Have a .com web address? Know the legal risks | Hacker News Reader

Have a .com web address? Know the legal risks

nbr.co.nz

203 pointspier075 comments

> The bottom line: If you have a .com domain name, or other at-risk domain names like .net, you are subject to US domestic laws and jurisdiction.

I don't understand this. If you buy an American product and use it for business, you're an American? Except without the benefits?

Isn't that like Taiwan (or, well, ROC) filing an extradition request when I use my Asus laptop to pirate Taiwanese movies??

Or like Miele dragging me before the German courts because I vacuum cleaned (loudly) on sunday?

What am I missing? Is US law really this fucked up, or is the article exaggerating?

That's exactly right. Do we still look down on third-world countries and their lack of democracy? Do we make fun of Chinese censuration? Sadly I've stopped doing that.

It's not the US law that is at fault here, but the extradition treaties. It should be the same as being tried in a Pakistani court for being an atheist while you're born and lived your whole life in Holland: you shouldn't care. But because US is a de facto empire...

That's not how extradition works. It depends on the treaty, but most of them stipulate that extraditable crimes must be recognized by both jurisdictions. You obviously can't be extradited to Pakistan for being an atheist.

Because we hear so often about legal proceedings against piracy in the US, I think we have a cognitive bias that suggests piracy is more criminal here than in Europe. That's mostly not the case. For instance: the UK's criminal copyright infringement laws, which date back to the late '80s, are just as stringent as ours.

So then why was the UK guy extradited if what he did wasn't even illegal in UK?

What he did was illegal in the UK, and has been since 1988.

Then they should be forced to pursue a private prosecution in the UK, where the crimes were committed instead of relying on a technicality that allows them to wrest "jurisdiction".

Why? He has better due process protections in the US than he does in the UK.

I think you just don't like the idea of people being prosecuted for crimes that involve file sharing.

Taking him in another country by force for what is essentially a civil matter is not ok. The process can take a long while, and all this time I assume he will be in custody - which most likely would not happen if he were to stand trial in his own country.

Plus yeah, we really don't like that he's being prosecuted for that. In all the talk about whether it's illegal or not it's too seldom that it's said "the law is just wrong". It protects too much the copyright holders, and the evidence that this is actually for the common good is getting sketchier and sketchier.

Yes, US law is really like that. Of course, "subject to US law" is a bit of an exaggeration - you subject-ness extends only as far as .com address is concerned, AFAIK. But if the US government thinks you violated US laws, it can seize your .com domain. Unfortunately, taking a domain is much easier than taking physical property, so US government (due to intensive lobbying by copyright mafia) instituted such laws and procedures as to allow it. Next time your local copyright mafia raises its head, remember what they are capable of.

UK law is like that too! People have attempted to have US citizens found civilly liable under the UK's (much stricter) libel laws in exactly the same jurisdictional razzle-dazzle as is being applied here.

You are not subjected to US law. However verisign have complete control over .com namespace, and they are subject to US law and US courts. Verisign will take your .com off you if the US counts tell them to.

Unless one day in the future you have to change planes in the US and suddenly find yourself arrested for running a used DVD site.

Or you can't fly inside Europe because the airlines share a no-fly list with the DHS and you are a US felon.

Yep. Things get 'troublesome'.

The exact same thing happened to Arrington in the UK with regards to a frivolous libel suit he chose not to defend. He couldn't visit the UK or risk being arrested.

National laws differ. We each make our own. If you are found guilty of a US law, either (a) don't do that, or (b) don't come to the US.

This is no different than any other country on the planet, the US is just bigger, so their laws may impact you more than Iran's, but no-one is forcing you to visit or do business in the US or Iran.

Except that they have extradited people on multiple occasions.

Yes, the american dream, the land of the free and the home of the brave.

.. and fuck the rest of the world!

The concept of jurisdiction is complicated, but often comes down to "do you have the authority to make me care".

Any country in the world can make laws about whatever they'd like with regards to things they have control over. In fact, they can make laws about things they don't have control over, but in practice, you can safely ignore getting sued in Iran unless you plan on visiting Iran.

