{ "schemaVersion": "1.0", "dataset": "ddos-jurisdiction-exposure", "title": "Vendor jurisdiction exposure, by mechanism", "description": "The four legal mechanisms that follow a DDoS vendor’s home jurisdiction rather than the buyer’s: what each reaches, what sets it in motion, which document settles it, and which of them an architecture can remove. No vendor is named and no country is rated.", "lastUpdated": "2026-08-22", "license": "Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.", "sources": [ { "id": "wassenaar-lists", "title": "Wassenaar Arrangement — Control Lists", "publisher": "The Wassenaar Arrangement Secretariat", "url": "https://www.wassenaar.org/control-lists/", "accessedDate": "2026-08-22", "notes": "The dual-use list most national control regimes are derived from; national lists differ and the national one is what binds a given shipment." }, { "id": "bis-ear", "title": "Export Administration Regulations (15 CFR 730–774)", "publisher": "US Bureau of Industry and Security", "url": "https://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear", "accessedDate": "2026-08-22" }, { "id": "ofac-sdn", "title": "Specially Designated Nationals and Blocked Persons List", "publisher": "US Department of the Treasury, OFAC", "url": "https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists", "accessedDate": "2026-08-22" }, { "id": "eu-sanctions-map", "title": "EU Sanctions Map — consolidated list of restrictive measures", "publisher": "Council of the European Union", "url": "https://www.sanctionsmap.eu/", "accessedDate": "2026-08-22" }, { "id": "cloud-act-2713", "title": "18 U.S.C. §2713 — Required preservation and disclosure of communications and records", "publisher": "US Code, via Cornell Legal Information Institute", "url": "https://www.law.cornell.edu/uscode/text/18/2713", "accessedDate": "2026-08-22", "notes": "The provision the CLOUD Act inserted; it is the operative text rather than the act’s title, which is why it is cited directly." }, { "id": "eu-e-evidence", "title": "Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence", "publisher": "European Union", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1543", "publishedDate": "2023-07-12", "accessedDate": "2026-08-22", "notes": "The ELI short form of this URL did not resolve from here; the CELEX form is the same instrument and does." }, { "id": "nis2-supply-chain", "title": "Directive (EU) 2022/2555 (NIS2), Article 21(2)(d)", "publisher": "European Union", "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj", "publishedDate": "2022-12-14", "accessedDate": "2026-08-22", "notes": "Supply-chain security, including the security of relationships between an entity and its direct suppliers." } ], "changelog": [ { "date": "2026-08-22", "note": "Initial release: four mechanisms, with the document that settles each and the architectural property that removes it where one does." } ], "rowCount": 4, "data": [ { "mechanism": "Export licensing", "reaches": "Whether the product may be shipped, updated or supported across a border at all, including firmware and support delivered remotely.", "trigger": "The control list of the vendor’s home jurisdiction meeting the buyer’s country and, for some categories, the buyer’s sector.", "document": "The export classification of the exact model in writing, and a statement of whether a licence is required for the buyer’s country and how long one takes.", "removedBy": "no purchase removes it; concentration is what a buyer controls", "authority": "Wassenaar dual-use list; US Export Administration Regulations" }, { "mechanism": "Sanctions exposure", "reaches": "Payment, renewal, support and, where a designation names the counterparty, the legality of continuing to use what is already installed.", "trigger": "A designation naming the vendor, an entity in its ownership chain, or a jurisdiction the buyer’s own regulator applies a programme to.", "document": "The ownership structure in writing, screened against every programme that binds the buyer — not only the buyer’s own country’s list.", "removedBy": "no purchase removes it; concentration is what a buyer controls", "authority": "OFAC Specially Designated Nationals list; EU consolidated sanctions list" }, { "mechanism": "Extraterritorial data access", "reaches": "Data the vendor holds or is able to reach, wherever it is physically stored, including telemetry a device sends home for classification.", "trigger": "A lawful order served on the vendor in its home jurisdiction, which the vendor may be barred from disclosing to the buyer.", "document": "What telemetry leaves the buyer’s network, in which jurisdiction it is processed, how long it is retained and who may compel its production.", "removedBy": "An architecture in which no telemetry leaves the network removes the mechanism, because there is nothing at the vendor to compel.", "authority": "US CLOUD Act, 18 U.S.C. §2713; EU Regulation (EU) 2023/1543" }, { "mechanism": "Vendor-operated cloud dependency", "reaches": "Whether the device still classifies traffic correctly on a day the vendor’s cloud is unreachable, for any reason including the three above.", "trigger": "An outage, a lapsed contract, a routing failure, or a legal event that stops the feed rather than the device.", "document": "The documented behaviour on feed loss, in writing: what still applies, what stops updating, and whether the device steps down to passing traffic.", "removedBy": "Detection trained and executed on the customer’s own infrastructure removes the dependency; the device degrades gracefully because it was never being told what to think.", "authority": "NIS2 Directive (EU) 2022/2555, Article 21(2)(d) on supply-chain security" } ] }