30 May 2017

VPN reviewer sees Internet Borders

While researching possible consumer VPN offerings, I was pleasantly surprised to find a candid acknowledgment that borders apply to the Internet.

Although I have used employer supplied VPNs, I was recently encouraged to re-consider the role of consumer VPN services. I'm especially interested in making it harder for "casual" hackers to interrupt communications when I connect to various cloud services via public WiFi. It's been a few years since I've looked at the state of the consumer VPN market, so I started with typical review articles aimed at consumers.

In reading VPN selling materials and third party reviews, I was slightly surprised to discover the very strong and common emphasis on the ability to use a VPN to mask one's geolocation - the ability of an end user in Country A to use a VPN for the purpose of pretending to be in Country B and thereby circumvent content distribution controls. In the past, I have described this as "online smuggling" or "internet smuggling".

What surprised me more was the express acknowledgement (by some) that internet smuggling is sometimes against the law - and not just the laws of "repressive" regimes. I was especially struck by this comment in a review article discussing the use of VPN to access Netflix and streaming media content generally:
Can I Use a VPN for Netflix?
Borders still exist on the web
. New, major-release films and television shows are often available on Netflix outside of the US yet only available for purchase via Amazon, iTunes, or on the Windows Store within the US. But if you were to select a VPN server in a country with rights to the show, your computer's IP address would appear to be in that country, allowing you to view the content. Of course, you might find Netflix in other countries to be even more restrictive.
The trouble is that Netflix and similar streaming services are getting wise to the scam. In my testing, I found that Netflix blocked streaming more often than not when I was using a VPN. There are a few exceptions, but I also have Netflix is actively working to protect its content deals. What works today may not work tomorrow. 
You'll note that I said "scam," above, and that is more or less true. Just because you paid for Netflix in one place does not mean you're entitled to the content available on the same service but in a different location. Media distribution and rights are messy and complicated. You may or may not agree with the laws and terms of service surrounding media streaming, but you should definitely be aware that they exist and understand when you're taking the risk of breaking them. 
- Eddy, "The Best VPN Services of 2017", PCMag UK (retrieved May 30, 2017) (emphasis added)
Reportage of Internet infrastructure has moved gradually over the years from "the Internet is borderless", to "it is impossible to apply borders to the Internet", to "it is difficult to enforce borders on the Internet".

Now we see "Borders still exist on the web". Furthermore, this author has helpfully tested the border circumvention technology as applied to a group of persons who are trying to enforce borders - online streaming media services - and found that anti-smuggling technologies are getting better.

Rather than wasting time saying silly things like "I told you so", I shall instead congratulate the growing number of people who are beginning to internalise and appreciate the reality of Internet Borders.

Oh, why not. I told you so!

18 January 2017

Why the EU Has Issued Relatively Few Data Protection Adequacy Determinations: A Reply

A January 2, 2017 commentary by Ariel Teshuva raises an intriguing question. While the European Commission is vested with the authority under Article 25(6) of the Data Protection Directive to issue data protection adequacy determinations—a declaration that a given jurisdiction outside the EU provides adequate legal protection for personal data—why have so few been adopted?

In reviewing this question, Teshuva finds the content of the current list of 12 adequacy decisions difficult to explain. She also wonders how it is that large technology and banking firms based in countries without an adequacy determination remain able to continue significant trading relationships with Europe.

In this post, I will suggest that while the list of 12 territories that benefit from adequacy decisions is heterogeneous, the membership list remains easy to explain. I will also suggest that it is understandable that many other jurisdictions remain absent from the list. Finally, I will provide some thoughts on how multinationals from third-party jurisdictions that do not benefit from adequacy determinations nonetheless maintain healthy European operations.