International and Cross-Border Issues

Global incidents face additional complexity:

Data Localization Requirements:

Russia: Data must remain in-country
China: Critical data cannot leave
EU: Schrems II implications
India: Sensitive data restrictions

Mutual Legal Assistance Treaties (MLATs):

Formal process for evidence sharing
Can take months or years
Required for many jurisdictions
Alternative: letters rogatory

Practical Considerations:

def assess_cross_border_risks(incident_data):
    risks = []
    
    # Check data locations
    for location in incident_data['locations']:
        if location['country'] != incident_data['hq_country']:
            risks.append(f"Cross-border data in {location['country']}")
    
    # Check applicable laws
    for regulation in get_applicable_regulations(incident_data):
        if regulation.has_data_localization():
            risks.append(f"{regulation.name} restricts data movement")
    
    # Check sanctions
    if is_sanctioned_entity(incident_data['threat_actor']):
        risks.append("Sanctions may apply to threat intelligence sharing")
    
    return risks