What International laws should one in the InfoSec industry we be aware of?

Question

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?

Answer 1

The world is increasingly interconnected, and it is more and more common that actions by people in one country can affect people in other countries and be regulated by laws there.

Here is a brief sampling of some of the issues to consider.

• A security researcher from Russia was detained while visiting the US by authorities for distributing free copyright circumvention software. See http://en.wikipedia.org/wiki/Dmitry_Sklyarov

• Web sites can have traffic from all over the world and laws in many different countries pertaining to privacy, copyright, libel, etc. may apply to the web site owners, operators and probably even contributors.

  See e.g. http://en.wikipedia.org/wiki/Information_privacy and European Union Aiming To Create New Privacy Laws

• Information considered a public service in one country can be seen by others as illegal. See e.g. the NPR story on Seeing The Internet As An 'Information Weapon' of which this is an excerpt:

  [In 2009] Russia successfully sponsored an even sharper version of its cyber disarmament proposal at a summit of the Shanghai Cooperation Organization, which includes China and four Central Asian countries as well as Russia. The accord defined "information war," in part, as an effort by a state to undermine another's "political, economic, and social systems."

  http://en.wikipedia.org/wiki/Shanghai_Cooperation_Organisation

Answer 2

@nealmcb gave some very good examples.

In general, since your question is quite vague, there are two types of laws that you need to consider when "going international":

• Local laws relevant to your destination (including regional laws, e.g. EU, and "state" laws)
• Laws of your origin country that relate to exporting your technology (e.g. the classic cryptography limitations from the U.S.).

As Neal mentioned, each of these laws may apply, depending on country/law:

• the country where your company is legally registered
• the country you are selling into
• the country where your technology is being developed
• the country where your users are located / citizens of
• the country where your web servers are physically located
• the country where your database is physically located
• the country/ies where your cloud provider may migrate your cloudy instance/s to (good luck with that one).

As mentioned, some of the big ones to know about, besides the non-country regulations such as PCI-DSS and depending on industry, are EU Data Protection, Basel II, and the Chinese Firewall.

If you ask a more targeted question, it may be easier to provide more specific answers.