8 ms·

I still have not seen addressed widely is the issue of US enforcing laws on an international level It's simple: if you do something which causes something ille

I still have not seen addressed widely is the issue of US enforcing laws on an international level It's simple: if you do something which causes something illegal-in-the-US to happen on computers-located-in-the-US, you can be prosecuted by the US for it. There is nothing new, radical, revolutionary, terrifying, unprecedented, etc. about this idea. There wasn't anything new about it recently when some bitcoin people were busted because they laundered their proceeds through US institutions. There isn't anything new about it when someone in another country hacks a US company's systems. "The internet" is not a magical extra-territorial location which wipes away all concept of countries having jurisdiction. As long as a computer in one country can cause things to happen to/on a computer in another country, there's an opportunity for either country, or both, or others in between them on the network, to have jurisdiction over things that go wrong. And your "only a matter of time" slippery slope has already happened: several EU nations have taken legal action against US-based online retail/auction sites to require compliance with laws against selling Nazi symbols or memorabilia. And I hope you'd understand that no matter how much you might argue "but I wasn't even in Germany", Germany will come after you if you offer to sell and ship items to Germany which are illegal to sell/ship there.

chx 9y ago
The problem here, as I wrote above, is arresting a UK citizen in the USA. If they would've issued a warrant and the UK police decides to arrest him and then extradite him, that's fine. But this sort of thing... this could potentially halt international travel. I am not kidding: how do you dare to travel anywhere if you can be arrested for something you did years ago which very well might have been legal in the country you resided in but not in the country you travel to?
- kelnage 9y ago
  What Malwaretech has been charged with here would likely be illegal under UK law as well as US law (section 37 of the Computer Misuse Act [1] appears to be analogous to the charges being brought against him). And regardless, the UK-US extradition treaty is written in such a way that the US charges do not have to be illegal under UK law for an extradition to take place (although the converse is not true). Now, it may well have been the case that when the inevitable court case to challenge the extradition in the UK took place, it might have gone all Gary McKinnon on them [2], due to public support after WannaCry etc. which I'd suggest is probably why the FBI chose to arrest him in the US rather than put in a formal extradition request or work directly with the UK authorities (AFAIK). But yes, I do agree that with the advent of a worldwide communications network, travel to countries with oppressive, obscure, or stricter legal regimes has become more dangerous for some. The thing I find curious is that others haven't perceived this change in risk. I wouldn't necessarily say this is a bad thing either - note there have been a number of (accused) botnet operators/cyber-criminals originating from Russia who were arrested whilst holidaying in the EU, and then extradited to the US. Since Russia has a reputation for being lax about prosecuting such "crimes" (especially if they only target people outside of Russia), and also tends to refuse to extradite Russian nationals, it doesn't seem that there are many other options. 1. http://www.legislation.gov.uk/ukpga/2006/48/section/37 http://www.legislation.gov.uk/ukpga/2006/48/section/37 2. https://en.wikipedia.org/wiki/Gary_McKinnon https://en.wikipedia.org/wiki/Gary_McKinnon
- mysterydip 9y ago
  If I went on travel to a foreign country and committed a crime, I would expect to be arrested there. Where the damage was done is the key, not where I was at the time. If I create some malware that takes out UK servers, I would expect to be arrested for that if I ever set foot on UK soil.
  - wav-part 9y ago
    So you believe regulations will keep you safe from even half-professional criminals let alone state-sponsered ones ?
  - chx 9y ago
    If you ever posted a sickle-and-hammer to the web, visible to the Hungarian public -- distributing it -- then you possibly could be fined for it. If you visit Hungary and you got fined, would you consider it just? Here's the Hungarian Criminal Code article in question: Article 335(1). Any person who a) distributes; b) uses in public; c) exhibits in public; a swastika, the SS sign, an arrow-cross, a hammer and sickle, a five-pointed red star or a symbol depicting the above, – unless a graver crime is realised – commits a misdemeanour, and shall be liable to punishment with a fine. (2) The person who uses a symbol of despotism for the purposes of the dissemination of knowledge, education, science, or art, or with the purpose of information about the events of history or the present time shall not be punishable. (3) The provisions of subsections (1) and (2) do not extend to the official symbols of states in force.
    - ubernostrum 9y ago
      As I've already noted, Germany and other countries have enforced their no-Nazi-stuff laws against US-based entities. If you do a thing that's illegal in Hungary, and then put yourself on Hungarian soil, I'm not going to be surprised when you get arrested. In other words, this is not the knock-down "that'll really show him!" counterexample you're looking for.
      - vageli 9y ago
        This seems untenable. Now, to travel to another country for holiday, I need to look back on everything I've ever done, (even something so minute as distribute an image of a hammer and sickle) and pore over the laws of that country and determine I have not ever been in violation of _any_ of them?
- ubernostrum 9y ago
  Why is it a problem that if you commit a crime and then visit a geographic location where the local governing entity has jurisdiction, you could get arrested? If he had robbed a gas station in Las Vegas, would you be upset if Las Vegas police arrested him? Do you believe that "I am not a citizen of your country" automatically provides exemption from a country's laws even when on their soil?
  - chx 9y ago
    This simply doesn't apply. He was not on US soil when committing the crime.
    - ubernostrum 9y ago
      Go chime in on this: https://news.ycombinator.com/item?id=14927597 https://news.ycombinator.com/item?id=14927597
jakubp 9y ago
Going by your logic, US could proactively import a computer that is a victim of a crime from somewhere in the world onto US territory, and arrest the person responsible.
- justinclift 9y ago
  Interesting idea. Now you've mentioned it publicly, wonder how long until it happens? :)
- ubernostrum 9y ago
  If you read the indictment, the claim alleged is that some of the computers affected were in the US at the time the crime occurred. Which would give the US jurisdiction. This is not a new, dangerous, slippery, radical, unprecedented idea in law. It doesn't lead to people digging up murder victims' corpses and importing them to other countries to give those countries jurisdiction over the murder, etc., because the law has worked this way for a very long time.
syshum 9y ago
>>And your "only a matter of time" slippery slope has already happened: several EU nations have taken legal action against US-based online retail/auction sites to require compliance with laws against selling Nazi symbols or memorabilia. And I hope you'd understand that no matter how much you might argue "but I wasn't even in Germany", Germany will come after you if you offer to sell and ship items to Germany which are illegal to sell/ship there. No that is infact not what my "slippery slope" argument is.. No where even remotely close to it Shipping an item INTO the nation means clearly you must abide by their laws, what I am talking about would be Germany attempting to take legal action because I operate a website that has nazi symbols on it that a german person happens to visit. >> There is nothing new, radical, revolutionary, terrifying, unprecedented, etc. about this idea. Seems to me that there is since the US is not just prosecuting people for their direct actions against US Computers but seem to be going after people many many steps removed from those actions that have the thinnest of connections to US Interests. This seems to be new and radical and terrifying from my point of view Do you support the US in doing this? You seem to imply you have no problems with the current state of affairs