In this case, things are pretty simple: .com, .net, .org, etc are US domain names, administered by a US company, and the US has the authority to subject you to their jurisdiction (because so much of it happens in the US).

If you would like to use a US domain name, you are subject to US law. If you live outside the US and would not like to be subject to US law, then don't use a US domain name or a US web host.

The United States isn't doing anything special here that every other country in the world isn't also doing. If I buy and use a .fr domain name and host servers in France, I am subject to French and EU jurisdiction.

This doesn't apply only to servers hosted in the US. The US is claiming that because .com domains must ultimately be registered by a US registrar (since they have ultimate control of the DNS) then even if you have no servers in the US, no customers in the US and no links with the US - you are under US jurisdiction.

It's like France having jurisdiction if you use a French word in your product.

No, it's exactly like if I registered a .fr domain name. France has jurisdiction over that domain name, and can shut it down if they'd like.

The US has jurisdiction over the .com domain.

If you have no US customers, no servers in the US and no other links to the US -- you may have your domain shutdown, but that's it.

I very much doubt you would be extradited to the US in that situation as it does not involve the US at all. But the US having extradition abilities with other countries' foreign nationals that it finds to be criminals is a separate issue entirely from their jurisdiction over .com, .net, .org etc.

[edited for clarity]

So should the US have jurisdiction over .com/.net/.info etc rather than just over ".us" ? Isn't .com an international designation nowadays?

Isn't that like giving the country that invented the telegraph jurisdiction over all undersea cables wherever they are installed?

No. com/net/info have always been US domain names from the beginning. It's a big reason why others were created. When you run a .com, you are running a US domain name.

There are no international domains -- can you imagine how disastrously messy that would be?

Domain names are under the jurisdiction of one country. It just so happens the US domain names are popular, but that certainly doesn't mean you are forced to use them.

What about .int?

http://en.wikipedia.org/wiki/.int

Also .eu is international, i.e. not a single country, although a single legal jurisdiction

"com/net/info have always been US domain names from the beginning" - Citation? And how come there is a ".us" TLD?

It may seem that way from where you sit (USA by any chance?), but I think you'll find the rest of the world sees com/net/org as transcending countries, hence their value.

Here's what wikipedia has to say:

"The domain COM was installed as one of the first set of top-level domains when the Domain Name System was first implemented for use on the Internet in January 1985. The domain was administered by the U.S. Department of Defense (DoD), however the department contracted the domain maintenance to SRI International. SRI created DDN-NIC, also known as SRI-NIC, or simply the NIC (Network Information Center),[3] then accessible online with the domain name nic.ddn.mil. Beginning October 1, 1991, an operations contract was awarded to Government Systems Inc. (GSI), which sub-contracted it to Network Solutions Inc. (NSI).[4]"

> And how come there is a ".us" TLD?

Because every country gets a two letter country code TLD.

> It may seem that way from where you sit (USA by any chance?), but I think you'll find the rest of the world sees com/net/org as transcending countries, hence their value.

Just because you see certain TLDs as transcending countries doesn't mean that they actually do.

Besides, having jursdiction over a TLD is necessary to deal with sites that have servers in multiple countries. How else do you handle jurisdiction for a website with multiple servers in multiple countries and that advertises to multiple countries, some of which don't have a server inside that country's border?

It's like France having jurisdiction if you use a French word in your product.

No it is not. This policy will not be beaten back with silly analogies such as this.

If you are interested in this topic and advocating a change in policy I highly recommend that you become familiar with the legal theories underlying establishment of jurisdiction.

The " legal theories underlying establishment of jurisdiction" consists of who has the biggest fleet. This has been true for about 5000years since the Egyptians got their act together, has continued through the Greek, Roman, Venetian, British and now American empires.

The only thing that is new is the power behind the fleet is now whoever pays for the commander-in-chief's re-election effort.

