There seem to be a few problems with this analysis.
First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.
Second, apparently, the data does not exist. WhatsApp publicly stated, including in testimony before the Brazilian Congressional Committee on Cyber Crimes[2], that it does not and has not retained any message content once messages are delivered, even before the recent full roll-out of E2E. Based on these statements, it would seem that WhatsApp is indeed unable to comply with the court's request, regardless of any jurisdictional arguments.
> First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.
This is all WhatsApp's and the US's problem, not Brazil's. In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings. If anything, I think this would justify ruling against WhatsApp more harshly, as it sends the message to the US that policies which don't respect the sovereignty of Brazil will hurt US economic interests in Brazil.
That said:
> Second, apparently, the data does not exist. WhatsApp publicly stated, including in testimony before the Brazilian Congressional Committee on Cyber Crimes[2], that it does not and has not retained any message content once messages are delivered, even before the recent full roll-out of E2E. Based on these statements, it would seem that WhatsApp is indeed unable to comply with the court's request, regardless of any jurisdictional arguments.
If this is true, that's a solid argument and stands on its own.
> In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings.
My apologies, but I think that if you re-read what was written, you will find that this was not suggested. The comment was written in response to one that came to the conclusion that this "was all [WhatsApp's] fault." It is suggesting that WhatsApp is not at fault, is probably strictly complying with US law, and cannot share the information in any case. At no point does it even come close to suggesting that the judge in the case should have "considered US law" in his rulings.
Moreover, I feel that your claim does not clearly differentiate between 'considering US law' as a material fact and 'considering US law' as a judicial precedent. You seem to be suggesting that someone arguing that US law ought to be held material to the case is somehow demanding that the Brazilian judiciary hold itself subservient to the US courts. You also seem to be suggesting that a Brazilian state judge has any business interpreting the law so as to "send a message" to the government of another nation, which is simply and patently untrue.
Complying or not complying to a foreing judges orders is a pretty common problem for any multinational company. Even if they have local presensence, the thing requested (data, object, whatever) might be somewhere else. And simply fetching it across a border on a foreign judges order can get you into trouble for "aiding a foreign power" and stuff like that.
It's worse that most local judges simple don't know that there's even a problem, and even if that'a clear to them, the judge most likely has 0 experience in making a successful request to the foreign state. And since all bureaucrats if the request isn't perfect it falls through the cracks. So often (at least if you're locally present) your laywers will need to help the judge to draft and push such a request through.
Long story short: These jurisdictional issues are not at all US specific, it's everywhere. Sovereign states just don't like it all over if their citizens and companies do stuff within their borders under orders of a foreign state.
Huge international US-based companies tend to comply with EU laws just fine (or at least participate in the judicial process) if they are doing business there.
Whatsapp can choose to assign resources to this issue, or it can ignore it and let it solve itself. If Whatsapp thinks that Brazil is an interesting market for whatever it is selling (what are they selling?) or if it is good for PR then they may choose to seek ways to intervene.
> Huge international US-based companies tend to comply with EU laws just fine
When they are operating their business within the EU, yes. For example US companies operating servers in the EU must comply with EU data protection laws regarding information on those servers. This situation is analogous. WhatsApp's servers are in the US so US law applies. If the servers were in the EU then EU law would apply, not Brazilian law.
US companies operating servers in the EU must comply with EU data protection laws regarding information on those servers.
More accurately, US companies processing personal data of EU citizens must comply with EU data protection laws. It just so happens that locating the servers in the EU is among the easiest ways to comply with that.
Right, because the personal information is being transmitted outside the EU. Even if it's from a browser in the EU to a server in the US, that still counts. It's still an activity taking place in the EU.
The Brazilian case isn't about data transmission though. WhatsApp isn't in breach of any rules about that. It's about court ordered access to records stored on an server in a specific geographic location - The USA. Now if the Brazilian government passed a law requiring WhatsApp to record all data on servers in Brazil that would at least be possible to comply with.
> You seem to be suggesting that someone arguing that US law ought to be held material to the case is somehow demanding that the Brazilian judiciary hold itself subservient to the US courts.
Allowing a company to break Brazilian law because US law demands that the company break Brazilian law would absolutely put the Brazilian judiciary in a subservient position to US law.
> You also seem to be suggesting that a Brazilian state judge has any business interpreting the law so as to "send a message" to the government of another nation, which is simply and patently untrue.
