U.S. companies Amazon, Equinix, IBM, Google, Microsoft, and Oracle, and Chinese companies Alibaba, Huawei, and Tencent have all either launched cloud centers or announced future plans to launch cloud operations in the Gulf Cooperation Council (GCC) countries. Their operations and plans cover the entire region. Saudi Arabia and United Arab Emirates (UAE) are the countries in which most data center and cloud region projects have been announced or started.
All of the top five biggest cloud providers worldwide (Alibaba, Amazon, IBM, Google, and Microsoft) are among the companies investing in data center infrastructure in the GCC countries. The global cloud provider market is becoming increasingly concentrated between these companies, and they hold a lot of power and influence on a global scale. These companies are committing to supporting the GCC governments' ambitions of digital transformation, and are largely providing the physical infrastructure necessary for their achievement.
All the GCC countries are pursuing similar strategies when it comes to digitalization of society, economy and government. These strategies are outlined in national "vision" frameworks and digital transformation programs, where implementing eGovernments and becoming a hub for the digital economy are central objectives. Data centers are essential pieces of infrastructure to fulfill these ambitions of digital transformation, and are largely being provided by the outlined foreign companies.
The geographical location of a data center matters because data is typically stored at the nearest data center, and because data is subject to the jurisdiction of its geographical hosting countries. Thus, as more data centers are located within the borders of the GCC countries, their governments will have legal control over an increasing amount of data. This will have consequences for how data is stored and managed across the West Asia and North Africa (WANA) region.
Digital Authoritarianism in the GCC
GCC governments routinely violate Articles 12 and 19 of the Universal Declaration of Human Rights, articles which respectively enshrine the right to privacy and the right to freedom of opinion and expression.
In particular, Saudi Arabia and the UAE frequently take advantage of technology provided by international companies such as surveillance systems, spyware, and social media platforms to exert power over domestic and foreign populations.[1]
The most notorious of these technologies is the Pegasus surveillance spyware, which governments of Bahrain, Oman, Saudi Arabia, and the UAE acquired from the Israeli NSO group. The spyware was deployed by the governments of these countries, in order to potentially target thousands of individuals by exploiting vulnerabilities on their smartphones - this included thirty-six journalists from Aljazeera.
The Pegasus spyware is also believed to have been integral to the killing of Saudi Washington Post columnist Jamal Khashoggi on 2 October 2018.[2] This last example may be the epitome of digital authoritarianism in the Gulf: severely infringing upon the privacy of individuals in order to brutally silence voices dissenting from a regime's line and ideology.
Another prominent practice of digital authoritarianism deployed by Gulf regimes is the use of social media bot armies in order to manipulate public discourse. The tactic was previously used on Twitter to manipulate the discourse around Khashoggi's murder[3] and to prop up attention around Emirati leader Mohammed bin Zayed.[4]Outside the GCC's borders, experts believe that the UAE and Saudi governments were previously behind social media propaganda campaigns supporting the Sudanese military after they committed a massacre of pro-democracy protesters in 2019, supporting Khalifa Haftar's attempt to overthrow a United Nations-recognized government in Libya,[5] and to distract from criticism over violations from Saudi-aligned forces in the war in Yemen.[6]
More Data, Yet Weak Personal Data Protection Laws and a High Degree of Government Control
Gulf states are among those with the highest internet penetration rates in the world. Along with the increasing capacity for storing and processing data in local data centers, the data consumption in the region is expected to grow by 400 percent between 2022 and 2028.[7] Thus, due to the increasing data localization and the push for data sovereignty, more and more data will be subject to the jurisdiction of these states. This is an integral point of concern for privacy and human rights in the region.
Saudi Arabia and the UAE introduced personal data protection laws (PDPLs) aimed at localizing data within their jurisdictions. Sufficient data center infrastructure is essential to achieve this and to ensure data sovereignty. Saudi Arabia also introduced a separate Cloud Computing Regulatory Framework (CCRF)[8] that contains stipulations about the retention and storage of personal data in its jurisdiction. The CCRF stipulates that government entities may only host their data with cloud service providers that have the appropriate licenses issued by the Communications and Information Technology Commission, and that no data of Saudi Arabia's public sector may be transferred outside of the country for any purpose.[9]
The PDPLs in Saudi Arabia and the UAE contain vague language and concerning loopholes: Saudi Arabia's PDPL contains exceptions for the law to not apply in cases related to "security, the Kingdom's reputation, the Kingdom's diplomatic relations, confidential sources of information, exceptions related to the public authorities,"[10] and UAE's PDPL stipulates that the law "shall not apply" to "government data" or "personal data held with security and judicial authorities" among other exceptions.[11] These loopholes essentially give the governments room to handle the data as they wish, putting individuals' privacy and human rights in the Gulf and the broader WANA region at further risk.
Further indicating the notion that the authoritarian governments of the region will have close access to the increasing amount of data that will flow through their territory, is the fact that most of the relevant data centers are being built in close collaboration with government entities. In many cases, such as Huawei's data center in Bahrain[12] and Google's cloud region in Saudi Arabia,[13] government-related entities (respectively Batelco[14] and Aramco) will control infrastructure and provide services.
