Where Are The Panama Papers? Governments May Pester Amazon, But Good Luck Getting In

With its smiley logo and rock-bottom prices, Amazon.com might be one of the world’s most beloved brands. But in the wake of the massive Panama Papers data leak, the online retailer could soon find itself playing middleman in one of the largest international tax and money-laundering scandals in history.

The Seattle tech giant is reportedly playing host to the 11 million leaked documents, which are said to reveal details of offshore accounts and shell companies for dozens of global power players, celebrities and world leaders. The documents, as widely reported, fell into the hands of the German newspaper Süddeutsche Zeitung, which handed them off to the International Consortium of Investigative Journalists, a nonprofit. The ICIJ then helped disseminate the material to more than 100 news organizations around the world.

To do that, the group uploaded a staggering 2.6 terabytes of data to an Amazon cloud data center, as Mar Cabra, head of ICIJ’s data and research unit, explained to Forbes on Tuesday. Cabra said the Panama Papers remain in an encrypted searchable database accessible only to a select group of about 400 journalists — for now, that is.

All of which raises the question of what Amazon is legally required to do if the United States or any number of foreign governments come knocking. Could Jeff Bezos’ behemoth be forced to disclose the documents to law enforcement? International security experts say there is no clear answer given the jurisdictional scope of the situation. At last count, the Panama Papers contain details of the offshore activities of politicians from at least 50 countries while Amazon’s cloud computing division operates in a dozen geographic regions.

“It isn’t a clear-cut answer in terms of who has access to or can compel production of the Panama Papers,” said Albert Gidari, director of privacy at the Stanford Center for Internet and Society.

Foreign governments have, in the past, compelled American companies to disclose data, but Gidari said the legal justification for that is still far from settled. “That is the subject of a lot of discussion today,” he said. “There certainly are cases where that has happened, just as the U.S. has forced subsidiaries of foreign companies operating in the U.S. to disclose data. But many companies have blocking statutes and require data requests to go through formal procedures.”

Gidari said the location of the data itself shouldn’t necessarily matter if Amazon is subject to the jurisdiction of the country making the data request, but even that is up for debate. In fact, Microsoft is currently embroiled a legal battle that hinges on this very issue, fighting a U.S. search warrant for emails stored in Ireland. The case is now in the 2nd U.S. Circuit Court of Appeals.

Robert Chesney, director of the Strauss Center for International Security and Law at the University of Texas, said another possible scenario is that a foreign government could come to a U.S. court to try to demand the documents, but the mechanisms in place for that are complex. He said they usually involve a bilateral treaty or process called “letters rogatory,” which is sometimes how courts seek judicial assistance from overseas.

“I will say it is possible, especially with what seems to be a legit foreign criminal investigation, to obtain such help,” Chesney said. “But it is cumbersome and slow.”

Amazon may be known popularly as an online retailer, but its Web Services unit has become a significant part of its business. In a letter to shareholders just this week, Bezos said Amazon Web Services, which launched about a decade ago, is poised to become a $10 billion operation by the end of this year. The last thing Amazon likely wants is an Apple-style fight with the feds.

A spokesperson for Amazon Web Services did not respond to a request for comment, nor did two members of the ICIJ. According to Amazon’s data privacy policy, “We do not disclose customer content unless we’re required to do so to comply with the law or a valid and binding order of a governmental or regulatory body.”

One possibility is that Amazon, if it is indeed hosting the data, could just pull the plug. That’s what it did in 2010 when, under pressure from the U.S. officials including Sen. Joe Lieberman, it cut off WikiLeaks.

But it likely wouldn’t be under any legal obligation to do that. The documents are newsworthy, and Amazon, like anyone else, is protected under First Amendment guarantees of free speech.

Mossack Fonseca, the Panama law firm at the center of the debacle, said in a statement the documents in question are stolen property and vowed to “ensure the guilty parties are brought to justice.” But as far as anyone knows, the leaker is anonymous.

“If you could pinpoint the person who did it, they could probably bring a claim and that would play out in court,” said Jeramie Scott, a national security attorney at the Electronic Privacy Information Center. “But they can’t, as far as I understand, bring any claim against Amazon for the storage of these documents that are part of media reporting. Amazon is not the one who took them.”

Whatever happens, the only certainty for now is that the process will involve more than the convenient “one click” Amazon is famous for. “Governments may have to wait to read them in the papers,” Gidari said.

Christopher Zara covers media and culture. News tips? Email me. Follow me on Twitter @christopherzara.