Court agrees with EFF: Utah's VPN law demands a technical impossibility
eff.org
eff.org
If you think they will stop at a mere "technical impossibility" I have bad news for you folks, they will just ban all the traffic they can't track, in Utah, UK, anywhere;)
Is it even possible to reliably know that a connection is from a VPN? Anyone can proxy through a random hosting provider.
Folks would just host their own vpns various places and this would be pointless ….
/Same as it ever was
There is absolutely a class of Utah politicians that has little sincere personal investment in purity culture and associated culture war issues, but knows that they can be used for ingroup/virtue signaling. They also know that the dominant religious culture in Utah prepares the most significant statewide voting block to respond to such culture issues far more powerfully than any kind of attempt to engage on policy or detailed dialogue. This isn't that different from a common general strategy of running on symbolic issues and then devoting your time in office to favor trading/personal gain plus occasional personal pet policy issues, but the particular flavor is regional with a strong religious emphasis.
But there's also significant portion of regional religious leadership and membership with sincerely held purity culture beliefs. Some of this is rooted in psychological traits amplified via theology where adherents achieve a perceived state of purity/redemption by cleansing rituals and avoiding contaminants. Some of this is rooted in credences: the tradition makes moral claims about sexual contaminants and you have to sign on to be part of the ingroup (and also the tradition's leaders speak for God and are therefore wrong and if you challenge them you're not just outgroup, you're actually challenging the authority of the tradition which makes you opposed to God himself, so from this perspective there's little legitimate discourse about sexuality topics leaders have spoken about, there's mostly authority of religious leaders and individuals declaring of which side of the spiritual war they're on).
So, some people shaped under this culture over time do believe they are fighting crucial battles for the children, to the point where they have no problem with the erosion or even destruction of any secular treaties like those the 1st amendment supports (the fact that Latter-day Saints are quite vulnerable should secular treaties fall in a nation of much larger religious organizations that see LDS as blasphemous heretics is largely lost on most of the porn crusaders, there are some peculiar delusions that come with being a local majority with some national clout yet a national minority nonetheless).
And others know this sincere belief is a convenient lever for other power plays, and all you have to do is flatter the prejudices and signals of the ingroup in order to get broad permission for corruption and other antisocial advances.
Kids are the misdirection
Obscenity is not protected as Free Speech.
Sure, hungry working girl needs your $5 tip. Now she can have a Famous Star with fries. Story over. No, wait.
Porn money rapidly becomes dark money. Who takes cuts? It goes offshore. It goes to pimps, gangsters, gun runners? Who knows? You don’t care!
Are you opposed to human trafficking and slavery? No you’re not! That spicy OF that you like is part of your problem!
Perhaps Utah and other people with morals are worried about the compromise of their men and the patrons of porn. You can drain a lot of information, and money, and desperate action, from porn addicts. So if there is a statewide financial drain, a trade deficit, if you will, perhaps it is in Utah’s best interest to keep dirty money where they can see it, and prevent their men from falling victim to the whore who sits upon many waters.
- religious/cultural. My beliefs forbid this, it makes people bad/worse in some hard-to-define way, so no one should be allowed to do it. Sometimes with an emphasis that the sellers are luring good people into sin/ruin.
- it harms women. Many of the participants are trafficked or coerced in some way (and further abused). The profits from the industry encourage more of this. It “warps” the mind of men who use it, leading them to mistreat and abuse women.
I see elements of truth in all these, but IMO they are ultimately not compelling, prohibition is unworkable and unduly infringes on willing participants and consumers.
That's one reason why traditionists in power usually crack down on any sort of pornography or alternate sexuality. Sex is a huge driver for human behavior. And established power structures would prefer that the only way for anyone to get sex is via compliance with the existing power structures. It's not something where the establishment is ever going to be able to perfectly control things, but if they can make it more difficult to get any sort of sexual gratification that doesn't align with their preferred social structure that gives the establishment an advantage in holding on to power.
Now that I have eaten of it as well, I want to testify to the good that it did in me. My "love life" was full of failures, and terrible relations with my female peers. I realized eventually that I didn't honestly know what love was, or how to be a husband, much less a father.
