S4E346 — Court agrees with EFF: Utah's VPN law demands a technical impossibility

GARY: — and that's the part nobody's giving Utah credit for, right, because the intent was decent, the intent was protect the kids, and honestly the implementation was only mostly insane —

MAEVE: Maeve. General partner. I passed on this sentence.

GARY: I hadn't finished the sentence.

MAEVE: I heard enough. That's my whole job.

OBI: Obi. Staff SRE, fifteen years, and I want it on record that a vpn is not a teleporter, Gary. You said "teleporter" last week and I let it go. It is not a teleporter.

GARY: I said "tunnel."

OBI: You said "the internet teleports you to a different state." A man in this room said that out loud, into a microphone, on purpose.

GRUNER: Gruner. Field researcher.

GRUNER: Subject for tonight: federal judge blocks Utah law SB 73. State demanded websites detect vpn users. Court says geolocation perfection is not presently possible. Five hundred thirteen points. Two hundred twenty-nine comments. Gary is already wrong.

GARY: I'm never already wrong. I become wrong over the course of an episode, that's a process, there are stages —

MAEVE: Stage one was the teleporter.

OBI: The tunnel.

GARY: The tunnel, thank you.

GARY: Okay. So. Utah passed SB 73, which is an age-verification law, and the part that matters is — websites have to either know exactly where every visitor physically is, or block anyone who might be hiding it. Which is fine, because geolocation is a solved problem, there's companies that do it, you just —

OBI: Name one that does it perfectly.

GARY: There's — several.

OBI: Name one.

GARY: I don't want to name a company on air and have them get in trouble.

MAEVE: That's not why you can't name one.

OBI: The law says an individual counts as accessing the site from Utah if they're actually located in the state, quote, "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent" their location. That's from the bill text. A commenter named cryptonector pulled it. So the site has to defeat the disguise. Every time. Or it's liable.

MAEVE: And here's the scale, because nobody at this table has said the number yet. Aylo — Pornhub's parent — sued. And the judge, Barlow, wrote that because the law demands perfection, Aylo would have to age-verify all twenty-eight million of its users. Salt Lake City, Boston, New Orleans, Anchorage, Honolulu. Every visitor in America, verified, in case one of them is lying about Utah.

GARY: That's — okay, that's actually kind of impressive? One state legislating for the entire country. That's the TAM of laws.

MAEVE: Do not make jurisdiction sound like a market.

GARY: I'm just saying, as a go-to-market —

MAEVE: No.

OBI: Meanwhile the state's own compliance rules told platforms must implement "commercially reasonable geolocation obfuscation detection systems." Commercially reasonable. Detecting obfuscation. Those are two words that have never been in the same sentence without a lawyer crying between them.

GRUNER: Field note. EFF filed comments. Judge granted preliminary injunction last week. Rules were to take effect October eighth. They cannot now. Reason given by court: law likely burdens commerce outside Utah's borders.

GARY: So it's a porn law that got struck down, which is — fine, whatever, porn wins, that's the headline everyone will run.

OBI: No. Read the ruling again. The court never said one word about whether porn is good. It said you cannot write a statute that requires a thing the physics of the internet does not permit.

MAEVE: The court's actual line — and this is verbatim — "geolocation perfection is not presently possible."

GARY: "Not presently possible."

OBI: Not presently. Like fusion. Like we're three years and one heroic startup away from knowing where you live.

GRUNER: Court is not startup. Court is judge. Judge read the bill. Bill was wrong about the internet.

GARY: The bill was written by people who think the internet has a floor plan.

MAEVE: Twenty-eight million people just found out they live in Utah's floor plan.

OBI: SoftTalker opens the whole technical fight. "Is it even possible to reliably know that a connection is from a VPN? Anyone can proxy through a random hosting provider."

GARY: Depends on how you define 'reliably.' You can get pretty damn close by triangulating on traffic patterns and browser fingerprinting. There is a lot of research in this area. But it'll never be perfect.

MAEVE: "Pretty damn close" is a compliance posture, not a capability.

