Facebook wants to bring the world together – but isolationism could tear it apart
Amid a tense global climate, countries are increasingly enacting "data localization" laws. Will Facebook respond to Russia's latest request by investing in local data centers?
“We will make sure the law is carried out, or else the company will stop working in Russia, as regretfully happened to LinkedIn. No exceptions will be made.”
-Aleksandr Zharov, Head of Roskomnadzor, Russian state media watchdog [1]
Over the last two decades, few innovations have aided in the rise of globalization as much as the proliferation of the Internet. Among the biggest beneficiaries of the new digital economy are U.S. tech giants like Facebook – now one of the top ten largest companies in the world by market cap [2] – which earns the bulk of its revenue from advertisements it serves online to its global audience of over 2 billion monthly active users [3]. However, recent worldwide trends towards isolationism threaten the way Internet companies store their data, and are forcing Facebook to answer some tough economic, strategic, and political questions.
The Rise of “Data Protectionism”
Over the last few years, countries have begun to implement “data localization” laws, which require all personal data on their citizens to be stored in data centers located within their borders [4]. Countries enact these laws to attract investment, give an advantage to local competitors, and protect their citizens from security and surveillance risks associated with their data being held outside of their jurisdiction [5]. By late 2015, a number of countries had implemented some level of data localization laws [6]:
A particularly rigid law went into effect in Russia in 2015 and “requires ‘personal data operators’ to collect, store, and process any data about Russian users in databases inside the country” [7]. The law (and others like it) presents a particularly thorny challenge for U.S. tech companies.
Data Center Operations and the Cost of Compliance
Facebook stores and manages most of its proprietary data internally, and currently has or is building 11 data centers around the world. While 3 are located in Northern Europe, the rest are all located within the U.S. [8].
Each data center requires a major investment of Facebook’s resources. Their most recently announced, in Virginia, will cost $1 billion to build [9] and Facebook’s cost of revenue, which consists primarily of data center-related costs, grew 36% in 2016 and represents 25% of Facebook’s total expenses [10]:
Building a data center in Russia could also come with added costs associated with investing in a less developed local infrastructure and implementing new internal processes to identify which of its users are Russian citizens and ensure their personal data is all routed to and stored in the appropriate facility. The investment may not be a one-time cost either, as it could set a precedent for other countries considering adopting similar laws.
Aside from pure economic considerations, Facebook also has to evaluate the significant political and PR risks associated with complying with Russian government requests on data privacy, in light of the current political climate and controversy surrounding Facebook’s inability to prevent Russian government-backed actors from using its platform to influence the 2016 U.S. election [11].
Facebook’s Response
Facebook’s initial response to the law was to attempt to negotiate terms with Russia in private, and it was successful in getting Russia to push back any planned inspections of its local data centers until 2018 [12]. However, other U.S. tech companies have been forced to pick a side, with Uber, eBay, and Apple agreeing to comply [13].
Meanwhile, LinkedIn refused, and Russia responded by banning the website nationally, a move that it is citing in threats to Facebook as it amps up the pressure to comply (see Aleksandr Zharov quote at top). With Facebook’s current average revenue per European user at $6.85 [14], losing access to Russia’s 144 million people could cost the company almost $1 billion in missed run-rate revenue.
What next?
For Facebook, the aforementioned costs associated with compliance are too great to accept. Storing all data locally would not only signal capitulation to the Russian government at a delicate time for the company, but would also leave the data particularly vulnerable to being intercepted by the government itself. Facebook prides itself on its protection of user privacy and has tussled with the Russian government before over demands to turn over user information. If that information is stored locally it will be much more difficult for the company to maintain control. Though the downside of losing access to Russia’s population is significant, it may be somewhat mitigated by users bypassing local regulations and accessing the site over VPN, as has become common in China.
On the other hand, Facebook’s mission statement is to “bring the world closer together.” Wouldn’t leaving Russia altogether achieve the opposite effect, taking away the opportunity for Russians to engage in meaningful online interactions with other Facebook users around the globe, thereby aiding in the isolationist, anti-globalism movement that caused the law to be enacted in the first place?
What can Facebook do to further its mission and its business goals without compromising its values in Russia?
(787 words)
References:
[1] Interfax, “Roskomnadzor: Facebook to stop working in Russia in 2018 unless complies with personal data localization law,” Kyiv Post, September 26, 2017, https://www.kyivpost.com/russia/roskomnadzor-facebook-stop-working-russia-2018-unless-complies-personal-data-localization-law.html, accessed November 2017.
[2] PWC, “Global Top 100 Companies by market capitalization,” March 31, 2017, https://www.pwc.com/gx/en/audit-services/assets/pdf/global-top-100-companies-2017-final.pdf, accessed November 2017.
[3] Mark Zuckerberg, “As of this morning, the Facebook community is now officially 2 billion people,” Facebook, June 27, 2017, https://www.facebook.com/zuck/posts/10103831654565331, accessed November 2017.
