2

Here is the real question which inspired my last: Does legality of an computerized action depend on user location or computer location?

Someone can be found guilty of crime legal in their home state if they use a computer located in another jurisdiction where the action is illegal to perform the action. However, with cloud computing a user may not be aware of where his computer is located, it may even 'move' to another country transparently; possible even as he is using it. Usually you have a good idea of where you computer likely is, but nothing is gaurenteed.

So lets imagine someone in the US who has purchased a virtual machine from amazon. This machine is physically hosted on a computer somewhere in the world, but the user doesn't know where that physical computer is. If the physical computer he is using dies for some reason his virtual machine may move to another computer located in a different physical location transparently without his being aware of more then a short system 'hiccup', likewise if he gets more customers to his service a new computer may start up in some other part of the world to support his customers, then kill itself later once demand lowers and it isn't needed. The point being he has no way of knowing where his computer is located or if it will move to another location when he purchases amazon's services.

Lets say that he is doing something with this virtual machine (or machines) that is legal in some states, but not in others. Maybe he has a marijuana home delivery service where some states allow selling marijuana and others don't (bad example, since marijuana is still illegal federally, but you get my point, different states have different laws). There is a good chance (but not gaurentee) that his VM from amazon is hosted somewhere within the US, but rather or not it's in a state that would find his action illegal is impossible to know or control.

I'm wondering rather he could be found guilty if amazon automatically moves his VM to a state where his action is illegal despite his home state being legal, without his having any way to prevent amazon from moving him to a state where the action could be illegal.

I know in reality no one would likely pay enough attention to realize his VM moved to somewhere where his action is illegal, and no prosecute would likely prosecute him for such a thing; but I'm talking about letter of the law, assuming a prosecute is aware of the computer location and for whatever reason chooses to prosecute.

Would our theoretical user have any legal defense he could use in this situation to be found innocent?

If it matters you could replace my example, of moving between states, with someone from Cuba buying a VM to discover it's in the US; if federal vs state laws actually matter. I'm assuming our unfortunate criminal happens to travel to the location the VM is located in at some point and thus can be arrested without extradition.

Improve this question
2
  • Generally with cloud services you intentionally choose the server location, or if you want geographic redundancy, the different zones that may be allowed. Even if you revert to whatever location is default, that info is still clearly available when a VM is provisioned. It is highly unlikely that this situation would ever present where a direct owner of a cloud service would ever not be able to determine the zone or zones that service might be hosted from.
    – Christopher Hunter
    Commented Sep 17, 2021 at 22:15
  • There are enough cloud services that stringently respect regional and national boundaries that there may be a presumption of negligence for using a more flexible service in a case where the data may or should not cross boundaries.
    – arp
    Commented Feb 25 at 4:41

1 Answer 1

Reset to default
4

It depends on the particular law in the particular jurisdiction in which you are charged.

Most statute laws enumerate the defences that are available. In common law countries there is a general defence that (except in strict liability offences) the perpetrator must well ... perpetrate the criminal act; what you describe does not appear to meet that requirement.

Other jurisdictions would not be so forgiving.

Improve this answer
3
  • 2
    I haven't checked with Amazon, but I know for sure where my DigitalOcean droplets are hosted and I've been told (not checked it myself though) where Azure servers I worked on were hosted and backed up. So not knowing where a server is might not be a viable defence.
    – Bent
    Commented Mar 2, 2018 at 21:22
  • 1
    @Bent you know where the server is now. For larger scale applications code will be written to allow spinning up new servers when demand is higher (and spinning them down when demand is lower). Likewise if a server hardware dies, which does happen, a new server should be spun up to replace it. Usually these new servers will be located in the same general area, but there is not gaurentee of that fact. Thus just because your servers were in complaint areas yesterday doesn't mean they are when you come in to work today.
    – dsollen
    Commented Jun 5, 2018 at 13:14
  • 5
    @dsollen "but there is not gaurentee of that fact." Err... isn't that dependant on the guarantees your provider provides? The providers I work with typically let you select a geographic region to host your services in (that will not deviate without your input).
    – NPSF3000
    Commented Feb 20, 2019 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .