Hacker News Reader

Comment by envy2 | Hacker News Reader

There seem to be a few problems with this analysis.

First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.

Second, apparently, the data does not exist. WhatsApp publicly stated, including in testimony before the Brazilian Congressional Committee on Cyber Crimes[2], that it does not and has not retained any message content once messages are delivered, even before the recent full roll-out of E2E. Based on these statements, it would seem that WhatsApp is indeed unable to comply with the court's request, regardless of any jurisdictional arguments.

[1] https://www.justsecurity.org/29203/british-searches-america-...

[2] http://www2.camara.leg.br/atividade-legislativa/comissoes/co...

View on HN

> First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.

This is all WhatsApp's and the US's problem, not Brazil's. In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings. If anything, I think this would justify ruling against WhatsApp more harshly, as it sends the message to the US that policies which don't respect the sovereignty of Brazil will hurt US economic interests in Brazil.

That said:

> Second, apparently, the data does not exist. WhatsApp publicly stated, including in testimony before the Brazilian Congressional Committee on Cyber Crimes[2], that it does not and has not retained any message content once messages are delivered, even before the recent full roll-out of E2E. Based on these statements, it would seem that WhatsApp is indeed unable to comply with the court's request, regardless of any jurisdictional arguments.

If this is true, that's a solid argument and stands on its own.

>In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings.

It's just as insensitive for a judge of a foreign nation to suggest that all foreigners must consider his rulings when making decisions under their own sovereign laws.

Really it's just absurd that we have borders. Ergo absurd situations arise.

Would you rather no borders exist, and a Brazilian judge ruling against WhatsApp taking out service worldwide, instead?

I'm not sure what I'd prefer, but borders are an artifact of lag-induced information asymmetry that has drastically lessened with modern means of communication and travel and their existence is a pre-requisite for a lot of the fucked up power dynamics on our planet so I imagine a number of potential systems without them could be an improvement.

If a business wants to operate in a foreign country, it seems natural to me to follow the rules of that country; the fact that the business did not open an office in that country looks irrelevant--otherwise, do not open any office abroad and do what you want.

Incidentally, I wonder how the situation would be handled and what the opinion would be if some big foreign company operating in the US were shut down in the same way.

> otherwise, do not open any office abroad and do what you want.

Isn't this a fair position ? Imagine you are a lone dev creating a service that has no specific limitations. You are subject to your countries law, but should also be liable under each single law of every country where your users might happen to be ?

It seems to me that countries should have the right to do what they want within their borders (including shutting down access to some services) but go the diplomatic route if they have to interact with people out of their borders.

What is your problem here? He does not shut down WhatsApp in total or request info for US user or anything like that, only in Brazil. This does not affect you at all. If they do not obey the law in another country, they do not get access there. Their activities in any other country do not change.

One problem I have is free trade. Can the US just randomly ban one of Brazil's exports? I mean the US likely exports more to Brazil than imports from it but if this weren't the case...

The US have always strictly controlled what they imported (if only via tariff) and what they exported.

Well, technically one could argue that it's not strange for a foreigner to comply with the judge's orders if they want their service to keep working in his country. They may refuse, sure, but there are consequences for that.

So, in this case, "all foreigners must consider his rulings", applies only for the those who wish to keep their service working in Brazil.

> It's just as insensitive for a judge of a foreign nation to suggest that all foreigners must consider his rulings when making decisions under their own sovereign laws.

If you are operating in Brazil you have to follow Brazilian laws, including judges' orders. Just because I decide to do something in the US doesn't mean it's automatically legal when I do it in Brazil.

As a digital native, I feel like an international Internet is more important than national sovereignty. That is, I don't think the interesting question is whether US or Brazilian law should apply, the question is how to ensure international access to international digital resources.

Internet sovereignty, for sure.

It's really the only way to go. Otherwise, you get pissing matches. Brazil blocks WhatsApp. China blocks Facebook, GitHub, etc. Iran blocks so much stuff that people need to get data dumps via satellite TV. The US blocks a lot too, but mostly about gambling, "piracy", etc.

That has nothing really to do with Internet sovereignty (whatever that means).

It has to do with some countries suck more, and some suck less.

Plenty of countries don't block anything. Like military aggression, child mortality, literacy rate, etc., that is one important data point about any country and its government.

> That has nothing really to do with Internet sovereignty (whatever that means).

If you don't know what "internet sovereignty" means, then how can you possibly claim that something had nothing to do with it?

I may a.gree with that but still, just because you do not like a law you have to comply. You can try to change it but as long as it exists its law for everyone. You cannot say murder should be legal, therefore I am allowed to do it.

> I may a.gree with that but still, just because you do not like a law you have to comply. You can try to change it but as long as it exists its law for everyone. You cannot say murder should be legal, therefore I am allowed to do it.