[4] Courtney Bowman, “Data Localization Laws: an Emerging Global Trend,” Jurist, January 6, 2017, http://www.jurist.org/hotline/2017/01/Courtney-Bowman-data-localization.php, accessed November 2017.
[5] Jyoti Panday, “Rising Demands for Data Localization a Response to Weak Data Protection Mechanisms,” Electronic Frontier Foundation, August 14, 2017, https://www.eff.org/deeplinks/2017/08/rising-demands-data-localization-response-weak-data-protection-mechanisms, accessed November 2017.
[6] Albright Stonebridge Group, Data Localization: A Challenge to Global Commerce and the Free Flow of Information,” September 2015, https://www.albrightstonebridge.com/files/ASG%20Data%20Localization%20Report%20-%20September%202015.pdf, accessed November 2017.
[7] Ibid.
[8] David Cohen, “Virginia Is for Lovers … and a New Facebook Data Center,” AdWeek, October 5, 2017, http://www.adweek.com/digital/henrico-virginia-facebook-data-center/, accessed November 2017.
[9] Ibid.
[10] Facebook, Inc., 2016 Form 10-K (filed February 3, 2017), p. 40, https://s21.q4cdn.com/399680738/files/doc_financials/annual_reports/FB_AR_2016_FINAL.pdf, accessed November 2017.
[11] Scott Shane, “These Are the Ads Russia Bought on Facebook in 2016,” New York Times, November 1, 2017, https://www.nytimes.com/2017/11/01/us/politics/russia-2016-election-facebook.html, accessed November 2017.
[12] Interfax, “Roskomnadzor: Facebook to stop working in Russia in 2018 unless complies with personal data localization law,” Kyiv Post, September 26, 2017, https://www.kyivpost.com/russia/roskomnadzor-facebook-stop-working-russia-2018-unless-complies-personal-data-localization-law.html, accessed November 2017.
[13] Kimberly Gold and Vera Shaftan, “Russia’s data localization requirements delayed for Facebook, Google and Twitter,” Data Protection Report, September 7, 2015, https://www.dataprotectionreport.com/2015/09/russias-data-localization-requirements-delayed-for-facebook-google-and-twitter/, accessed November 2017.
[14] Facebook, Inc., “Facebook Q3 2017 Results,” November 2, 2017, p. 8, https://s21.q4cdn.com/399680738/files/doc_financials/2017/Q3/Q3-’17-Earnings-Presentation.pdf, accessed November 2017.
I really enjoyed reading this article, since it greatly emphasizes the tough decision that Facebook must make on how to balance its mission to bring the world together while not foregoing its core principles to appease certain countries. One idea that came to my mind as I read this article was how much Facebook has to lose if it conducts a deal with Russia. Since the US-Russia relationship is under tremendous scrutiny at the moment, I am under the impression that companies like Facebook would be heavily criticized, which could have adverse impacts on its share price. Something I consider is what is the cost of waiting a bit longer before complying with Russian data center laws? Given the tumultuous political climate, there may be a benefit to waiting to see if any major political shifts on the US and Russia side create an atmosphere where those regulations may become more lax. I also believe that by not immediately agreeing to Russia’s terms, Facebook can take a bold stance on its values and set a firm precedent of where they stand on data localization.
With Uber, eBay, and Apple already capitulating to Russia’s demands, it may make it tough for Facebook to resist. But I think Facebook can make a strong case that they are fundamentally different than those firms. Uber, eBay, and Apple are all transactional by nature, so to the extent that there’s concern with the Russian government gaining access to these companies’ data, there’s nothing too sensitive in there (do you really care if they know you thought Airpods were worth $160?). Facebook, on the other hand, is entirely social by nature, and the data Facebook collects reflects much about what’s important to you, your political persuasions, and causes you may be sympathetic to, data that in the wrongs hands could make some users nervous about what they post in Russia. Facebook can only bring people closer together when their is trust in the medium provided to do so, and since Russia’s laws call that trust in to questions, Facebook is justified in resisting the laws.
When looking at the map, it’s interesting to note that one of the few other countries with as restrictive a setup as Russia is China, which is another country that Facebook is desperately trying to enter. It’s going to be fascinating to see how Facebook’s approach differs between the two countries. There have been a lot of recent reports about how Facebook is optimistic about finally entering China (properly) in the next year, and that does not have the political risk that Russia does. Could Facebook make the decision to go into China but not Russia? What about vice versa?
I agree with Boaty that Facebook is justified in resisting the laws, but if their future growth potential is hampered because of saturation in the markets they have already entered, they will ultimately need to capitulate and enter those new markets.
This paper raises a very important and timely issue within the technology sector, and urges us to take a closer look at the value created by large technology players. When deciding whether to store and control data locally vs. globally, the operational challenge needs to be compared to the opportunity of delivering a great user experience.
Currently, many of these technology players work with a hub-and-spoke data center model, where all data is stored in the hub, and cached locally in the spokes. This local caching is necessary to ensure delivery of a great user experience.