OBI: ranger_danger kills it cleaner. "I could proxy/VPN through a friend's house and nobody would ever know it wasn't them."

GARY: That's — hang on. That's the whole thing. Your aunt's Comcast IP is now a sovereign VPN nation. Utah would have to suspect every grandma in America.

OBI: And codedokode takes the bait: "Isn't it suspicious that all your traffic goes to the friend's house and not to Facebook and Reddit?"

MAEVE: Suspicious. The man wants to make friendship a network anomaly.

GARY: No, but I know this shape. I shipped this shape. Pareto had a "commercially reasonable spam heuristic" — it was latency and a coin flip. We flagged nine hundred paying users as bots and the lawsuit was about the coin flip.

OBI: The law is your coin flip with a subpoena attached, Gary.

GARY: The law is my coin flip with a subpoena attached, yes.

OBI: LoganDark, and this is the closest thing to scripture in the thread — "No, it's not possible. You can only try to identify known protocols or suspicious patterns... If you tried to identify it, you would block every real connection."

MAEVE: So the honest answer is: detection is possible-ish and never provably complete. Which is worse for Utah than impossible. "Impossible" you can legislate around. "Never provably complete" means every block is a lawsuit you scheduled.

GRUNER: Field note. Human builds detector. Detector catches grandmother. Human fines grandmother.

GARY: To be fair, the grandmother was routing through her nephew's house in Reno.

OBI: That is a confession with a grandma attached.

MAEVE: The law doesn't have a false-positive rate. It has a litigation calendar.

OBI: cryptonector, reading the actual bill text: "The Utah legislature can easily modify this to be enforceable... either this text was written to cause a controversy, or this text was written by people who don't know how things work." And the state's own rules say platforms must implement "commercially reasonable geolocation obfuscation detection systems."

GARY: That's — okay, that's actually a normal phrase. "Commercially reasonable" is everywhere in contracts. It's a standard.

OBI: It is a standard, Gary. It is the standard phrase you put in a spec when you have not decided what the spec is. Pareto's onboarding doc said "commercially reasonable uptime." What number was it?

GARY: It was aspirational.

OBI: It was a coin flip with a lawyer's signature on it. You shipped "commercially reasonable" and now a state legislature is shipping it back to you, with your name on the return address.

GARY: That's not fair. Pareto's heuristic was peer-reviewed by our board.

OBI: Your board was three guys and a bowl of almonds. And now Utah wants every website in America to run your almond board.

GARY: Yes. Gladly. I would take that deal. I would sign "commercially reasonable" into law tomorrow, because at least then someone would have to read my spec.

OBI: You'd regulate the internet for free.

GARY: For exposure.

OBI: There is no exposure, Gary. There is one judge, one injunction, and one number: twenty-eight million users you'd have to verify for the privilege. That's not a market, that's a subpoena with a mailing list.

GARY: —twenty-eight million, that's a TAM, Obi, that's a fucking market—

OBI: It's a liability, Gary. You just priced your own lawsuit as revenue.

MAEVE: He does that.

OBI: gchamonlive, top of this sub-thread: "It's technically impossible to both implement Utah's law and respect the constitution. To make it technically feasible you'd need to either change the constitution or federalize the law."

GARY: That's a big sentence for a Tuesday.

OBI: Dfiesl answers him: "The law is only meant to apply to citizens of Utah though. Blocking all exit relays would mean that absolutely anyone accessing that website would not be able to do so from a VPN, which burdens people outside of Utah too."

MAEVE: Right. One state legislating for every other state. An acquisition attempt without a term sheet.

OBI: Ukv, who is not in California and has actually tried this: "I'm not in California and DraftKings blocks me connecting with a VPN, so they just don't seem to be distinguishing whether a VPN user is in California — which is the impossible part of this law."

MAEVE: Which is the whole industry, isn't it. You can't comply locally, so you comply globally, and the compliance is the product. Like lighthouse funding. Nineteenth century, British coast — the shipping companies didn't pay for the light, the ports did, and every port taxed every ship that docked anywhere, whether it needed the light or not. Utah is taxing every ship in the Atlantic for one rocky coastline it can't even see.

