Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

I came here pissed off, saw your comment, listened to the arguments, and walk away pleased with the performance of our justice system.

A court found personal jurisdiction over an individual before the court, issued an order requiring the disclosure of information and then expected the person to comply with the order irrespective of where said information was stored. If you break American law in America, saying "the information is overseas" isn't--and shouldn't be--a valid excuse. Extending that to a third-party providers, when both the individual and provider are in America, makes sense.

Could this be abused? Sure. But the oral arguments show the Justices giving the question respectful concern.

View on HN

> If you break American law in America, saying "the information is overseas" isn't--and shouldn't be--a valid excuse.

So, by this logic, if a prosecutor in [country without privacy rights] claims one of their laws has been broken, they are able to seize emails, files, and VM images (even, say, from the US government) stored in any cloud provider that happens to have a business office in that country?

Yes. All those countries you have in mind can attempt that and likely already have. The creation of law or precedent in the USA doesn't make it happen elsewhere, nor does not having law or precedent in the USA prevent it elsewhere. This response comes up a lot, and it deserves to be considered more than rhetorically.

> The creation of law or precedent in the USA doesn't make it happen elsewhere, nor does not having law or precedent in the USA prevent it elsewhere.

If that were true, I think we in the US wouldn't be hearing so much about the EU GDPR.

If that were true, I think we in the US wouldn't be hearing so much about the EU GDPR.

It's true.

That doesn't mean you can ignore other countries laws if you want to do business there.

The EU GDPR only applies to companies doing business in the EU. Of course, if you have customers in the EU you do business there under the GDPR definition.

You are free to ignore it. Good luck trying to do any other business in the EU after that though.

There's an important distinction re GPPR: it only applies to commercial entities. LEA is generally exempt:[0]

> The European Commission hopes to set an international standard with its upcoming proposal to give police easier access to data from tech companies, and has already asked the United States to cooperate.

The US response was the CLOUD Act.

0) https://www.euractiv.com/section/data-protection/news/commis...

The US has an outsized impact on international law, though. What happens in the US, legally, can’t be ignored by other countries. I wish it could be.

Opportunity: space-based cloud servers? Microsats that rotate into service every few months as their orbits decay.

Strong cryptography with steganographic/deniable key storage is much more cost efficient.

But it can be seized because its under some national sovereignty. That was the point. And a satellite server can still be keyed and encrypted. In fact, maybe it just has to be a CA/key store.

They can certainly try. The foreign entities may or may not cooperate.

Governmental information is likely to be protected by the terms of a treaty signed between countries with diplomatic relations, and subject to the same sort of sovereignty extended to embassies and the like.

Listen to the oral arguments. The analogy is a Chinese national in front of a Chinese "court" being demanded to disclose records held by a Chinese company on servers in America. It's a narrow ruling and, given the facts and circumstances, in my opinion, correct.

No, they are able to demand the information and punish the governed who refuse to comply. Assuming that the subpoena won't be valid of the data was stored domestically, why would the location of where the data was stored affect anything? If I rob a bank and hide the money in a different country, that doesn't make me immune from restitution .obligations

Yes, congress just passed a bill that takes this ruling to its logical extreme. The CLOUD act forces US providers to hand over data without question to foreign government workers (“police” or “courts” would probably be to narrow a reading of the bill...)

I’m hoping this gets abused in the midterm elections to replace the people that backed with more reasonable legislators, but I doubt it’ll play out like that.

Reply on news.ycombinator.com