MoreRSS

site iconAlec MuffettModify

Alec is a technologist, writer & security consultant who has worked in host and network security for more than 30 years, with 25 of those in industry.
Please copy the RSS to your reader, or quickly subscribe to:

Inoreader Feedly Follow Feedbin Local Reader

Rss preview of Blog of Alec Muffett

I asked ChatGPT to explain why Ofcom, acting as an agent of the sovereign UK Government, cannot enforce penalties or sanctions in the USA against 4chan &al

2025-11-21 03:44:37

If Ofcom clarifies its role as an agency of a sovereign government, this is what happens next:

Good, now we’re in the domain where the constraints become absolute rather than merely procedural. And here the core reality is blunt:

The UK cannot enforce its own regulatory, penal, or public-law penalties in U.S. courts.

Full stop.


Not “sometimes.” Not “if they find a clever jurisdictional hook.”
The prohibition is structural, doctrinal, and consistently upheld.

Let’s dissect the mechanics, the edge-cases, and the loophole-like tactics governments use when they appear to succeed anyway.


1. The hard constraint: the U.S. will not enforce foreign “public laws”

American courts follow the penal and revenue rule, rooted in common law:

  • They will not enforce foreign penal laws (criminal, quasi-criminal).
  • They will not enforce foreign revenue laws (taxes).
  • They will not enforce foreign regulatory penalties or administrative sanctions, even when they are formally “civil.”

This rule applies even when:

  • the defendant is a U.S. corporation
  • the conduct occurred online but reached UK users
  • the UK penalty is framed as “civil,” “regulatory,” or “administrative”
  • the UK judgment is final and issued by the proper UK authority

A U.S. court treats such actions as attempts to enforce another sovereign’s public policy — which is forbidden.

This is the barrier you were sensing, and it’s deeper than any treaty.


2. Why MLATs don’t help

Even for criminal matters, MLATs do not:

  • allow the UK to force U.S. prosecutors to act
  • allow the UK to directly enforce fines, penalties, or orders in the U.S.

They only allow evidence and assistance if the U.S. is independently willing to prosecute under its own laws.

They are not enforcement mechanisms.


3. What about “recognition of foreign judgments”?

Recognition of foreign judgments is available only for private-law judgments (contract, tort, etc.), not for public-law sanctions.

So if the UK obtains a regulatory fine or order via:

  • ICO (data protection penalties)
  • OFCOM penalties
  • CMA penalties
  • FCA regulatory fines
  • HMRC penalties
  • Competition Act fines
  • Any statutory enforcement action

…the U.S. court will refuse recognition on public-policy grounds.

Even if the underlying conduct would also be illegal in the U.S.


4. So how does a foreign regulator ever get traction against a U.S. corporation?

Here’s where the strategic reality comes in. A foreign regulator cannot enforce its own law in the U.S., but it can:

A. Get the company where it is vulnerable: local assets, local operations

If the U.S. corporation:

  • has a UK subsidiary
  • has assets in the UK
  • derives revenue from UK operations

…then the UK can enforce penalties inside UK jurisdiction, and the only question is whether the parent corporation wants to protect those assets, subsidiaries, or revenue streams.

This is the most common path.

B. Pressure via licensing, market access, or compliance obligations

Example:

  • If you want to operate in the UK (data, telecom, finance, payments), you must accept regulatory jurisdiction.

If the firm has no UK presence and chooses not to comply, the UK cannot reach them through U.S. courts — but it candeny access to the UK market entirely.

C. Convert the problem into a U.S. law violation

This is the only path to enforcement on U.S. soil.

Foreign regulators frequently try to persuade U.S. agencies that:

  • the conduct overlaps with U.S. consumer protection law,
  • or U.S. securities law,
  • or U.S. data protection/privacy rules,
  • or U.S. competition law.

If the DOJ, FTC, FCC, SEC, or state AGs decide the behavior independently violates U.S. law, then enforcement occurs — but under U.S. statutes, not UK ones.

This is the closest thing to a “backdoor,” but it depends entirely on U.S. prosecutorial discretion.

D. Use criminal charges to unlock MLAT assistance

If the UK classifies the offense as criminal, and the U.S. considers it extraditable, MLATs can assist with evidence — but again:

  • The U.S. does not enforce the UK criminal penalty.
  • The U.S. only helps the UK prosecute inside UK courts, or independently prosecutes under U.S. statutes.

Still no direct enforcement on U.S. soil.


5. The internet-specific misconception

You alluded to the idea that an internet presence might extend UK regulatory reach into the U.S. It does not.

Internet presence does not create extraterritorial enforcement capability.

A U.S. company accessible online from the UK does not become subject to UK penalties unless:

  • it avails itself of the UK market,
  • or it has assets/substance in the UK,
  • or it voluntarily participates in that regulatory framework.

If it chooses not to, the UK is essentially limited to:

  • blocking,
  • restricting services,
  • civil injunctions against UK-facing operations,
  • or relying on U.S. enforcement through domestic U.S. law.

