Brazil’s Rousseff targets internet companies after NSA spying

SAO PAULO (Reuters) – Angered by reports that the U.S. government spied on her and other Brazilians, President Dilma Rousseff is pushing new legislation that would seek to force Google, Facebook and other internet companies to store locally gathered data inside Brazil.

The requirement would be difficult to execute, technology experts say, given high costs and the global nature of the Internet. Still, Rousseff’s initiative is one of the most tangible signs of a backlash following revelations that the U.S. National Security Agency monitored emails, phone calls and other communications abroad.

The legislation, which is being written by a lawmaker in Rousseff’s left-wing Workers’ Party and is scheduled to be completed next week, would force foreign-based internet companies to maintain data centers inside Brazil that would then be governed by Brazilian privacy laws, officials said.

Internet companies operating in Brazil are currently free to put data centers wherever they like. Facebook Inc, for example, stores its global data in the United States and a new complex in Sweden.

Rousseff believes that the change would help shield Brazilians from further U.S. prying into their activities, and she is considering urging other countries to take similar measures when she speaks at the United Nations General Assembly later this month, a senior Brazilian official told Reuters.

“This would be a turning point for these companies,” the official said, naming Facebook, Google Inc and Microsoft Corp as examples, although they would not be the only companies affected. “If you want to work here, you will have to obey our rules.”

The official spoke on condition of anonymity to frankly discuss Rousseff’s plans and the consequences of the law.

The proposal follows a series of media reports based on documents leaked by Edward Snowden, a former NSA contractor who is now in asylum in Russia.

While Brazil is one of several countries named as targets in the documents, the revelations have been especially controversial here because of a long-standing distrust of U.S. spy agencies’ activities in Latin America and a report that Rousseff’s own communications were compromised.

In another sign of concern from the region, Brazil’s Defense Minister Celso Amorim said on Thursday he planned to discuss a plan for bilateral cooperation on cyber defense with Argentina’s president, Cristina Fernandez, during a meeting in Buenos Aires.

Alessandro Molon, a legislator in Brazil’s house of deputies, was invited to the presidential palace on Tuesday to meet with Rousseff, several ministers and other top aides to discuss the proposed changes to data storage requirements.

Molon has been pushing Congress since 2012 to pass a bill known as the “Internet Constitution.” The law would establish Brazil’s first legal framework for users’ rights online, and among other requirements would force social media companies to delete users’ data once they close their profiles.

The president asked Molon to add language to the bill regarding data centers, Molon’s spokesman Leonardo Santos said.

Following the meeting, Rousseff’s office filed a motion in Wednesday’s edition of the government’s official gazette that seeks to force Congress to vote on the bill in the next 45 days.

DIFFICULT, BUT MAYBE NOT IMPOSSIBLE

Santos said Molon has been in regular contact with internet companies over the past year and he is aware of the technical challenges posed by Rousseff’s request and other provisions.

The proposed changes are “difficult, as they (the companies) say, but I don’t know if they’re impossible,” Santos said.

Santos declined to provide further details of the legislation, such as which types of data would be covered by the law or which categories of companies would be subject to such rules, saying such questions were still under study.

Bill Coughran, a former senior vice president of engineering at Google and now a partner at top-tier venture firm Sequoia Capital, said Brazil would not be able to impose controls on the transport of all data.

A more likely outcome would be less onerous restrictions that keep some data local, which might add to corporate expenses and reduce income while making the consumer experience slightly worse, he said.

“Balkanization would increase the complexity of how you manage your business,” Coughran said.

Representatives for Facebook and Microsoft did not immediately respond to requests for comment.

Some European countries already require certain sensitive personal data to be stored locally. Microsoft, Amazon and other big providers of remote computing services have data centers in those countries so their customers can comply with local regulations.

Social media may be more difficult to govern. If a Facebook user in Brazil commented on a French friend’s post, for example, it is not clear how that data could stay in Brazil.

Studies suggest building data centers in Brazil is more expensive and logistically difficult than many other countries.

A 2012 report by real estate firm Cushman & Wakefield and hurleypalmerflatt, an engineering consultancy, ranked 30 nations in terms of risks posed to data center operations. Brazil finished in last place, due primarily to high electricity costs, low education levels and a poor environment for doing business.

However, as Latin America’s largest economy and home to some of the world’s most prolific users of social media, Brazil may be too big for companies to just walk away from if they do not like the legislation.

Brazil’s internet penetration rate is 44 percent – half that of the United States – meaning it still has plenty of growth potential.

The new legislation is one of several responses by Rousseff to the reported spying.

She has demanded a detailed account from Washington on the extent of its espionage in Brazil, and said that otherwise she may cancel a planned state visit to Washington next month.

Her government has so far rejected Washington’s contention that it gathers intelligence only to guard against threats to U.S. national security. Brazil is a peaceful democracy with no history of international terrorism and no access to weapons of mass destruction.

The senior Brazilian official voiced a belief that the data storage bill would not only work but other countries would follow suit, naming other members of the BRICS bloc of large emerging markets: China, India, Russia and South Africa.

“Once we do it, it will become a standard,” the official said.

(Additional reporting by Esteban Israel, Anthony Boadle and Brad Haynes in Brazil, Guido Nejamkis in Argentina and Joseph Menn in San Francisco; Editing by Kieran Murray, Eric Walsh and Mohammad Zargham)