{"id":38047,"date":"2025-06-13T15:54:12","date_gmt":"2025-06-13T15:54:12","guid":{"rendered":"https:\/\/publicknowledge.org\/?p=38047"},"modified":"2025-11-22T20:48:01","modified_gmt":"2025-11-22T20:48:01","slug":"oh-look-a-new-censorship-tool","status":"publish","type":"post","link":"https:\/\/publicknowledge.org\/oh-look-a-new-censorship-tool\/","title":{"rendered":"Oh Look, a New Censorship Tool"},"content":{"rendered":"\n

For the past few decades, the entertainment industry has been pushing for the ability to control what websites Americans can access online. Those of you who were around in 2012 may remember SOPA\/PIPA \u2013 a disastrous attempt to enlist the entire online ecosystem, from payment processors to ISPs, to choke off pirate websites \u2013 that failed only after massive grassroots pushback. But the same players are back, hot off a wave of <\/span>site-blocking<\/span><\/a> <\/span>experiments<\/span><\/a> in <\/span>Europe<\/span><\/a>, and ready to try again.\u00a0<\/span><\/p><\/span>

A note up top: We\u2019ve been following this for a while. Most of these discussions have taken place behind closed doors; the only publicly available text is <\/span>a bill introduced<\/span><\/a> by Representative Zoe Lofgren earlier this year. There are, however, at least two other draft bill proposals in the discussion, both from Republican <\/span>offices<\/span><\/a>. Here\u2019s what we\u2019re worried about, what we\u2019ve seen, and what we\u2019re trying to stop.<\/span><\/p><\/span>

Site blocking 101: How is this supposed to work, anyway?<\/span><\/p><\/span>

Rightsholders\u2019 reasoning is pretty straightforward: Most sites that provide unauthorized content are located overseas, which makes it difficult-to-impossible to drag the operators into a U.S. court. The next best thing to shutting those websites down at the source is conscripting someone who <\/span>is <\/span>subject to U.S. court jurisdiction to block traffic to and from the offending websites. SOPA\/PIPA took a shotgun approach, creating liability for <\/span>everyone<\/span> from broadband providers to payment processors to ad services if they failed to choke off disfavored websites. This time, the discussion is a bit narrower, focusing almost exclusively on DNS resolvers.\u00a0<\/span><\/p><\/span>

If you\u2019re unfamiliar with DNS resolvers, never fear. There are plenty of <\/span>detailed write-ups<\/span><\/a> out there, but all you need to know is that DNS acts as a kind of telephone book for the internet, translating URLs (useful to humans) into IP addresses (useful to computers). Site blocking at this level would involve forcing DNS resolvers to de-list the targeted URL, and prevent the return of IP addresses or other information that the network needs to route the traffic.\u00a0\u00a0<\/span><\/p><\/span>

This can create some problems.<\/span><\/p><\/span>

Technical Problems: It\u2019s Infrastructure, Stupid<\/span><\/p><\/span><\/p>\n\n\n\n

Broadly speaking, DNS resolvers fall into two categories: internet service providers, and everyone else, referred to as \u201calt\u201d (or global) DNS resolvers.<\/span><\/p><\/span>

The overwhelming majority of DNS resolution \u2013 <\/span>authoritative estimates<\/span><\/a> place it at over 90% \u2013 is handled by broadband ISPs. When a broadband provider sets up service at your home or office, it selects itself as the default DNS resolver. It\u2019s an easy setting to change, but most people never bother. This \u201csticky default\u201d means that for most users, their broadband company is the one resolving and routing their traffic.<\/span><\/p><\/span>

The remaining 9% or so of DNS resolution is done by \u201calt-DNS\u201d providers, which sit on the web and aren\u2019t tied to a geographic footprint. Google\u2019s DNS lookup (famously at IP address 8.8.8.8) and Cloudflare (1.1.1.1) are two of the biggest providers, but they\u2019re not the only ones; major tech companies like Cisco, Qualcomm, and Huawei provide DNS resolution services, as do smaller groups like OpenDNS and Quad9. There are plenty of reasons people might prefer alt DNS resolvers, including security, parental controls, and speed at routing certain kinds of traffic.<\/span><\/p><\/span><\/p>\n\n\n\n