Brazil decides what is and is not the business of Brazilian state judges.
As a digital native, I feel like an international Internet is more important than national sovereignty. That is, I don't think the interesting question is whether US or Brazilian law should apply, the question is how to ensure international access to international digital resources.
It's really the only way to go. Otherwise, you get pissing matches. Brazil blocks WhatsApp. China blocks Facebook, GitHub, etc. Iran blocks so much stuff that people need to get data dumps via satellite TV. The US blocks a lot too, but mostly about gambling, "piracy", etc.
That has nothing really to do with Internet sovereignty (whatever that means).
It has to do with some countries suck more, and some suck less.
Plenty of countries don't block anything. Like military aggression, child mortality, literacy rate, etc., that is one important data point about any country and its government.
I may a.gree with that but still, just because you do not like a law you have to comply. You can try to change it but as long as it exists its law for everyone. You cannot say murder should be legal, therefore I am allowed to do it.
On the other hand, I believe that we have a duty to disobey laws that prevent communication. Civil disobedience is also much easier when you're outside their jurisdiction.
> I may a.gree with that but still, just because you do not like a law you have to comply. You can try to change it but as long as it exists its law for everyone. You cannot say murder should be legal, therefore I am allowed to do it.
Bad laws are bad laws. If you can avoid complying with them, you absolutely should.
>In fact, it's kind of insensitive for foreigners to suggest that a judge of a sovereign nation must consider US law in his rulings.
It's just as insensitive for a judge of a foreign nation to suggest that all foreigners must consider his rulings when making decisions under their own sovereign laws.
If a business wants to operate in a foreign country, it seems natural to me to follow the rules of that country; the fact that the business did not open an office in that country looks irrelevant--otherwise, do not open any office abroad and do what you want.
Incidentally, I wonder how the situation would be handled and what the opinion would be if some big foreign company operating in the US were shut down in the same way.
> otherwise, do not open any office abroad and do what you want.
Isn't this a fair position ?
Imagine you are a lone dev creating a service that has no specific limitations. You are subject to your countries law, but should also be liable under each single law of every country where your users might happen to be ?
It seems to me that countries should have the right to do what they want within their borders (including shutting down access to some services) but go the diplomatic route if they have to interact with people out of their borders.
What is your problem here? He does not shut down WhatsApp in total or request info for US user or anything like that, only in Brazil. This does not affect you at all. If they do not obey the law in another country, they do not get access there. Their activities in any other country do not change.
One problem I have is free trade. Can the US just randomly ban one of Brazil's exports? I mean the US likely exports more to Brazil than imports from it but if this weren't the case...
Well, technically one could argue that it's not strange for a foreigner to comply with the judge's orders if they want their service to keep working in his country. They may refuse, sure, but there are consequences for that.
So, in this case, "all foreigners must consider his rulings", applies only for the those who wish to keep their service working in Brazil.
I'm not sure what I'd prefer, but borders are an artifact of lag-induced information asymmetry that has drastically lessened with modern means of communication and travel and their existence is a pre-requisite for a lot of the fucked up power dynamics on our planet so I imagine a number of potential systems without them could be an improvement.
> It's just as insensitive for a judge of a foreign nation to suggest that all foreigners must consider his rulings when making decisions under their own sovereign laws.
If you are operating in Brazil you have to follow Brazilian laws, including judges' orders. Just because I decide to do something in the US doesn't mean it's automatically legal when I do it in Brazil.
> This is all WhatsApp's and the US's problem, not Brazil's.
So you're saying it's OK for Brazil to send a SWAT team to raid a house in the US? The judge's order has no validity outside his jurisdiction; just like a US judge's order has no validity in Brazil.
I can believe them when they say they don't keep data. When I got a new phone (the old one broke), I was expecting my conversations to be in the cloud somewhere so that I could recover them. Nope, I lost everything that I hadn't backed up.
I don't see what they can gain from storing masses of old chats and then not allowing users to download them onto new devices. If they kept chats to do analytics on, there's no reason that they wouldn't expose it to users too.
(This may also explain how they survived as a company for so long with so many users and so little revenue. All they're doing is running a few fast servers to shuttle messages back and forth, no storage requirements at all).
On the other hand Telegram does seem to store conversations - if you log in using a desktop app, it will pull down your recent chats.
> I can believe them [WhatsApp] when they say they don't keep data.