It was a few years ago when I came across a handful of pornographic scenes that opened my eyes to what people mean by "consent" and what a really loving relationship could look like, as a "fly on the wall". Because it had never played out in front of me until then, I didn't know what it looked like, or sounded like or felt like when people were consenting to intimacy, enjoying that intimacy, accepting their partner, and encouraging them for more. It was literally just beyond my experience, and when I saw it, I was so ashamed of myself.
I was ashamed of how I'd treated women and I was sad because they had treated me so badly, and I hadn't even the guts to say "no". I try not to "belong" to an incel community or foster bitterness to women for how I am, but my gender ID and my sexuality have been thoroughly ruined, even without so much porn. Just from imbibing pop culture depictions, and all the singers, and MTV, and actresses, and fake sitcoms and films that warped my self-image along with warping my reality into fantasy.
Porn addiction isn't moral, and there are many, many ways for a man to be trapped by porn into worse and worse mental health, ruining his RL relationships as well. But it seems that women are empowered to use all their qualifications and gifts to earn a living and provide for themselves and families, and even sincerely follow their faith and conscience to worship the demons that fuel porn. So who am I to judge that they do the needful, because we capitalists live by PT Barnum's maxim, "There's a Sucker Born Every Minute".
What about pornography…the concentrated, focused depiction of sex acts…makes it human nature to you?
Ofcom is investigating PornHub even after PornHub installed age checks as Ofcom claims age checks not “robust” (read: VPN ban). So hand over your id to see porn.
The rest of the world would be better off to just block the UK from online platforms rather than risky complying with their increasingly insane demands.
The government demonstrably has the ability to break into your comms and data without going through any of this. Instead of a libertarian conspiracy theory have you considered that politicians chase power and re-election?
Taking a stand and making major changes is hard to pull off, costs a lot of political resources, and can backfire horribly. Doing symbolic, popular crap that’s popular with the (admittedly thick and ignorant) majority is an easy win. Moral outrage is an easy win. “Think of the children” is an easy win.
Ed: Corrected “comma” to “comms”
In the real world, very few people have that capability.
Less savvy individuals/business would also have no reason to obey these laws.
The limitation is technical skill, even having enough skill to know that this is a solution.
Yes, lots of things will at any point be beyond the technical ability of most people as long as they remain niche. But as soon as a sizable market exists(e.g one created by a law, like in this case), products and services that close that gap will appear.
Hell, there's even stuff for doing this already, which is not that hard for non-technical people to set up, like Tailscale. I can easily imagine a Tailscale-like product that easily allows friends to use eachothers networks as a VPN with zero configuration or Wireguard knowledge required. I mean, when you think about it it's just Tailscale but more streamlined for that particular purpose.
I think that’s the GPs point.
Though some services do already block traffic originating from popular hosting providers like AWS out of fears of bots.
They’re not mutually exclusive statements ;)
Now of course, if your VPN is a home-lab style VPN where you are connecting to a little wireguard box sitting in your own home, that is a totally different story.
Who is going to check anyway? You need significant technical leverage AND law leverage for the people doing that.
> Is it even possible to reliably know that a connection is from a VPN?
I use VPN most of the time. My work requires it, and I like Mozilla VPN for personal privacy. (Note: it has ad blocking DNS built in which is nice!)
I occasionally get blocked by websites or services, especially streaming apps, if I'm on VPN. I suspect they're just looking out for Amazon/Microsoft/etc IP address blocks. It's very annoying
The simplest methods block known datacenter IP ranges like you thought. More will score it based on several heuristics and a reputation over time. If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.
Or, their so-called "smart" TV is acting as a proxy without their informed consent.
In some parts of the world hiding (NAT) entire neighborhoods behind one public IP is normal practice.
There are also third party providers of IP annotations to classify known VPN address ranges that content providers typically subscribe to blanket block providers.
The reason for this aggressive approach is streaming apps all need your IP as core signal for tagging your region and all content licensing is region locked (even on YT).
Netflix are/were the most relaxed about it , and for long time would only buy content if they got global distribution rights, but not anymore. Many VPN ads specifically used to market that you can watch Netflix geolocked content.
[1] IME they block DC IPs too although not needed for blocking professional VPN, even self hosted OpenVPN on cloud box usually gets flagged.
No, it's not possible. You can only try to identify known protocols or suspicious patterns of data, timing or entropy. Theoretically, with a big enough collaboration, you could hide a VPN behind shaping traffic patterns and request order towards hundreds of different servers, and there's just no method of traffic analysis that can possibly identify that without prior knowledge.
