# US 2014/0155093 A1 · Method for Ensuring Data Localization on an Ad Hoc Moving Data Network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0155093 A1 - Document ID: US20140155093A1 - Status: Published application - Kind: A1 - Application number: 13/692,957 - Filed: 2012-12-03 - Published: 2014-06-05 - Earliest claimed: 2012-12-03 - Assignees: Google Inc. - Applicants: Google Inc. - Inventors: Eric Teller - Web page: https://patentgrep.com/patent/US20140155093A1 ## CPC - H04B 7/18504: {Aircraft used as relay or high altitude atmospheric platform} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences - H04W 4/025: {using location based information parameters} - H04W 4/029: Location-based management or tracking services - H04W 12/08: Access security - H04W 16/00: Network planning, e.g. coverage or traffic planning tools; Network deployment, e.g. resource partitioning or cells structures - H04W 16/26: Cell enhancers {or enhancement}, e.g. for tunnels, building shadow - H04W 24/02: Arrangements for optimising operational condition - H04W 84/005: {Moving wireless networks} - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04W 88/08: Access point devices - H04B: TRANSMISSION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure provides methods operable in a balloon network. The method can include determining that a balloon is at a location associated with a legally-defined geographic area. An area profile of the legally-defined geographic area may identify geographically-restricted data that must not be removed from the legally-defined geographic area. The method can also include determining that the balloon contains at least some of the geographically-restricted data. The method can also include determining that the balloon is likely to move out of the legally-defined geographic area. The method can also include removing the geographically-restricted data from the memory of the balloon. ## Claims ### Claim 1 A computer-implemented method comprising: determining that a first balloon is at a location associated with a legally-defined geographic area, wherein a balloon network provides service in a plurality of legally-defined geographic areas, and wherein an area profile identifies geographically-restricted data that must not be removed from the legally-defined geographic area; determining that the first balloon contains at least some of the geographically-restricted data; determining that the first balloon is likely to move out of the legally-defined geographic area; and responsively removing the geographically-restricted data from the memory of the first balloon. ### Claim 2 (depends on 1) The method of claim 1, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising: responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 3 (depends on 2) The method of claim 2, wherein the device receiving the geographically-restricted data from the first balloon is a second balloon located in the legally-defined geographic area. ### Claim 4 (depends on 2) The method of claim 2, wherein the device receiving the geographically-restricted data from the first balloon is a ground-based station located in the legally-defined geographic area. ### Claim 5 (depends on 2) The method of claim 2, wherein the geographically-restricted data is transferred via a RF air-interface. ### Claim 6 (depends on 2) The method of claim 2, wherein the geographically-restricted data is transferred via a free-space optical link. ### Claim 7 (depends on 1) The method of claim 1, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising: determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data; responsive to the determination that the second balloon does not include the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 8 (depends on 1) The method of claim 1, wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises: determining a direction in which the first balloon is travelling; based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability. ### Claim 9 A method operable by a first balloon in a balloon network, the method comprising: receiving at least a portion of geographically-restricted data when the first balloon enters a legally-defined geographic area; determining that the legally-defined geographic area has an area profile that identifies geographically-restricted data that must not be removed from the legally-defined geographic area; determining that the first balloon is likely to move out of the legally-defined geographic area; and responsively removing the geographically-restricted data from the memory of the first balloon. ### Claim 10 (depends on 9) The method of claim 9, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising: responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 11 (depends on 9) The method of claim 9, wherein the device receiving the geographically-restricted data from the first balloon is a second balloon located in the legally-defined geographic area. ### Claim 12 (depends on 9) The method of claim 9, wherein the device receiving the geographically-restricted data from the first balloon is a ground-based station located in the legally-defined geographic area. ### Claim 13 (depends on 9) The method of claim 9, wherein the geographically-restricted data is transferred via a RF air-interface. ### Claim 14 (depends on 9) The method of claim 9, wherein the geographically-restricted data is transferred via a free-space optical link. ### Claim 15 (depends on 9) The method of claim 9, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising: determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data; responsive to the determination that the second balloon does not include the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 16 (depends on 9) The method of claim 9, wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises: determining a direction in which the first balloon is travelling; based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability. ### Claim 17 A computer-readable medium storing instructions that, when executed by one or more processors in a computing device, cause that computing device to perform functions, the functions comprising: determining that a first balloon is at a location associated with a legally-defined geographic area, wherein a balloon network provides service in a plurality of legally-defined geographic areas, and wherein an area profile identifies geographically-restricted data that must not be removed from the legally-defined geographic area; determining that the first balloon contains at least some of the geographically-restricted data; determining that the first balloon is likely to move out of the legally-defined geographic area; and responsively removing the geographically-restricted data from the memory of the first balloon. ### Claim 18 (depends on 17) The computer-readable medium of claim 17, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the functions further comprising: responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 19 (depends on 17) The computer-readable medium of claim 17, wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the functions further comprising: determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data; responsive to the determination that the second balloon does not contain the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon. ### Claim 20 The computer-readable medium of 17, wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises the functions of: determining a direction in which the first balloon is travelling; based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability. ### Claim 21 A computer-implemented method comprising: determining that a first balloon is at a location associated with a legally-defined geographic area, wherein a balloon network provides service in a plurality of legally-defined geographic areas, and wherein an area profile identifies geographically-restricted data that must not be removed from the legally-defined geographic area; determining that the first balloon contains at least some of the geographically-restricted data; encrypting the geographically-sensitive data with an encryption key; determining that the first balloon is likely to move out of the legally-defined geographic area; and responsively removing the encryption key from the memory of the first balloon.