Aramco, the world's largest oil producer and the third largest company in the world, is primarily owned by the Saudi state. In Saudi Arabia's push to achieve the objectives outlined in the Saudi Vision 2030, Aramco is a strategically important player. As the country is looking to diversify its economy away from oil dependency, Aramco is in the process of being transformed into a "global industrial conglomerate."[15] Google Cloud's data centers in Saudi Arabia are built in collaboration with Aramco. While Google will deploy and operate the cloud region, a subsidiary of Aramco will be offering the cloud services to customers in Saudi Arabia.[16]
Previous cases illustrate how authoritarian governments in the region will not hesitate to abuse their access to data to exercise control and crackdown on dissent. In a 2022 federal court ruling in the U.S., a former Twitter employee was "found guilty of spying on Saudi dissidents using the social media platform and passing their personal information to a close aide of Crown Prince Mohammed bin Salman."[17] This example shows the length to which the Saudi regime is willing to go to reach their objectives and consolidate power, and that they are not necessarily afraid of the repercussions that might come with exploiting tech companies' platforms.
The close collaboration between international cloud providers and government-owned companies and entities will only increase the risk of unauthorized access to data by GCC governments.
Human Rights Due Diligence
Technology companies do not hide their commitments to supporting the digital ambitions of GCC governments. Many make explicit commitments to supporting data localization requirements in the region by providing data center infrastructure.
When announcing their launch of a cloud region in Qatar, Microsoft highlighted that their investments will "empower customers to meet local compliance and policy requirements" and "provide a foundation for the country to achieve Qatar National Vision 2030."[18] In Saudi Arabia, Oracle's vice president of technology for EMEA (Europe, Middle East, and Africa) said upon the announcement of the company's second cloud region in the country that his company is "fully committed to support Saudi Arabia's digital economy objectives in line with Saudi Vision 2030."[19]
As explained above, given the GCC's poor human rights record and weak data protection laws in the region, the joint ventures between GCC governments and the world's most powerful technologies companies is bad news for digital rights. The most dominant technology companies, often known as Big Tech, collect and keep a wide range of user data through their data processing and cloud services. U.S. company Oracle alone claims to have data from three billion user profiles, with thousands of data points that can be used to predict future behavior of individuals.[20]
Yet, what are these companies doing to protect human rights in their new ventures? Not enough as demonstrated by publicly available evidence.
During the 2022 Annual General Meeting of Alphabet, a majority of shareholders rejected a proposal led by global advocacy group SumOfUs to "commission a human rights assessment of the company's plans to locate cloud centers in countries with poor human rights records,"[21] including Saudi Arabia, and publish it online. A majority of independent shareholders (57.6 percent) voted in favor of the proposal. However, due to Alphabet's voting system, which gives more votes to a certain class of shareholders--the 17.06 percent consisting of company executives, officers, and its former CEO-- managed to secure a majority of votes in favor of building the data center in Saudi Arabia.[22]
The company did promise to conduct a human rights impact assessment in Saudi Arabia, and claim to have done so. However, they have not made such an assessment public, nor have they shared it with the shareholders or the thirty-nine human rights organizations that called upon Google to make the assessment. Alphabet's Human Rights Policy claims that: "In everything we do, including launching new products and expanding our operations around the globe, we are guided by internationally recognized human rights standards."[23] However, Google has "not provided information on what organization undertook that 'independent human rights assessment' and it has not provided information on the 'matters identified' or 'steps [taken]'."[24] In other words, the human rights diligence claimed by such a prominent US company like Google is not very reassuring, and is yet another source of concern.
Conclusion
Ultimately, the report raises serious concerns about the implications that the relevant investments may have for human rights, privacy, and freedoms not just in the Gulf but also the entire WANA region. GCC digital authoritarianism and willingness to exploit technology provided by foreign companies in order to reach their objectives is a source of concern for how they may exploit newly acquired data center capacity to further manipulate digital spaces. The weak personal data protection laws and high degree of government control over the data centers reinforce concerns about the degree of access and control that the governments will have over personal data of individuals around the WANA region.
Adding to these concerns is the fact that the relevant technology companies also have a track record of being opaque in their ventures. Many of the companies commit to helping the GCC governments in reaching their objectives of digital transformation and data localization, and at the same time most of the companies lack disclosure of how they handle requests from governments when it comes to both censorship of content and user information. Thus, the strengthened relationships between the highlighted companies and the GCC governments is a dangerous development for digital rights in the region, and the implications of the infrastructure investments highlighted in this report should be paid close attention to.
This is an edited excerpt of the SMEX report entitled Mapping Tech Companies' Cloud Expansion in the Gulf and Its Human Rights Implications. The full report is accessible here: https://smex.org/wp-content/uploads/2024/03/Mapping-report-Final.pdf.
For further information, please contact: Social Media Exchange (SMEX), Badaro, Beirut, Lebanon, e-mail: info@smex.org; https://smex.org/.