Bad laws are bad laws. If you can avoid complying with them, you absolutely should.

I wonder if you'd say the same to Gandhi. "The law is for everyone so you can't evade taxes by making your own salt." https://en.wikipedia.org/wiki/Salt_March

On the other hand, I believe that we have a duty to disobey laws that prevent communication. Civil disobedience is also much easier when you're outside their jurisdiction.

> In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings.

My apologies, but I think that if you re-read what was written, you will find that this was not suggested. The comment was written in response to one that came to the conclusion that this "was all [WhatsApp's] fault." It is suggesting that WhatsApp is not at fault, is probably strictly complying with US law, and cannot share the information in any case. At no point does it even come close to suggesting that the judge in the case should have "considered US law" in his rulings.

Moreover, I feel that your claim does not clearly differentiate between 'considering US law' as a material fact and 'considering US law' as a judicial precedent. You seem to be suggesting that someone arguing that US law ought to be held material to the case is somehow demanding that the Brazilian judiciary hold itself subservient to the US courts. You also seem to be suggesting that a Brazilian state judge has any business interpreting the law so as to "send a message" to the government of another nation, which is simply and patently untrue.

Complying or not complying to a foreing judges orders is a pretty common problem for any multinational company. Even if they have local presensence, the thing requested (data, object, whatever) might be somewhere else. And simply fetching it across a border on a foreign judges order can get you into trouble for "aiding a foreign power" and stuff like that.

It's worse that most local judges simple don't know that there's even a problem, and even if that'a clear to them, the judge most likely has 0 experience in making a successful request to the foreign state. And since all bureaucrats if the request isn't perfect it falls through the cracks. So often (at least if you're locally present) your laywers will need to help the judge to draft and push such a request through.

Long story short: These jurisdictional issues are not at all US specific, it's everywhere. Sovereign states just don't like it all over if their citizens and companies do stuff within their borders under orders of a foreign state.

Huge international US-based companies tend to comply with EU laws just fine (or at least participate in the judicial process) if they are doing business there.

Whatsapp can choose to assign resources to this issue, or it can ignore it and let it solve itself. If Whatsapp thinks that Brazil is an interesting market for whatever it is selling (what are they selling?) or if it is good for PR then they may choose to seek ways to intervene.

> Huge international US-based companies tend to comply with EU laws just fine

When they are operating their business within the EU, yes. For example US companies operating servers in the EU must comply with EU data protection laws regarding information on those servers. This situation is analogous. WhatsApp's servers are in the US so US law applies. If the servers were in the EU then EU law would apply, not Brazilian law.

But by the US laws the US company has to share information information on those servers located in EU with US government if requested...

Which of course is bonkers. But that doesn't mean it's OK for a Brazilian judge to be similarly bonkers.

US companies operating servers in the EU must comply with EU data protection laws regarding information on those servers.

More accurately, US companies processing personal data of EU citizens must comply with EU data protection laws. It just so happens that locating the servers in the EU is among the easiest ways to comply with that.

Right, because the personal information is being transmitted outside the EU. Even if it's from a browser in the EU to a server in the US, that still counts. It's still an activity taking place in the EU.

The Brazilian case isn't about data transmission though. WhatsApp isn't in breach of any rules about that. It's about court ordered access to records stored on an server in a specific geographic location - The USA. Now if the Brazilian government passed a law requiring WhatsApp to record all data on servers in Brazil that would at least be possible to comply with.

> You seem to be suggesting that someone arguing that US law ought to be held material to the case is somehow demanding that the Brazilian judiciary hold itself subservient to the US courts.

Allowing a company to break Brazilian law because US law demands that the company break Brazilian law would absolutely put the Brazilian judiciary in a subservient position to US law.

> You also seem to be suggesting that a Brazilian state judge has any business interpreting the law so as to "send a message" to the government of another nation, which is simply and patently untrue.

Brazil decides what is and is not the business of Brazilian state judges.

"The truth is like a lion. it needs not defense. it will defend itself" -- St. Augustine

St. Augustine was wrong

> This is all WhatsApp's and the US's problem, not Brazil's.

So you're saying it's OK for Brazil to send a SWAT team to raid a house in the US? The judge's order has no validity outside his jurisdiction; just like a US judge's order has no validity in Brazil.

> So you're saying it's OK for Brazil to send a SWAT team to raid a house in the US?

No.

> The judge's order has no validity outside his jurisdiction; just like a US judge's order has no validity in Brazil.

Which is why the judge only banned WhatsApp from operating in Brazil.

I can believe them when they say they don't keep data. When I got a new phone (the old one broke), I was expecting my conversations to be in the cloud somewhere so that I could recover them. Nope, I lost everything that I hadn't backed up.

