IBM pushes back against US government data requests

Jetter added that, in the one instance where a request was made by US authorities under the Cloud Act, “IBM insisted the US government either contact the client directly or work through the internationally recognised mutual legal assistance treaty [MLAT] process. Faced with the IBM position, the US government pursued the MLAT process.”

According to the company’s 2020 Law enforcement requests transparency report, IBM received 42 law enforcement requests from the US federal government last year, and 17 from US state governments, which it said have nothing to do with the Cloud Act.

While client data was not provided in any of these instances, account information – which includes “basic subscriber contact information such as name, email, business address, and IP address” – was provided in 40 and 16 cases respectively.  

Another 22 requests for its customer data were made by “other countries”, 20 of which led to the disclosure of account information, and one of which led to the disclosure of IBM client data to the UK government, although IBM declined to comment on the specifics of the case.

Speaking to Computer Weekly, IBM’s vice-president of government and regulatory affairs in Europe, Liam Benham, clarified that “the one request that is mentioned in our latest transparency report is not the same request we’re talking about under the Cloud Act… We’ve had one Cloud Act request in the three-plus years life of the act, and over the past 12 months… we reported one additional request from a government that wasn’t the US government.”

He added: “I think that also speaks to our point here that we are not a magnet for these government data requests, and I think that’s because of the nature of our business – we’re not in that consumer space where many of these requests target.”

Aside from the Cloud Act, under section 702 of the Foreign Intelligence Surveillance Act (FISA), the US attorney general and director of intelligence services are able to jointly authorise the targeted surveillance of people outside the US, as long as they are not a US citizen.

Any court order issued under FISA laws also comes with a gag order, a legal instrument that prevents the recipients from letting anybody else know they have received the order.

Asked about FISA, Benham said: “We’ve never provided client data stored outside of the US to the US government under any national security order, including FISA warrants. We’ve also said that we would legally challenge any attempt to access our clients’ data, and we would also legally challenge any attempt at a gagging order.

“We do not own this data, we’re mapping this data on behalf of our client, so you’ve got to go talk to the client if you have concerns… because protecting our clients’ data is obviously sacrosanct to our business.”

He added that despite IBM’s focus on managing business customers’ data, it would approach the disclosure of industrial data just as it would with personal data. “We apply these principles equally,” he said, adding that other cloud providers must be more open and transparent about government requests for their customers’ data.

Agnieszka Bruyère, vice-president of IBM Cloud in EMEA, said these were “legitimate concerns because the data is really the source of innovation”, reiterating that the data is owned by IBM’s clients, not IBM itself.

“Back in 2017, we put in place the specific service which is called EU-only services, where the operations are done by EU personnel. We have a specific approval process under control, with very strict controls, to give temporary access, if the necessity is raised, to a non-EU person.

“But all of this is completely strict to the approvals and with the controls we put in place, with a very short timeframe when the people can actually connect, so I think that’s a very important differentiator for us.”