Hacker News Reader

Comment by voxic11 | Hacker News Reader

Because continuing to provide the service to French users would mean they have not exited the jurisdiction. You cant provide services in a jurisdiction and at the same time expect not be subject to that jurisdiction. That's just not how any country treats legal jurisdiction.

View on HN

As a side project I help out with some technical stuff at a hosting company that provides services to a political group that is strongly anti Erdogan. The infrastructure is in the USA.

We do not block IP traffic from known Turkish ISP ranges. The customer (the political group) receives all sorts of dire legal warnings and threats that what they publish is contrary to Turkish law.

None of our other hosting platforms are configured to block any traffic to/from Turkish IP ranges. We have no business presence or financial involvement with anything domestically in Turkey. Am I subject to Turkish jurisdiction? I don't think so.

But by what you wrote, I am providing services in Turkey.

If you go to Turkey you might find yourself in a prison until you abruptly close this website. This is what happened to Pavel Durov (Telegram creator) in France. Telegram now complies with French law, because otherwise Pavel Durov would still be in French prison.

That's certainly a valid risk, if I were to put myself physically at the mercy of Turkish armed law enforcement inside their borders. In my particular case there's no public information that links my real name to the hosting company, as my work is behind the scenes.

Could Turkish intelligence link me to the company if they spent significant resources researching the hosting company that provides services to their political enemies? Probably. Do I have any personal plans to take a vacation in Turkey any time soon, or a pressing need to visit Turkey? No.

I am pretty sure we also have someone, somewhere hosting something that insults the King of Thailand, so I suppose that's a risk too.

This is a Swiss company offering services to French users. Although Switzerland is not an EU member, it is a party to the European Free Trade Area (EFTA) and through this, the Swiss government would likely be required to help enforce French rulings against their companies.

> This is a Swiss company offering services to French users.

If I operate a bookstore physically in switzerland and a few of the books I sell are illegal in france I'm not required to check passports or whatever, am I? I can just sell books to whoever (subject to swiss law) and if a french national illegally imports one to france that's a problem for customs or the local police or whoever (analogously the french ISPs) to deal with. Not me, the swiss bookstore operator.

Now consider if I were handing out pamphlets for free rather than selling anything. At that point I'm arguably not even doing business because no money has changed hands.

I realize that the current legal reality might be that quad9 needs to block french users in practice but the entire thing is a farce if you stop and think about it.

What about countries friendly with Turkey? I can easily imagine you being arrested in half of the world and extradited to Turkey because you are being criminally prosecuted in Turkey.

It sounds like your point is that (1) you think Türkiye is unlikely to unmask any individuals associated with your company and also (2) you have little interest in ever visiting that country anyway.

In the Quad9 people’s case, defying French law and still doing operating the services under French jurisdiction might work out just fine for as long as (1) holds true, but it doesn’t take a consorted effort of research to change that. It could just be that some leaked piece of information eventually surfaces. It could be a tweet posted by someone else. And I don’t know how many people work for that organization, or might do so in the future, but it seems like a bad move to make a decision on their behalf to paint a target on all their backs.

Also, France being part of the EU makes being an enemy of the state there seem even more unwise for anyone who might want to have associations in any other EU country.

I personally would do exactly what they are doing: if French people want a government that respects free speech, they had better elect one themselves. I wouldn’t become a martyr to that cause - it wouldn’t help anyway.

Bad example, especially githen the fact that Durov is a french national.

Yes but if you don’t have any assets in the country you could not liable, that was OP’s point.

But even being based in Switzerland I believe there’s some inter-countries agreements, so it would not be practical.

Let's say you are a software company based in country C (company) and offer services to users in country U (users), only over the internet, and having no physical assets in country U. You could imagine Microsoft offering Office 365 to customers in Liechtenstein, for example.

GP's point is that whenever you sell or offer something to users in U, you have to abide by U's laws in doing so - no matter whether you did that all while sitting at your desk in country C.

Whether or not enforcement or liability is realistic is up to the relationship between U and C I guess - my guess is France and Switzerland are on pretty good terms.

Then Law is both broken, and dumb -

This is not exactly your focus, but this means that it can be possible for there to be a set of laws in U, such that an action is required and illegal if not present, but that this same action is illegal in C...

I.e., the predication is both meaningless and pointless, unless the supposition is that the laws of U don't hold - if C extradites a citizen of U over said action, is then U's law not supreme?

I understand that's probably how the law works, but it is kind of nonsensical to me that it passively allowing visitors from a country would pull you into their jurisdiction. Requiring you to be responsible for blocking any users to your service from U ensures seems analogous to an author of a book that is illegal/censored in U being required to make sure that no one from U buys the book and takes it back to their country.

“Dear France, have your ISPs block us because we won’t block you” could buy a few days of uptime there.

It's funny that you think Microsoft doesn't have at least a single person living and working in Liechtenstein

The problem is that, technically, an IP address doesn't have a country. GeoIP is at best a suggestion, and it is trivial to route your traffic through a "foreign" IP.

It is about as enforceable as "don't read letters written by redheaded people": it'll never be airtight, and it'll always have a huge amount of false positives.

The only possible "solution" is to ban all open devices from the internet, mandate a DRM-style "trust zone", have the device do mTLS, and embed a realtime DNA sequencer in every device.

Don't give them ideas... That's the wet dream they all salvate at... complete control of what's allowed to be published with a instant way of banning content and people.

They wouldn't be providing services in France, they'd be providing service in Switzerland to people from France. No different than if someone from France traveled to a bagel shop in Switzerland for a bite to eat. If France wants to make it illegal for French citizens to communicate with a foreign business in Switzerland, I don't see how it's the business's responsibility to enforce that.

If someone put a bagel shop on the Swiss/French border and sold bagels across it (using, I don’t know, a long pole or something) I guess there would be some questions.

Realistically, Switzerland and France have a relationship; treaties, etc. Quad9 has to comply with Swiss law, and they probably hope that making reasonable good-faith moves to block French users will cause Swiss courts (if it comes down to that) to see them as the more sympathetic party.

Nothing's crossing the border in this case other than information. It's more like a guy on the French side of the border shouting over to a guy on the Swiss side, and the French government trying to regulate what the guy on the Swiss side is allowed to say in reply.

Regardless of what analogy you use, the point is that the company isn't in France, it's in Switzerland. It doesn't make sense for it to have to do anything to comply with French law, even if it's interacting with someone who happens to be in France.

None of these analogies work very well because providing services across the border without crossing it doesn’t scale very well in-person. I should have just said that directly, but the image of cross-border bagel service was too funny to pass up.

WRT your second paragraph, I think I addressed it already in my second paragraph.

Hence the “shield” part. I guess it’s easier said than done when you’re a Swiss non-profit and not an anonymous sysadmin in Iraq (or whatever jurisdiction would work for this example, idk).

> whatever jurisdiction would work for this example

The Principality of Sealand*

* until the UK or French navy shows up

Reply on news.ycombinator.com