If you doubt this you should look at UK students being extradited to the US under 'vital anti-terrorism legislation' for running a site giving links to TV shows

Well, yes. Force is the ultimate source of power. The extent of which, in this case, means jurisdiction.

To quote drusenko's first point: The concept of jurisdiction is complicated, but often comes down to "do you have the authority to make me care"

I don't see you disagreeing!

You discredit your argument by wording it so outrageously.

The UK student you're talking about ran a 6-figure business, which he admitted publicly on his site was all about directing people to pirated movie content (the "TV" in his domain name is, of course, a red herring).

But, worse, the notion that he was "extradited under vital anti-terrorism legislation" is simply a lie. The "anti-terrorism legislation" this phrase refers to is the entire UK/US reciprocal extradition treaty, which governs absolutely all extradition between the two countries. The changes in that treaty that people are referring to when they invoke "terrorism" were proposed and negotiated before 9/11, and actually remediate an unfairness in evidentiary standards towards the US --- it used to be easier to be extradited from the US than from the UK, and now the same standards are used on both sides.

Moreover, those changes have absolutely nothing to do with this case. The crime which O'Dwyer was charged under was a criminal offense in both the UK and the US, and the evidence implicating O'Dwyer is open-and-shut: O'Dwyer, after having his domain seized by ICE, brought it up again with a fuck-you to the authorities. He admitted to UK prosecutors that he had been taking in 15,000GBP per month (!) running the site.

The United States isn't doing anything special here than every other country in the world isn't also doing.

Yes but one should use "special" advisedly here. As you say, the US has arrogated this authority simply because it can and indeed every state does this at one time or another and in one fashion or other. This shouldn't stand in the way of those who feel that those claims are outrageous trying to stop them.

Verisign is the registrar for .com, and they are based in the USA. So the registration of a .com domain is (currently) under US jurisdiction.

It's because that statement is not legally correct. Yes, they can take the domain away, but they can't extradite you and prosecute you, unless you're in one of the countries with mutual extradition treaties. It's not the US that fucked up, it's your country that caved to the US pressure.

With very few exceptions (basically, China, Ukraine and Russia), the countries that don't have mutual extradition with the US are underdeveloped, poor, repressive, unstable, theocratic (the Vatican!), or all of the above.

I'm not sure what kind of pressure you think has to be brought to bear to get two countries to agree to extradite. Extradition treaties are the norm, not the exception. Extradition is not a product of American imperialism.

With very few exceptions (basically, China, Ukraine and Russia), the countries that don't have mutual extradition with the US are underdeveloped, poor, repressive, unstable, theocratic

-Russia is plenty repressive.

-China is poor and repressive.

-What about Morocco? Andorra? Slovenia?

-Maybe also Namibia, Botswana, Mongolia, Croatia?

There are some nice exceptions, but not a lot. You're mostly subject to full US jurisdiction everywhere in the world. And if the USA police want to sieze your assets, including your domain names, in New Zealand they're going to do so without any trouble.

For now you can smoke in Amsterdam without going to jail in the USA, but only because the US government doesn't care yet.

I guess I agree about Russia and China but I think you're making my point for me.

There's extradition, and then there's extradition of own nationals/citizens. The latter happens but is not the norm and many fairly civilized countries, France or Germany† for example, generally don't do it.

† some exceptions related to the European Arrest Warrant apply

Define "repressive" and "unstable".

US has the highest incarceration rate.

US caused the recent global financial crisis.

Children born and raised in prison camps. Military coups d'etat within the last 10-20 years. That sort of thing.

The point of the article is very valid and concerning, but there are alot of factual problems with how this article represents the facts in its main case study.

> For years the Department of Justice had maintained that online gambling was illegal. In a spectacular about turn just before Christmas last year, it said that the law (the Wire Act) only applied to sports betting. They finally recognised the obvious- it takes some skill to win at poker and blackjack. So when it took action against Bodog, it wasn’t for its main activity of online gambling but the relatively smaller one of sports betting.

From someone who has the unique combination of having been a professional poker player for long periods, as well as having worked at Bodog as a software developer I can tell you two things that are very wrong about this paragraph.