- ubernostrum 9y ago
  So, let's just put it clearly: suppose someone who is, at the time, not physically present in the US, breaks into a computer system which is physically present in the US at that time. Which of the following do you think most accurately describes the situation? 1. No crime has been committed, because these actions took place on the internet, where no laws apply and no country has jurisdiction. 2. A crime may have been committed, but only if breaking into computer systems is against the law of the country the person was in at the time, and so only that country could prosecute. 3. A crime was committed in the United States, but the United States cannot prosecute someone for a crime if some element of that crime took place physically outside the borders of the United States. 4. A crime was committed in the United States, and the United States can prosecute the person responsible, and has the power either to arrest that person if they happen to visit the US voluntarily, or to extradite that person from the country they're in if an extradition treaty exists between the United States and that country. The accepted view, for the record, is (4), and appears to be the basis of this case: the indictment claims computers physically located in the US were affected, which gives the US jurisdiction to arrest and prosecute.
jdietrich 9y ago
Hypothetical: A Pornhub executive flies from New York to Seoul on Etihad Airways. While transiting in Abu Dhabi airport, they are arrested on charges of obscenity. What would be the reaction in the US? Factual: In 2006, David Carruthers was arrested while transiting through Dallas-Fort Worth Airport. He was convicted under the RICO act and sentenced to 33 months imprisonment. He was the CEO of the online gambling company BetOnSports, which operated in full compliance with the regulations in the UK and Costa Rica, but accepted bets from American gamblers. Gary Kaplan, another BetOnSports executive, was extradited from the Dominican Republic. The precedent set in the BetOnSports case is either utterly hypocritical or extraordinarily dangerous. If we give every country the right to impose their laws across the whole internet, we don't have an internet any more. A Facebook user posts a comment critical of the Thai royal family; Zuckerberg is sentenced to life imprisonment for lèse-majesté. A Chinese internet user accesses anti-government material via a VPN hosted on AWS and a Google search; Bezos, Page and Brin are all sentenced to 10 years hard labour for subversion.
- ubernostrum 9y ago
  If you run a business, and decide to do business with people in another country, it's your responsibility to figure out if the business you're doing is legal for that country. This is only a strange idea to a certain segment of internet commenters. The rest of the world has just treated this as the way things are for a long, long, long time. The new, strange, radical idea out of step with established norms is the notion that "on the internet" is some magical lawless, stateless, jurisdictionless place where anything is fair game since nobody could ever prosecute for something that happened in this magical fairyland. It really is time to stop being surprised that you can be arrested and prosecuted for your interactions and business relationship with people, property or other entities in a country of which you aren't a citizen. Also, don't look now, but large tech companies headquartered in the US routinely make changes to their products/services to comply with other countries' laws. If Facebook wants to operate in Thailand, Facebook has to be prepared to comply with Thai law, for example. "We're on the internet" doesn't work as an out.
  - ncallaway 9y ago
csomar 9y ago
While I agree that the US should arrest people or entities that tries to harm its citizen; it's important to note that the US doesn't really look for that criteria. For example, they attacked Syria for crimes committed by Syrian against Syrian. The US wanted to carry the attack, and then found the excuse. But why would this surprise anyone? Do anyone think that the US is spending billions on military weapons just for the fun of it?