I don't see what they can gain from storing masses of old chats and then not allowing users to download them onto new devices. If they kept chats to do analytics on, there's no reason that they wouldn't expose it to users too.

(This may also explain how they survived as a company for so long with so many users and so little revenue. All they're doing is running a few fast servers to shuttle messages back and forth, no storage requirements at all).

On the other hand Telegram does seem to store conversations - if you log in using a desktop app, it will pull down your recent chats.

Telegram isn't end-to-end encrypted unless you're in a "secret chat", and that chat exists only between two different devices and can't be used by multiple devices on one account.

It's a "feature" of the normal chats/channels/groups/supergroups of Telegram that you are able to download them to other devices, or to restore them on a freshly wiped device, because (and I'm over-simplifying here, but the end result is the same) they are encrypted with a key known to the server, and which other devices signed into your account can then be authorized to use.

My point was more that if WhatsApp retained messages in some form they most likely would expose that functionality to its users (as Telegram does). So when people say 'apparently' they don't store messages, I'm inclined to believe WhatsApp/Facebook.

> I can believe them [WhatsApp] when they say they don't keep data.

If that's true, I'm in awe of their integrity. Skype on the other hand now has complete disregard for user privacy. Skype stores your voice mails and video messages forever[1]. This is something that they started doing 2-3 years ago and few people seem to be aware of it. It's amazing how low Skype fallen from its early days when it was considered a beacon of privacy and on the cutting edge of encryption and security.

[1] Details: Clicking on Preferences -> Privacy -> Delete history (OS X) or Options -> Privacy Settings -> Clear history (Windows) pretends to delete the voice/video messages but it merely hides them from your view. If you re-install Skype on the same computer or run Skype on a different computer, all those "deleted" voice mails and video messages re-appear. The delete and clear buttons are basically lies; there's no polite way to put it.

You used to could store your archive to Google Drive (at least with the Android client).

Edit: yes, the chat backup functionality still works. I have never tried to restore it though.

Go to settings > chats >> Chat backup to start backing up your messages to Google Drive. (Make sure you have 2FA on your Google account)

I thought Skype only stores the last 30 days of data on their servers, while it will store every piece of data received on your local computer indefinitely (unless you delete it, of course).

No. I personally have a video message that is almost 3 years old that I've tried to delete multiple times over the years and it still shows up if I do a fresh install of Skype on a new computer.

Very old voice messages are also accessible even if "deleted".

Text chats do seem to disappear, but at this point I don't believe anything Skype says. I figure they keep the chats forever as well.

Chats are definitely saved, but files aren't. You can't retrieve files after certain amount of time. I can also retrieve conversation from 3+ years ago. I don't remember if there is an option to forget conversation history though.

In all fairness, that's not say they're not being moved to deep physical storage. That's a practice in many organisations dealing with mass data.

Skype was never a reliable option. They never published their protocols or security (just that one "review" iirc). They took many measures to prevent people from inspecting the client.

storing data for 1 billion users and maintaining consistency is a pain the butt operationally. Whatsapp isn't storing the data. If they are, they're spending hundreds of millions on servers for data they can't monetize easily without alienating all of its users.

It is just text records, I doubt it will take hundreds of millions, even at whatsapp levels

No, a lot of pictures and audio messages as well go through Whatsapp

I wonder if they record the necessary analytics data from mining the text, and then delete the actual text. Depending on what data you're trying to mine, you may be able to get what you need on transmission, and then dump the source data in favor of the output of the analytics event.

The chats are end-to-end encrypted, so there is no plain text anyone could "mine"

Unless they are covertly decrypting them on the fly using a master key.

Shouldn't that be impossible by definition?

I think it would be possible to include additional data in the E2E handshake that would allow a third party to extract the session key.

That's true if you believe WhatsApp (and I do with some probability of certainty--not certain enough to trust it with data I wouldn't want the government to see, but enough that I'm comfortable hackers won't get my bank info).

But, the NSA approach to data collection is basically to vacuum it all up and, if possible, decrypt it later. This has two implications:

1. Metadata. "We kill people based on metadata" isn't a joke, it's a quote from Michael Hayden, ex-executive in both the NSA and CIA. End-to-end encryption doesn't hide who you're talking to or when.

2. It seems unlikely that it will be computationally possible for them to decrypt all traffic, but it would only surprise me a little if AES128 is breakable for high-value targets in the next 20 years: increased computing power, better multi-threading, better cryptanalysis algorithms, maybe quantum computing or some completely unexpected technology; it's hard to say what will come along.

In short: mining encrypted data still matters.

Digressing from the actual discussion, Whatsapp now allows you to keep a backup of your chats and related media on your Google Drive and then recover it when you move to a new device. Probably applicable only for newer versions of Android (not sure about iOS).

You can backup to (and restore from) iCloud, but then again WhatsApp (the company) does not have the data then.