If that's true, I'm in awe of their integrity. Skype on the other hand now has complete disregard for user privacy. Skype stores your voice mails and video messages forever[1]. This is something that they started doing 2-3 years ago and few people seem to be aware of it. It's amazing how low Skype fallen from its early days when it was considered a beacon of privacy and on the cutting edge of encryption and security.
[1] Details: Clicking on Preferences -> Privacy -> Delete history (OS X) or Options -> Privacy Settings -> Clear history (Windows) pretends to delete the voice/video messages but it merely hides them from your view. If you re-install Skype on the same computer or run Skype on a different computer, all those "deleted" voice mails and video messages re-appear. The delete and clear buttons are basically lies; there's no polite way to put it.
Skype was never a reliable option. They never published their protocols or security (just that one "review" iirc). They took many measures to prevent people from inspecting the client.
I thought Skype only stores the last 30 days of data on their servers, while it will store every piece of data received on your local computer indefinitely (unless you delete it, of course).
No. I personally have a video message that is almost 3 years old that I've tried to delete multiple times over the years and it still shows up if I do a fresh install of Skype on a new computer.
Very old voice messages are also accessible even if "deleted".
Text chats do seem to disappear, but at this point I don't believe anything Skype says. I figure they keep the chats forever as well.
Chats are definitely saved, but files aren't. You can't retrieve files after certain amount of time. I can also retrieve conversation from 3+ years ago. I don't remember if there is an option to forget conversation history though.
storing data for 1 billion users and maintaining consistency is a pain the butt operationally. Whatsapp isn't storing the data. If they are, they're spending hundreds of millions on servers for data they can't monetize easily without alienating all of its users.
Telegram isn't end-to-end encrypted unless you're in a "secret chat", and that chat exists only between two different devices and can't be used by multiple devices on one account.
It's a "feature" of the normal chats/channels/groups/supergroups of Telegram that you are able to download them to other devices, or to restore them on a freshly wiped device, because (and I'm over-simplifying here, but the end result is the same) they are encrypted with a key known to the server, and which other devices signed into your account can then be authorized to use.
My point was more that if WhatsApp retained messages in some form they most likely would expose that functionality to its users (as Telegram does). So when people say 'apparently' they don't store messages, I'm inclined to believe WhatsApp/Facebook.
Digressing from the actual discussion, Whatsapp now allows you to keep a backup of your chats and related media on your Google Drive and then recover it when you move to a new device. Probably applicable only for newer versions of Android (not sure about iOS).
I wonder if they record the necessary analytics data from mining the text, and then delete the actual text. Depending on what data you're trying to mine, you may be able to get what you need on transmission, and then dump the source data in favor of the output of the analytics event.
That's true if you believe WhatsApp (and I do with some probability of certainty--not certain enough to trust it with data I wouldn't want the government to see, but enough that I'm comfortable hackers won't get my bank info).
But, the NSA approach to data collection is basically to vacuum it all up and, if possible, decrypt it later. This has two implications:
1. Metadata. "We kill people based on metadata" isn't a joke, it's a quote from Michael Hayden, ex-executive in both the NSA and CIA. End-to-end encryption doesn't hide who you're talking to or when.
2. It seems unlikely that it will be computationally possible for them to decrypt all traffic, but it would only surprise me a little if AES128 is breakable for high-value targets in the next 20 years: increased computing power, better multi-threading, better cryptanalysis algorithms, maybe quantum computing or some completely unexpected technology; it's hard to say what will come along.
I always feel like many large US tech companies want to have their cake and eat it. They want to be a global company, they want to have 2 billion users, and are valued at having that many users. But when it comes to laws, suddenly they operate under US law alone.
I wouldn't mind if they ignored all national laws, and acted like a true global company. But I'm not from the USA (or Brazil), and don't want to be under US law. If you want to operate only user US law, then why not constrain yourself to the US market? Only operate there?
... and when it comes to taxes they operate under US law, meaning that if they repatriate any foreign profits, they will have to pay taxes. If they decide not to, like Apple has decided, they won't be liable for any tax payment.
There's absolutely nothing special in this case because WhatsApp happens to be operating on the internet. Suppose they were a mail order company based in Brazil but serving customers internationally by post. If a US judge issued a court order in the US requiring the company to hand over business records stored on paper in Barzil, he would have no jurisdiction whatsoever. Brazilian law protecting the privacy of information stored in Brazil would prevail. there would be no controversy about this.
