The Internet and Extra-Territorial Effects of Laws

How to avoid rule-setting and decision-making that will constrain the Internet around the world

The Internet is global, so regulations and court decisions that affect it may have extra-territorial[1] effects. This raises two questions: How mindful are states about avoiding harmful and unnecessary impacts outside their borders, and how can they minimize such negative effects?

The Internet is a network of networks consisting mostly of privately-operated networks; some of those networks cross national boundaries, and many of the organizations themselves cross boundaries, too (for example, international corporations). The value of the Internet comes from its open and global nature. Globalization is a feature of the Internet, not a bug, and legal systems everywhere should recognize this, not try to ‘fix’ it. Decisions that exert jurisdiction extra-territorially should be made in ways that allow the Internet to evolve as an open, globally-connected, secure and trustworthy technology for everyone.

This Concept Note sets out problems that occur when states exert extra-territorial jurisdiction – i.e. when they make policy or judicial decisions with effect outside the country’s territory, either by accident or design. We suggest an approach to avoid or minimize judicial or regulatory decisions that can harm the Internet’s global reach and unique characteristics. But, fundamentally, states should not impede the flow of ideas and information the Internet brings, especially to their own citizens.

Executive Summary

• The social and economic progress the Internet brings globally is based on its fundamental properties of openness, innovation, permission-less innovation, interoperability, collaboration and competition (the “Internet Invariants”)[2]. If we undermine these properties, we risk all the benefits the Internet brings.
• Right now, decision-makers in many states are imposing rules that spill over onto the Internet elsewhere, hamper innovation, deter investment in their own countries and risk creating new digital divides that disadvantage their own citizens.
• Decision-makers can mitigate these problems by encouraging decentralized collaborative approaches, including international norms development processes, to shape Internet-related laws and policies. Such processes and structures can create better outcomes because they have broader participation and are more politically responsive and economically sustainable than some top-down approaches.[3]
• These primary principles will help guide decision-makers and mitigate unintentional extraterritorial harms:
  • Weigh risks and benefits.
  • Check what’s been done before.
  • Collaborate with other stakeholders
  • Focus on the activity/behaviour, not the medium
  • Be mindful of the properties of the Internet and what they stand for.

Background

Many national laws are intended to have extra-territorial effect; they apply to people or companies outside the borders of the state that made the laws. This practice long pre-dates the Internet, but its effects are exacerbated both by the cross-border nature of the networks and also the drive by some countries to exert authority over the Internet. Examples include:

• Non-US companies have long been targeted by American laws, including the 1996 Helms Burton Act,[4] on bribery or sanctions relating to third countries.
• EU data protection regulations like the General Data Protection Regulation (GDPR) apply to companies from outside the EU that use the personal data of European citizens.
• Changes made in 2011 to the Criminal Law of the People’s Republic of China now include people or companies neither from nor in China who may be guilty of corruption against the Chinese state or its citizens.

Intentional extra-territorial effects of laws aim to ensure that people do not become victims of law-breakers from outside their jurisdictions. While governments have a responsibility to protect their citizens from illegality, the Internet’s cross-border nature can create conflicts arising from activities that are legal in one country being illegal in another. In the early 2000s, as the Internet became popular and commercialized, the Yahoo! case highlighted the challenges of Internet regulation. The American search and listings company, Yahoo!, was forced to stop advertising Nazi memorabilia for sale in France, and its executives faced criminal charges[5].

However, many Internet-related laws and international frameworks only regulated where absolutely necessary to promote commerce, and promoted openness and innovation in the development of the networks. For example, the idea of ‘mere conduit’ – where network operators are not liable for the content of traffic – is found in many laws, including the European E-Commerce Directive of 2000.[6] Governments took a light regulatory touch domestically and coordinated regionally and internationally to allow the Internet to flourish.[7] 

Today, government and citizen concerns about privacy, cybersecurity, taxation, competition and electoral integrity have launched a new wave of extra-territorial effects both in regulations and court decisions. Examples include:

• In 2014, a Spanish court created a Europe-wide Right to Be Forgotten in Google’s search-engine results.[8]
• In 2017, the Supreme Court of Canada upheld orders for Google to “de-index” a website, and asserted the jurisdiction of Canada’s courts over Internet intermediaries in other countries. However, the Court provided no insight about how this could be enforced, causing uncertainty and confusion.[9]
• In 2017, a US court ordered the blocking of the academic resource, sci-hub, by a broad range of ISPs and search engines, in addition to the seizure of its domain names (a more typical response to alleged intellectual property rights infringement).[10]
• The European Union’s General Data Protection Regulation (GDPR)[11] is explicitly designed to protect European users’ personal data, whatever jurisdiction it is processed in.
• The US CLOUD Act coordinated the interests of law enforcement and US tech firms to ensure access to data internationally but has been criticised for minimising other stakeholder interests.
• China is taking steps to increase the extra-territorial reach of its content monitoring and filtering regime.[12]
• The UK and some Middle Eastern countries seem to be moving away from a ‘notice and takedown’ approach to illegal or unwanted content, and towards a positive obligation for technology platforms to police existing content or even prevent it from being uploaded.[13]

Because of the Internet, decision-making with extra-territorial effect is intensifying, and risks undermining what made the Internet such a powerful and positive force.

