united-states international
Does legality of an computerized action depend on user location or computer location?
<p>Now of days it's quite easy to have a computer in a completely different part of the world from where I'm located that I'm working on.  This makes me wonder how 'criminality' is defined if the laws of my home country differ from the country the computer is in.  I'm wondering at what point the location of a server/computer decide the laws that apply to it and at what point it's the location of the user that matters.</p>

<p>To give some examples, not so much expecting answers to all of the below so much as explaining my confusion of distinction in case it informs an answer.</p>

<p>For example, lets say I choose to view material that is not legal for me to view in my home state (copyright material I haven't payed for, some type of outlawed pornography, some sort of state secret I'm not suppose to see etc), but which is legal to view in the country in which some server I connect to is located.  I'm pretty sure I've committed a crime, even if the computer providing the data is illegal, but is this only because the data was copied to my computer?  If I use some VNC technology that shows me the screen of another computer located outside of the US to view this data without any of it stored or cached on my computer, am I still committing a crime (I think so?)</p>

<p>On the other hand I see servers located outside of the US doing things that would be illegal in the US, online gambling, 'spamming' people, selling things without paying US taxes etc.  Can I connect to a server for any reason and still be legal?  If amazon want's to have a server in some country X and pay that countries taxes instead of US taxes can someone from the US still connect to that server to do anything at all with it without suddenly being guilty of violating a law because that server isn't abiding by US law?</p>

<p>If it's the location of the user that matters then does that mean I can use a computer outside the US to do something that is illegal in <em>that</em> country?  If I'm in the US and using a cloud computer hosted in say the UK and for some reason I end up doing something with that computer that is 100% legal in the US but isn't legal in UK (maybe some data is allowed to view here that isn't there?) have I broken the law in UK?  If I happen to travel to UK at some later date could a zealous prosecute arrest me because of the location of my computer?   (I realize this last question is probably comes down to "it depends on the country", but generally speaking for countries that practice common law is there a consensus that most countries agree on?)</p>

<p>The general answer is "yes." Who ever said that only <em>one</em> set of laws applied?</p>

<p>Jurisdiction isn't a matter of "one country's laws matter here, let's find out which one it is." All jurisdiction means is that <em>your</em> laws apply to the conduct, not that no one else's can as well. Broadly, there are a few sources of jurisdiction that are generally considered legitimate (to at least some degree) in international law:</p>

<ul>
<li>Territoriality: You have jurisdiction over actions performed in your territory. You also have jurisdiction over crimes where just one part of the crime happens in your jurisdiction (e.g. standing in country A and shooting someone in country B), or even if it just has a significant effect in your territory.</li>
<li>Nationality: You have jurisdiction over crimes committed by your citizens anywhere in the world, regardless of whether or not they were breaking the law of wherever they were.</li>
<li>Passive personality: You have jurisdiction over crimes committed against your citizens anywhere in the world.</li>
<li>Protective: You have jurisdiction over crimes directly harming core state interests, like counterfeiting your passports or sabotaging your warship.</li>
<li>Universal: A handful of crimes (like piracy or genocide) are so serious that every country in the world can exercise jurisdiction. If you catch a pirate, you can punish them.</li>
</ul>

<p>These are accepted to different degrees. Passive personality and protective jurisdiction tend to be iffier; territorial jurisdiction is unquestioned (although if it's just based on effects in your territory, it becomes a bit iffier as well). But any of them <em>can</em> be a basis for jurisdiction. If multiple countries have jurisdiction, whoever actually <em>has</em> the offender decides who will try them (jurisdiction to make an arrest is limited to the country in which the arrest is made).</p>

<p>So: If you're located in a country, you have to comply with their laws, and they can regulate just about whatever they want, including what you're doing to foreign computers. The foreign country can <em>also</em> generally regulate what you're doing, because part of what you're doing is happening on their territory. Even if both you and the computer are in a foreign country, you may have to answer to the courts of your country of citizenship.</p>

<p>Depending on what exactly you're doing, the protective principle may come into play. For instance, if you hack into a computer on a foreign military base, the foreign country could prosecute you for endangering their security. If you're coordinating a genocide, universality applies and <em>anyone</em> can prosecute you. If you hack the computer of a foreigner, passive personality may apply, although this tends to be controversial.</p>