The problems with ISPs and DNS blocking<\/span><\/p><\/span>

For one thing, internet service providers should not be policing the behavior of their users, and \u2013 as the <\/span>Trump administration acknowledges<\/span><\/a> \u2013 <\/span>definitely <\/span>should not be copyright cops. Second, if you\u2019re an ISP \u2013 particularly a small, rural, or Tribal service without teams of lawyers or engineers on call \u2013 editing your DNS resolver on the fly is no small matter. These are the same broadband providers currently fighting for their livelihoods as broadband deployment funds are drying up; they simply have other things to worry about.\u00a0<\/span><\/p><\/span>

Some proposals have tried to ease the burden by exempting any ISP that serves less than 1% of the U.S. broadband market. Out of thousands of providers, only 30 serve more than 1% of the population; and only 10 serve more than 5%. That\u2019s a start, but it\u2019s still a big burden on those in the 1-5% bracket, who are pushing to connect more and more Americans in low-income and rural areas. Unlike the old <\/span>Communications Assistance to Law Enforcement Act<\/a><\/span> (CALEA), <\/span>which made some attempt<\/span><\/a> to <\/span>reimburse providers<\/span><\/a> for the cost of making sure law enforcement can still tap your phone line or internet connection, proponents of site blocking expect the providers to largely eat the cost. That means increasing the cost of broadband that too many already can\u2019t afford.<\/span><\/p><\/span>

The problem with Alt-DNS blocking<\/span><\/p><\/span>

Alt-DNS resolvers run one global DNS registry. This means that when they de-list something, they cannot, as a rule, limit the geographic reach of a block they impose through their DNS service. If a blocking order is issued in the United States, it doesn\u2019t just apply in the U.S.; it applies globally. Alt-DNS resolvers are understandably hesitant to take this step because of their global user base, and the tension has caused significant problems in Europe, where many DNS services (including big names such as Cisco and Qualcomm) have opted to pull out of the market entirely rather than comply with blocking mandates. The notable exception to this is Google, which spent considerable money and engineering time building up its own proprietary technology to try and cabin where blocks apply. Google has made it abundantly clear that, given the cost to develop it, this is not a technology other companies can easily replicate, and Google is not interested in sharing.<\/span><\/p><\/span>

Also, because alt-DNS resolvers are opt-in systems, their users tend to be more tech savvy than the average consumer. This presents a somewhat predictable problem; if you know how to use an alt-DNS server to begin with, you likely already know how to change that server (or use a VPN, or <\/span>virtual private network<\/span><\/a>) to evade a block. Research bears this out: A study by French industry research group IFOP, in collaboration with the French anti-piracy agency ARCOM, found that when alt-DNS users attempted to access a site but were met with a block notice, <\/span>only 2% of them actually gave up<\/span><\/a>. The other 98% simply turned to other methods, such as VPNs. If this seems extreme on its face, remember that these figures are coming from the<\/span> French cultural ministry, <\/span>one of the most pro-rightsholder institutions <\/span>in the world, <\/span>and therefore a huge supporter of site blocking<\/span>. <\/span>Even the most diehard pro-content organization cannot sugarcoat the reality that <\/span>alt-DNS blocking Does. Not. Work.<\/span><\/p><\/span><\/p>\n\n\n\n

Including alt-DNS services tends to create massive problems wherever it\u2019s tried. As detailed in a recent <\/span>study<\/span><\/a> by the Internet Infrastructure Coalition, France, Spain, Germany, and Italy have all pushed blocking orders against alt-DNS resolvers. The results have bordered on farce. Italy\u2019s \u201cPiracy Shield\u201d has blacked out everything from <\/span>Cloudflare\u2019s entire CDN network<\/span><\/a> to the <\/span>whole Google Drive productivity suite<\/span><\/a>. Spain blocked the entirety of <\/span>Cloudflare\u2019s networks<\/span><\/a>, denied it ever happened, and then <\/span>did it again<\/span><\/a>.\u00a0<\/span><\/p><\/span>

So, to recap: including alt-DNS resolvers creates massive overblocking risks, strains infrastructure, and captures \u2013 at most \u2013 a negligible volume of traffic. Yet in all the proposals we\u2019ve seen, alt-DNS services are explicitly included as subjects for blocking orders. Why?\u00a0<\/span><\/p><\/span>

Partly it\u2019s a power grab by content producers, who have explicitly stated that they do not care what the cost is or who\u2019s footing it, so long as they have their rights even marginally more protected. The other reason, though, is speed; the push is coming from the House Judiciary Committee, which handles intellectual property issues. Broadband and internet access, on the other hand, is the purview of the Energy and Commerce Committee (in the U.S. House) and the Commerce, Science, and Technology Committee (in the U.S. Senate). Including alt-DNS resolvers makes the bill more \u201ctechnology neutral,\u201d and arguably keeps it outside of E&C\u2019s reach. Why do they want that? Sending a bill through multiple committees of jurisdiction may produce better, more balanced legislation, but it also prolongs the process. Right now, the content industries want to get this done fast, at the expense of good policy.<\/span><\/p><\/span>

