Hacker News Reader

Comment by avar | Hacker News Reader

Let's say a Russian company opens up a chain of coffee shops in the US, has surveillance cameras for theft prevention, keeps various records on its customers etc.

Now the Russian government issues a warrant to demand data from the US subsidiary. Do you think that US jurisdiction should have no say in the matter?

If the Russians compelled their US subsidiary to hand over the data in violation of US law, how long do you think they'd be allowed to operate in the US?

The end result of this US overreach will be trade wars and the further rise of national enclaves of the Internet. I'd argue that that's not in anyone's long term interests, least alone the US's.

View on HN

This isn't an American court asking an American company for data held abroad about a foreigner. "Each account holder" charged "resides in the United States, the crimes they are suspected of committing occurred solely in the United States, and the electronic data at issue was exchanged between persons located in the United States."

The analogy is an American coffee shop opening a branch in Russia, filming Russians, storing that data in America and then refusing to turn it over to Russian authorities. Practically speaking, you surrender as collateral your property and people in a country's jurisdiction when you choose to do business there.

There are challenges with that approach though. If a UK corporation does business in the US as well as the UK and uses Google, should it be possible for a US court to compel production of their e-mail.

Should the reverse be true, i.e. should a UK court be able to compel google to produce data on from one of their US customers if that customer had done business in the UK?...

it's a very sticky area, personally I think it will lead down the path that Microsoft have started on which is that the cloud providers will end up with partially independent companies running in major legal jurisdictions and the data will be held in those countries.

On the contrary, I'd argue that it's in most users' interests for there to be national enclaves of the Internet, for just this reason: Your data is within the jurisdiction of the laws of your country. If this is clearly defined, you do not have to worry about another country's laws, like Russia, affecting your data.

It isn't in certain corporations' interests though, because the whole cloud provider thing hinges on shoving everyone's data into a small number of datacenters globally. I think this is an example of the quite common situation where corporate interests and individual interests are not aligned.

For what it's worth, there are technical limitations to this idea. IP routing makes basically no guarantees about what countries your data will travel through on the way to where it's going. Crypto helps with this, but it can't solve everything. (Sometimes all you want to know is that I visited a certain website, for example, and it doesn't matter that you can't read my traffic.)

There are limitations caused by the software configuration of most AS's. Significant work is being done on novel approaches to IP routing with better security, scalability and control guarantees by ETH Zurich, as part of the SCION project. It's sponsored by the EU, Google, Swisscom, the NSF and a few other entities.

Link: http://www.scion-architecture.net/

This is already "live" in the sense that it is implemented and there are 14 router nodes active, and it is meant to be incrementally deployed. I haven't gotten around to hooking up a client myself, that will be an interesting weekend project someday. Any interested ISP can set up their own node and join this project.

Some cool things about SCION and its extensions:

* Isolation domains: can be used to enforce traffic to never leave a given routing sub-plane, for instance a country or a state

* SIBRA: volumetric DDoS mitigation and enablement of the creation of "dynamic interdomain leased lines"

* HORNET: high-speed onion routing

Are you suggesting that users should be banned from using internet services that are run from other countries?

No, but if I voluntarily use another countries' web service, I'd say I'm handing data over to that country's jurisdiction. We should be wary of companies who can't even guarantee our data is remaining within the boundaries of our own laws.

A lot of the "cloud" is an obfuscation. At the end of the day, our data lives on hard drives on servers that are physically somewhere. We should know where that is, and what laws apply to it. When I selected a web hosting provider, I picked the one that disclosed it's datacenter location, the physical security and environmental protection measures, etc. I know the physical place I am entrusting my data to.

>We should be wary of companies who can't even guarantee our data is remaining within the boundaries of our own laws.

Global companies cannot always guarantee that because they operate under a large number of sometimes contradictory laws that keep changing all the time.

Also, if you consider a web app that lets users communicate with each other then the jurisdictions involved might be all of the following:

1) The web site owner's jurisdiction.

2) The hosting firm's jurisdiction.

3) The jursidiction of every single user.

And all of these jurisdictions may have agreements governing data exchange and law enforcement.

This is bound to be extremely complicated.

When those datacenters are in your own jurisdiction, but the Global HQ of the company is in a different jurisdiction, then you have a problem. This is bigger than corporate vs individual interests.

What you're really saying in the first part of your comment is that there would need to be 'an independent google' for every jurisdiction. That isn't going to happen.

The current situation is a little different since:

"Each account holder resides in the United States, the crimes they are suspected of committing occurred solely in the United States, and the electronic data at issue was exchanged between persons located in the United States."

In this case it does seem reasonable that the company should comply.

Well I'd agree that an independent google for every jurisdiction won't happen, but I'd bet on independent googles in major legal blocs (e.g. the EU) for exactly this reason.

Whilst this case my seem straightforward, the precedent (that data held in other countries can be requested by a court in the US based on the fact that Google is a US corp) would lead them necessarily to establish legal entities to prevent that spreading.

> * ... would lead them necessarily to establish legal entities to prevent that spreading*

They already have multiple legal entities. And there are two different things being conflated here.

1. Info/data that was generated and pertains to people in one jurisdiction that just 'happens' to be shipped to a datacenter elsewhere, just because Google can. This seems to be the current story.

2. Info/data that was generated and pertains to people in one jurisdiction that a legal system in a different jurisdiction tries to claim rights to. This is also happening and has implications for service users, privacy law, etc.

Reply on news.ycombinator.com