The fact that WhatsApp's info is stored on servers rather than paper records is irrelevant. The jurisdiction in which the records reside applies. Although the fact that their servers don't even store the information requested anyway should be.
> Suppose they were a mail order company based in Brazil but serving customers internationally by post. If a US judge issued a court order in the US requiring the company to hand over business records stored on paper in Barzil, he would have no jurisdiction whatsoever.
Fair point. But to continue that analogy, the US judge is quite free to ban the commercial operation of that Brazilian company in the USA. Which is exactly what happens, and is happening here.
OK. So now you're banning a company for operating in your country, because they choose not to become criminals in their own jurisdiction. So why ban them for a day or two? What's that supposed to accomplish? Logically if this was the justification they would ban it permanently. Banning it temporarily is just playing spiteful games that isn't going to accomplish anything.
As an ideological position it has some interesting points to make, but in a contemporary legal setting it's difficult to find footing.
My personal position is informed by Hobbes (https://en.wikipedia.org/wiki/Leviathan_(book) ) in that we have to make compromise with our individual liberty to bring about a greater good.
> "No arts; no letters; no society; and which is worst of all, continual fear, and danger of violent death: and the life of man, solitary, poor, nasty, brutish and short."
> in a contemporary legal setting it's difficult to find footing.
Freemnan-on-the-land is totaly quackery in a comptemporary legal setting. It's like homeopathy, but for laws. It's Creationism, it's snake oil. Fundamentally it presumes/assumes that laws work differently from how the organs of the state think they work.
Law ≠ Science. It's an interesting thought experiment. It's not like homoeopathy or creationism in that legal precedent emerges by evaluating any reasonable legal argument and their counterpoints and determining which among many is 'right'. It is not hard to conceive of a "freeman" society but what's important is to point out why isn't a realistic aspiration, rather than just shouting "you're wrong you're wrong you're wrong".
True enough. What I mean is that I don't wear disguises, have multiple sets of IDs, hang out at anonymous exchange sites, and so on. But one can compartmentalize cyberspace substantially from the rest of meatspace, and then compartmentalize within cyberspace. Or at least, that's my experience. Maybe I'm just not interesting enough ;)
Interesting. I think it boils down to a freeman argument though - you're basically issuing refutation of your implicit social contract. While the sentiment therein is laudable it is somewhat premature. Though one has a great deal of independence in the cyber realm one is can still run afoul of limitations of the real world and her laws (as demonstrated today in Brazil).
I think cyberspace currently is best categorized as a distinct estate rather than realm in a similar vein to the press and the judiciary. Each functions with more or less autonomy but can occasionally be subjugated to the other.
One can always be subjugated. By robbers. By terrorists. By ISPs. By governments. By whatever. So one does what one can to be left alone. And helps others following the path.
But in meatspace, one blends in, doesn't attract attention. As in Vinge's True Names. Ultimately, authoritarian states may wither. Or not. But in the meantime, one can manage, under occupation.
If it was a small company based out of Iceland, or South Africa, or Singapore, it would still be in the same legal situation. The company (assuming just a single incorporation presence) is under the laws of the country it's from, and Joe Random user from across the internet is internationally accessing it.
National law cannot enforce anything on organizations not within the national jurisdiction, without international cooperation. However, they can (attempt to) stop their own citizens from accessing the international service.
That is false, at least in the example of online retail. If you sell stuff to someone in another country, online or not, you are bound by the consumer protection laws of that country. So someone in Scandinavia has two years of warranty on a laptop bought on dell.com, vs. one year for an American making the same purchase.
I don't think it makes a difference whether what you are offering is physical or not, your service is bound by the laws in whichever country the exchange takes place. Of course enforcement might be an issue, which is exactly why the Brazilian judge did what he did, when Whatsapp failed to abide by Brazilian law.
Note that I only said "enforce". A country can claim whatever they want within their own borders, but cannot really enforce them across the border.
Even with the laptop warranty case, if some small retailer from Country A shipped a laptop to Scandinavia, but didn't uphold a 2 year warranty, the Scandinavian governments would not be able to force the warranty to be upheld. They can make whatever local judgments they want, but none of them would touch Country A without international agreements in place.
It seems to me that they did comply with Brazilian law. They handed over all the conversations they had — zero. Is there a law that says they have to record all the conversations?
I don't remember if those comments had sources, but I've seen that in various comments in this thread. There seems to be a lot of misinformation going around.