Abuse and censorship risks<\/span><\/p><\/span>

Assume, for a moment, that the frameworks proposed actually worked. Even in that scenario, the ability to block anyone in the United States from viewing a certain webpage is an authoritarian\u2019s fever dream. Like every system that allows private actors to control what others can see or hear, it\u2019s a question of when \u2013 not if \u2013 this power will be used for something other than its intended purpose. To illustrate, it helps to game out a hypothetical scenario.<\/span><\/p><\/span>

A whistleblower website launches. The website features leaked contracts, emails, and other files that expose fraud, corruption, and improper coordination with authorities. The activists behind the site choose to publish it anonymously to preserve their safety and protect themselves from retaliation. The exposed parties, upon discovery of the website, immediately request a court order blocking access to it.<\/span><\/p><\/span>

Supporters, of course, dismiss these concerns as speculation. But we know from <\/span>long experience<\/span><\/a> that parties will cheerfully use the notice-and-takedown provision of the Digital Copyright Millennium Copyright to suppress speech they do not like. Given a more powerful tool to suppress critical speech, why on Earth wouldn\u2019t parties abuse it in the same way?<\/span><\/p><\/span>

What makes a website foreign? <\/span>Supporters of site-blocking argue that site-blocking is a last resort against sites located outside of the United States and therefore unreachable by a standard copyright injunction. But how do you determine a \u201cforeign\u201d website from a domestic one? In every proposal, a website is treated as foreign if rightsholders, after a \u201creasonably diligent\u201d search of public information, cannot determine that its operators are based in the United States. <\/span>Any anonymously operated website is treated as a foreign actor<\/span>.<\/span><\/p><\/span>

What makes a site \u201cpiratical\u201d?<\/span> All proposals use some variation on the same test; if the site is \u201cprimarily designed or primarily provided for purpose of infringing copyright,\u201d \u201chas no commercially significant purpose other than infringing copyright,\u201d or (in some instances) \u201cis intentionally marketed by or at the direction of the operator to promote use in infringement of copyright,” it is considered a pirate site. Because contracts and communications are protected by copyright, any publication of documents without authorization constitutes infringement. <\/span>A whistleblower site would thus be subject to a blocking order<\/span>.\u00a0<\/span><\/p><\/span>

Who could object?<\/span> The website operator could unmask themselves and come forward, but that\u2019s unlikely. The judge could, if she was otherwise aware of the website, deny the blocking order. But the judge is under no obligation to verify (or even investigate) any claims made in the petition, and is expected to take the petition at face value.\u00a0<\/span><\/p><\/span>

The only other entities that <\/span>could<\/span> object to an obvious misuse of the blocking system would be those entities tasked with enforcing it \u2013 ISPs and DNS resolvers. However, <\/span>services have interests separate from those of their users<\/span>, and have no desire to be caught in the middle of a politically sensitive issue like moderating controversial content. It\u2019s easier for those services to just take it down without considering the internet user\u2019s side.\u00a0<\/span><\/p><\/span>

One consistent theme among all the proposals that have been put forward is that the public has no role in these proceedings. An occasional nod has been made toward allowing private parties to flag for the court that they have accidentally swept in sites <\/span>other than the ones targeted, <\/span>but this does nothing to protect against misuse.\u00a0<\/span><\/p><\/span>

What\u2019s the penalty for bad faith misuse?<\/span> None. The farthest any proposal has gone has been to subject bad faith actors to potentially being charged with perjury, which any practicing lawyer will tell you is something that the Department of Justice simply doesn\u2019t bother doing (unless you\u2019ve pissed them off for other reasons).\u00a0<\/span><\/p><\/span>

Can this kind of abuse really happen here?<\/span> It might seem unlikely\u2026 until you consider that Canada\u2019s site-blocking regime was used to <\/span>shut down access to a website<\/span><\/a> that called for a boycott of a popular book chain because of its CEO\u2019s stance on the war in Gaza. So the answer is: YES, it can happen here.<\/span><\/p><\/span>

What do we need?\u00a0<\/span><\/p><\/span>

Glad you asked. <\/span>We need policymakers to avoid, or oppose, site blocking bills that create these specific harms:<\/span><\/p><\/span><\/p>\n\n\n\n