chx 9y ago

The problem here, as I wrote above, is arresting a UK citizen in the USA. If they would've issued a warrant and the UK police decides to arrest him and then extradite him, that's fine. But this sort of thing... this could potentially halt international travel. I am not kidding: how do you dare to travel anywhere if you can be arrested for something you did years ago which very well might have been legal in the country you resided in but not in the country you travel to?

kelnage 9y ago
What Malwaretech has been charged with here would likely be illegal under UK law as well as US law (section 37 of the Computer Misuse Act [1] appears to be analogous to the charges being brought against him). And regardless, the UK-US extradition treaty is written in such a way that the US charges do not have to be illegal under UK law for an extradition to take place (although the converse is not true). Now, it may well have been the case that when the inevitable court case to challenge the extradition in the UK took place, it might have gone all Gary McKinnon on them [2], due to public support after WannaCry etc. which I'd suggest is probably why the FBI chose to arrest him in the US rather than put in a formal extradition request or work directly with the UK authorities (AFAIK). But yes, I do agree that with the advent of a worldwide communications network, travel to countries with oppressive, obscure, or stricter legal regimes has become more dangerous for some. The thing I find curious is that others haven't perceived this change in risk. I wouldn't necessarily say this is a bad thing either - note there have been a number of (accused) botnet operators/cyber-criminals originating from Russia who were arrested whilst holidaying in the EU, and then extradited to the US. Since Russia has a reputation for being lax about prosecuting such "crimes" (especially if they only target people outside of Russia), and also tends to refuse to extradite Russian nationals, it doesn't seem that there are many other options. 1. http://www.legislation.gov.uk/ukpga/2006/48/section/37 http://www.legislation.gov.uk/ukpga/2006/48/section/37 2. https://en.wikipedia.org/wiki/Gary_McKinnon https://en.wikipedia.org/wiki/Gary_McKinnon
mysterydip 9y ago
If I went on travel to a foreign country and committed a crime, I would expect to be arrested there. Where the damage was done is the key, not where I was at the time. If I create some malware that takes out UK servers, I would expect to be arrested for that if I ever set foot on UK soil.
- wav-part 9y ago
  So you believe regulations will keep you safe from even half-professional criminals let alone state-sponsered ones ?
- chx 9y ago
  If you ever posted a sickle-and-hammer to the web, visible to the Hungarian public -- distributing it -- then you possibly could be fined for it. If you visit Hungary and you got fined, would you consider it just? Here's the Hungarian Criminal Code article in question: Article 335(1). Any person who a) distributes; b) uses in public; c) exhibits in public; a swastika, the SS sign, an arrow-cross, a hammer and sickle, a five-pointed red star or a symbol depicting the above, – unless a graver crime is realised – commits a misdemeanour, and shall be liable to punishment with a fine. (2) The person who uses a symbol of despotism for the purposes of the dissemination of knowledge, education, science, or art, or with the purpose of information about the events of history or the present time shall not be punishable. (3) The provisions of subsections (1) and (2) do not extend to the official symbols of states in force.
  - ubernostrum 9y ago
    As I've already noted, Germany and other countries have enforced their no-Nazi-stuff laws against US-based entities. If you do a thing that's illegal in Hungary, and then put yourself on Hungarian soil, I'm not going to be surprised when you get arrested. In other words, this is not the knock-down "that'll really show him!" counterexample you're looking for.
    - vageli 9y ago
      This seems untenable. Now, to travel to another country for holiday, I need to look back on everything I've ever done, (even something so minute as distribute an image of a hammer and sickle) and pore over the laws of that country and determine I have not ever been in violation of _any_ of them?
ubernostrum 9y ago
Why is it a problem that if you commit a crime and then visit a geographic location where the local governing entity has jurisdiction, you could get arrested? If he had robbed a gas station in Las Vegas, would you be upset if Las Vegas police arrested him? Do you believe that "I am not a citizen of your country" automatically provides exemption from a country's laws even when on their soil?
- chx 9y ago
  This simply doesn't apply. He was not on US soil when committing the crime.
  - ubernostrum 9y ago
    Go chime in on this: https://news.ycombinator.com/item?id=14927597 https://news.ycombinator.com/item?id=14927597

jakubp 9y ago

Going by your logic, US could proactively import a computer that is a victim of a crime from somewhere in the world onto US territory, and arrest the person responsible.

justinclift 9y ago
Interesting idea. Now you've mentioned it publicly, wonder how long until it happens? :)
ubernostrum 9y ago
If you read the indictment, the claim alleged is that some of the computers affected were in the US at the time the crime occurred. Which would give the US jurisdiction. This is not a new, dangerous, slippery, radical, unprecedented idea in law. It doesn't lead to people digging up murder victims' corpses and importing them to other countries to give those countries jurisdiction over the murder, etc., because the law has worked this way for a very long time.

