3 ms·

> But what's to stop a European from hosting content on USA servers, posing as USA company, and violating their regulation--even specifically targeting users lo

by kd5bjo 6y ago

> But what's to stop a European from hosting content on USA servers, posing as USA company, and violating their regulation--even specifically targeting users local to their area from that remote server? That’s what customs and border control is ultimately for: to ensure that goods being imported are compliant with local laws. In the case of data, this means national firewalls— something that would fundamentally change how the internet works.

dheera 6y ago
Correct. Countries can impose firewalls. China does. Iran does. The EU can if they want to. But as a website host, I don't have to do anything. Alcohol is illegal in Saudi Arabia. A Saudi citizen is free to buy alcohol during their visit to the US. They just can't take it back home of course. But the liquor store they visit in the US doesn't need to change their policies for that one customer, and doesn't even need to know which country their customer is from.
bonestormii_ 6y ago
That seems perfectly reasonable by analogy, yet completely unfortunate. Personally speaking, would you prefer a network barrier that actually limits international communication to a toothless enforcement of something like GDPR? In practice, I think I would prefer the latter, even if it is less clear and purely logical. I mean, the US is railing against inquiries over war crimes this week. Though that particular action is entirely irrational, it seems unlikely that the USA would enforce GDPR on the behalf of the EU short of a very large company violating it flagrantly. If I run a local nonprofit in the US that serves the elderly of my community, and the EU-resident child of one of my clients donates to my organization, by which I wind up collecting their information--repercussions seem frankly very unlikely. Firstly, I doubt my non-profit would be pursued for such a violation by the offended nation, as they do have optics to maintain. Secondly, I have no physical presence in their jurisdiction against which to enforce the regulation, so my own government would have to enforce it on their behalf, which currently seems unlikely to me (though I'm not an expert on such things by any means). Depending on their specific activities (information collection, in the case of GDPR); whether or not they are physically present in the jurisdiction of whatever regulation; and their home country's foreign relations with the foreign government who originated the internet law, a company can choose to comply with foreign internet law--or not--at varying degrees of risk. As messy as it is, this seems better than firewalls to me. Perhaps explicit agreements with foreign governments are needed in this area. That seems preferable to firewalls, arbitrary risk-taking, or mindless compliance with a foreign law.

by kd5bjo 6y ago

dheera 6y ago

Correct. Countries can impose firewalls. China does. Iran does. The EU can if they want to. But as a website host, I don't have to do anything. Alcohol is illegal in Saudi Arabia. A Saudi citizen is free to buy alcohol during their visit to the US. They just can't take it back home of course. But the liquor store they visit in the US doesn't need to change their policies for that one customer, and doesn't even need to know which country their customer is from.

bonestormii_ 6y ago

That seems perfectly reasonable by analogy, yet completely unfortunate. Personally speaking, would you prefer a network barrier that actually limits international communication to a toothless enforcement of something like GDPR? In practice, I think I would prefer the latter, even if it is less clear and purely logical. I mean, the US is railing against inquiries over war crimes this week. Though that particular action is entirely irrational, it seems unlikely that the USA would enforce GDPR on the behalf of the EU short of a very large company violating it flagrantly. If I run a local nonprofit in the US that serves the elderly of my community, and the EU-resident child of one of my clients donates to my organization, by which I wind up collecting their information--repercussions seem frankly very unlikely. Firstly, I doubt my non-profit would be pursued for such a violation by the offended nation, as they do have optics to maintain. Secondly, I have no physical presence in their jurisdiction against which to enforce the regulation, so my own government would have to enforce it on their behalf, which currently seems unlikely to me (though I'm not an expert on such things by any means). Depending on their specific activities (information collection, in the case of GDPR); whether or not they are physically present in the jurisdiction of whatever regulation; and their home country's foreign relations with the foreign government who originated the internet law, a company can choose to comply with foreign internet law--or not--at varying degrees of risk. As messy as it is, this seems better than firewalls to me. Perhaps explicit agreements with foreign governments are needed in this area. That seems preferable to firewalls, arbitrary risk-taking, or mindless compliance with a foreign law.