[oneplane]

You don't need a lawsuit if you're Iran, you just use your APTs to perform cyberattacks on US-hospitals and send your Iranan secret agents to work at Twitter and do your bidding from the inside out. Both have happened and are happening.

This isn't really a "but it's the law!"-case, it's a country A wants something, and they might use whatever they have to get it. The US has sanctions, but Iran doesn't except maybe oil production, but there are other places where you can get oil. So if Iran has nothing they can deny anyone else, they resort to attacks.

So when Iran says "do this because it is our law", you might not do it because you are interested in their laws nor do you have to follow them (legally), but you might not want the expense of being targeted by them.

[mindslight]

Isn't that the exact opposite of what you said above? "If you serve customers in another country, their laws apply. You can either follow the law or not serve in that country." That would seem to imply some overarching legal enforcement regime, rather than law of the jungle.

As to the law of the jungle, if embedded Iranian agents have enough power to do anything to Twitter, then the right framing is that Twitter has a massive security problem. Also it would be foolish of Iran to burn such resources on damaging Twitter rather than continuing to silently exfiltrate data that interests them.

If Iran performs arbitrary attacks on hospitals in "retaliation" for Twitter's actions, then that still doesn't affect Twitter. And similarly, that's best framed as said hospitals having abysmal security, rather than focusing blame on Iran. The Internet is hostile noise.

[oneplane]

> That would seem to imply some overarching legal enforcement regime, rather than law of the jungle.

No, it implies that if you respect the laws of the countries the people you serve reside in, you can choose to follow the law by not serving them, and therefore not having to "do what they say", or serve them, but then by their laws "do what they say".

Regarding effects on Twitter: it costs them money. Their share prices drop and jo-jo a ton when stuff like this gets out. Legally, not much effects twitter, it's not a person after all, and legal departments weasel their way around plenty to make sure a company keeps existing and keeps making money. If it's cheaper to censor some random person on your private platform then compared against shoring up your cyber defences, that's an easy choice for the people in charge with somewhat cartoonish dollar signs in their eyes.

The reality is that nothing is truly isolated from side-effects and circumstances in the world. Even if there are no diplomatic ties, and no physical violence, it's all happening on the same globe with the same internet. So ignoring laws is not always the cheapest way to deal with countries, and not dealing with countries is generally not an option when you're connected online.

[mindslight]

> it implies that if you respect the laws of the countries the people you serve reside in, you can choose to follow the law by not serving them, and therefore not having to "do what they say", or serve them, but then by their laws "do what they say".

This is only a real dichotomy if there is a legal enforcement regime forcing one to choose.

You're substituting a few handwavey indirections to profit-based incentives. While partially true, this mainly functions to absolve Twitter from not taking a more principled stand - the same argument could be made if they started doing more deplorable things with user data.

So sure, the stock market is fickle and irrational, like every herd. But the fundamental analysis for Iran being able to attack Twitter is that Twitter has poor security, period. I'd rather focus on the real problem than merely shoot today's messenger.