Yes. Although obviously, there would most likely not be any consequence from doing so.

This occurs more frequently in cases of sex tourism (most particularly in countries like Thailand), and online gambling.

A few years ago at a previous employer, we had a client in Costa Rica who made online gambling applications who hired us to do an application assessment (preventing cheating and things like that); and it was only after we had started performing the assessment that I happened to inquire in a meeting with our legal department as to whether this was actually legal for us to do.

As a result of that meeting, we had to stop work on the assessment immediately, and not do any invoicing, as our lawyer thought that charging for that assessment would be a pretty clear violation of the law.

Were you doing this work in Costa Rica? Because if not, your example is completely different. You were doing work in the US that the US deems illegal.

And actually, I'm not certain that your lawyers were correct in stating that the work was illegal. It's illegal to operate an online casino in the US. That's not the same as it being illegal to develop software that can be used by an online casino. If the casino in question was serving US customers, then you might be considered an accomplice in a crime. If they were only serving customers outside the US, I seriously doubt you'd be guilty of any crime.

The work was being done in Costa Rica, onsite. And the software was used for their own online gambling site (we were testing the production site, not software that they provided to other people).

I concur that it was probably a more complicated legal matter, but our counsel was pretty confident that this would have been problematic.

The comparison makes more sense, now. :)

Were they allowing US customers to use their site? If so, you were might have been in a gray area. I agree with your legal dept that it could have been problematic either way. Not necessarily illegal, but not worth the hassle.

There's a long whitepaper on the subject here, but U.S. laws by default don't have extraterritorial application: http://www.fas.org/sgp/crs/misc/94-166.pdf

Some laws are explicitly applied extraterritorially; for example, the U.S. has in recent years been prosecuting Americans who travel to other countries to pay for sex with minors, even if legal in the destination country. Drinking when under 21 isn't in that category, though. I have no idea if jailbreaking a phone is. Although, even without extraterritorial application, there might be some kind of U.S. contract violation if the person returns to the U.S. and continues to use the phone.

Interesting! Given that the US has even been attempting to extradite people who aren't even US citizens on DMCA matters (although not with entire success) I am not certain if the powers that be entirely agree on where their rights are (nor arguably will anyone know until they conclusively win or lose such a case).

Internet-related stuff uses a different theory I think, that someone making stuff available over the internet to Americans is basically acting in the U.S. for the purposes of jurisdiction. Same way people who've never been to the UK get sued under UK libel law, because someone in the UK read their article on the internet. The internet makes a big mess of jurisdiction...

Perhaps minorly important: I don't believe the '21 to drink' thing is federal, but rather something the federal government pressures all states into adopting themselves.

> While I would believe you over many other people because of who you are and what you do...

Thanks for the sentiment, but on legal grounds for end users I'm quite often not the most knowledgable ;P. In particular, I don't like travelling internationally, and I now actively avoid it, so I also tend to know less about how things work in other countries than more reasonable people. I work with some people here, however (who are asleep currently) that have spent a bunch of time researching the landscape of international law with regards to jailbreaking, but they probably themselves only focussed on "citizen of that country in that country".

What I will say I tend to know more about than average is "stuff that affects myself and my friends", but the reality is that as an end user of these tools, you really aren't ever going to be prosecuted: I thereby would tend to care more about "what if someone took a trip to a conference in Germany, built an unlocking tool with some friends there, and released it while abroad?", and for that situation I can dig up enough to make it sound sketch (although the extent to which DMCA exemptions help people who provide tools is at least in question).