1. There isn't any skill in playing blackjack online. The only skill component of playing live is in counting cards, and that doesn't translate online because you are getting a "new deck" with every hand.

2. Sports betting is far and away the most profitable part of their business. In fact, their poker room is nothing but a nuisance to them because it allows professional poker players to swoop in and extract money from the sports betters before Bodog is able to extract it. This is demonstrated by the recent changes to their poker software that make the site very very unattractive to play poker on for any thinking player (ie anonymizing the tables), not to mention their previous rules about limiting the number of tables played at a time.

And then the main point of taking action against the site for the minor crime of sports betting, which is "legal" in Canada. I'm not so sure about that, I know when I worked there that it was common knowledge that the founder of the company hadn't stepped foot in Canada since Bodog had launched. Also, what does it matter if sports betting is the main part of its business or not? If it's illegal to service US customers with an activity that the US government finds illegal, they are obviously going to take action.

Of course I believe online sports betting shouldn't be outlawed, but the US government has always been much more clear about this being illegal when compared to its sometimes wishy-washy stance on poker.

There are 2 issues here:

(1) The US gov't is getting more active in shutting down US-based domain names, sometimes legitimately and sometimes mistakenly. This is obviously very bad when it's not legitimate.

(2) Don't use GoDaddy. A Secret Service "request" should not have shut down JotForm -- they had no legal basis for doing so. GoDaddy has shown themselves time and time again to go above and beyond their legal duties and shut domain names down without any reasonable due diligence. (see http://david.weebly.com/1/post/2011/12/godaddy-a-glimpse-of-...)

It is surprising to me how far a company like GoDaddy will go to alienate customers, and how a government like the US will go to alienate citizens, visitors and business people. I understand it's about money and power, but it still surprises me.

It's time for Google to give equal power to all national domains if they don't already do it in their search algorithm. Many people still make their websites .com because they know they would be better treated in Google search.

I think they value domains of the language you're searching, right? Or is that just a consequence of the websites in that domain being in the language that you're searching?

I can't wait till someone (successfully) gets an injunction in their home country to get whatever.com resolving back to their proper IP addresses.

It would either fork the .com namespace, or international pressure would mount for the US to no longer have full control over .com.

Since .com registrar is on US soil, AFAIK, injunction outside of the US would carry a very little weight fr it.

They would carry little weight in the USA. But, say, in the EU DNS servers and ISPs would have to obey it. It would a technical nightmare and complete headache for any sysadmin to have to "manually patch" in some values, but would be possible.

It would be an interesting time to live in.

Maybe ICANN should allow multiple parties to manage the assignment of domains that aren't country-specific.

For example, let Nominet UK, auDA, InteretNZ, and CIRA manage some .com domains. Why not?

As far as I can tell, the current arrangement is a historical accident.

Hand over our God given internet to some foreigners?

In other news - Britain has announced that all letters sent with a postage stamp come under UK jurisdiction.

Our company recently started using alternative domain handles such as .nu, .es, .se and so on in response to one of my rants. It is the interests behind legislation that continue to halt innovation. We could evolve much faster if we had brighter minds leading our country. In the meantime we decided to contribute by not using .com domains.

I believe URLs are bound to disappear.

Wired also published a related article on March 6: http://www.wired.com/threatlevel/2012/03/feds-seize-foreign-...

We completely agree with the UN's statement: “no single government should have a pre-eminent role in relation to international internet governance.”

How about a redirect?

If i have a .com address redirect to my main .de page, i'd expect that the worst that could happen is the .com redirect will be changed to a takedown page, without any extradition charges for myself, am i wrong?

I sincerely doubt that the ICE would see it that way. I presume they would liken it to putting up a billboard in Yuma that says "Free Crack at my store in Mexico!"

Correct. However, if you always redirect to somewhere else, and that somewhere else has an identity which really stands out, then people will get used to that destination. So, when the government takes away your DotCOM, your existing audience is already prepared with the knowledge of where to go to get your content. After some research, I believe that destination should be DotTEL, and I wrote about some of its features recently [1]. Lastly, I notice that I forgot to include there that DotTEL is also useful as a status page for the services handling the content to which it points.

[1] http://news.ycombinator.com/item?id=3649087

Thats more what i was thinking of. Once my .de url is established enough a takedown order of the .com won't hurt so much and is just one google search away if you really can't find it on your own.

I'm not big on trying to get myself ranked high in search engines, but I am switching all of my DotCOMs to redirect to the corresponding DotTELs, and I'll let visitors know, somewhere near the top of the DotTEL, that this is what they should bookmark or remember to use if the DotCOM disappears. DotTEL is controlled by UK law, so to lose that, someone needs to get a UK court order against you, or they need to convince DotTEL that you have broken their agreement. Of course, if the US wants to make an example out of you, it can exert pressure on the UK, given that they are best buddies on so many matters these days, but that's not going to happen to most people.

In that post, you wrote, "DotTEL is not at all limited, as long as you can transition to the mindset of decoupling your content from its address."

Care to elaborate? I thought tel stores no more than phonebook data. How could you use it to serve a web app?

It's not only for phonebook data. Telnic, the company which manages DotTEL, uses [1] as their main example. For more examples, see "DotTEL of the Week" [2].

By "decoupling", I mean to get away from the mindset that your domain goes directly to your content, which is what we've all come to expect when we type in the URL and press ENTER. I envision my DotCOM redirecting to my DotTEL, which has: 1) a very short description of what it's all about, 2) a link to a long description, 3) a link to a chatroom, 4) a link to a forum, whose content might be mirrored, in realtime, to one or two other forum providers, which would also be linked on the DotTEL, thus providing continuity for important material, and 5) links to any other webapp or content that I could possibly want to include. Also, I can quickly modify the DotTEL with status info about myself or about any of my links.

The bottom line is that my DotTEL becomes an anchor for all of my stuff. Of course, I don't anticipate that everyone will simply convert, as most people will come up with objections as to why their content or their audience can't or won't switch or be switched to this intermediate format, but it will work fine for me, and I assume for a good number of people who want some measure of protection when faced with the aftermath of their DotCOM being seized.

[1] http://justin.tel

[2] http://www.nic.tel/community-weeklytel.html

That might be acceptable for your personal information, but for a startup? Let's see what that does to your conversion rate.

I think you've misunderstood my point.

If you're advertising crack in Yuma, the Feds really aren't going to care if you're selling it in Mexico. Either way, you're going to end up in prison.

I understood it, but decided to take my response in another direction, with my input still having value for the general discussion. Anyway, DotTEL is British, which means that it will take the US a bit longer to take down than a DotCOM, but since I live in the US, no TLD will matter as far as arrest goes.

Extradition charges? You think they are going to go to the trouble of extraditing you? What are you doing exactly that you feel there would be the risk of that? How many people do you think they can even afford to extradite in a given year?

You may laugh, but how many years ago would extraditing a university student with a website that had links to pirated content have been laughable?

It's very simple. Benefit of .com (for most) far outweighs the chance that that will happen.

You're http://chocolatapp.com/ uses .com, right?

Nice by the way. I use coda and flow. Would like to be able to select text and make a code snippet. I would select the text and have a little icon appear. If I click the icon (which is proximate to the text) it would save the snippet.

Later bring up all the snippets and add other info. That way you don't get all distracted with typing other info.

Edit: The "I use coda and flow. Would like to see" means I will buy a product with this feature and why I am mentioning. Sorry for the fork.

I don't think the .COM vs DE extension is as relevant as what type of interaction your web site is having with American citizens. ( Selling pharma/torrents/gaming etc )

They'll grab your NET/COM/ORG address in a heartbeat, but I think actually extraditing a person would require:

a: that person residing someplace that bends to US will. ( damn near everywhere )

b: costing US interests enough $$$ to piss them off.

Even if they don't extradite, you might find yourself arrested at the airport if you ever make a connecting flight through the good old US of A.

I think this says it all about the bias in this article. Note who the author of it is:

"Vikram Kumar is chief executive of InternetNZ, which adminsters the .co.nz domain, and advocates on behalf of internet users."

But forgetting for a second even that, there are millions of .com/net/org etc domains. If you think the US Government is going to start to file cases against even 1000's of those owners they won't. They have the resources to prosecute only a small fraction that are "breaking laws".

In the US and other countries there are plenty of things that are illegal (smoking pot as only one example). How much enforcement effort is put into that? How many tax returns are audited? Of those audited how many are TCMP (where they reverse engineer and look at everything). An extremely small amount. Sure some people will get snagged. But to think it is you (in the case of most .com uses) is truly paranoia.

The US Government of course will act if they see something that clears the tipping point of a violation. But the risk is way overstated in exchange for having the benefit (at least for a US company) of a .com address.

Just to avoid doubt, InternetNZ is a charitable organisation that is neutral of commercial interests. .nz domain space is managed much differently than the rest of the world.

In fact, most of european TLDs are managed in a similar way. Usually always a non-profit, with varying degrees of involvement from internet-related businesses.

He still has to worry about the bottom line. He gets paid a salary and would certainly benefit from registrations in .nz even if a non-profit. Non-profit revenues pays his salary. No different then the head of PBS saying why pbs is superior to non-public tv.

Actually he doesn't. Vikram is CEO of Internet NZ* which outsources running of the domain to NZ Registry Services and administering to DNC. Each of these has a board and a CEO. It's a pretty clever system, which came about because of some issues about 10 years ago whihc saw the whole thing almost go off the rails. It's now seen, I'm told, as best practice.

Revenues from NZRS are more than sufficient to pay Vikram's salary, and that of his staff, and InternetNZ has a decent warchest to keep doing so for quite some time. Check the website - all the accounts are published.

*I'm an elected Councillor for InternetNZ. We at internetNZ worry most about ensuring we have an "open and uncapturable" internet in NZ. This takeover of .com domains is an important issue for us all.

I'm working with my local Pirate Party to outlaw domain name seizures for the reason that it's asinine since domain names act as typically an address to content and can't violate any laws although the server hosting the content can still be. I also have further reasoning.

Unfortunately, it's for Australian domain names (.au). I think .au domain names are under USA jurisdiction due to AuDA's sponsorship contract with ICANN where ICANN is hosting Australian domain names on a nameserver. The sponsorship deal cost seems to be ~7% of domain names.

The Pirate Party is pretty great for entrepreneurs as they have many closely aligned motives. Did you know a Pirate Party in Czech is trying to make a constitutional amendment of an Internet Access right?

Now if only they wouldn't call it the Pirate Party, it might actually attract more mainstream attention. Self-marginalising your political ethos because of the name seems remarkably short sighted. Sadly too many people won't get past the name to see the good that is trying to be done.

It has caught some mainstream attention, look up Pirate Party Australia.

Is this mainstream attention enough: http://www.smh.com.au/technology/technology-news/aussie-pira... ?

This really has nothing to do with the US government. While the US worries the hell out of me in general, it is merely asking for these people. The real problem is the various other governments who, like the UK government, seem to bend to the will of the US with out a squeak.

What I don't understand is that the first job of a government has to be protecting its people. But recently, the reverse seems to be true. Why? Why are we the people suddenly the enemy of government? Why are our governments so happy to sling any one they can in to the weird and unjust legal system? How did that happen? Who the hell elects the US the world policemen and court?

But recently, the reverse seems to be true

I don't believe this is a recent phenomenon.

The US is going completely authoritarian, and it's becoming more and more scary by the day. It is an extremely serious situation when the most powerful country in the world starts acting like this. Fascism is dangerous, and the US is walking a very thin line now.

Without question root DNS control needs to be stripped from this regime. Imagine for a second if the Internet was controlled by Nazi Germany, or Stalin-era Russia, or today's China... It would be completely unacceptable. If control is not taken away from these thugs now it will only get harder in the future.

Reply on news.ycombinator.com