What makes the Internet so powerful: The “Internet Invariants”

The Internet has fundamental properties that have made it a global enabler of social and economic progress. We call these properties the Internet Invariants[14], because while applications on the Internet often change, the underlying source of the Internet’s strength does not vary. The sum of these invariants ensures the Internet is an open platform for innovation and creativity.

Supporting the Internet Invariants will ensure the next generation of innovations develop and that everyone has a chance to enjoy their benefits and rewards:

Global reach and integrity: An ‘end to end’ Internet where information sent from any point can get to any other.

General purpose: The Internet is not designed for specific purposes or business models, but for general use. There are no built-in limitations on the applications or services that use it.

Permission-less innovation: Anyone can set up a new service on the Internet without having to ask permission, as long as it meets existing technical standards and best practices.[15]

Accessibility: Anyone can use the Internet, not just to consume but to contribute content, put up a server and attach new networks.

Interoperability and mutual agreement: Through open technology standards and mutual agreements between operators of different parts of the Internet.

Collaboration: The best solutions to new issues come from the willing collaboration between stakeholders.

Reusable building blocks: Technologies are often deployed on the Internet for one purpose, only to be used later to do something else. This creativity and problem-solving would be impossible with vertically integrated, closed solutions.

No permanent favourites: Success depends on relevance and utility, not on special status. It must not be ‘locked in’ by today’s winners. Openness and innovation are the life-blood of the Internet.

How might the extra-territorial effects of some national rules and court decisions challenge the premise of the Internet Invariants?

Why extra-territorial jurisdiction can be a problem?

National laws and judicial decisions that exert extra-territorial jurisdiction can have negative and often unintended consequences. For the sake of analogy, let’s call them the “extra-territoriality Internet symptoms”:

• Unpredictability – The unpredictability of how domestic laws might apply and be enforced can stifle innovation because it creates greater risk and uncertainty for new product and services.
• Inconsistency – As different organizations try to implement decisions and rules, there can be variance in how rules are implemented. With a proliferation of rules and complexity, only the largest organizations may be able to comply.
• Power-grabs – Some states are trying to grab back power over the Internet, and from other countries, seeing it as a threat to their authority. This can intensify the conflict of laws as each country or court races to come out on top, and can even create a wider sense of uncertainty and resentment of interference from abroad. The resulting confusion to users could reduce their trust in the Internet.
• Uncoordinated action – Unilateral regulatory actions at a national level displace and undermine collaborative ways of examining issues and impede the development of international norms. While increasing friction between both networks and nation-states, they produce outcomes restricted to the social and economic sensitivities of one jurisdiction or even just one set of stakeholders.
• Fragmentation – Applications running in the Internet start to behave differently in different countries,[16] or content is unavailable. The result is an increasing degree of Internet fragmentation, creating new digital divides and concentrating the benefits of innovation in some countries, as products and services from abroad are barred or dissuaded from entering their market.

Negative externalities of extra-territorial jurisdiction

A negative externality is when the benefit of doing something is enjoyed by some people or organizations, but the costs are largely borne by others. A classic example is airborne pollution created in one country that poisons rivers and forests in another. Jurisdictional extra-territoriality can create negative externalities on the networks – by undermining the Internet Invariants – and more broadly on governance and participation in the digital economy.

A. Externalities on the Internet Invariants

B. Broader externalities

These concern a range of political and economic externalities that affect both governance and how people participate in the digital economy:

• Fragmentation: As well as creating a fragmented Internet, extra-territorial jurisdiction drives both governmental and commercial fragmentation,[17] leading to narrow and reduced offerings across various countries.
• Business model disruption as businesses try to cope with the compliance burden of possibly conflicting laws. This creates added uncertainty for companies operating globally and weakens the framework of international trade and investment. It can also drive consolidation and competition issues if only the biggest and best-resourced companies can cope with the legal complexity and business risk of compliance.
• The creation of new digital divides. As technology advances in certain parts of the world, many countries consider regulation as a means to ‘catch up’ with such progress. Such regulation risks being narrow in scope and reflecting cultural, economic and social sensitivities incompatible with those in other countries. This limits the range of information and services available, creating new digital divides for users in different countries.
• International tension and resentment generated by states imposing their will in other countries. When one state actor is seen as aggressively using domestic law to assert its hegemony globally, we can expect others to react accordingly[18]. Additionally, extraterritoriality undermines international collaboration by diverting attention and resources from developing collaborative frameworks and international norms. Extraterritoriality creates a patchwork of inconsistent rules as different institutions in different countries approach international issues using different laws and procedures.