Yes, I didn't mean to say they have the data. That's why I said I'm digressing from the topic (realizing the parent commenter might find it useful).

> WhatsApp is a US company and...

I always feel like many large US tech companies want to have their cake and eat it. They want to be a global company, they want to have 2 billion users, and are valued at having that many users. But when it comes to laws, suddenly they operate under US law alone.

I wouldn't mind if they ignored all national laws, and acted like a true global company. But I'm not from the USA (or Brazil), and don't want to be under US law. If you want to operate only user US law, then why not constrain yourself to the US market? Only operate there?

> when it comes to laws, suddenly they operate under US law alone

And when it comes to taxes...

... and when it comes to taxes they operate under US law, meaning that if they repatriate any foreign profits, they will have to pay taxes. If they decide not to, like Apple has decided, they won't be liable for any tax payment.

That makes sense to me. But there really is no international law that's coherent and enforceable. It's a hard problem.

I think given that, it is reasonable for local jurisdictions to act as they see fit.

For everyone to act as they see fit, I believe.

You mean as a Freeman of the Land? https://en.wikipedia.org/wiki/Freemen_on_the_land

As an ideological position it has some interesting points to make, but in a contemporary legal setting it's difficult to find footing.

My personal position is informed by Hobbes (https://en.wikipedia.org/wiki/Leviathan_(book) ) in that we have to make compromise with our individual liberty to bring about a greater good.

> "No arts; no letters; no society; and which is worst of all, continual fear, and danger of violent death: and the life of man, solitary, poor, nasty, brutish and short."

Well, that's the Internet, isn't it?

I mean this: https://anarplex.net/hosted/files/declarationseparation.html

Interesting. I think it boils down to a freeman argument though - you're basically issuing refutation of your implicit social contract. While the sentiment therein is laudable it is somewhat premature. Though one has a great deal of independence in the cyber realm one is can still run afoul of limitations of the real world and her laws (as demonstrated today in Brazil).

I think cyberspace currently is best categorized as a distinct estate rather than realm in a similar vein to the press and the judiciary. Each functions with more or less autonomy but can occasionally be subjugated to the other.

https://en.wikipedia.org/wiki/Fifth_Estate

One can always be subjugated. By robbers. By terrorists. By ISPs. By governments. By whatever. So one does what one can to be left alone. And helps others following the path.

But in meatspace, one blends in, doesn't attract attention. As in Vinge's True Names. Ultimately, authoritarian states may wither. Or not. But in the meantime, one can manage, under occupation.

Yeah but you can't "declare independence"

I can act as if I were independent. And as long as I can manage that, I am independent. Until I'm not, or dead ;)

> in a contemporary legal setting it's difficult to find footing.

Freemnan-on-the-land is totaly quackery in a comptemporary legal setting. It's like homeopathy, but for laws. It's Creationism, it's snake oil. Fundamentally it presumes/assumes that laws work differently from how the organs of the state think they work.

Law ≠ Science. It's an interesting thought experiment. It's not like homoeopathy or creationism in that legal precedent emerges by evaluating any reasonable legal argument and their counterpoints and determining which among many is 'right'. It is not hard to conceive of a "freeman" society but what's important is to point out why isn't a realistic aspiration, rather than just shouting "you're wrong you're wrong you're wrong".

I am not talking about separation in meatspace. Or at least, only in subtle ways. Attracting attention is just stupid.

You're always in meatspace - cyberspace is just another dimension to it. Unless you're Job from the lawnmower man.

True enough. What I mean is that I don't wear disguises, have multiple sets of IDs, hang out at anonymous exchange sites, and so on. But one can compartmentalize cyberspace substantially from the rest of meatspace, and then compartmentalize within cyberspace. Or at least, that's my experience. Maybe I'm just not interesting enough ;)

completely agree.

If it was a small company based out of Iceland, or South Africa, or Singapore, it would still be in the same legal situation. The company (assuming just a single incorporation presence) is under the laws of the country it's from, and Joe Random user from across the internet is internationally accessing it.

National law cannot enforce anything on organizations not within the national jurisdiction, without international cooperation. However, they can (attempt to) stop their own citizens from accessing the international service.

That is false, at least in the example of online retail. If you sell stuff to someone in another country, online or not, you are bound by the consumer protection laws of that country. So someone in Scandinavia has two years of warranty on a laptop bought on dell.com, vs. one year for an American making the same purchase.

I don't think it makes a difference whether what you are offering is physical or not, your service is bound by the laws in whichever country the exchange takes place. Of course enforcement might be an issue, which is exactly why the Brazilian judge did what he did, when Whatsapp failed to abide by Brazilian law.

Note that I only said "enforce". A country can claim whatever they want within their own borders, but cannot really enforce them across the border.

