Method for ensuring data localization on an ad hoc moving data network

1. A computer-implemented method comprising:

determining, by one or more processors of a first balloon, that the first balloon is at a location associated with a legally-defined geographic area of a network, wherein the network includes a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas and a ground station, and wherein the first balloon is one of the plurality of moveable balloons;

responsive to the determination that the first balloon is at the location associated with the legally-defined geographic area, accessing, by the one or more processors of the first balloon, an area profile that identifies geographically-restricted data;

determining, by the one or more processors of the first balloon, that the first balloon contains at least some of the geographically-restricted data in physical data storage on the first balloon;

determining, by the one or more processors of the first balloon, that the first balloon is likely to move out of the legally-defined geographic area; and

responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area and based on the area profile:

determining, by the one or more processors of the first balloon, the geographically-restricted data is not stored by at least one other device in the legally-defined geographic area, and in response to the determination that geographically-restricted data is not stored by another balloon or ground station in the legally-defined geographic area,

transferring, by the one or more processors of the first balloon, the geographically-restricted data to the ground station, and

removing, by the one or more processors of the first balloon, the geographically-restricted data from the physical data storage on the first balloon before the first balloon exits the legally-defined geographic area.

2. The method of claim 1 , wherein the area profile indicates that the geographically-restricted data is restricted from leaving from the legally-defined geographic area.

3. The method of claim 1 , wherein the area profile further identifies that the geographically-restricted data must be stored in the legally-defined geographic area.

4. The method of claim 1 , wherein die area profile is accessed from the ground station.

5. The method of claim 1 , wherein the at least one other device includes at least one other balloon of the plurality of moveable balloons.

6. The method of claim 1 , wherein the at least one other device includes the ground station.

7. The method of claim 1 , wherein the transferring includes using radio-frequency (RF) communications.

8. The method of claim 1 , further comprising, when the first balloon is no longer able to determine the first balloon's location, using a last known location of the first balloon in order to estimate when the first balloon is likely to move out of the legally-defined geographic area, and wherein transferring the geographically-restricted data to the ground station, and removing the geographically-restricted data from the physical data storage are performed based on the estimate.

9. A system comprising one or more processors configured to:

determine that a first balloon is at a location associated with a legally-defined geographic area of a network, wherein the network includes a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas and a ground station, and wherein the first balloon is one of the plurality of moveable balloons;

responsive to the determination that the first balloon is at the location associated with the legally-defined geographic area, access an area profile that identifies geographically-restricted data;

determine that the first balloon contains at least some of the geographically-restricted data in physical data storage on the first balloon;

determine that the first balloon is likely to move out of the legally-defined geographic area; and

responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area:

determine geographically-restricted data is not stored by at least one other device in the legally-defined geographic area, and in response to the determination that geographically-restricted data is not stored by another balloon or ground station in the legally-defined geographic area,

transfer the geographically-restricted data to the ground station, and

remove the geographically-restricted data from the physical data storage on the first balloon before the first balloon exits the legally-defined geographic area.

10. The system of claim 9 , wherein the area profile further identifies that the geographically-restricted data must be stored in the legally-defined geographic area.

11. The system of claim 9 , wherein the one or more processors are further configured to access the area profile from the ground station.

12. The system of claim 9 , wherein the at least one other device includes at least one other balloon of the plurality of moveable balloons.

13. The system of claim 9 , wherein the at least one other device includes the ground station.

14. The system of claim 9 , wherein the one or more processors are further configured to, when the first balloon is no longer able to determine the first balloon's location, use a last known location of the first balloon in order to estimate when the first balloon is likely to move out of the legally-defined geographic area, and wherein transferring the geographically-restricted data to the ground station, and removing the geographically-restricted data from the physical data storage are performed based on the estimate.

15. A non-transitory computer-readable medium on which instructions are stored, the instructions, when executed by one or more processors of a first balloon, cause the one or more processors to perform a method, the method comprising

determining that the first balloon is at a location associated with a legally-defined geographic area of a network, wherein the network includes a plurality of moveable balloons that provide service to client devices in a plurality of legally-defined geographic areas and a ground station, and wherein the first balloon is one of the plurality of moveable balloons;

responsive to the determination that the first balloon is at the location associated with the legally-defined geographic area, accessing, by the one or more processors of a first balloon, an area profile that identifies geographically-restricted data;

determining that the first balloon contains at least some of the geographically-restricted data in physical data storage on the first balloon;

determining that the first balloon is likely to move out of the legally-defined geographic area; and

responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area:

determining that the geographically-restricted data is not stored by at least one other device of the network in the legally-defined geographic area, and in response to the determination that geographically-restricted data is not stored by another balloon or ground station in the legally-defined geographic area,

transferring the geographically-restricted data to the ground station, and

removing the geographically-restricted data from the physical data storage on the first balloon before the first balloon exits the legally-defined geographic area.

16. The medium of claim 15 , wherein the area profile further identifies that the geographically-restricted data must be stored in the legally-defined geographic area.

17. The medium of claim 15 , Wherein the area profile is accessed from the ground station.

18. The medium of claim 15 , wherein the at least one other device includes at least one other balloon of the plurality of moveable balloons.

19. The medium of claim 15 , wherein the at least one other device includes the ground station.

20. The medium of claim 15 , wherein the method further comprises, when the first balloon is no longer able to determine the first balloon's location, using a last known location of the first balloon in order to estimate when the first balloon is likely to move out of the legally-defined geographic area, and Wherein transferring the geographically-restricted data to the ground station, and removing the geographically-restricted data from the physical data storage are performed based on the estimate.