Arabia’s Rampant Repression and Abusive Surveillance

Saudi Arabia has an extensive record of seeking to spy on its own citizens, including through illegally accessing their personal information within US technology companies, and has amassed a dismal human rights record in which authorities have unleashed a wave of domestic repression that has attempted to crush peaceful dissent. Given this reality, Google’s plan raises serious concerns about how it can and will uphold its human rights responsibilities under the United Nations Guiding Principles on Business and Human Rights (UNGPs) to prevent or mitigate the adverse human rights impacts that are clearly linked to the hosting of a cloud region in Saudi Arabia.

For many years, Amnesty International, Human Rights Watch, and other human rights groups have reported extensively on Saudi Arabia’s human rights abuses, including its escalating domestic repression and use of the judiciary to silence dissent. Since 2017, de facto leader Crown Prince Mohammed bin Salman has overseen mass arrests that have targeted prominent clerics, public intellectuals, senior royal family members, academics, human rights activists, and the country’s leading women’s rights activists. This crackdown on peaceful dissent and perceived opposition to Saudi authorities was coupled with a significant deterioration in due process rights in a country where the rule of law was already tenuous.

In 2017, the country’s prosecution service and security apparatus were also placed directly under the oversight of the royal court, putting the primary tools of Saudi repression in the sole hands of the king and crown prince. Saudi Arabia’s domestic repression has extended to the killing of dissidents abroad. In October 2018, Saudi state agents brutally murdered Washington Post columnist Jamal Khashoggi in Saudi Arabia’s consulate in Istanbul, Turkey. There has been no clear accountability for the perpetrators of any of these abuses. While some Saudi activists have recently been released from prison, they face additional prison time if they do not stay silent and most, including Loujain al-Hathloul, remain banned from travel and have suspended sentences hanging over them.

Saudi repression has sometimes targeted employees of large international companies operating in Saudi Arabia, including the 2017 arrest of a Saudi man who was a partner at the consulting firm McKinsey & Co. Saudi authorities also arrested prominent businessmen, royal family members, and current and former government officials in 2017 and pressured them to hand over assets to the state in exchange for their release, outside of any recognizable legal process.

Saudi authorities also have repeatedly sought to identify anonymous dissidents and spy on its citizens through digital surveillance. For instance, Citizen Lab, a Canadian academic research center, concluded with “high confidence” that in 2018, the mobile phone of a prominent Saudi activist based in Canada was infected with spyware, which allowed full access to a victim’s personal files, such as chats, emails communications, and photos, as well as the ability to surreptitiously use the phone’s microphones and cameras to view and eavesdrop.

Additionally, an Amnesty International staff member and another Saudi Arabian rights activist were targeted in 2018 through a Saudi-related message, in what the organization suspects was a deliberate attempt to spy on its own staff by a government hostile to its work. Investigations by Amnesty International revealed that clicking the links sent to the staff member and activist would have installed “Pegasus,” a sophisticated surveillance tool developed by the Israel-based company NSO-Group.

In another instance, in 2019, two Twitter employees were charged by the US Department of Justice with spying for Saudi Arabia. Both were accused of accessing the private information of Saudi dissidents who utilized the platform to discuss current issues. This enabled the Saudi authorities to uncover information that is not available elsewhere and to unmask the identities of anonymous critics. One anonymous online Twitter critic whom Saudi authorities eventually unmasked, Abdulrahman al-Sadhan, received a 20-year prison sentence for his online criticism in April 2021 and has been held largely incommunicado since his arrest in 2018.

Human Rights Watch has previously called for technology companies to halt the sale of surveillance technologies and ensure that any ongoing training and technical support to Saudi Arabia does not contribute to human rights violations. Human Rights Watch, Amnesty International, Access Now, and other groups have also called on Google to refrain from facilitating human rights abuses by operating in repressive environments where it faces excessive government pressure.