Even with the laptop warranty case, if some small retailer from Country A shipped a laptop to Scandinavia, but didn't uphold a 2 year warranty, the Scandinavian governments would not be able to force the warranty to be upheld. They can make whatever local judgments they want, but none of them would touch Country A without international agreements in place.

There's absolutely nothing special in this case because WhatsApp happens to be operating on the internet. Suppose they were a mail order company based in Brazil but serving customers internationally by post. If a US judge issued a court order in the US requiring the company to hand over business records stored on paper in Barzil, he would have no jurisdiction whatsoever. Brazilian law protecting the privacy of information stored in Brazil would prevail. there would be no controversy about this.

The fact that WhatsApp's info is stored on servers rather than paper records is irrelevant. The jurisdiction in which the records reside applies. Although the fact that their servers don't even store the information requested anyway should be.

> Suppose they were a mail order company based in Brazil but serving customers internationally by post. If a US judge issued a court order in the US requiring the company to hand over business records stored on paper in Barzil, he would have no jurisdiction whatsoever.

Fair point. But to continue that analogy, the US judge is quite free to ban the commercial operation of that Brazilian company in the USA. Which is exactly what happens, and is happening here.

OK. So now you're banning a company for operating in your country, because they choose not to become criminals in their own jurisdiction. So why ban them for a day or two? What's that supposed to accomplish? Logically if this was the justification they would ban it permanently. Banning it temporarily is just playing spiteful games that isn't going to accomplish anything.

If WhatsApp is unable to comply with Brazilian law, should it be allowed to operate in Brazil?

I think this is a bad law by the way. Hopefully the clearly negative impact it is having will lead to it's reform.

It seems to me that they did comply with Brazilian law. They handed over all the conversations they had — zero. Is there a law that says they have to record all the conversations?

They didn’t – they didn’t hand over the IP addresses that were requested.

Where did you read that?

I don't remember if those comments had sources, but I've seen that in various comments in this thread. There seems to be a lot of misinformation going around.

Do they operate in Brazil? They apparently have no offices there and are only available over the internet (as is true of all websites throughout most of the world.) How can anyone expect to hold what amounts to a random IP address on the internet responsible for anything?

Their apps are in the Brazilian app stores

My apps are in the Danish Google Play and Apple App Store...

I never been there, I don't read or write danish, I never interacted with danish government, or met any danish person.

If the dane government wanted something from me, and sent a letter to some random person, written in danish, even if it reaches me, I wouldn't understand it anyway.

Thus, having app in some other country store doesn't prove much, except that you clicked "publish" somewhere on Google or Apple uploading interfaces.

> except that you clicked "publish" somewhere on Google or Apple uploading interfaces.

At which point you agree to adhere to their laws and regulations.

A famous example of someone operating legally under local law, but who got prosecuted for having merely a website accessible in another country, was Kim Dotcom.

That’s the current state of international law, either lobby to change it, or accept it, but don't ignore it.

>>At which point you agree to adhere to their laws and regulations.

Uhm nope. If my app(published on Apple Store/Google Play) violated a law in Saudi Arabia and they sent me a letter requesting me to appear and subject myself to 100 lashes for violating their law, I would very promptly disregard said letter, to put it politely.

Then don’t publish your app in those countries.

But....why not? As a person interested in selling my app, why would I not publish it in the largest number of markets available?

Because if you're not willing to do the legwork to see if your app is following the letter of the law in those countries, you may be subjected to being banned due to violation of said laws.

That's not really an argument. Go ahead and ban it. There's no reason anyone should preemptively ban themselves just because someone else wants them banned.

It's a bit like saying "You should hang yourself, because if you don't, I'll hang you." The proper response is "get on with it then."

They have the power to block you in their country, just as you have the power to publish in their country.

Just because you can take their money doesn't mean they have to accept that.

Selling apps is like selling any other product.

I can’t sell medical marihuana in most states of the US – and I don’t go and try, and then complain about getting arrested.

Instead, if I wanted to start a business doing that, I’d check out where it would be legal, and in which ways, and sell my product in those markets.

Why do you assume you can sell your product in markets without having checked the legality, and then complain when they ban your product because it violates the local law?

Hmmmm your example isn't exactly valid. If I was selling something on ebay out of EU, and you ordered something from me to US, I would almost definitely not get in trouble for sending it to you, unless it was an item which has export restrictions from my country. Or to go back to my example of Saudi Arabia - if someone from Saudi Arabia bought something from me I would definitely absolutely not bother to check if what I'm sending is legal in there. If it isn't, then customs will confiscate it and the person buying it will be in trouble, most likely.

My point was - is there any reason why I, as a developer, should not check "all countries" when publishing an app? If Saudi Arabia wants to ban my app later - let them, I literally don't care.