Like, some firewalls try to identify an absence of connections outside the VPN, or an abnormal volume of data over a sustained period of time. But all that goes out the window when, say, you are connecting to hundreds of real servers at all times and only exchanging, say, basic HTTP requests with each one. For all they know you just have a million browser toolbars installed. They wouldn't know if the choice of request, order and timing encodes information because they wouldn't be able to prove what the client's intentions are in sending it or what the servers do with it.
If you tried to identify it, you would block every real connection.
I believe some VPN providers are beginning to play with things like this, but the problem is really that it's impossible to provide this. It only really works when you run it yourself, because that's the only way others don't know. So they're having to settle for compromises, like Mullvad's DAITA, which still uses a single server but tries to avoid showing tells of a VPN connection as opposed to something else like streaming.
It took quite a bit of finagling to bypass the GFW on my own and in some regions (Beijing) I was still randomly detected and throttled, it seemed.
>SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user’s physical location, and then block those in Utah, or to verify every visitor’s age just in case they might be in Utah. The law’s “actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating,” the court wrote.
In order to withdraw from Utah, they would be forced to block traffic from everywhere since it's possible that some kid in Utah used a VPN to make it look like they lived in Singapore.
There is a very vocal anti-porn group in Utah. They do things like put up massive billboards that say "[Store name] sells porn." (Which is basically free advertising instead of shaming.)
It's a fun place to visit!
There are more recent studies that rank Utah in the bottom 10. [5]
[1] Edelman, Benjamin. "Red Light States: Who Buys Online Adult Entertainment?" Journal of Economic Perspectives 23, no. 1 (Winter 2009): 209–220.
[2] http://www.benedelman.org/publications/redlightstates.pdf
[3] https://www.cnbc.com/2009/07/14/Top-US-States-For-Online-Por...
[4] https://www.ksl.com/article/news/utah/utah-not-necessarily-n...
[5] https://www.yahoo.com/news/narrative-utah-leads-nation-porno...
Most ISPs are already VPNs. Your connection is tunneled from your router at home, through some expansive DSL/ATM or GPON/PPPoE network, to a box at a data center that serves five neighborhoods with a single link by establishing a tunnel to each individual consumer router.
But the ISP has to make sure the geolocation databases have accurate information about it, and it has to retain logs of which user used which IP address at which time because the law says so. That's why it's not a "VPN".
Tons of false positives, but they are non-domestic IPs so who (dares to) cares.
To handle the matter technically Utah would need a "great firewall of Utah" and a legislative mandate that all ISPs route thru it. Somehow they'd have to factor-in signals from cellular sites neighboring states and satellites.
The inability to immediately and perfectly eliminate a behavior is not a good enough reason to be against any attempt to eliminate that behavior.
So if you are legally required to block all VPN users and then fail to actually block all VPN users what is stopping you from being punished for not complying with the law?
Since when do you have to pull permits to put a server on the web?
Under Utah's law as written, a private business has to assume any single IP address could be operating a VPN/proxy.
With cross tunneling all your normal traffic would go through your ISP usually and just your porn traffic goes through the VPN. Unless it's a major provider, as far as your ISP is concerned you're just connecting to someone's private server occasionally
It’s starting to get annoying that things aren’t working. They’re shooting themselves in the foot though.
If they didn’t block VPNs, they would at least know what category to group them in.
On the other hand, using Masque for TCP transfers will probably fool a server to believe the MSS is 1500.
Let’s block traffic on the internet blindly just in case someone is looking at an adult website.
It won't route around self-censorship that arises out of surveillance
Nor will it take a stand against SNI which is a dead simple means of implementing censorship that's in widespread use every day for years
Could you elaborate? What's "SNI", and how does it relate to censorship?
I assume it's Server Name Indication, which sends hostnames in plain text. A better approach is Encrypted Client Hello, or ESNI (I'm not sure how they differ, probably like Betamax and VHS, one allows porn).
