Comment by rdl | Hacker News Reader

Comment by rdl | Hacker News Reader

Parent Full thread

There are multiple concepts of jurisdiction.

It does very little good to just "incorporate offshore" and still have US operations, US principals, etc.

If you're a US citizen doing something questionable in the US, you have basically three choices: try to do it in a compliant way, renounce your citizenship, or leave the US and/or operate underground and hope you never get caught.

While I have problems with the US Government's actions in the terrorism/cyberspace regulation/IP spheres (particularly in that the legislative branch has totally abdicated its role in oversight, as well as being generally incapable and obstructionist in general), I'm a loyal US citizen, respect the laws of the US and its political process, etc. So, all I'm willing to do is try to do things in a superior technical way, or to try to get the laws changed in the US.

The silent circle guys are basically all US citizens, and as far as I'm aware, equally wedded to the idea of US legal compliance.

Thanks for the additional context. On the surface it doesn't seem that there are any benefits to having the parent company offshore.

I agree with the sentiment of trying to change the system, which won't happen if people (and companies) simply try and leave.

Sounds like what the market needs is a provider that is truly offshore: foreign principals, headquarters, operations.

That's only a limited success, because I still trust the US Government, even NSA, more than almost any foreign government. (NSA has more resources, but there's at least some semi-effective political and thus popular oversight).

The ultimate solution is providers which can prove their operational security to end users continuously, through technical controls.

Trust in a government is mostly relevant in situations where they would be breaking the law, like spying. If the law doesn't protect you in the first place, then the trustworthiness of the government doesn't really matter.

If the courts decide that you can't be compelled to give away master keys, then the US is a good choice. If not, no amount of governmental honesty can protect you.

Could you elaborate on that first statement? Would you really place more trust in the US government in these matters than, say, the government in one of the Nordic countries? Or Germany?

As far as I know, US citizens can't be ordered to violate laws when they operate in foreign countries. If they receive compliance letter requesting them to use foreign company with servers located in that country to break those laws, they can point out that it's outside US jurisdiction.

There would probably be an argument about "instrumentality", and the US person sitting in the US would be in an exceptionally uncomfortable position.

You're right. Legally setup foreign businesses can't be forced to comply with US law, unless it's fraud or other criminal activity.

There's still a few safe places out there to do business legally and protect your data. The Bahamas comes to mind.

Reply on news.ycombinator.com