Principles for dealing with Internet-related decisions and regulation

We are just beginning the conversation on regulation. Some regulators and judges may be dealing with these topics for the first time. These preliminary principles are intended to help decision-makers to achieve their goals while ensuring the Internet still drives social empowerment and economic growth, both at home and abroad:

1. Weigh Risks and Benefits.

• The most limited and targeted decisions will create the least unintended negative consequences. Does the decision have to have extra-territorial effect for it to work?
• Actively consider the role and impact of decisions on other stakeholders, including in other countries.

2. Check what’s been done before.

• It’s likely other governments or courts have pondered the same challenging questions, Resources to check how others have approached issues may be available from international or regional organizations[19], including regulatory best practices, norms and even suggested legal frameworks.

3. Be mindful of the properties of the Internet.

• The Internet’s unique properties – the “Internet Invariants” – can provide an additional benchmark in determining the effectiveness of regulation. We encourage policy makers to add them as evaluators for sound decision making. 

4. Focus on the activity/behaviour, not the medium.

• Design laws, rules and decisions to deal with the undesirable or illegal activity or behaviour itself, rather than the medium it occurs in. For example, is fraud that occurs online – e.g. phishing – substantively different from offline fraud? While the Internet adds new dimensions or can change the scale or reach of an activity, it doesn’t always require rule-making targeted at the Internet itself. 

5. Seek out collaborations with other stakeholders

• Actively seek out opportunities to resolve issues with all relevant stakeholders, including at the regional and international level where cooperation and collaboration on norms can be highly effective.

6. Apply the principle of proportionality

• Has the regulatory measure gone beyond what is required to attain a legitimate goal? Do its claimed benefits exceed the costs?

There is much work to do so the traditional nation-state approach to regulation and the global Internet can continue to evolve. These principles are a starting point. There is a need to both acknowledge and resolve some of the differences identified in the legal systems around the world, and to ensure the Internet remains a source of opportunity and a force for good.

Annex

You can find the annex in the PDF version of the document. The annex is a non-exhaustive list of national laws, dedicated to dealing with Internet issues, that have an extraterritorial effect.

Continue reading

Endnotes

[1] We recognize that extra-territoriality involves different layers of interpretation and application. However, for the purposes of this concept note, it will refer to the legal ability of a state actor to exercise authority beyond its borders. It does not include Terms of Services imposed by private companies on individual users around the world.

[2] “Internet invariants” refers to the fundamental properties that make the Internet unique. They are inherent in the original design of the Internet and, if altered or significantly weakened, would undermine the Internet’s open and generative nature. https://www.internetsociety.org/internet-invariants-what-really-matters/

[3] https://www.internetsociety.org/resources/doc/2016/internet-governance-why-the-multistakeholder-approach-works/

[4] https://en.wikipedia.org/wiki/Helms%E2%80%93Burton_Act

[5] Yahoo!, Inc. v. La Ligue Contre le Racisme et L’Antisemitisme, 169 F. Supp. 2d 1181, 1186 (N.D. Cal. 2001)

[6] https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32000L0031

[7] A similar principle is found in section 512 of the US Digital Millennium Copyright Act (DMCA)

[8] Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González (2014)

[9] https://www.osler.com/en/resources/regulations/2017/supreme-court-of-canada-upholds-global-search-engi

[10] https://torrentfreak.com/sci-hub-loses-domain-names-but-remains-resilient-171122/

[11] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG

[12] https://citizenlab.ca/2016/11/wechat-china-censorship-one-app-two-systems/

[13] https://arstechnica.com/tech-policy/2016/05/uk-ip-enforcement-2020-notice-trackdown-teach-kids/

[14] https://www.internetsociety.org/internet-invariants-what-really-matters/

[15] The best example of permission-less innovation is the World Wide Web, created by Sir Tim Berners-Lee in Switzerland who made his technology available to everyone.

[16] https://gizmodo.com/dozens-of-american-news-sites-blocked-in-europe-as-gdpr-1826319542

[17] Internet Fragmentation: An Overview, World Economic Forum, http://www3.weforum.org/docs/WEF_FII_Internet_Fragmentation_An_Overview_2016.pdf

[18] There is precedent: Kenneth W. Dam, Extraterritoriality in an Age of Globalization: The Hartford Fire Case, 1993 SUP. CT. REV. 289, 324; see also Thabo Mbeki, Presi- dent of South Africa, Statement to the National Houses of Parliament and the Nation at the Tabling of the Report of the Truth and Reconciliation Commis- sion (Apr. 15, 2003), http://www.anc.org.za/ancdocs/history/mbeki/2003/ tm0415.html (“[W]e consider it completely unacceptable that matters that are central to the future of our country should be adjudicated in foreign courts which bear no responsibility for the well-being of our country.”).