Lawmakers Want to Ban VPNs–and They Have No Idea What They're Doing
techdirt.com99 points by speckx a day ago
99 points by speckx a day ago
Content of sites should be 1000% irrelevant wrt a state or municipality blocking it. It's like phone numbers- they don't get a say in what gets transmitted, period, full stop, and any access of the content requires a well worn and battle tested legal process. This sort of arbitrary, whiny, "we dont like it so we're going to pretend things like freedom of communication and association don't exist" and other perspectives don't survive the technical reality, let alone the principled legal framework.
It's 100% legal for me to read off the zeroes and ones of a file I own that exists on my computer over the phone talking to anyone I want. Even if it's horribly offensive. Even if it's hateful, or makes people feel bad. I can even mock the deceased mothers of congress people, and there's nothing they can (or should) do about it.
Internet regulation should begin and end there. If you're wiretapping, getting a warrant, etc, then there has to be justification and law in support of your actions, otherwise, the communication should not even exist as a concept in your mind, at the governmental level. They should consider any and all network traffic to be completely meaningless, illusory babble from which no conclusions can be drawn, absent underlying due process.
Somehow we've gotten to a state where it's now being debated as to not only who you are allowed to connect to, but under what conditions, and what may be communicated once the network is connected. That sort of default surveillance and censorship is 100% never used for the good of a society, historically 100% of the time used to the detriment of society, and it's only in those cases where substantial protections of due process exist and are robustly followed where any sort of surveillance and censorship actually does any good.
These actions are power grabs. Any attempts to extend and expand state surveillance and control over communications should be vehemently condemned, up to and including running the authors out of any community they're in if they don't drop it.
[flagged]
The act of communication isn't itself a crime. See: bitcoin blockchain. There are numerous reports on various data on the blockchain that are very illegal, but now cryptographically permanent, unless they fork it and eliminate the corruption. IIRC, the criminals who did that got caught. If it were known you were trafficking in that kind of stuff, then hell yes, get that due process in motion. It doesn't matter if they're babbling binary, sending pigeons, or using smoke signals at that point - the underlying crime is the CSAM possession, distribution, etc, and should be pursued relentlessly.
"Ahhh, but what if someone does a horrible thing involving crimes against children!" is not valid justification for throwing out civil liberties and basic right to privacy, freedom of communication, association, freedom of the press, and so forth. You don't need to discard the latter in service of prosecuting and preventing the former.
With regards to the terrorist attack plans, is it satire? Is it research for a Seal Team 6 show or book? Are you deeply considering how to beef up your own security, or maybe thinking about what you think of national security policies? Maybe you're planning an epic podcast series that explores historic attacks, and the tactics and strategies used in execution and prevention of attacks. Is it just vengeful fantasizing?
Again, if there's cause, we have due process for that. You don't throw out basic fundamental civil liberties because scary words.
And don't even get me started on copyright. That system needs to be nuked from orbit. Razed, burned to the bedrock, salted over, and completely rebuilt from scratch, with no grandfathering, exceptions, or acknowledgement of previous rights, with absolutely no consideration given to third party rights transfers, extending rights periods, or any of the godawful stupid games lawyers play these days to screw everyone out of their money without providing any concurrent value to the system whatsoever.
Freedom is terrifying. Get used to it, then build policy. Maximize the agency and liberty of good faith individuals, and incentivize people to be the best they can be. Ruthlessly protect liberty and principles of freedom against any and all threats, regardless of how politically convenient violations and suppression of rights might be in the moment. If you treat every individual in a society like an incompetent moron without the capacity to decide how they should live, then you incentivize sociopaths and bad faith actors and morons to positions of power where they will rapidly spin the society out into destructive cycles.
Bad people exist. Most people aren't bad. Build a world where it's more beneficial for everyone to act good, where you protect the rights of every individual from abuse and exploitation, and put the responsibility for their lives onto the individuals living it. Make extreme invasion of privacy an exceptional, unusual thing that requires extreme justification. Where we are at now is abominable.
I love how government's gut reaction to literally anything they don't like is to "ban" it without having the slightest understanding what that means or involves.
That's right guys, ban hunger and poverty next.
The US government, rather than ban these things, declares they either dont exist, are criminal activities, or are mental illness problems.
There's far more than "banning" that happens when a government gets eaten by libertarian and religious fascists.
While the propaganda around the european laws are certainly against the free expression of information, you certainly shouldn't ignore how a lot of technology is being use to turn the rest of the world of democracy into a pre-Trump era country.
If you think America is a blueprint for Europe, then keep whole-hog buying the "free" expression argument that lets the far right nazis flourish.
Ironically, I can't access the cited bills, possibly because I', not within the States: https://docs.legis.wisconsin.gov/2025/proposals/reg/asm/bill...
I wanted to double check that the bill "demands that websites block VPN users from Wisconsin", as opposed to "demand that adult sites hosted in Wisconsin block VPN users in general" or "demand that Wisconsin VPN providers or Wisconsin/US compliant providers block websites according to the registered user's location rather than their proxy location".
The details are important, and I don't trust that either "the lawmakers are idiots", or that treating the opposition as idiots is productive in general. Laymen, and legally trained laymen have just as much say in technical matters as technical folk. Lest we setup the feared technocracy...
The wording of the bill is as follows:
(c) A business entity that knowingly and intentionally publishes or
distributes material harmful to minors on the Internet from a website that contains
a substantial portion of such material shall prevent persons from accessing the
website from an internet protocol address or internet protocol address range that is
linked to or known to be a virtual private network system or virtual private network
provider.
Where the bill gets its teeth on the VPN side of things is in section (4) of the assembly bill, which is probably intended for parents of children to sue publishers:
(4) Civil liability. (a) A person alleging a violation of sub. (2) or (3) may
bring an action seeking actual and punitive damages, court costs, and reasonable
attorney fees notwithstanding s. 814.04 (1). A person bringing an action under this
paragraph is not required to first exhaust any relevant administrative remedies.
What does it mean for an IP range to be "known" to be a VPN? Where are web site owners supposed to get this data?
(also it only affects web sites, so gopher is still good my friends)
I am throwing out a wild guess here, but some services already block ranges of IP addresses on the basis that they have VPN servers running.
Netflix, Hulu and Amazon Prime Video all do something along these lines to protect geographically restricted licenses.
Presumably, the authors of the bills were aware that these services were already doing it and want that same behavior to be legally required for obscene material.
It's not the first time that word appears on the bill, itspecifies that the publisher needs to "knowingly and intentionally..." do the deed.
So there is no responsibility created to actively discern (IANAL) traffic, but if you already have that info, you would be compelled to act upon it.
Again IANAL, but this could create responsibilities to avoid estoppel, for example if you filter users from VPNs for purposes like reducing spam, then you receive the benefit of identifying VPNs, and you might be compelled to bear the responsibility of it.
Another nuance is that the vpn identification might be provided by a 3rd party (see cloudflare) in which case the provider would not KNOW, but then again CF might bear the responsibility considering that they would be the distributors with knowledge of the VPN lists.
I think the law plays out very sensibly.
I don't get it - doesn't this only apply to content hosted in Wisconsin? I doubt they have any jurisdiction outside, especially outside the US
It'll apply to any business that does business in Wisconsin. For example: collecting sales tax on membership subscriptions, or hires remote workers who reside in WI.
So it seems that the article is factually incorrect and is quite obtuse in interpreting that the lawmakers are idiots.
The bill demands that porn distributors OR VPN providers that deliver content to Wisconsin residents, must block traffic from virtual private networks.
"In short, if my child uses a VPN to circumvent the age verification rules or some other safeguard to access the obscene materials, I can sue any site that operates in or employs people in Wisconsin for damages in a civil lawsuit for punitive damages."
I am not a lawyer and this is not legal advice, but I believe that any company that operates outside of the State but serves residents of the Wisconsin state would still be in violation and the State of Wisconsin and its laws would still have jurisdiction. If your website serves users from Wisconsin, it must abide by Wisconsin laws and both Wisconsin jurisdiction and venue is proper, absent any other agreement (which would be null anyways if the Wisconsin resident is a minor).
I think it's more that the author of this article is being obtuse AND "has no idea" about law.
Btw the wording says publishers or distributors, so it applies to both porn websites, vpn operators and ISPs, which could technically block vpn ips from connecting to porn ips. I'm not sure of the implications of "knowingly or intentionally though", I'm just saying they could do that.
The nuances and legal theory are a very deep discussion that the original article ignores completely by focusing on a political agenda.
ISPs and search sites are specifically exempted at the end of the assembly version of the bill. I haven't looked at the Senate version but I imagine it's in there too.
Oh cool. Shame that I can't access the bill, but that's for the better, it's after all a domestic issue that you guys want to keep domestic.
The US network policies were so open that it sometimes felt voyeuristic, in my country we are also implementing national firewalls organically due to malicious traffic, so it seems the world is converging on closing the networks a bit, thanks Russia and China.
best of lucks!
From the bill summary:
> The bill also requires a business entity that knowingly and intentionally publishes or distributes material harmful to minors on the Internet from a website that contains a substantial portion of such material to prevent persons from accessing the website from an internet protocol address or internet protocol address range that is linked to or known to be a virtual private network system or provider.
Later:
> A business entity that knowingly and intentionally publishes or distributes material harmful to minors on the Internet from a website that contains a substantial portion of such material shall prevent persons from accessing the website from an internet protocol address or internet protocol address range that is linked to or known to be a virtual private network system or virtual private network provider.
No mention is given to where the business is located.
Thank you!
It looks like the interpretation of the article is quite incorrect, there is no part of the law that demands that porn websites "block VPN users from wisconsin".
Rather that:
1- Porn websites must block underage users from wisconsin. 2- VPN websites must block underage users from wisconsin from accessing . 3- Porn websites must block vpn users in general.
And this is not strictly laid out in the law, the law specifies the functional requirements, and we are estimating how the technical implementation will play out, the author strawmanned a stupid hypothetical technical implementation to paint lawmakers as technical troglodytes.
[dupe] This is a syndication of original EFF article with lots of discussion: https://news.ycombinator.com/item?id=45924483
imagine Cloudflare saying, okie dokie then, guess we don't serve Wisconsin anymore