If you sell in another country you are subject to their laws, an obvious example is consumer protection laws. This is a fact. Whether or not you are going to follow any rulings made against you is another matter, in that case all the country can do is try to block you in whichever way they can (like Brazil just did) and possibly prosecute you in absentia.

But...I'm not selling anything in another country. I'm advertising online and someone who bought the item asked me to ship it to Saudi Arabia - sure, whatever. I don't have an office there or a business presence. How would they prosecute me? What for? Their citizen bought something from me and then had it delivered to their home in Saudi Arabia - if he's breaking the law, then it's on him. Now cut out the post from this equation - imagine he came over here, bought the item from me and brought it back with him - how would I be held responsible for what he is doing with the item and where he is taking it?

And yes, consumer protection laws absolutely still apply. The laws of my country - if my country says that I have to give him 2 years warranty - of course he gets 2 years warranty. If his country says a seller can be subject to 100 lashes for selling prohibited materials - they can go and try executing this, I wish them all best luck.

You might do this and then you get convicted in absentia, Saudi Arabia will send a request for extradiction, your country will say no, done. Except: better not travel to Saudi Arabia or any other country that will extradict. Also Saudi Arabia will propably ban your App, which is what is happening in Brasil.

> You might do this and then you get convicted in absentia, Saudi Arabia will send a request for extradiction, your country will say no, done. Except: better not travel to Saudi Arabia or any other country that will extradict.

And that is the problem. You can't actually expect people to hire lawyers from 108 different countries to see if their app is legal in each of them just because they're going to distribute it on the internet, to say nothing of what happens when two countries have mutually contradictory laws (e.g. privacy vs. data retention). And a person who goes to see the Great Pyramids shouldn't have to worry about being hauled off to Saudi Arabia and then stoned to death because their app doesn't prohibit blasphemy.

> Also Saudi Arabia will propably ban your App, which is what is happening in Brasil.

Which only increases the proliferation of tools to bypass the restriction.

> You can't actually expect people to hire lawyers from 108 different countries

You could expect facebook, with their almost infinite resources to so.

No business should play along with their BS or hand over customer data.

I never thought I'd say this, but: Good on Facebook for not complying.

So, VW should be able to sell cars in the US ignoring the environmental laws, too?

VW has an actual office in the US - it's not VW Germany selling cars in the US, but VW America.

If you purchased a VW car in Germany and had it shipped over to the US it would be on YOU to make sure it complies with all requirements of your country, not Volkswagen's.

They have every right to pull your app, arrest you and prosecute you if you ever do go to their country, and apply to have your extradited under relevant treaties.

They have every right to do something ridiculous like that, in the same sense Hitler had every right to kill the Jews. I.e. only in their minds.

Harmful lays laws should not be considered lawful just because somebody wrote them down.

While I agree that whipping someone, execution via stoning, and other punishments are inhuman and no country has the right to exact them, I stand by my point in general.

I disagree, because I believe human rights exist.

And you won't care if they summarily shut down your app in their country, then, of course?

> A famous example of someone operating legally under local law, but who got prosecuted for having merely a website accessible in another country, was Kim Dotcom.

That's a pretty shit example, given everything that happened around that case.

Lesson there is not to piss off the US IP industry ;)

They are in the Apple and Google app stores, you mean to say.

The person I was replying to asked "Do they operate in Brazil?". And considering that the app stores are on a country level, I'd say they do.

The app stores operate there as distributors. Just because my product is distributed somewhere by a third party doesn't necessarily mean I operate there.

If an art dealer sells a painting to someone in brazil, does it mean the original artist operates in Brazil?

I think the difference is that you /knowingly/ (to an extent) sell your app to Brazil. If you sell your art depicting, say, women in power to Saudia Arabia to someone here and they move to Saudia Arabia and sell it, it's not your fault. But if you told him it's ok to sell that painting in Saudia Arabia, I would assume you can be held liable.

(Not that I agree with that, but that's what it looks like)

In the artist/dealer scenario, only the latter is actually under the legal jurisdiction of Saudi Arabia and could be legally compelled to follow a court order. They can choose to hold anyone liable but their legal and practical ability to compel an entity to comply doesn't extend beyond their state unless they have an agreement with another state.

Apple has a corporate office in Brazil (google too) and they're the ones who distribute and approve the application for sale there. They're legally required (I assume) to respond to legal notice they're served with. WhatsApp is not legally required to do so, and others have pointed out that it might not even be legally feasible for them to do so.

Of course this situation is more complex because obviously Apple doesn't have the data and I doubt Brazil wants to get into a legal battle with Apple. And although Brazil doesn't have the ability to force WhatsApp to comply with anything, they do have the leverage of being able to shut down their service. Should make for an interesting story to follow.

At the very minimum, if they had served Apple/Google instead, they would have had a legal requirement to actually respond. I don't know much about the actual case so these are mostly assumptions.

