Microsoft and Google may have to surrender people’s data to Saudi Arabia after signing huge deals there

• Activists say that tech firms could become complicit in Saudi surveillance and repression. 
• Firms including Microsoft and Google are creating cloud storage centers in the kingdom. 
• But Saudi Arabia has weak privacy laws and a track record of persecuting dissidents. 

At a lavish conference in Riyadh, in February, representatives from some of the world’s biggest tech companies gathered. 

The event was part of Crown Prince Mohammed bin Salman’s “Vision 2030” plan to transform Saudi Arabia, best known for its oil reserves and ultraconservative interpretation of Islam, into a hub for tech and innovation.

Technology bosses rubbed shoulders with Saudi officials and planners of Neom, the $1 trillion futuristic data-run megacity being built in the northwest of the kingdom that is the centerpiece of the crown prince’s vision.

Soon after, Saudi officials announced they had secured $9 billion in investment from the firms, including a $2 billion plan from computer and tech giant Microsoft to build a cloud storage facility in the kingdom.

It followed a similar announcement from Google last year that it would create a cloud center in the kingdom. 

Saudi’s ill-defined security laws

But as tech firms rush to secure lucrative Saudi contracts, human rights activists are warning that Saudi officials could use the vast stores of digital information being stored in the kingdom to intensify its brutal persecution of dissidents.

They are warning tech giants like Microsoft and Google that they could be forced to hand over private citizen data to Saudi hitmen. 

In a May report, Human Rights Watch warned that under Saudi law, security services are given sweeping powers to access data, and can compel companies to hand over private information deemed to have breached ill-defined and broad national security laws.

It said that Google and Microsoft, two of the biggest tech firms in the world, are refusing to disclose how they will shield the privacy of data hosted in the kingdom. 

Data handed over a silver platter

Marwa Fatafta, an analyst with digital rights group Access Now, described Saudi Arabia as a country with a “dismal” human rights record.

“There are serious concerns around data protection, around privacy, around surveillance,” she said. “Have they really [Google and Microsoft] investigated how they plan to mitigate potential human rights abuses or privacy violations, building such infrastructure?” 

 “A Google cloud center under Saudi’s jurisdiction would basically serve our sensitive data on a silver platter to Saudi’s top hitmen,” Rewan Al-Haddad, campaign director for a shareholder group called S,umOfUs told the New York Post last year. 

In recent years, Saudi authorities have ruthlessly pursued government critics on social media, using spyware to track exiled dissidents, and even reportedly infiltrating Twitter’s headquarters to steal data.

Recently, Saudi authorities jailed a woman, Fatima al-Shawarbi, for 30 years who criticized the Neom megacity project on Twitter. In 2020, Leeds University student, Salma al-Shehab, was given a 30-year jail sentence for criticizing the crown prince on the social media platform. 

Saudi Arabia can ‘do want it wants’

Professor Alan Woodward, a computer technology expert at the University of Surrey, said that Saudi authorities would potentially be able to access vast amounts of sensitive political information stored via the cloud. 

“The government can basically do what it wants,” he said. “And if you can imagine all the things that are put online it could be something quite edgy, it could be used against dissidents.”

Countries such as Saudi Arabia, he said, often told companies that “if you want to operate in this country, you’ve got to keep the data in this country. And that’s for an obvious reason: So they could potentially access it.”

Microsoft told Insider it remained committed to human rights, yet offered no concrete details on how it would safeguard data privacy while operating in a state that doesn’t acknowledge it. 

“Respecting human rights is a core value of Microsoft. Our investment in the region will be consistent with Microsoft’s commitment to protecting fundamental rights and includes a focus on responsible cloud practices including security, privacy, compliance, and transparency, as well as adherence to Microsoft’s values and principles,” a Microsoft spokesperson told Insider. 

A Google spokesperson pointed Insider to a statement on the company’s website, saying that “as the global landscape continues to evolve, we are committed to collaborating with human rights organizations and the broader technology industry to uphold human rights in every country where we operate.”

James Lynch, a researcher at human rights organization Fairsquare, challenged Microsoft and Google to publish their human rights “due diligence” reports, aimed at assessing how they can ethically operate in a country with a poor human rights record. 

However, he said the companies refused to publish the reports and called on them to “show us clearly how they plan to mitigate risks such as the Saudi authorities asking them for access to data.”

Neom, a surveillance city 

A particular concern for human rights activists is Neom, the vast city Crown Prince Mohammed has commissioned to be built in the northeast of the kingdom. Saudi Arabia’s sovereign wealth fund has earmarked $1 trillion to build the city, whose services, ranging from transport to air conditioning will be run on user data accessed through smartphones. 

In March, Insider reported on concerns that the data could be used in huge surveillance systems by Saudi authorities, to track and monitor residents in real time. 

It’s a concern James urged Western firms planning on being involved in the creation of the city’s digital infrastructure to address. 

“Tying in almost all data about the way people live and using that as the organizing principle of the city is extremely scary,” said Lynch, in a country with at best opaque privacy laws and sweeping powers to suppress dissent. 

Neither Google nor Microsoft would say whether they were involved in building Neom’s digital infrastructure. 

But amid the concerns, there is also the question of whether Saudi Arabia would risk imperiling the investment it has pinned so much of its future on through using data stored in the kingdom.

It’s part of a balancing act analysts have told Insider Crown Prince Mohammed has long sought to perform, seeking to open up the kingdom to innovation and appear as a reformer, while maintaining his authoritarian powers to quash dissent. 

“I would take Neom’s involvement positively, and perhaps that might tip one over into sort of looking at this with the glass half full and say, ‘well, it’s genuinely probably part of the kingdom’s attempts to diversify and hence have more technology infrastructure in the country,” said Woodward.