syshum 9y ago

>>And your "only a matter of time" slippery slope has already happened: several EU nations have taken legal action against US-based online retail/auction sites to require compliance with laws against selling Nazi symbols or memorabilia. And I hope you'd understand that no matter how much you might argue "but I wasn't even in Germany", Germany will come after you if you offer to sell and ship items to Germany which are illegal to sell/ship there. No that is infact not what my "slippery slope" argument is.. No where even remotely close to it Shipping an item INTO the nation means clearly you must abide by their laws, what I am talking about would be Germany attempting to take legal action because I operate a website that has nazi symbols on it that a german person happens to visit. >> There is nothing new, radical, revolutionary, terrifying, unprecedented, etc. about this idea. Seems to me that there is since the US is not just prosecuting people for their direct actions against US Computers but seem to be going after people many many steps removed from those actions that have the thinnest of connections to US Interests. This seems to be new and radical and terrifying from my point of view Do you support the US in doing this? You seem to imply you have no problems with the current state of affairs

ubernostrum 9y ago
So, let's just put it clearly: suppose someone who is, at the time, not physically present in the US, breaks into a computer system which is physically present in the US at that time. Which of the following do you think most accurately describes the situation? 1. No crime has been committed, because these actions took place on the internet, where no laws apply and no country has jurisdiction. 2. A crime may have been committed, but only if breaking into computer systems is against the law of the country the person was in at the time, and so only that country could prosecute. 3. A crime was committed in the United States, but the United States cannot prosecute someone for a crime if some element of that crime took place physically outside the borders of the United States. 4. A crime was committed in the United States, and the United States can prosecute the person responsible, and has the power either to arrest that person if they happen to visit the US voluntarily, or to extradite that person from the country they're in if an extradition treaty exists between the United States and that country. The accepted view, for the record, is (4), and appears to be the basis of this case: the indictment claims computers physically located in the US were affected, which gives the US jurisdiction to arrest and prosecute.

jdietrich 9y ago

Hypothetical: A Pornhub executive flies from New York to Seoul on Etihad Airways. While transiting in Abu Dhabi airport, they are arrested on charges of obscenity. What would be the reaction in the US? Factual: In 2006, David Carruthers was arrested while transiting through Dallas-Fort Worth Airport. He was convicted under the RICO act and sentenced to 33 months imprisonment. He was the CEO of the online gambling company BetOnSports, which operated in full compliance with the regulations in the UK and Costa Rica, but accepted bets from American gamblers. Gary Kaplan, another BetOnSports executive, was extradited from the Dominican Republic. The precedent set in the BetOnSports case is either utterly hypocritical or extraordinarily dangerous. If we give every country the right to impose their laws across the whole internet, we don't have an internet any more. A Facebook user posts a comment critical of the Thai royal family; Zuckerberg is sentenced to life imprisonment for lèse-majesté. A Chinese internet user accesses anti-government material via a VPN hosted on AWS and a Google search; Bezos, Page and Brin are all sentenced to 10 years hard labour for subversion.

ubernostrum 9y ago
If you run a business, and decide to do business with people in another country, it's your responsibility to figure out if the business you're doing is legal for that country. This is only a strange idea to a certain segment of internet commenters. The rest of the world has just treated this as the way things are for a long, long, long time. The new, strange, radical idea out of step with established norms is the notion that "on the internet" is some magical lawless, stateless, jurisdictionless place where anything is fair game since nobody could ever prosecute for something that happened in this magical fairyland. It really is time to stop being surprised that you can be arrested and prosecuted for your interactions and business relationship with people, property or other entities in a country of which you aren't a citizen. Also, don't look now, but large tech companies headquartered in the US routinely make changes to their products/services to comply with other countries' laws. If Facebook wants to operate in Thailand, Facebook has to be prepared to comply with Thai law, for example. "We're on the internet" doesn't work as an out.
- ncallaway 9y ago

csomar 9y ago

While I agree that the US should arrest people or entities that tries to harm its citizen; it's important to note that the US doesn't really look for that criteria. For example, they attacked Syria for crimes committed by Syrian against Syrian. The US wanted to carry the attack, and then found the excuse. But why would this surprise anyone? Do anyone think that the US is spending billions on military weapons just for the fun of it?