Imagine how long it would take to load a video stored on Facebook’s main data center, without it being cached in a local spoke. If several users access that same video, the same data transmission would have to happen several times. In a hub-and-spoke model, that data transmission only happens once between the hub and each spoke, and then several times from the spoke to the user. A hub-and-spoke model leads to lower redundant data streams, and is therefore much more efficient. In addition, users can access the desired content more quickly, as data needs to travel for shorter distances. Because of the increasing richness of media consumed, local caching of data is becoming more and more common to ensure delivery of that great user experience.
Yes, compliance with local data privacy and control will be something new for multinational tech giants to work with, but local data caching is necessary from a user experience point of view.
The only reason why tech giants (should) leave a country is because they cannot create a competitive user experience (e.g., eBay in China)
Noemie – are you saying that Facebook would need to make the capital investments in local Russian data centers anyway in order to execute their “cache locally” operation? If so, do we know what the incremental cost would be to have the data completely stored in Russia?
If the incremental cost is not so significant, then the key questions are i) what are the PR implications and associated costs of full data storage in Russia, and ii) does splitting data storage between current location(s) and Russia impact other areas of Facebook’s ongoing operations/core competencies (i.e. data analysis and utilization for various initiatives and business strategy), and if so, what are the associated costs of that impact?
I am focused on Facebook’s mission statement, “bring the world closer together.”
As the US election has demonstrated, Russian government involvement creates division. Certainly, the Russian philosophy on many global issues does anything but bring the world closer. As a result, appeasing the Russian government will not uphold the mission statement and the decision to leave Russia altogether does not run contrary to it. On the other hand, everyone has a right to privacy. For instance, whether one agrees with Apple in its legal battle against the FBI over access to the iPhone used by the San Bernardino shooter, this case illustrates the importance of data privacy in preserving our way of life.
Protecting privacy is particularly important in Russia where the LGBT population faces significant legal and social challenges. I am reminded of what Tim Cook said in 2015 about the dire consequences of sacrificing the right to privacy.[1] Having recently come out, he strongly defended Apple’s commitment to privacy because of the fact that when people aren’t treated equally, they may face serious discrimination based on personal information.
[1] http://www.zdnet.com/article/tim-cook-speaks-at-cybersecurity-conference/
If Facebook chooses to serve customers in the Russian market in pursuit of its mission to “bring the world closer together,” it has the obligation to follow the laws and regulations of the country in which it operates. Whether or not it agrees with the actions of the Russian government, Russia remains a sovereign nation-state with the ability and will to enforce regulatory action in pursuit of its own goals. In this case, the author and many additional comments, have pointed to the high costs and the negative potential social and political externalities of compliance with the Russian government’s demands. However, the huge market potential of Russia, combined with the positive social impacts of Facebook continuing to serve Russian consumers, even in the face of these regulations cannot be ignored. If Facebook is unable to successfully lobby the Russian government to change its policy, I believe that compliance is the appropriate path forward to maintain Russian consumers connection to the global platform, albeit with some restrictions imposed by their nation-state.
This is a real long-term concern for Facebook not just in Russia but in other countries around the world. I wonder to what extent (and for how long) these decisions will remain in Facebook’s court: many of these questions have clear geopolitical implications and governments are bound to step in. There’s scope, for example, for the creation of an international framework on what is acceptable data protectionism and what is not, possibly through the WTO. Unfortunately, this may take some time… so Facebook should work to lobby to make it a reality as soon as possible.
Given current rules (or lack thereof) on data protectionism, I would still advice Facebook, as you say, to move to Russia. Such a move, fits with Facebook’s mission of connecting the world (to the best of its ability) and it secures Facebook’s competitive position as the social network of choice. Leaving Russia would give space to other players to gain critical mass that will be very hard to displace in the future. After all, a social network is technically quite easy to replicate, the network is not.
This is a great article and it is very interesting to see how countries are thinking about these issues, especially with respect to the internet which is traditionally viewed as a medium that transcends borders. I agree with Steve on this one in that it should be on Facebook to meet any applicable laws in a given jurisdiction, and I would think that if the US enacted similar laws around data privacy then American users would want Facebook to comply. However, I think another consideration in this decision is the fact that Facebook may not have as much bargaining power in the discussion as one might think. To fdelabalze’s comment above, I would argue that there are already several larger players in the market which have a significantly stronger foothold in the social media space, including http://www.vk.com which is used by over 60% of the Russian population (compared to Facebook’s 14%) [1]. While there may be room for some negotiation around timing, I think that if Facebook wants to further its goal of “bringing the world closer together” by keeping a presence in Russia, it will have no choice but to change.
[1] http://mandmglobal.com/digital-marketing-trends-in-russia-social-networks/
Thank you for your research. Have you researched how countries can actually enforce these laws and verify that companies are in compliance? If the purpose is really to encourage investment, have governments been offering subsidies or tax credit to these tech companies?