Do they operate in Brazil? They apparently have no offices there and are only available over the internet (as is true of all websites throughout most of the world.) How can anyone expect to hold what amounts to a random IP address on the internet responsible for anything?
This argument looks like it can also be applied to even malware. If I put something illegal doesn't has the judges right to stop the distribution of that app in the country?
Another question is if what Watsapp did should be illegal. But if the judges can't stop internet companies from doing something illegal who do you thing should do it?
No, he does not have that right. By that same logic brazilians shouldn't be allowed to visit websites from any other country where there's a discrepancy with brazilian law. With a government like ours next thing you know we have our own Great Firewall.
This kind of thing can't even be enforced, being so easy to bypass.
No it's not a minor detail, because it's easy to bypass, specially if its a decentralized service. Nevertheless its an outrageous retrenchment of our freedom.
they have bank accounts and deals with many tel co to operate as they do in each country they are.
you do not get pre-installed on the three biggest mobile operators phones (99.9% of market) and get deals where data to your service do not count as part of the limited data-plan on two of them, by just "being an IP address on the web".
Right now, it's more of a benefit to phone manufacturers to pre-install whatsapp than it is to whatsapp itself.
Same goes for the telcos. Offering free whatsapp and Facebook is a thing. And it's not because whatsapp had a "deal". It's because the telcos want more users.
Developing countries eat that up. People explicitly want to see whatsapp support or they don't buy the phone and many terrible devices have been sold on this premise.
Source: 20+yrs on the online advertising industry.
Nothing that lives of ads or telecomunication companies survive only by "serving the user". The telco only pre-install something on the device if: A. they are paid upfront, B. if they get a percentage of the ads.
yeah, serving the user is good, but remember that you are talking about companies that charges for SMS. the day they have to rely on "pleasing the user" hell will freeze over. They rely on regional monopoly, just like in the US.
We have a clear market leader, but it's by no means a monopoly.
People constantly switch network providers here since we have number portability.
My wife, me and many of our friends switched to Vodafone cos they were offering a really great Internet package.
Free Whatsapp, Facbook, Twitter, Instagram,and Snapchat plus 3.5 GB for what's essentially $9 a month. Here that's unbeatable and unheard of. http://support.vodafone.com.gh/customer/portal/articles/1813...
I doubt all these services are paying for for Vodafone to do this.
you can't do that in brazil without having the papers to do business there. in fact, you can't even sell anything without the right documents. Just like everywhere else.
I don't know portuguese so I didn't actually read what the deal is.
Is this a service where subscribers pay the carrier a fee for 30 days of unlimited data traffic to whatsapp servers (VoIP excluded) + 50M of data ?
If yes, does that constitute a transaction the consumer makes directy to whatsapp via the operator? I understand that likely whatsapp and TIM (an Italian company btw) might have made some deal and exchanged some money for the use of whatsapp logo etc, but I guess that transaction could have been done anywhere.
My apps are in the Danish Google Play and Apple App Store...
I never been there, I don't read or write danish, I never interacted with danish government, or met any danish person.
If the dane government wanted something from me, and sent a letter to some random person, written in danish, even if it reaches me, I wouldn't understand it anyway.
Thus, having app in some other country store doesn't prove much, except that you clicked "publish" somewhere on Google or Apple uploading interfaces.
> except that you clicked "publish" somewhere on Google or Apple uploading interfaces.
At which point you agree to adhere to their laws and regulations.
A famous example of someone operating legally under local law, but who got prosecuted for having merely a website accessible in another country, was Kim Dotcom.
That’s the current state of international law, either lobby to change it, or accept it, but don't ignore it.
>>At which point you agree to adhere to their laws and regulations.
Uhm nope. If my app(published on Apple Store/Google Play) violated a law in Saudi Arabia and they sent me a letter requesting me to appear and subject myself to 100 lashes for violating their law, I would very promptly disregard said letter, to put it politely.
You might do this and then you get convicted in absentia, Saudi Arabia will send a request for extradiction, your country will say no, done.
Except: better not travel to Saudi Arabia or any other country that will extradict. Also Saudi Arabia will propably ban your App, which is what is happening in Brasil.
> You might do this and then you get convicted in absentia, Saudi Arabia will send a request for extradiction, your country will say no, done. Except: better not travel to Saudi Arabia or any other country that will extradict.
