Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have 4 days to contest KYC being required by internet services

federalregister.gov

Post reply on HN
Print view View original

101–110 of 395 posts

Re: We have 4 days to contest KYC being required by internet services

#101

Post by lumb63 »

AdamH12113 wrote: post #19

For those who didn't know, KYC stands for "know your customer". It's a good idea to spell out abbreviations the first time they're used, especially since the abbreviation itself is not used in the linked article. It's also worth noting that the proposal is about US infrastructure as a service (IaaS) products specifically, not "internet services" in general.

It also looks like it only applies to foreign peoples? That said, I don’t know how you select for only foreigners without collecting identity.

Re: We have 4 days to contest KYC being required by internet services

#103

Post by ZephyrBlu »

SOLAR_FIELDS wrote: post #26
AdamH12113 wrote: post #19

For those who didn't know, KYC stands for "know your customer". It's a good idea to spell out abbreviations the first time they're used, especially since the abbreviation itself is not used in the linked article. It's also worth noting that the proposal is about US infrastructure as a service (IaaS) products specifically, not "internet services" in general.

Yeah this is a very industry standard term in banking and anyone in that industry is going to immediately know what you are talking about, but outside of that industry, chances are high that a layman will not

KYC is that poorly known? I would have expected most white-collar professionals to have at least heard of it.

Re: We have 4 days to contest KYC being required by internet services

#104

Post by reaperman »

rangerelf wrote: post #65
gdcbe wrote: post #43

Earlier quoted context omitted.

In the past that would be true. But given most blockchain platforms require it, I imagine it is more widely known in the tech-savy hn-like realms? Then again I worked on blockchain tech around half a decade ago, so I might be knowledge biased here?

Definitely biased. I had no idea what KYC means. I don't think typing it out fully once at the beginning is too much to ask, is it?

In defense of the person who wrote the HN title, I’ve seen KYC discussed in front-page articles roughly weekly for the past several years straight. I’ve learned about as much of it as I care to know (and more, honestly) from HN comments on 1st and 2nd page posts in that time. In just the past year, I can see that there have been about 1,000 comments mentioning KYC, and about 21 1st/2nd page posts that are explicitly about KYC (nearly 2 per month). Honestly I don't expect all of HN to know what KYC is, but I did expect most HN readers to have a general idea of what it is and why it's a huge pain for a small % of people (but very large number, 1% of the USA is still >3 million people).

Once you're familiar with it, your brain/eyes key onto "KYC" much more strongly than "know your customer". I might have missed the latter, but "KYC" in the title grabbed my attention instantly and reading the title made my heart jump a bit, because generally KYC means a pain in my ass, and even moreso for friends here on visa.

I have a Canadian friend visiting and staying with my girlfriend and I for a month or so. KYC causes actual headaches for her, to the point that she just decides not to get cellular service at all while she visits unless I get a pre-paid SIM under my name and hand it to her. When she pays for things like restaurants, I can't just Venmo/Paypal/Zelle/ApplePay her back on the spot, I have to withdraw cash at some point and coordinate giving it to her.

The general concept of "KYC" makes sense for some situations, but actual implementations really fucking suck for a lot of people. It's very scary to me to see it be required for more and more categories of services because of the way it's currently implemented.

Re: We have 4 days to contest KYC being required by internet services

#105

Post by willmadden »

AdamH12113 wrote: post #19

For those who didn't know, KYC stands for "know your customer". It's a good idea to spell out abbreviations the first time they're used, especially since the abbreviation itself is not used in the linked article. It's also worth noting that the proposal is about US infrastructure as a service (IaaS) products specifically, not "internet services" in general.

KYC in the context of internet services stands for "violating the 4th Amendment".

Re: We have 4 days to contest KYC being required by internet services

#106

Post by chrisjj »

oshout wrote: post #21

Skimming through the article, it seems like the extent of this is to require IAAS (Infrastructure) providers to verify the identity of those who are using their services to train AI. It's an attempt to stymie sanctioned or malicious actors, from training AI and especially from hopping between services or using aliases to continue training on their model. It seems a bit benign and I don't understand the parallels othe…

> seems like the extent of this is to require IAAS (Infrastructure) providers to verify the identity of those who are using their services to train AI.