Google should uphold its human rights commitments

Google has a responsibility to respect human rights, regardless of any state’s willingness to fulfill its own human rights obligations. The company’s statement on human rights asserts its commitment “to respecting the rights enshrined in the Universal Declaration of Human Rights and its implementing treaties, as well as upholding the standards established in the United Nations Guiding Principles on Business and Human Rights (UNGPs) and in the Global Network Initiative Principles (GNI Principles)” across all of its products, including Cloud.

In January 2021, Access Now and the Canadian Internet Policy and Public Interest Clinic

The Canadian Internet Policy and Public Interest Clinic (CIPPIC) wrote an open letter requesting information on the due diligence process that Google has carried out to understand the potential impact on human rights, the type of user data that will be stored and processed in the Saudi cloud, the security measures to protect this data, the legal standards that Saudi Arabia has met to be trusted with securing the information stored, and the type of access that the Saudi government will have to this data. Human Rights Watch wrote to Google in February 2021 highlighting these and related concerns, such as asking how Google will vet employees that will have access to information stored in the Saudi Arabia Cloud region and how they will respond to authorities’ requests for user data that are legal under Saudi law but do not comply with international human rights standards.

In separate replies, Google reiterated its commitment to human rights, stated that an independent human rights assessment for the Google Cloud region in Saudi Arabia was conducted, and that the company took steps to address matters that were identified, but did not specify what those steps were. The UNGPs specify that human rights due diligence should involve meaningful consultation with potentially affected groups and other relevant stakeholders, and that companies should communicate how impacts are being addressed. The MENA digital rights organization SMEX also wrote to Google to express concerns about what data protection policies will apply to data hosted in Saudi Arabia, but has yet to receive a reply.

In order to address the serious human rights concerns linked to hosting a Cloud region in Saudi Arabia, Google should:

• Conduct a robust, thorough human rights due diligence process that includes meaningful consultation with potentially affected groups, including human rights organizations from the region, and publish a summary of findings, including steps it is taking to mitigate risks of adverse human rights impacts.
• Draw red lines around what types of government requests concerning Cloud regions it will not comply with because they are inconsistent with human rights norms.

Moving forward, Google should also:

• Prevent or mitigate risks of adverse human rights impacts and clearly communicate steps it is taking to this end before implementing plans to build cloud regions in other countries where there are similar risks linked to these business activities.
• Develop baseline standards for where to host cloud services that take into account Google’s human rights responsibilities to guide expansion into new countries.

The Saudi government has demonstrated time and again a flagrant disregard for human rights, both through its own direct actions against human rights defenders and its spying on corporate digital platforms to do the same. We fear that in partnering with the Saudi government, Google will become complicit in future human rights violations affecting people in Saudi Arabia and the Middle East region.

List of Signatories:

Organizations:

1. 7amleh – The Arab Center for Social Media Advancement
2. 7iber
3. Access Now
4. ALQST for Human Rights
5. Amnesty International
6. Association for Progressive Communications (APC)
7. Canadian Internet Policy and Public Interest Clinic (CIPPIC)
8. Center for Democracy and Human Rights in Saudi Arabia
9. Democracy for the Arab World Now (DAWN)
10. Digital Action
11. Electronic Frontier Foundation
12. Fantsuam Foundation
13. Freedom Forward
14. Front Line Defenders
15. Heartland Initiative
16. Human Rights Watch
17. International Center for Not-for-Profit Law (ICNL)
18. Iraqi Network for Social Media (INSM)
19. Jeem
20. Jokkolabs Banjul
21. Jordan Open Source Association
22. Masar
23. Media Matters for Democracy
24. MENA Rights Group
25. Mnemonic
26. Oxford Internet Institute (OII)
27. PEN America
28. Ranking Digital Rights
29. SMEX
30. Tahrir Institute for Middle East Policy (TIMEP)
31. Yemen Relief and Reconstruction Foundation (YRRF)

Individuals:

1. Abir Ghattas
2. Afef Abroughui
3. Joey Shea
4. Rima Sgheir
5. Sarah Aoun
6. Wafaa Ben Hassine
7. Wafaa Haikal