It is possible
Consider all the sites hosted at 199.36.58.100 for example. Over 1,620 such sites have been submitted to HN in the past few years
ESNI is "Encrypted SNI", ECH is "Encrypted Client Hello". The Client Hello packet contains the SNI. For a time ESNI was available on all Cloudflare sites. Not anymore. ESNI, whatever its flaws, worked well enough that some censorship regimes blocked connections that used it. IMHO, ESNI and ECH are overcomplicated proposed solutions to a relatively simple problem: gratuitous use of SNI. For example, so-called "modern" browsers will send SNI to those 1,620+ sites even though it's not required
Alas, the people developing ESNI and ECH are not publishers or readers, the targets of censorship. They are "CDNs", hosting companies, intermediaries in the business of serving multiple HTTPS sites on single IP addresses. SNI has benefits for CDNs and costs for others
For example, one cannot use ECH when connecting to www.cloudflare.com
https://www.rfc-editor.org/rfc/rfc9848.txt
dohclient -s 1.1.1.1 www.cloudflare.com https in
dohclient -s 1.1.1.1 defo.ie https inIs this still true, or has it become a truism? It seems nations like Iran and China (and events like Kashmir come to mind) have progressed the state-of-the-art and playbook to where we can't actually say it definitively will route around it.
Now seeing that the US and EU are flirting with these similar restrictions it's making me wonder how we'll be able to keep hold of these principles.
Maybe my concern with that adage is ultimately its passive voice, since it takes 'active' action by people to give us those options, and will probably take more actions by more people to keep it alive now.
Things China can't do: Magically "downgrade", "decrypt" or "intercept" the secure protocols we use every day like HTTPS. Facts won't budge, the technology we are using does what it says on the tin.
The Internet can't route around you being thrown off a tall building by men with guns, but the IETF has for some years considered it to be extremely important to design the network protocols to prevent these shenanigans. BCP # 188 "Pervasive Monitoring is An Attack"
Normal people don’t care about “downgrade” or “decrypt” or “intercept” they care about availability.
They aren't stupid, they're not going to insta-block everything they can detect, giving away clues to people trying to evade it.
If there's civil unrest, they can of course essentially turn off the internet, but there's a distinction between "the internet can route around censorship" and "the internet can be blocked in its entirety (or near entirety)"
But of course the easiest approved “VPN” is just data roaming.
1. Make it illegal to distribute a browser that distrusts their CA
2. Make it illegal to run a browser that distrusts their CA
3. Block all encrypted traffic that they can't MITM and notify police that you are running illegal softwareDoesn’t require cracking crypto or any funny business around forcing people to install stuff.
Furthermore, doing any of the things you listed would isolate all legitimate network traffic as well as any undesirable traffic, fully shuttering all Chinese manufacturing businesses from global requests via the web. This hat would happen then? Phone calls, emails, and even physical mail would become the new norm and most of the Chinese economy would collapse under the weight of not being able to hop on a Zoom with a client that wants tooling made for its aluminum manufacturing molds.
So besides my point of the black market your hypothesis of total control misses all the other pressures that exist that make what you’re proposing infeasible on its face. Only a place like North Korea that is willing to be a pariah state is old be willing to take the economic and social costs associated with your proposal, and they’ve only been able to do that because their abominable regime was in place before the internet existed and they pre-built controls very late in the game.
Tl;dr simply because a country _could_ do something doesn’t mean it’s realistic for reasons outside of basic networking concepts.
I mean... They could, though, no? If they control the gateways they could drop any traffic that isn't encrypted with some root cert that allows them to decrypt in transit packets.
I'm sure that works in a Hollywood movie, in the same way you could reverse the polarity of the lasers to enable you to travel inside the computer from a household video projector, or decrypt all the world's telephone calls using a device built into your batmobile - but this isn't a Hollywood movie and so traffic isn't in fact "encrypted with a root cert".
If for any of a variety of reasons the Chinese authorities don't want your connection to exist they'll terminate the connection, exactly as I described in my earlier comment.
That said, your point that they're probably more interested in information control than spying on everyone's traffic is a good call out, and would change their methodology. My issue was more with your statement that they can't magically downgrade modern encryption; MITM via OS cert store 'compromise' isn't magic, but I think it's certainly possible in a threat model where your adversary is a nation-state.
So there is a route around censorship, but maybe the public doesn't really care about it.
People with more first hand experience can probably explain it better but it doesn’t seem that strict. China is not North Korea, their aims seem less about preventing people from learning about the world and more preventing non compliant foreign tech companies having Chinese users.
During the World Cup (2022, still zero covid in China), they started blurring out the crowd because people were noticing that nobody in the stands was wearing masks. They’d been told that the zero covid policy and draconian lockdowns were keeping them safe, and outside China was a Covid hell-hole. Protests followed four months later.
