Federal officials at two agencies briefly raised alarms in early 2024 over whether Amazon's updated cloud computing terms could allow the company to train its artificial intelligence systems on government data, according to documents obtained through a public records request.
The exchange began when an IT official in the Securities and Exchange Commission's Cloud Center of Excellence reviewed Amazon's revised terms and concluded they appeared to permit the use of data outside a customer's environment and even outside the United States. The official warned colleagues that the change represented an urgent potential data leakage and urged federal chief information officers to opt out of allowing Amazon to train AI on government data.
The SEC official identified roughly 22 Amazon services that could be affected, including Amazon Rekognition, an image-analysis tool with facial recognition capabilities that has been used by the Federal Bureau of Investigation. Concerns also extended to Amazon Polly, Amazon Translate, and Amazon Comprehend. The email encouraged the government's highest-ranking technology officials to contact their Amazon representatives and push for an official policy change.
The issue drew attention at the FBI, where officials briefly examined whether the agency had any potential exposure and analyzed its total Amazon footprint. Amazon later clarified to FBI officials that its services were stored on a separate cloud system and that the changes would not affect FBI data. The SEC declined to comment, and Amazon did not respond to multiple requests for comment. An FBI spokesperson said the agency would let any material released through the Freedom of Information Act process speak for itself.
The episode underscores how deeply federal agencies now rely on a small group of technology companies to host government software and data. Amazon, like Google and Microsoft, competes aggressively for federal cloud contracts. Last year the company said it would invest as much as $50 billion in government computing services.
Varoon Mathur, a former White House Presidential Innovation Fellow and senior adviser to the Biden administration's federal chief information officer, said such incidents happen every day in government tech. He attributed the confusion to procurement officials who are not themselves technical reading technical service terms, while integrators have little incentive to be proactive. Mathur said vendors training on government data by accident, on purpose, or in lieu of vague policy is pretty standard, adding that the people running procurement are rarely the ones who could properly read a service term.
The documents also raise broader questions about whether officials always understand the terms they agree to when contracting with major cloud providers. The concerns appear to have been short lived, but the exchange highlights the gap between the technical complexity of modern cloud contracts and the capacity of the agencies that sign them.