And that is the problem. You can't actually expect people to hire lawyers from 108 different countries to see if their app is legal in each of them just because they're going to distribute it on the internet, to say nothing of what happens when two countries have mutually contradictory laws (e.g. privacy vs. data retention). And a person who goes to see the Great Pyramids shouldn't have to worry about being hauled off to Saudi Arabia and then stoned to death because their app doesn't prohibit blasphemy.
> Also Saudi Arabia will propably ban your App, which is what is happening in Brasil.
Which only increases the proliferation of tools to bypass the restriction.
VW has an actual office in the US - it's not VW Germany selling cars in the US, but VW America.
If you purchased a VW car in Germany and had it shipped over to the US it would be on YOU to make sure it complies with all requirements of your country, not Volkswagen's.
They have every right to pull your app, arrest you and prosecute you if you ever do go to their country, and apply to have your extradited under relevant treaties.
While I agree that whipping someone, execution via stoning, and other punishments are inhuman and no country has the right to exact them, I stand by my point in general.
I can’t sell medical marihuana in most states of the US – and I don’t go and try, and then complain about getting arrested.
Instead, if I wanted to start a business doing that, I’d check out where it would be legal, and in which ways, and sell my product in those markets.
Why do you assume you can sell your product in markets without having checked the legality, and then complain when they ban your product because it violates the local law?
Hmmmm your example isn't exactly valid. If I was selling something on ebay out of EU, and you ordered something from me to US, I would almost definitely not get in trouble for sending it to you, unless it was an item which has export restrictions from my country. Or to go back to my example of Saudi Arabia - if someone from Saudi Arabia bought something from me I would definitely absolutely not bother to check if what I'm sending is legal in there. If it isn't, then customs will confiscate it and the person buying it will be in trouble, most likely.
My point was - is there any reason why I, as a developer, should not check "all countries" when publishing an app? If Saudi Arabia wants to ban my app later - let them, I literally don't care.
If you sell in another country you are subject to their laws, an obvious example is consumer protection laws. This is a fact. Whether or not you are going to follow any rulings made against you is another matter, in that case all the country can do is try to block you in whichever way they can (like Brazil just did) and possibly prosecute you in absentia.
But...I'm not selling anything in another country. I'm advertising online and someone who bought the item asked me to ship it to Saudi Arabia - sure, whatever. I don't have an office there or a business presence. How would they prosecute me? What for? Their citizen bought something from me and then had it delivered to their home in Saudi Arabia - if he's breaking the law, then it's on him. Now cut out the post from this equation - imagine he came over here, bought the item from me and brought it back with him - how would I be held responsible for what he is doing with the item and where he is taking it?
And yes, consumer protection laws absolutely still apply. The laws of my country - if my country says that I have to give him 2 years warranty - of course he gets 2 years warranty. If his country says a seller can be subject to 100 lashes for selling prohibited materials - they can go and try executing this, I wish them all best luck.
Because if you're not willing to do the legwork to see if your app is following the letter of the law in those countries, you may be subjected to being banned due to violation of said laws.
That's not really an argument. Go ahead and ban it. There's no reason anyone should preemptively ban themselves just because someone else wants them banned.
It's a bit like saying "You should hang yourself, because if you don't, I'll hang you." The proper response is "get on with it then."
> A famous example of someone operating legally under local law, but who got prosecuted for having merely a website accessible in another country, was Kim Dotcom.
That's a pretty shit example, given everything that happened around that case.
The app stores operate there as distributors. Just because my product is distributed somewhere by a third party doesn't necessarily mean I operate there.
If an art dealer sells a painting to someone in brazil, does it mean the original artist operates in Brazil?
I think the difference is that you /knowingly/ (to an extent) sell your app to Brazil. If you sell your art depicting, say, women in power to Saudia Arabia to someone here and they move to Saudia Arabia and sell it, it's not your fault. But if you told him it's ok to sell that painting in Saudia Arabia, I would assume you can be held liable.
(Not that I agree with that, but that's what it looks like)
In the artist/dealer scenario, only the latter is actually under the legal jurisdiction of Saudi Arabia and could be legally compelled to follow a court order. They can choose to hold anyone liable but their legal and practical ability to compel an entity to comply doesn't extend beyond their state unless they have an agreement with another state.
Apple has a corporate office in Brazil (google too) and they're the ones who distribute and approve the application for sale there. They're legally required (I assume) to respond to legal notice they're served with. WhatsApp is not legally required to do so, and others have pointed out that it might not even be legally feasible for them to do so.
