Revealed: Israel demanded Google and Amazon use secret ‘wink’ to sidestep legal orders
In 2021 Israel secured a $1.2bn cloud contract with Google and Amazon that included a clandestine "winking mechanism"—a coded payment system to alert Israeli officials when the firms complied with foreign data requests. The arrangement, part of Project Nimbus, raises questions about legal complianc…
In 2021 Israel signed a $1.2 billion cloud‑computing agreement with Google and Amazon, known as Project Nimbus. The contract contained an unusual clause that required the two U.S. firms to send a secret, coded signal—dubbed the “winking mechanism”—to the Israeli government whenever they were compelled by foreign courts or law‑enforcement agencies to hand over Israeli data. The code, embedded in small payments, was intended to alert Israel without breaching the gag orders that typically accompany such requests.
What the "wink" entails
According to leaked finance‑ministry documents, the mechanism works through "special compensation" payments made within 24 hours of a data transfer. The amount corresponds to the telephone country code of the requesting nation: a request from the United States (+1) triggers a payment of 1,000 shekels, Italy (+39) triggers 3,900 shekels, and so on. If a gag order prevents the companies from even indicating the country, a back‑stop payment of 100,000 shekels (about $30,000) is required.
Legal analysts say the scheme skirts the letter of U.S. law that obliges companies to keep subpoenas confidential, while potentially violating the spirit of those same obligations. Former U.S. prosecutors described it as "highly unusual" and warned that a court could view the payments as an illegal workaround.
Why Israel demanded the code
Israeli officials feared that data stored on foreign cloud platforms could be accessed by overseas authorities, undermining national security and sovereignty. The government also anticipated pressure from human‑rights groups and European courts that might force the tech giants to suspend services if they were linked to alleged abuses in the occupied Palestinian territories. By embedding the wink, Israel aimed to retain real‑time awareness of any external data disclosures while preventing the cloud providers from unilaterally cutting off access.
Project Nimbus also includes clauses that bar Google and Amazon from restricting any Israeli agency, security service or military unit from using the cloud, even if the usage appears to breach the companies' standard acceptable‑use policies. The contract explicitly prohibits the firms from suspending services for political or human‑rights reasons, and imposes financial penalties for non‑compliance.
Corporate responses and broader scrutiny
Both Google and Amazon have denied that they ever used the winking mechanism to evade lawful orders. A Google spokesperson called the suggestion "categorically wrong" and reiterated that the company follows its global process for handling lawful requests. Amazon similarly said it has no process to circumvent confidentiality obligations.
Despite the denials, the leaked documents show that the companies agreed to adapt internal procedures and subordinate some contractual terms to satisfy Israel's demands. The arrangement mirrors earlier controversies, such as Microsoft’s decision in 2024 to cut off the Israeli military’s access to Azure after reports that the platform stored intercepted Palestinian phone calls. Microsoft’s bid for the Nimbus contract failed, reportedly because it refused to accept Israel’s most stringent clauses.
Project Nimbus has drawn criticism from NGOs, journalists and former intelligence officials who argue that the deal enables large‑scale surveillance and potentially illegal data transfers. During Israel’s 2023‑2024 war in Gaza, the military reportedly stored massive volumes of intercepted communications on cloud services, first on Microsoft’s Azure and later planning a migration to Amazon Web Services. The scale of that data—described by a UN commission as evidence of possible genocide—highlights the stakes of how cloud infrastructure is used in conflict zones.
Legal and ethical implications
The winking mechanism raises a clash between U.S. legal obligations and Israeli contractual demands. If a U.S. court discovers that a company is sending coded payments to a foreign government to signal compliance, it could view the act as contempt of court or obstruction. Conversely, Israel argues that the clause protects its sovereign right to know when foreign powers access its data.
Human‑rights advocates warn that the contract’s “no‑restriction” language could allow the Israeli military to move any type of data—including intelligence on civilians—into the cloud without oversight. The agreement also sidesteps the usual corporate safeguards that prevent the use of cloud services for activities that cause "serious harm" to people, a standard clause in both Google’s and Amazon’s acceptable‑use policies.
While the contract is set for an initial seven‑year term with an option to extend, the lack of public transparency makes it difficult for watchdogs to assess ongoing compliance. Both tech giants have declined to comment on whether the wink has ever been triggered since the deal’s inception.
What comes next?
As of 2024, the winking mechanism remains a confidential provision, known only through leaked documents and investigative reporting by The Guardian, +972 Magazine and Local Call. Future legal challenges in the United States or Europe could force Google or Amazon to reveal whether they have ever used the code, potentially exposing them to fines or contract termination.
Meanwhile, the Israeli government continues to rely on cloud services for a broad range of civilian and military operations. Any shift in corporate policy—such as a decision similar to Microsoft’s 2024 cut‑off—could have significant operational impacts, given the contract’s prohibition on service suspension. Stakeholders, including civil‑society groups and international regulators, are watching closely to see whether the balance between national security, corporate responsibility and human‑rights law can be maintained.
Why it matters
The secret "wink" reveals how governments can embed covert compliance tools in high‑value tech contracts, raising profound legal and ethical questions about data sovereignty and corporate accountability.
Key points
- Israel’s $1.2 bn Nimbus contract required Google and Amazon to send coded payment alerts when foreign authorities accessed Israeli data
- The "winking mechanism" ties payment amounts to the requesting country’s telephone code, with a 100,000‑shekel backstop
- Both firms deny using the code, but leaked documents show they accepted the clause to secure the deal
- The contract bars the companies from restricting any Israeli agency, even if usage breaches standard acceptable‑use policies
- Legal experts warn the mechanism could conflict with U.S. subpoena secrecy laws and expose the firms to penalties
Frequently asked questions
What is the "winking mechanism" in the Israeli cloud contract?
It is a covert system that requires Google or Amazon to make a small payment to Israel—coded to the requesting country's telephone prefix—whenever they are forced by a foreign court to hand over Israeli data and are gagged from notifying the government.
Did Google or Amazon actually use the secret code?
Both companies have publicly denied ever using the mechanism, and no direct evidence has been released showing a payment was made. The existence of the clause is confirmed by leaked Israeli finance‑ministry documents.
How could the winking mechanism violate U.S. law?
U.S. subpoenas often include confidentiality orders. Sending a coded payment that signals compliance could be seen as an attempt to circumvent those orders, potentially constituting contempt of court or obstruction.
Why did Israel want such a clause in the Nimbus deal?
Israel wanted real‑time awareness of any foreign data requests to protect national security and to prevent activist or judicial pressure from forcing the tech firms to cut off services.
What are the broader implications for cloud providers?
The clause highlights the tension between sovereign data‑access demands and global legal obligations, suggesting future contracts may face increased scrutiny from regulators, NGOs and courts.
