Hacker News Reader

Comment by BrandoElFollito | Hacker News Reader

> Apparently a lot of US business sites refuse to connect from oversea IP because (...) they just don't want to deal with it

I am French. What I find fascinating is that there are local US newspapers (that server a tiny community) that went through the effort to do a geoblock from the EU and put a page along the lines "we cannot be compliant to Privacy laws in the EU so we must block you".

Why do they care at all? How is the EU law relevant to their small, local business?

Large companies are different - there could be some litigation against their footprint in the EU etc. - but for thosewho just live in the US (or anywhere outside the EU) going the extra mile to block because of non compliance is really weird.

View on HN

It's just a lot simpler to block than having to keep up with laws in other countries for businesses who don't even do business in those countries. It's not like it's hard or time consuming to implement, and cheaper than your other suggestion further down of consulting a lawyer every time one of these pops up, like "do I have to annoy my customers with these stupid cookie popups every time they visit?" Why should I have to spend a dime for something that is external to my company, has nothing to do with it, and have to constantly keep on top of it? We don't even sell our services there. Why should I even waste the bandwidth? Our firewalls are sure a lot less active, as well. Why should I waste time answering emails from people we don't sell to? It's better to just not get them. I guess my question to you is why do YOU care if they're accessible or not? If a (local) business really just wants to sell within their own (local) country (or even smaller municipality such as state/county/city), is there something wrong with blocking everything outside it out and just not worrying about it?

> It's just a lot simpler to block than having to keep up with laws in other countries for businesses who don't even do business in those countries.

Exactly, except that it is just simpler to do nothing.

Do you (I assume you are not in either of the countries I give an examples, nor travel there) worry about laws in, say, China when you state "Taiwan is an independent country", or Russia when you say "Russia invaded Ukraine", or North Korea when you say "NK is a tyranny", or France when you say "Retirement should be at 60 and not 64". No. Because the local laws that forbid these statements are, well, local. Nobody cares outside of these countries. They could send you letters informing that you did wrong and that you have to pay 1M USD and you would just put that to trash.

> I guess my question to you is why do YOU care if they're accessible or not? If a (local) business really just wants to sell within their own (local) country (or even smaller municipality such as state/county/city), is there something wrong with blocking everything outside it out and just not worrying about it?

I do not care - it is just that I ended serendipitously on a few of these places and was wondering why they care (I would not care about the cookie law in Zimbabwe or Patagonia if I had a web site).

Ah, now I remember how I got to one of these pages. I wanted to have a look at the local newspaper of Tuttle, Oklahoma because of a funny (and sad for open source devs) event that happened there in 2006: https://www.theregister.com/2006/03/24/tuttle_centos/. It was blocked for GDPR reasons (at the time at least)

Our hacking attempts dropped by approx 85%, and we use less bandwidth. There are other benefits to blocking traffic to places where you don't do business.

> They could send you letters informing that you did wrong and that you have to pay 1M USD and you would just put that to trash.

I think it's just better to not get those letters in the first place (any more than spam phone calls or texts) and have to waste time reading them, or having to possibly consult an attorney over them to see if they have merit. It's just not something I want to be bothered with, nor should I. It has nothing to do with the company, what we do or our customers.

> Do you (I assume you are not in either of the countries I give an examples, nor travel there) worry about laws in, say, China when you state "Taiwan is an independent country", or Russia when you say "Russia invaded Ukraine", or North Korea when you say "NK is a tyranny", or France when you say "Retirement should be at 60 and not 64".

We don't say anything like that on our company sites.

Most small local newspapers are owned by huge megacorps. GDPR EU laws and some others explicitly say that they can be enforced to entities outside the EU. I don't know if it has ever been enforced, except for large multinationals.

The US does do that kind of thing though. As a dev, break some law, step foot in the US for a conference, get arrested (ex: Sklyarov 2001 case, for breaking PDF encryption).

Although for most financial things, it's common in US/CA to block non-local IPs. Heck, I was in Mexico and I couldn't login to my provincial government tax portal. There are constant security issues with those sites.

> GDPR EU laws and some others explicitly say that they can be enforced to entities outside the EU

They can tell whatever they want, but it would need to be a US court (in that case) who would do the litigation. Which they won't.

> The US does do that kind of thing though. As a dev, break some law, step foot in the US for a conference, get arrested

yes, this is why I mentioned that my point is only for local businesses. Travel or business in the EU can/will be problematic.

> Heck, I was in Mexico and I couldn't login to my provincial government tax portal. There are constant security issues with those sites.

Blocking for security is another thing. Maybe a good idea, maybe not - but that's another story.

> They can tell whatever they want, but it would need to be a US court (in that case) who would do the litigation. Which they won't.

That's a pretty incomplete view of how jurisdiction works. You do probably need a US court ruling to enforce a claim against a US entity – but if that entity has any EU subsidiaries or assets, you can bet that European courts will come after those.

> Blocking for security is another thing. Maybe a good idea, maybe not - but that's another story.

As a customer/taxpayer that needs access to a service from abroad, I really don't care why I have to jump through hoops to cancel a subscription/order or pay my taxes owed.

> That's a pretty incomplete view of how jurisdiction works. You do probably need a US court ruling to enforce a claim against a US entity – but if that entity has any EU subsidiaries or assets, you can bet that European courts will come after those.

I am not sure you read my post in details - I explicitly mentioned that I am talking about local services, without any international footprint. And mentioned that in case of this footprint - yes, they will be sought after.

This is also exactly waht the US does to enforce their "extraterritoriality"

They're maybe local services, but they're not local businesses. c.f. my post :)

And they can be enforced not only from assets, but also from travel or various financial tools at their disposal. (it would be surprising, but for many businesses, it's not worth the hassle)

The business may be local but the owner or other management or employees may wish to keep all of their travel options wide open without fear of some obscure foreign law that might hold them individually responsible.

The golden days of global network accessibility are closing little by little.

I'm sure there are still some people willing to report the websites to EU commission, it's a guaranteed fine (less so a paycheque, I have no clue if the company has to comply with paying it (unless later on they want to expand to the EU))

This is a fine that the EU can issue but why would the local business care?

If I was issued a fine by the US, China, India or Japan it would directly go to the trashbin. It is their law, and their problem, not mine.

Of course this means that I will not be able to do business there, if I travel I may be in trouble etc. But again - we are talking about small local newspapers (and similar businesses).

between the options of:

A. [re-]architect in in GDPR compliance;

B. deal with incoming legal documents, likely can't just discard;

C. block country representing tiny share of viewership,

option C seems to present the least hassle

Option D: ask a local lawyer once (100 USD or so) and they will confirm that the business can trash such foreign requests and be done.

Not sure whether C or D would be more complicated long term (you need to manage the geoloc somehow, or outsource and pay for the service)

Additionally, it shows traveling US-based customers that you care about them.

Yep, hence why I mentioned this would only be a problem if they ever want to do business with the EU

They care because no matter how small with travel and such these days there are potential risks if they're 'found' to be non-compliant. Simpler to say "no, we can't comply" than spend time/money/risk fighting about it later.

Not that I disagree with you on the 'it seems stupid' front. But that doesn't change the risk profile for the company.

Reply on news.ycombinator.com