Nobody in China was told about western covid vaccines, much less allowed to get them.
VPNs aren’t widely used — there was a study posted here some months ago that estimated VPN use at around 1% of the population, too little to matter.
That’s why they’re a bit lax. They can afford to let some through to grease the wheels of commerce. You do have to be seriously unlucky to get into trouble.
(I was there during Covid, and some years before and after)
That's some interesting info anyways if not. It's funny that the absolute number of VPN users is large but negligible compared to the overall population.
I suppose Utah could impose some sort of strategy here, but would be so burdensome and anti-American I’m not sure they could pull it off. Instead of a blacklist of sites dictated by the site provider, you go the other way where all Utah ISPs maintain a whitelist of IPs permitted to Utah citizens. Any traffic attempting to reach a non-white listed IP, would be rejected.
The layer 2 and 3 of ISO/OSI stack does indeed "route around censorship". But the Internet as we know it is all Layer 7, and it's as centralized as it gets.
That's why regulators often aim straight at Layer 7 entities - companies providing consumer services over the web. Because no matter how unblockable the route between you and some server is, it doesn't mean anything when the server itself is refusing to talk to you.
It's a politico-technological arms race. They make their laws. We make technology that completely nullifies their laws. They need to increase their tyranny in order to enjoy the same level of control they had before. The end state is either a totalitarian government or an uncontrollable population.
I used to think that we'd find some kind of equilibrium along the way, that we'd eventually discover the government's limits: some principle they refuse to break, some line they refuse to cross...
But the truth is these tyrants have no limits whatsoever. They'll stop at nothing in their quest to control the flow of information.
A VPN/proxy could exist at almost any single address at any given time.
> “I sometimes joke that we might as well turn the Ministry of Communications and the Supreme Council of Cyberspace into amusement parks, because they will no longer serve any purpose,” Hakami said.
https://gulfnews.com/world/mena/iran-official-says-starlink-...
That’s a rather shallow and naive perspective. I’ll try to keep this short, but the overt blocking oriented “censorship” ascribed to China, Iran, or Israel is actually not at all “state-of-the-art”, it’s an inherent rather coarse approach to censorship.
If you want the true “state-of-the-art“ you can look no farther than the USA, where the “state-of-the-art” is such that people don’t even realize it’s censorship, let alone that anything is happening at all.
China, Iran, or Israel may or may not engage in censorship at a kind of high level that is apparent and observable; however the censorship in the USA and by extension in its various vassals of its empire, is far more sophisticated and base level to such a degree that the system, the whole society is the censorship mechanism, censorship is not something done to the system, the system is the censorship. That is “state-of-the-art”!
To a large degree, most of the internet today is ultimately controlled by a few people. If what you have to say pisses off these people, and someone is determined to keep you off the internet, you have a problem. Kiwi Farms is a well known example, and continues to suffer under regular DDOS attacks. Regardless of how you feel about KF, it's undeniable that a) this nonsense has streissanded the site enormously and b) it's speech you don't like that needs protection.
Also there was the whole covid "misinformation" garbage fire... I certainly do not want my government or some megacorp to decide what can and can't say or read.
And going beyond the internet, I just want to remind you Americans, that your 1st amendment is almost unique (to my knowledge). Enjoy and protect your offensive, hateful, blasphemous, extremist, and deeply unpopular speech.
How is that not a blatant first amendment violation?
Under state and common law at the time many kinds of speech were routinely regulated or even criminalized, such as defamation and blasphemy.
Or at least it shouldn't.
It wasn't until the 14th amendment that the constitution started overriding state constitutions/laws.
Idaho did in fact add additional ink to the freedom of speech [1]. In fact this is why so many states have a bill of rights similar to the federal constitution in their own constitutions.
[1] https://legislature.idaho.gov/statutesrules/idconst/ArtI/Sec...
> Congress shall make no law ... abridging the freedom of speech
Note that it does not define what that means. At the same time, it is well established that some forms of speech do come with consequences. I'm sure you can think of commonly accepted examples.
Laws do not exist outside of courts who interpret them. They made an extra court to do that for the constitution. That's a feature!
Reality is fuzzy. The problem with insisting on "verbatim" readings of texts is that there is always wiggle room and edge cases, and nobody can agree on what that one, true reading is.
So, yeah, the first amendment might not say what you think it says, because it only says what it says, and not what it does, because it can only say, and it takes people to do.
Trying to define something simple and universally applicable is a fool's errand, because people will disagree, and even if it's just you, reality will hit you with exceptions and curveballs if you look hard or wait long enough.
The point of the constitution is not to satisfy a need for simple, unchangeable rules that need no interpretation whatsoever.
If you look for the point of the constitution, here's one explanation from the horse's mouth:
> We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America.
It's ground rules. They will necessarily require interpretation, as all rules do. What that interpretation should be and how far it should go is part of that, and has been ongoing ever since, as would be expected.
https://www.pastpaperhero.com/resources/state-v-gibson-36-in...
This law did not "almost pass" but actually passed and remained in force till 1967.
You think they wouldn't try to fuck with pi?
First, the confounding quote from the Torah/Bible: "He made the Sea of cast metal, circular in shape, measuring ten cubits from rim to rim and five cubits high. It took a line of thirty cubits to measure around it." (1 Kings 7:23)
From this, some people (stupidly) claim that God's divine and infallible word says that a circle has a circumference 30/10 the length of its diameter; i.e. pi = 3.
First, a rabbi answered this question with a great dodge: he asserted that the diameter was measured between the outer rims of the pool, while the circumference was measured inside the perimeter wall. From this, he calculated the pool's wall thickness to be 0.33 cubits (about 6 inches/15 cm). Hella conspicuous consumption of bronze, but math is not falsified.
The second is the phrase "circular in shape", which is also translated as "round". The early Latin phrase was "ad labium rotundum", which often means circular, but may mean merely rounded. IOW, the cast bronze pool walls may not have been perfectly circular, and the dimension given may be the major axis/greatest diameter. But that's really a silly argument; why would they make an elliptical pool?
Of course, if you derive your morality from a niche detail about a long-destroyed handwashing basin, you lack practical morals.
* Face showing - banned in middle Eastern Muslim countries * Bellies showing - banned in south east Asian Muslim countries * Ankle showing - banned in India * Shoulders showing - banned in catholic countries * ... * Nipples showing - banned in US * Genitals showing - banned in Japan * Personal name mentioned without a personal data release form - banned in Germany * (End of list)
If necessary can be supplemented by a range of the commonly accepted levels of male nudity * Any skin showing - banned in Vatican * Penis showing - banned in US * (End of list)
So we have a binary numerical code, or a ternary if you add also practices (ranging probably from female eye contact with the camera and male-female touching over male-male intimacy up to bestiality).
(Hope clear that this is sarcasm.. do not build the torment nexus!)
The obvious enhancement is for the metadata to be a little more specific about the content, making it easier for them to just provide facts without making a judgment about whether the content is "appropriate" in any given jurisdiction/household/etc. Most obviously, we might want to treat medical images and historic art separately.
And because this mechanism would enable guardians to set up reasonably-effective automated censorship for the vulnerable humans in their care without requiring that they provide any information about those humans to any third parties, neither big "social media" companies nor the politicians into whose ears they whisper want anything to do with it.
https://www.everycrsreport.com/files/20080714_RL33224_1e6b93...
This Utah law requires perfection.
underlying reason is hatred for free internet
So in theory sites could block all VPN users (if you can somehow "perfectly (1) detect VPN/proxy users"), but if the law necessitates that nationally/globally then it's unconstitutional anyway. It's the age assuring of VPN-users specifically from Utah part that Utah are relying on being possible for the law the be constitutional.
A VPN/proxy could exist on any given IP address at any time, which the California law recognizes but the Utah law does not.
Heck, Lowes and BestBuy are pretty unusable in general via VPN already.. (or maybe due to ublock, or privacy badger or eff, etc.. :-)
Unfortunately know this because a gambler friend showed me.
Seems like we need a fundamental challenge to the concept that you have any jurisdiction whatsoever.
Would you let someone hand out pornagraphic images in a middle school? Obviously not, so why let it happen online.
A porn site does not.
Idk why people think it’s a good idea to force everyone to provide their id to jerk off.
How does legislation work in the US? How can an impossible law pass? Is it just some boomer stomping his feet like a toddler "I know what I want, and I want it now" without consulting any technical experts, and then private organizations like the EFF and courts have to clean up the mess?