This argument looks like it can also be applied to even malware. If I put something illegal doesn't has the judges right to stop the distribution of that app in the country? Another question is if what Watsapp did should be illegal. But if the judges can't stop internet companies from doing something illegal who do you thing should do it?

No, he does not have that right. By that same logic brazilians shouldn't be allowed to visit websites from any other country where there's a discrepancy with brazilian law. With a government like ours next thing you know we have our own Great Firewall.

This kind of thing can't even be enforced, being so easy to bypass.

except you are wrong. e.g. https://en.wikipedia.org/wiki/Countries_blocking_access_to_T...

every country treats certain content as criminal as they wish. Where the servers are is just a minor detail.

No it's not a minor detail, because it's easy to bypass, specially if its a decentralized service. Nevertheless its an outrageous retrenchment of our freedom.

No it's not a minor detail, because it's easy to bypass

All laws are easy to bypass, what's your point? Ever tried to go 60 in a 30km/h zone? Lack of 100% enforcement does not make a law useless.

BS!

they have bank accounts and deals with many tel co to operate as they do in each country they are.

you do not get pre-installed on the three biggest mobile operators phones (99.9% of market) and get deals where data to your service do not count as part of the limited data-plan on two of them, by just "being an IP address on the web".

Do you have a source for this? Why would bank accounts need to be situated in Brazil for these deals to happen? That doesn't make sense.

you can pay whats app directly via the operator. e.g. http://www.tim.com.br/sp/para-voce/planos/pre-pago/turbo-wha...

you can't do that in brazil without having the papers to do business there. in fact, you can't even sell anything without the right documents. Just like everywhere else.

paying whatsapp?

I don't know portuguese so I didn't actually read what the deal is.

Is this a service where subscribers pay the carrier a fee for 30 days of unlimited data traffic to whatsapp servers (VoIP excluded) + 50M of data ?

If yes, does that constitute a transaction the consumer makes directy to whatsapp via the operator? I understand that likely whatsapp and TIM (an Italian company btw) might have made some deal and exchanged some money for the use of whatsapp logo etc, but I guess that transaction could have been done anywhere.

tim is Spanish.

the app has in app purchase. that page describes both what you described plus paying for in app purchases via operator

https://en.m.wikipedia.org/wiki/TIM_(brand)

> TIM is an Italian brand owned by Telecom Italia. Originally founded as a mobile telephony company in 1995

https://en.m.wikipedia.org/wiki/TIM_Brasil

> Parent Telecom Italia Mobile, Telecom Italia

Right now, it's more of a benefit to phone manufacturers to pre-install whatsapp than it is to whatsapp itself.

Same goes for the telcos. Offering free whatsapp and Facebook is a thing. And it's not because whatsapp had a "deal". It's because the telcos want more users.

Developing countries eat that up. People explicitly want to see whatsapp support or they don't buy the phone and many terrible devices have been sold on this premise.

Source: Experience

Source: 20+yrs on the online advertising industry.

Nothing that lives of ads or telecomunication companies survive only by "serving the user". The telco only pre-install something on the device if: A. they are paid upfront, B. if they get a percentage of the ads.

yeah, serving the user is good, but remember that you are talking about companies that charges for SMS. the day they have to rely on "pleasing the user" hell will freeze over. They rely on regional monopoly, just like in the US.

Does not including a popular app preinstalled increase sales?

not at all. what part of monopoly didn't you get? they already have all the sales.

We have a clear market leader, but it's by no means a monopoly.

People constantly switch network providers here since we have number portability. My wife, me and many of our friends switched to Vodafone cos they were offering a really great Internet package. Free Whatsapp, Facbook, Twitter, Instagram,and Snapchat plus 3.5 GB for what's essentially $9 a month. Here that's unbeatable and unheard of. http://support.vodafone.com.gh/customer/portal/articles/1813...

I doubt all these services are paying for for Vodafone to do this.

Luckily, there is serious competition here.

MTN does it, Airtel does it and Vodafone I think does it as a package.

If you currently don't offer some sort of package or free service, you're out of the competition.

Who cares what the law says? The laws should serve the citizens. And in this case, a huge majority of the citizens prefer to use WhatsApp.

The judge cares. Because the basic tenet of a Republic is the separation of powers, a Judge is not allowed to decide whether or not a law is fair or good for the people; that decision falls on the legislative branch.

> has no presence in Brazil.

If they have no presence in Brazil, how did they get shut down in Brazil? I don't mean to be glib, but I don't see how the two concepts jive with each other.

On a purely practical level, if they were interesting in maintaining their service in Brazil, why didn't they establish a presence in Brazil when all these previous orders and shutdowns were going on? This is like ignoring notices in the mail and then wondering why you're getting collections calls.

