A site-blocking bill introduced in the US House this month would allow courts to order virtual private network providers to block pirate sites, a category of intermediary absent from the draft circulated last year.
Rep. Darrell Issa formally introduced the American Copyright Protection Act last week. The full text became public after Public Knowledge shared a copy with Ars Technica, and was posted on Congress.gov on 22 September.
An earlier discussion draft, reported in June last year, stated that internet service providers and DNS resolvers would be covered, and nothing more. The final text goes further. "The term 'service provider' includes providers of broadband internet access services, providers of domain name resolution services, and virtual private networks, but excludes root nameserver operators and top level domain registries," the bill reads.
The mechanism has two stages. A copyright holder asks a federal court to determine that a website is a foreign piracy site, and with that declaration in hand petitions for a blocking order requiring particular providers to prevent people reaching it. Smaller services are exempt: the bill excludes "any entity that provides services to fewer than 100,000 monthly users or subscribers in the United States", which means it targets the larger providers.
Once an order is issued, providers have 14 to 30 days to "take all commercially reasonable steps to prevent users or subscribers from using its systems or networks to access the foreign piracy site from the United States".
For an ordinary internet provider that requirement is fairly straightforward. For a VPN provider with servers in dozens of countries it can be read in more than one way. The provider could block the site on its US servers only, in which case American subscribers remain free to connect through Amsterdam or Toronto while a Canadian subscriber routing through New York is blocked. Or it could block the site for anyone connecting from an American IP address, whatever server they choose, which should be possible without logging anybody's address.
The bill does not say which, and a judge has no say either: blocking orders cannot prescribe or require any specific blocking technique, so the choice is left to the provider. Providers can contest their inclusion, and before naming one a court must weigh several factors, including the "technical feasibility and efficacy" of the blocking. VPNs raised similar objections in France, where the Paris court concluded that a no-log policy does not prevent a VPN from blocking sites.
There is a fast lane. A court may shorten any deadline in the bill for good cause, including for measures aimed at "time-sensitive events". At a House hearing in June, Issa made plain who that is for, arguing that enforcement has to be quick enough to matter while a match is still on air. "[W]hat is the reasonable speed? Can we do it at the speed of sound? Can we do it at the speed of light? More importantly, in a 45 minute or sometimes a fraction of that live sports broadcast, can we do it soon enough to make it no longer profitable for those who pop up and sell their clandestine wares?" he said.
Alongside sport, the time-sensitive carve-out also covers films and television programmes that leak online not more than 24 hours after their first authorised release in the United States.
Commentary so far has come mostly from opponents, including Public Knowledge and Re:Create. Rightsholders have been quieter, and the Motion Picture Association told TorrentFreak it would share a statement once Issa's office issues a press release. Issa retires at the end of this year, and Senator Thom Tillis and Rep. Zoe Lofgren are preparing a bicameral site-blocking bill of their own.
The bill therefore asks a specific question of a VPN and declines to answer it. The obligation is to stop access from the United States. A VPN exists to make where a subscriber appears to be connecting from a matter of choice.
This newspaper has looked for the configuration that is certainly compliant, and can find only one. A provider that blocks the site on every server, in every country, for every subscriber has definitely prevented access from the United States, because it has prevented access from everywhere. Nothing in the bill forbids doing more than the order requires.
Our analysts note that this is also the cheapest option, because it requires no knowledge of where anybody is. A global block is what a provider implements when it is told to be geographically precise and given no means of being so.
The Department of Unnecessary Research has followed this back to the drafting. "From the United States" describes a destination in a statute and a rule set on a server, and the two are connected only by the provider's guess. The more carefully a VPN respects the phrase, the more of the world it has to switch off.
One line in the bill resolves the whole question, and it does so by removing the only party who could have ruled on it. The order may not prescribe the technique.
The geography is therefore left to whoever is holding the routing table. It is a 45-minute problem, as the sponsor said, solved at planetary scale.