Only foriegners.

> It's an attempt to stymie sanctioned or malicious actors, from training AI and especially from hopping between services or using aliases to continue training on their model.

Unlikely, since it exempts non-foriegn malicious actors

Re: We have 4 days to contest KYC being required by internet services

#107

Post by logifail »

justaman wrote: post #37
oshout wrote: post #21

Skimming through the article, it seems like the extent of this is to require IAAS (Infrastructure) providers to verify the identity of those who are using their services to train AI. It's an attempt to stymie sanctioned or malicious actors, from training AI and especially from hopping between services or using aliases to continue training on their model. It seems a bit benign and I don't understand the parallels othe…

I think everyone has a sour taste left over from decades of half-baked laws written by politicians that don't understand the basics of the internet or technology in general. With that said, I also don't understand the issues people are having with this.

> With that said, I also don't understand the issues people are having with this.

The regulation "requir[es] U.S. Infrastructure as a Service (IaaS) providers of IaaS products to verify the identity of their foreign customers"

Q: How would one propose to determine if a customer is foreign or not?

A checkbox, perhaps?

No bad actor would possibly pretend to be a domestic customer, of course...

Re: We have 4 days to contest KYC being required by internet services

#108

Post by zinekeller »

chadsix wrote: post #46
lolinder wrote: post #42

Earlier quoted context omitted.

It's still just for IaaS companies, though, right? Not that that makes this all okay, but it is a much more limited proposal than "internet services" makes it sound.

Legally speaking, internet service providers are infrastructure providers.

Definitely not in this case (unless you're using Digital Ocean as a VPN end point or something). EO 13984 (which is cited as the enabling act) has a narrow definition:

(e) The term ‘‘Infrastructure as a Service Product’’ means any product or service offered to a consumer, including complimentary or ‘‘trial’’ offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications. The consumer typically does not manage or control most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of ‘‘managed’’ products or services, in which the provider is responsible for some aspects of system configuration or maintenance, and ‘‘unmanaged’’ products or services, in which the provider is only responsible for ensuring that the product is available to the consumer. The term is also inclusive of ‘‘virtualized’’ products and services, in which the computing resources of a physical machine are split between virtualized computers accessible over the internet (e.g., ‘‘virtual private servers’’), and ‘‘dedicated’’ products or services in which the total computing resources of a physical machine are provided to a single person (e.g., ‘‘bare-metal’’ servers)

(https://www.govinfo.gov/content/pkg/FR-2021-01-25/pdf/2021-0...)

Re: We have 4 days to contest KYC being required by internet services

#109

Post by EGreg »

lolinder wrote: post #56
chadsix wrote: post #46

Earlier quoted context omitted.

Legally speaking, internet service providers are infrastructure providers.

Do you have a basis for this claim or are you just throwing it out there to see if it catches on? The document linked refers to IaaS, which as an acronym definitely does not include ISPs.

In practice, as long as a definition can conceivably cover something, the DOJ or some agency will use it. Case in point from yesterday: money transmitter as applied to arresting the developers of a NON-CUSTODIAL wallet, as part of a wider war on crypto mixing:

https://www.coindesk.com/policy/2024/04/24/samourai-wallet-f...

This comes amid a war on end-to-end encryption, and so on. It's not like they are going to stop here.

Re: We have 4 days to contest KYC being required by internet services

#110

Post by zinekeller »

chadsix wrote: post #93
lolinder wrote: post #56

Earlier quoted context omitted.

Do you have a basis for this claim or are you just throwing it out there to see if it catches on? The document linked refers to IaaS, which as an acronym definitely does not include ISPs.

There are probably very few ISPs that can fall outside of this standard. For example if your provider provides e-mail, it's providing infrastructure. And yet, the slope can get much more slippery than this.

Please read EO 13894 before proceeding further. Is the user able to run custom software directly with a customary ISP (because that's in the definition)? I agree with EGreg that they can possibly twist this, but as written it's actually narrower than you think.
Post reply on HN