And that often comes down to people realising that they need to engage those experts. Instead many just assume "it makes sense to me, with the thinking I've done about it" means that it definitely actualy makes sense.
Also sometimes the very cynical view is true: people know technical experts will pick holes in something, so they find a way to rush it through quickly to not allow the chance for that. Sometimes they are quite honest about this with arguments based in "not letting perfect be the enemy of good". Once a rule is in place it then becomes someone else's problem to undo it, or at least fix the technical problems in-place. Meanwhile those that got it through get credit from those who agree with the emotive argument, and also don't care about the technical details & accidental implications, credit that they can try use to further the cause or their career.
Utah is one of a few states that bans gambling. It is logically consistent for them to want to prevent people from using VPNs while in Utah to get around that to do things like access gambling websites, sports books, or prediction markets.
That said, it is fairly difficult (and almost impossible for self-made VPNs/tunnels...). The court was right, but it kind of sucks for Utah in this case. They should have the right in some way to uphold their gambling laws.
Sorry, but if you haven't seen how bad some people and places can be when it comes to that stuff, you probably won't get why.
EDIT: HN is ratelimiting my ability to reply to replies again, for some reason, so my response follows:
Yes, but they have the uncomfortable reality of having to police (I mean in the classical, community way, not an Orwellian way) the results of it -- with resources that are scarecely available, or unavailable. Crime goes up, domestic violence increases, rowdiness and noise complaints go up, fights increase, addiction increases, money problems and lenders get involved....
I never liked social issues being called "public health" issues but in some cases, where things are literally outlawed and more than a certain amount of people with certain predilections take advantage of opportunities to skirt the law more than a few times, it sort of becomes so...
Which usually means less other kinds of freedoms for the rest of the people in that location. Some places I have lived with large online gambling populations have been frankly disturbing.
They still have the right to legislate, just not the technical capability to enforce.
I'm not against adding some friction to certain behavior deemed undesirable by society, but at the end of the day people are going to do what they will. Vice predates the Internet by thousands of years and will not and can not be "solved" by technical means.
The law likely violates the U.S. Constitution’s prohibition on passing laws that significantly burden businesses and people outside Utah’s borders.
SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user’s physical location, and then block those in Utah, or to verify every visitor’s age just in case they might be in Utah.
I still suspect there's some kind of solution. Like Utah could tell VPN providers that if they service a customer in Utah then the VPN provider can't route traffic to adult sites. Or put the burden on the VPN provider to do age verification if porn is gonna be available through the VPN.
Come to think of it, I'm still a bit confused as to why VPNs are even relevant because it would seem to me that age verification would be done through some kind of having-credit-card type scheme which VPNs are entirely irrelevant to. I even read the article and I'm still confused. Oh well.
| An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state.
But how can any site check if a client is a) a VPN client (typically this can be known because VPN exit node IPs can be learned), __and__ b) in Utah?
The impossibility lies in (b). Effectively this forces any affected companies having a nexus to the state of Utah to forbid VPN clients. I think that's a bit too far-reaching. It would be much more practicable instead to ask VPNs to disallow Utah client exits to affected sites w/o age checks -- VPN services aren't free, so VPNs basically can do age checks.
Given that this could have been written to be feasibly implemented, either this text was written to cause a controversy, or this text was written by people who don't know how things work. Either way, this text cannot be enforceable as written. The Utah legislature can easily modify this to be enforceable (see above), so it's not like a court striking this down might be playing partisan games just by striking it down.
It's impossible to have perfect knowledge of the entire set of VPN exit node addresses.
It also seems to me like Utah could just demand that adult sites only accept traffic from residential ips.
Utah can't tell businesses that service the country (or the world) how to do anything in this regard. You can't demand a list of the VPN exit nodes, because no VPN would ever give you that, and if they're outside of your jurisdiction, how could you possibly enforce it (assuming you got the Feds to agree with your law regulating interstate/international commerce now). You can't tell websites to only accept residential traffic, for the same reasons.
The internet sorta fucks states rights (in a good way).
Besides, there's no such thing as "residential" IPs. If I set a VPN gate at my mum's house, how would the porn company know?
The "impossibility" is in them saying "we cannot guarantee with 100% certainty that the user isn't using a VPN" and that's correct, they can't - but the law has no provision for that, they are risking fines over something they cannot control.