[1] Gaurav Bhatnagar, "Sultanate of Oman Achieves Major Digital Milestone on Journey to National Vision 2040 Supported by Oracle", Oracle News, 22 June 2022, www.oracle.com/kw/news/announcement/sultanate-oman-achieves-major-digital-milestone-with-oracle-2022-06-22/.
[2] Afef Abrougui & Mohamad Najem, "Follow the Money for Better Digital Rights in the Arab Region", The Project on Middle East Political Science, 2021, https://pomeps.org/follow-the-money-for-better-digital-rights-in-the-arab-region.
[3] Abrougui & Najem, "Follow the Money for Better Digital Rights in the Arab Region," ibid.
[4] Megan O'Toole, "Digital authoritarianism: The rise of electronic armies in the Middle East", Middle East Eye, 29 September 2022, www.middleeasteye.net/opinion/middle-east-digital-authoritarianism-electronic-armies-rise.
[5] Ibid.
[6] Abrougui & Najem, "Follow the Money for Better Digital Rights in the Arab Region," op. cit.
[7] O'Toole, "Digital authoritarianism: The rise of electronic armies in the Middle East," op. cit.
[8] RationalStat, "Middle East and North Africa Data Center Market Analysis and Forecast 2019-2028."
[9] Communications, Space & Technology Commission, "Cloud Computing Services Provisioning Regulations", Kingdom of Saudi Arabia, October 2023, www.cst.gov.sa/en/RulesandSystems/RegulatoryDocuments/Documents/CCRF_En.pdf.
[10] Baker McKenzie, "Data Localization/Residency", Baker McKenzie, May 8th 2023, https://resourcehub.bakermckenzie.com/en/resources/data-privacy-security/emea/saudi-arabia/topics/data-localizationresidency.
[11] Marianne Rahme, "Data Protection in Saudi Arabia: Comparative Analysis", SMEX, 10 February 2022, https://smex.org/data-protection-in-saudi-arabia-comparative-analysis/.
[12] Nay Constantine, "UAE's Data Protection Law: Between Exceptions and Exemptions", SMEX, 25 March 2022, https://smex.org/uaes-data-protection-law-between-exceptions-and-exemptions/.
[13] Max Smolaks, "Huawei to build Tier III data center for Bahrain's Batelco", Data Centre Dynamics, 26 October 2018, www.datacenterdynamics.com/en/news/huawei-to-build-tier-iii-data-center-for-bahrains-batelco/.
[14] Dave Stiver, "Expanding our global footprint with new cloud", Google Cloud, 21 December 2020, https://-cloud.google.com/blog/products/infrastructure/google-cloud-announces-new-regions.
[15] Batelco is a telecommunications company in which the Bahraini government is the majority stakeholder. It is the main telecommunications company in Bahrain and also has a presence in a multitude of other countries around the WANA region.
[16] Government of Saudi Arabia, "Saudi Vision 2030."
[17] Aramco, "Aramco to bring Google Cloud Services to Saudi Arabia", Aramco, 21 December 2020, www.aramco.com/en/news-media/news/2020/aramco-to-bring-google-cloud-services-to-saudi-arabia.
[18] Julian Borger, "Ex-Twitter employee found guilty of spying on Saudi dissidents", The Guardian, 10 August 2020, www.theguardian.com/us-news/2022/aug/09/twitter-saudi-arabia-dissident-spying.
[19] Microsoft News Center, "Microsoft opens first global datacenter region in Qatar, bringing new opportunities for a cloud-first economy", Microsoft, 31 August 2022, https://news.microsoft.com/en-xm/2022/08/31/microsoft-opens-first-global-datacenter-region-in-qatar-bringing-new-opportunities-for-a-cloud-first-economy/.
[20] Dan Swinhoe, "Oracle to launch cloud region in Saudi Arabia's Neom city", Data Centre Dynamics, 28 October 2021, www.datacenterdynamics.com/en/news/oracle-to-launch-cloud-region-in-saudia-arabias-neom-city/#:~:text=Oracle%20opened%20its%20first%20Saudi,includ ing%20a%20second%20Saudi%20region .
[21] 64 Wolfie Christl, "Corporate Surveillance in Everyday Life", Cracked Labs, June 2017, https://crackedlabs.org/en/corporate-surveillance.
[22] Access Now, "Saudi Google Cloud center: shareholder vote can prevent storm of human rights abuses", Access Now, 30 May 2022, www.accessnow.org/press-release/google-cloud-saudi-arabia-alphabet-shareholders/ .
[23] SMEX, "Google is Moving Forward with its Data Center in KSA", SMEX, 22 June 2022, https://smex.org/google-is-moving-forward-with-its-data-center-in-ksa/ Google, "Human Rights", Google, 2023, https://about.google/intl/ALL_in/human-rights/.
[24] U.S. Securities and Exchange Commission, "Alphabet Inc. Shareholder Proposal: Data Operations in Human Rights Hotspots", SEC, 1 June 2022. www.sec.gov/Archives/edgar/-data/1652044/000121465922005905/j427221px14a6g.htm.