[cassianoleal]

This is not about countries sanctioning each other. This is the US sanctioning a local company because a foreign company doesn’t follow certain US laws in foreign soil, where such laws don’t apply.

It’s a bit like the US arresting your mom at home in Texas because you ate a baggie of magic truffles in Amsterdam.

[rafram]

You're being very vague. Please explain what you mean? I don't see anything here about the US "sanctioning a local company," and I'm not aware of that being possible under US law.

[cassianoleal]

Please see my answer to the sibling comment.

[cromka]

"Clarifying Lawful Overseas Use of Data (CLOUD) Act."

[kube-system]

The way you are using these words seems to indicate you might be confused about how this works.

The US has not "sanctioned" LetsEncrypt or ISRG. The US sanctions foreign entities as punishment for various reasons precisely because they are not subject to US law. That's the entire point of leveraging a sanction -- to pressure those outside of your legal jurisdiction. If they were in your jurisdiction, you'd simply arrest them.

People and organizations basically anywhere not permitted to do business with anyone your country has sanctioned. Anyone who does business internationally should be aware of their country's sanctioned list. That applies no matter where you live on the planet.

[cassianoleal]

This is not that though.

This is literally about a company that has a branch in the USA and another branch in another country, where it's bound by that country's laws. If the foreign entity which just so happens to be commercially linked to the one in the USA has any dealings with countries sanctioned by the US, the US branch is punished.

There was a case a few years ago where a public University in Brazil bought lab computers from Dell Brasil. Dell Brasil is a subsidiary of Dell, but it's 100% incorporated in Brazil, the computers were manufactured in Brazil, everything following Brazilian law. The computers were delivered with terms of service that prohibited them from being used for any dealings with US-sanctioned countries such as Iran and Cuba. The University was caught by surprise and questioned it, since they had many academic links with Cuban Universities, and Dell Brasil explained that.

I don't know how the whole ordeal ended. The Brazilian Federal Government got involved, I believe the Ministry of Exterior and the Ministry of Commerce and Industry both got involved and were at one point going to sue Dell Brasil. I suspect it ended with the University returning the computers and purchasing from another supplier.

The suggestion that Let's Encrypt could work around US sanctions by opening a branch in the EU falls under similar conditions, and the US branch would be liable if the EU subsidiary had dealings with US-sanctioned countries.

[kube-system]

Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country. It would be absurd if that were the case. Sometimes people try setting up subsidiaries overseas to hide their evasion of the law, but it is illegal to do so.

[lmm]

> Incorporating a subsidiary in a foreign country doesn't make the parent company immune to the legal obligations it has in it's home country.

We're not talking about legal obligations in its home country though. I can buy Jack Daniels at age 19 in my country from their local subsidiary, and no-one thinks that this should be a crime for their US parent company because the US drinking age is higher. (Of course it would be a crime for either the parent or the subsidiary to sell to 19 year olds in the US)

(No-one is blaming Dell or Let's Encrypt here, to be clear, it's the US' excessive extraterritorial laws that are the problem)

[kube-system]

If you are in the US you must ensure that your local company, and any sub-entity you control abroad complies with sanctions law. That is US law, and the US can apply that law to Dell the parent company, because it is in the US and controls the subsidary.

> I can buy Jack Daniels at age 19 in my country from their local subsidiary, and no-one thinks that this should be a crime for their US parent company because the US drinking age is higher.

Because there is no US law that says you cannot sell alcohol to people abroad under 19. Heck, there's no US federal law that says Jack Daniels can't sell to people in the US under 19, either. And in fact, there are some places in the US where you can legally drink at 18, e.g. Puerto Rico. But if the US congress wanted to pass one of these laws and enforce it, it could.

[lmm]

US sanctions law saying that you must not transfer X from the US to Iran, directly or indirectly, is reasonable. US sanctions law saying that you must not transfer X from Brazil to Iran is gross overreach. Yes, of course the US can apply its absurdly extraterritorial laws to any parent company in the US, just as Iran could penalise any Iranian company whose US subsidiary distributed a depiction of the prophet or whatever, but that doesn't make it good law or good practice.

[cassianoleal]

You may call it a subsidiary all you want, but it's still a company that's wholly incorporated in foreign soil, doing business in foreign soil.

At least in Brazil, companies that operate there must obey local laws. What happens when those laws are in contradiction with US laws, like in the example I cited? Is Brazil supposed to cave? Is Brazil supposed to keep fining Dell Brasil until it folds? Maybe prosecute Dell Brasil's directors for actively and repeatedly disregarding the law and fines?

How does that work on a global scale?

I'll say again, this is not about a US company opening a foreign subsidiary to do things in the US that are forbidden in the US. This is about a company incorporated abroad having to follow US laws while operating wholly abroad. This is a breach of sovereignty however you look at it.

[kube-system]

It is plainly routine for a company to have to deal with multiple legal jurisdictions at a time.

Yes, sometimes this causes compliance complication. This isn't unusual, it happens frequently.

Ultimately, every government exercises the laws of their country as they see fit, using the enforcement tools they have available to them. These rules often extend outside of their borders and apply to foreign or partially-foreign entities depending on the situation. The only limits on this are the practical means of enforcing it.

Dell Brazil would have been subject to Cuba sanctions because it was controlled by the US parent company. The US has obvious jurisdiction over Dell Technologies the parent company, and the nexus to enforce it.

Nothing you are are describing is even remotely unique to the US. No country is going to let you set up a foreign subsidiary to launder goods around sanctions law. If they did, everyone would do that and nobody would ever follow sanctions.

[trumpdong]

Why didn't the university just ignore the terms of service?

[cassianoleal]

I don't know, and to be fair they might have done just that - and it wouldn't surprise me if that happened with the blessings of the Federal Government.

As I mentioned, I didn't follow up on the story and in fact when I searched for it a few years ago, I couldn't even find the original articles any more.

[drstewart]

Ah, so it would be like the EU fining a US based company for not following certain GDPR laws even if they don't have a presence in the EU? Definitely would never happen!