Of course this situation is more complex because obviously Apple doesn't have the data and I doubt Brazil wants to get into a legal battle with Apple. And although Brazil doesn't have the ability to force WhatsApp to comply with anything, they do have the leverage of being able to shut down their service. Should make for an interesting story to follow.
At the very minimum, if they had served Apple/Google instead, they would have had a legal requirement to actually respond. I don't know much about the actual case so these are mostly assumptions.
The judge cares. Because the basic tenet of a Republic is the separation of powers, a Judge is not allowed to decide whether or not a law is fair or good for the people; that decision falls on the legislative branch.
If they have no presence in Brazil, how did they get shut down in Brazil? I don't mean to be glib, but I don't see how the two concepts jive with each other.
On a purely practical level, if they were interesting in maintaining their service in Brazil, why didn't they establish a presence in Brazil when all these previous orders and shutdowns were going on? This is like ignoring notices in the mail and then wondering why you're getting collections calls.
Why is that a flaw in the service? The ISP/mobile operator is essentially the gatekeeper to the Internet; having them block WhatsApp (or anything else) is just a case of them adding a block rule to their DNS.
What would interest me is knowing whether or not access is still blocked if you change your default DNS server to something like 8.8.8.8?
WhatsApp uses IP addresses directly to route the traffic, but you could still use a VPN. The problem is that unless everyone else uses one you won't be able to talk to them...
Whois has provider name, business address and telephone.[0] They say:[1]
> VPN was founded in 2009 by a group of information security professionals who met whilst doing their Msc in Information Security at Royal Holloway, University Of London.
I've never researched that, but I've worked with them for years, and it's consistent with my experience. They're good people, I believe.
If a US law makes it impossible for a US company to comply with laws in another country in which they operate, that other country has the right to prohibit said company from operating there.
I also use the web interface and I believe it tethers your phone to the browser - so the phone is sending the unencrypted messages to the browser window.
If you delete a message on the phone the message disappears in the web interface too.
Foreign law enforcement may kindly request US DoJ OR operate under their (foreign) laws (and with 0 help, it's not hard to guess what route would be taken).
> Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content
i know nothing about law, but where are you getting this from? does not seems to be the case with any company in china (yahoo gave in, google decided to leave) for example.
The difference is likely that these companies had the type of presence that causes Chinese law to come into effect ... such as physical presence (servers), buildings (owned property), human presence (employees, especially if they're Chinese citizens), financial presence (bank accounts, insurance), business/legal presence (i.e. local corp, subsidiary, company of some sort).
> One of the most talented and diverse cities in the world, Sao Paulo is a hub for our operations throughout Latin America. Our teams make an impact by providing support to our communities, small and medium businesses and brands in the region.
And of course their Latin America VP is located in this office:
I suppose, but would you refer to General Electric and Telemundo in the same interchangeable way? Same difference. If I were applying to a job in GE's aviation research division, I wouldn't mail my application to Telemundo.
That's actually wrong at multiple levels; Telemundo is a division of NBCUniversal, a wholly owned subsidiary of Comcast since 2013.
It would be an apt comparison, if you imagine that Comcast had a Latin American headquarters in Brazil, where Telemundo's Portuguese telenovelas have millions of viewers; it would be weak tea for NBCUniversal to then argue that Brazil had no jurisdiction over it and the programming it distributes there because the shows are produced in Florida and NBCUniversal has no employees there.
> First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.
If you want to do business in a country then you should follow its laws.
First, WhatsApp is a US company and has no presence in Brazil. Under many readings of US law (specifically, ECPA), US companies are in fact prohibited from complying with requests from foreign law enforcement for content, except in emergencies. Instead, foreign law enforcement must make a request for assistance to the US DoJ, which will then (eventually, and maybe) process it and serve it on the US company. This is one of the reasons why MLAT reform, such as the proposed UK-US agreement[1], is so important because it would allow US companies to directly respond to foreign law enforcement requests.
Second, apparently, the data does not exist. WhatsApp publicly stated, including in testimony before the Brazilian Congressional Committee on Cyber Crimes[2], that it does not and has not retained any message content once messages are delivered, even before the recent full roll-out of E2E. Based on these statements, it would seem that WhatsApp is indeed unable to comply with the court's request, regardless of any jurisdictional arguments.
[1] https://www.justsecurity.org/29203/british-searches-america-...
[2] http://www2.camara.leg.br/atividade-legislativa/comissoes/co...