---
title: "Law, rule of law, necessity, and jurisdiction"
chapter: "01"
---

# Law, rule of law, necessity, and jurisdiction

Standards describe technical interfaces; they do not create legal power. The applicable legal framework defines who may issue an authorization, for which offences or purposes, with what necessity and proportionality tests, within which territory, and under which oversight, notification, retention, and remedy rules.

> **Safety boundary:** this chapter teaches lawful, governed system design from
> public standards. It does not provide operational targeting, activation,
> decryption, surveillance-evasion, or covert collection instructions.

## The mental model

| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| **Legal basis** | The statute, court order, or other lawful instrument permitting action | Record source, status, and jurisdiction; do not infer it |
| **Competent authority** | The body legally allowed to issue or validate the mandate | Verify authority independently from request content |
| **Necessity** | The action must address a legitimate need that less intrusive means cannot satisfy | Technical convenience is not necessity |
| **Proportionality** | Intrusion must be limited relative to purpose and harm | Scope growth needs renewed authority |
| **Jurisdiction** | Law and authority are territorially and organizationally bounded | Roaming, cloud regions, and cross-border delivery complicate it |
| **Oversight and remedy** | Independent review and challenge mechanisms constrain power | Audit must support meaningful review |

## Apply it as a controlled workflow

1. Maintain a jurisdiction register owned by legal and compliance specialists.
2. Validate issuing authority, dates, signatures, purpose, target scope, service, and territory.
3. Resolve conflicts of law before technical provisioning.
4. Encode only approved fields; preserve the original authoritative instrument separately.
5. Require renewed approval for amendments, extensions, or new identifiers.
6. Route legal uncertainty to a stop-and-escalate path.

## Evidence to demand

- Legal sign-off and validation timestamps are immutable and independently reviewable.
- No technical activation can exist without a live authorization reference.
- Cross-border paths have an explicit legal-assistance basis and approved receiving authority.
- Policy tests reject missing, future, expired, revoked, and overlapping-invalid mandates.

## Failure to reason about

A subscriber travels, the service is operated in one country, the cloud workload runs in another, and the requesting authority is in a fourth. A hostname or data-center location cannot decide jurisdiction. The organization needs a legal determination and an approved cross-border mechanism before delivery.

## Feynman check

Standards are the shape of the locked box. Law decides who may ask for the box, what may go inside, where it may travel, and when it must be destroyed.