6. The distilled reality

If the UK wants to force a U.S. company with zero UK assets or presence to pay UK regulatory penalties in the U.S., then:

It’s impossible. Period. The U.S. courts will not assist.

The only workable levers are:

  • make it a U.S. law issue,
  • make the company care about the UK market,
  • or make it a criminal matter and seek cooperative action (still under U.S. law).

7. If you want, I can map:

  • the specific statutory categories that trigger the penal/revenue rule
  • the few edge cases where foreign sovereigns can sue in the U.S.
  • how regulators strategically structure penalties to avoid enforceability gaps
  • or the defensive strategies U.S. corporations deploy to stay beyond foreign reach

Which angle do you want to dive into?

Suffice it to say: when the equivalent US laws would be violations of the 1st amendment, there’s no hope for Ofcom here.

So, long story short, Ofcom are going to have to resort to (DNS, IP, DPI) blocks imposed on ISPs to prevent Britons from accessing:

  • 4chan
  • KiwiFarms
  • SaSu
  • <various other US-based forums>

…which will lead to:

  1. Streisand-Effect motivation / boosting of traffic to go see those websites
  2. Enormous bunfights to attempt to get VPNs to censor access similarly
  3. Attempts to block VPNs which do not comply, as well as privacy-enabling tools such as the Tor Project (which is used, e.g., by the BBC as part of its public service)
  4. Inability to block cross-border wireless services, e.g. France, Ireland, …
  5. Eventual collapse of public trust in censorship as everyone walks around the blocks

There is not enough popcorn.

“MPs and peers warned of China spy risk on LinkedIn” | Translation: “Horny / Lazy Spooks Targeted by Fake Hot Chinese Girls via LinkedIn, GCHQ Panic”

2025-11-21 02:36:01

Hot Asian Women Seek Fun In Cheltenham:

The MI5 alert identifies two LinkedIn profiles … used on behalf of … Chinese MSS … “actively reaching out to individuals in our community” … to “collect information and lay the groundwork for long-term relationships … The … “false personas” approach targets to “work as freelance consultants authoring geopolitical reports”.

https://www.bbc.co.uk/news/articles/c4gpnz05kr8o

“‘We’re Going to DESTROY the Online Safety Act’: Meet the Top Lawyer Waging War on Ofcom” | OrderOrder | …it’s an interesting thesis that…

2025-11-21 02:04:14

…the credibility of the online safety act now hinges upon its (in)ability to make Britain the safest place to be online, by virtue of inability to effectively sanction the rest of the world.

Instead it will become a British censorship charter, failing to stop Britons accessing content that would worry safety activists, academics, or the Government. Until it dies.


Via:

The simple test that blew up the FTC’s case against Meta | …absolutely fascinating read re: puncturing wild claims of “monopoly” in social networking

2025-11-20 15:05:34

I wish we did something similar in the EU re: interoperability:

In the end, it was a simple experiment that undid the FTC’s case. To determine whether Meta held a monopoly, Meta hired an expert to pay people to stop using its products — and then to observe where they went to fill the time.

https://www.platformer.news/ftc-loses-meta-case-analysis/

Interesting to compare and contrast EU attempts to force chat control, with failed Australian attempt at the same from 2024:

2025-11-19 17:17:20

2024 Australia: In November, the eSafety commissioner announced draft standards that would require the operators of cloud and messaging services to detect and remove known child abuse and pro-terror material “where technically feasible”, as well as disrupt and deter new material of the same nature.

https://www.theguardian.com/technology/article/2024/jun/21/australia-esafety-commissioner-child-abuse-detection-online-safety

Key Concerns Raised by Experts:

1. Flawed ‘voluntary’ AI Chat Control Creates Dangerous False Positives

The experts warn that unlike the previous Council’s proposal, the new text expands scanning of private communications to include automated text analysis, using AI to identify ambiguous “grooming” behaviours. They argue this will create a dragnet that ensnares innocent people. “Current AI technology is far from being precise enough to undertake these tasks with guarantees for the necessary level of accuracy.”

https://www.patrick-breyer.de/en/eu-chat-control-proposal-still-poses-high-risks-despite-removal-of-mandatory-scanning-experts-warn/

Australia: eSafety Commissioner Julie Inman Grant called to testify before US Congress by Donald Trump ally over ‘threat’ to Americans’ free speech | Sky News

2025-11-19 15:46:50

Chickens coming home to roost:

Sky News has obtained a bombshell letter from a US House of Representatives committee chairman and ally of President Donald Trump accusing eSafety Commissioner Julie Inman Grant of being a “zealot” and “direct threat” to the free speech of American citizens and requesting she testifies before Congress within two weeks.


https://www.skynews.com.au/world-news/united-states/esafety-commissioner-julie-inman-grant-called-to-testify-before-us-congress-by-donald-trump-ally-over-threat-to-americans-free-speech/news-story/c232d406b9a58089bf94240cb3b425d3

Via: