After US spying, Brazil to require local data storage

Brazil, in an effort to protect its citizens from alleged spying by the NSA, is going full-steam ahead with its plan to force global Internet companies to store Brazilian user data within the country.

Brazilian President Dilma Rousseff is pushing lawmakers to vote on the law as soon as this week, and the law could have significant implications on how Internet giants like Google, Facebook and Twitter conduct business in one of the world's largest telecommunications markets.

Rousseff's insistence on a speedy vote comes after revelations, exposed by former NSA contractor Edward Snowden, that U.S. surveillance operations in Brazil were so widespread they even managed to track the personal phone calls and emails of Rousseff herself. The news is in line with other reports of spying in Germany, France and numerous other countries.

A draft of the law reads "the government can oblige Internet service companies ... to install and use centers for the storage, management and dissemination of data within the national territory." This would give the Brazilian government authority to force companies to build servers in Brazil for all of Brazil's web traffic.

The government would evaluate the requirement for each company, the draft says, "taking into consideration their size, their revenues in Brazil and the breadth of services they offer the Brazilian public."

The spying has given Rousseff, a leftist who is expected to run for another four-year term in 2014, a cause celebre to pursue both at home and on the international stage, especially after Germany said it would back a Brazilian proposal at the United Nations that would seek to strengthen international rules for Internet governance and put limits on foreign surveillance.

According to Amie Stepanovich, director of the domestic surveillance project at the Electronic Privacy Information Center, Brazil is not alone.

"As countries, specifically foreign leaders, realize that they are not only vulnerable to but also the subject of NSA surveillance, they've come out to try and find a solution to make sure that this couldn't happen again and to make sure that the NSA can't reach their users' data," Stepanovich said.

But she said to do so would likely be extremely complicated, and forcing companies to open up offices in every country they want to operate in just to do business wouldn't necessarily keep data out of the hands of the NSA. Plus, it would also drive up the cost of business.

"If Facebook has a server in Brazil where information is routed through before it goes back to their offices in the U.S., the NSA can still get ahold of that data," Stepanovich said. "They would have to be walled off completely. The nature of the Internet means that data flows everywhere, so the thought that they could keep information within the geographical boundaries of the country just doesn't seem to make a lot of sense."

Brazil will host a conference in Rio next April to discuss ways to guard Internet privacy from espionage. The meeting will be held by ICAAN, the body that manages web domain names and is considered neutral by many because it includes governments, civil society and industry.

Proponents of the Brazilian law say in-country data centers would make companies answerable to local privacy rules and other Brazilian laws. They dismiss industry fears that the law would make online activities costly and inefficient and create unnecessary barriers in what is supposed to be a frontier-free Internet.

"We are not regulating the way information flows, just requiring that data on Brazilians be stored in Brazil so it is subject to the jurisdiction of Brazilian courts," Rousseff spokesman Thomas Traumann said. "This has nothing to do with global communications."

But the government argues the size of the market justifies having part of the infrastructure in the country, especially when companies like Google, which recently built a data center in Chile, are already setting it up nearby.

"The Brazilian market is huge," a senior official told Reuters. "There is a consensus within the government that if the market is here, it makes sense to have the data centers here too."

Some in the industry believe big companies would eventually comply, if given no choice. Others, however, say companies could skip Brazil or choose to operate remotely. That's especially true for companies that don't already have a physical presence in Brazil, because the law, according to the draft, would apply only to foreign companies with offices in the country.

Dexter Mullins contributed reporting, with Reuters.