> If they have no presence in Brazil, how did they get shut down in Brazil?

Blocked at the ISP level.

Seems like a flaw in the service if it can be shut down that easily.

Why is that a flaw in the service? The ISP/mobile operator is essentially the gatekeeper to the Internet; having them block WhatsApp (or anything else) is just a case of them adding a block rule to their DNS.

What would interest me is knowing whether or not access is still blocked if you change your default DNS server to something like 8.8.8.8?

Changing the DNS server has no effect; I use Google's and it's still blocked.

What if you hit it via some VPN service?

I can reach them through a VPN, no problem at all to communicate with people outside of Brazil or with those connected through a VPN.

OT: Intrigued and tempted by ivpn.net but the about page don't give me enough info to decide (no team, no physical address...) Where can I read more?

Whois has provider name, business address and telephone.[0] They say:[1]

> VPN was founded in 2009 by a group of information security professionals who met whilst doing their Msc in Information Security at Royal Holloway, University Of London.

I've never researched that, but I've worked with them for years, and it's consistent with my experience. They're good people, I believe.

[0] http://www.siteshowinfo.org/sites/www.ivpn.net

[1] https://www.ivpn.net/aboutus

Somehow I assumed you worked for ivpn, based on your profile. My bad! Thanks for the info anyway.

I freelance.

WhatsApp uses IP addresses directly to route the traffic, but you could still use a VPN. The problem is that unless everyone else uses one you won't be able to talk to them...

Using DNS is the start of the flaw.

If a US law makes it impossible for a US company to comply with laws in another country in which they operate, that other country has the right to prohibit said company from operating there.

That doesn't mean it's wise for the said country to do so. In this case, doesn't seem like it is.

> WhatsApp publicly stated that it does not and has not retained any message content once messages are delivered

This does not make a lot of sense.

If they don't retain any message content, then how am I able to browse all my message threads on https://web.whatsapp.com?

EDIT: I'm wrong.

The messages come from your phone; that's why you need your phone to access the webapp.

It connects to your phone which stores the messages, I believe.

I also use the web interface and I believe it tethers your phone to the browser - so the phone is sending the unencrypted messages to the browser window.

If you delete a message on the phone the message disappears in the web interface too.

Looks like you guys are right:

"WhatsApp Web connects to your phone to sync messages."

I.. did not know that.

Foreign law enforcement may kindly request US DoJ OR operate under their (foreign) laws (and with 0 help, it's not hard to guess what route would be taken).

Your first point makes no sense whatsoever. Because an American company operates in a foreign country doesn't mean they don't have to follow the law.

"oh sorry, breaking local laws? Oh well, we're in america! Too bad!"

Doesn't work like that.

> Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content

i know nothing about law, but where are you getting this from? does not seems to be the case with any company in china (yahoo gave in, google decided to leave) for example.

The difference is likely that these companies had the type of presence that causes Chinese law to come into effect ... such as physical presence (servers), buildings (owned property), human presence (employees, especially if they're Chinese citizens), financial presence (bank accounts, insurance), business/legal presence (i.e. local corp, subsidiary, company of some sort).

And in that case, it's the Chinese subsidiary that makes the decision to comply with Chinese law, as it obviously has to.

> First, WhatsApp is a US company and has no presence in Brazil.

I certainly disagree with this ruling, but "no presence in Brazil" is wrong and contradicted by Facebook itself:

https://www.facebook.com/careers/locations/saopaulo/

> São Paulo, Brazil 23 open positions

> One of the most talented and diverse cities in the world, Sao Paulo is a hub for our operations throughout Latin America. Our teams make an impact by providing support to our communities, small and medium businesses and brands in the region.

And of course their Latin America VP is located in this office:

http://www.zdnet.com/article/facebook-hires-new-latin-americ...

So I don't know where the bizarre idea that Facebook has "no presence" in Brazil comes from.

WhatsApp and Facebook are in fact still separate companies. Just making this distinction.

"Separate" as in WhatsApp Inc. is a wholly-owned subsidiary of Facebook Inc. That matters a lot.

I suppose, but would you refer to General Electric and Telemundo in the same interchangeable way? Same difference. If I were applying to a job in GE's aviation research division, I wouldn't mail my application to Telemundo.

That's actually wrong at multiple levels; Telemundo is a division of NBCUniversal, a wholly owned subsidiary of Comcast since 2013.

It would be an apt comparison, if you imagine that Comcast had a Latin American headquarters in Brazil, where Telemundo's Portuguese telenovelas have millions of viewers; it would be weak tea for NBCUniversal to then argue that Brazil had no jurisdiction over it and the programming it distributes there because the shows are produced in Florida and NBCUniversal has no employees there.

If you want to do business in a country then you should follow its laws.

Reply on news.ycombinator.com