3 ms·
I ran that very same project for a large tech company as well and our assessment was the same as yours. Intent is not having to deal with other countries author
by smueller1234 9y ago
I ran that very same project for a large tech company as well and our assessment was the same as yours. Intent is not having to deal with other countries authorities when making information requests.
Oh, and the guess-what-they-really-want-so-we-can-even-comply-at-all game was fun here, as well. We made a genuinely good-faith effort in no small part because the Russian market does really matter to us. I think/hope it'll hold up.
Sidenote: There's a similar (in hilarity not content) guesswork coming up with the new EU privacy regulations (GDPR and the new e-privacy regulation that isn't done yet). Sigh.
- int_19h 9y agoOut of curiosity, how do you determine whether a particular user is within the scope of this law, or not? (The problem with the law is that, by the literal meaning of its wording, it is applicable to all Russian citizens anywhere in the world, not just in Russia proper.)
- smueller1234 9y agoGeo-IP minus any cases of "we know they're not Russian" due to accounts/etc. In other words: as conservative as possible heuristics. Edit: Clarification. Simply having an account on some website is obviously not what I meant. I meant cases where we legitimately have and are allowed to use (see GDPR consent requirements wrt what you can and can not do with PII under EU regulations) users' PII to decide this.
- int_19h 9y agoIs there a case where "you know they're Russian", but geo-IP doesn't support that?
- smueller1234 9y agoWhat I wrote earlier ought to be symmetrical. But in practice, having certainty is exceedingly rare. It's not like we require passports for our service. What I meant is more that simply because an existing customer uses the services while travelling on Russia, we don't just move all data there.