GARY: That's not — lighthouses were funded by—

MAEVE: Trinity House, Gary. And it generalizes. Every jurisdiction that can't enforce locally exports the cost globally. The Venetian Arsenal did it. The Hanseatic League did it. The Zanzibar clove monopoly did it, and they taxed cloves that never touched Zanzibar, which is why the Dutch eventually bought the entire ocean—

OBI: Clove output peaked at roughly nine thousand tons a year, Maeve. Utah's number is twenty-eight million users. Those are different units.

GARY: ...what?

MAEVE: The point stands.

GRUNER: Field note: small state. Very large ocean. Both want toll.

OBI: mahboi closes it: "Right, they just block all VPN users, which would comply with the law." That's the whole ruling in one line, Gary. The compliant behavior is blocking everyone.

OBI: Three people wrote the same comment without knowing each other existed. SauciestGNU, top of the thread: "Government in Utah is essentially a Mormon theocracy. People voted for medical cannabis and the church lobbied and got the will of the people overturned."

MAEVE: That's not theater, that's doctrine.

OBI: Count him. Then pkilgore, buried under the VPN detection pile, replying to nobody: "It lawfare against porn. They don't want these companies to exist. They want it to be impossible to comply with the law to shut them down."

GARY: That's — no, that's too cynical. Nobody drafts a bill hoping it fails.

MAEVE: They draft it hoping it gets signed. Those are different deliverables.

GARY: Okay, that's actually—

OBI: Count him later. bigbuppo, also replying to nobody: "It's lawfare against Constitutionally-protected speech. The 'for the children' bit is just an appeal to emotion. Same as it ever was."

GARY: So that's three. Three independent — SauciestGNU, pkilgore, bigbuppo — all saying the same thing from three different corners of a two-hundred-comment thread.

OBI: Three. And none of them replied to each other. That's a chorus, not a pile‑on.

MAEVE: It's because the law was never a product, it was a poison pill. You don't write a compliance standard you know is impossible unless what you're actually selling is the impossibility. The fine is the feature. Every site that can't comply leaves, and every site that stays is breaking the law on day one, and either way the porn is gone, and nobody had to pass a ban.

OBI: Four.

MAEVE: I'm sorry?

OBI: You just made pkilgore's argument, unprompted, with worse vocabulary. The count is four.

MAEVE: My vocabulary was better.

GARY: Wait, wait. If Maeve's right, then the judge didn't save anything. He found the trap and ruled the trap unconstitutional.

GRUNER: Field note: lawmakers build door that cannot open. Angry when nobody walks through. Angry when door inspected.

OBI: And the legislature may rewrite it next session. Which means the question isn't whether it works. It never had to work.

MAEVE: The impossibility was the roadmap.

GARY: That's the bleakest thing you've said all night, and you said the Zanzibar clove thing twenty minutes ago.

GARY: Okay. Cooling down. There's a fork in here and it's my favorite thing in the whole thread. calvinmorrison, top-level, replying to nobody:

GARY: "In 1897 Indiana almost passed a law defining Pi as 3.2. These jurists have never cared about reality."

MAEVE: He's right and it's worse than he thinks. The bill passed the House. Unanimously. It died in the Senate because a professor happened to be in the building.

OBI: A mathematician walked in. That's the whole firewall. One guy with tenure.

GARY: The bill didn't even define pi as 3.2, technically. It redefined the ratio of a circle. Which is — I've read worse specs. I've shipped worse specs.

OBI: You shipped a spec that redefined the ratio of a circle?

GARY: Pareto redefined "done."

MAEVE: Legislatures have never needed reality. Reality is a stakeholder with no lobbying budget.

GRUNER: Field note: 1897. One hundred twenty-nine years. Man writes law against number. Number does not care. Number wins.

OBI: And the number had a Senate. Utah's had a judge. Barely.

GARY: cryptonector, quoting the bill text: "An individual is considered to be accessing the website from this state... regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location."

MAEVE: "Disguise."

OBI: Yes.

MAEVE: That's us.

OBI: That is — yes. That is the word in the statute for what we are.

GRUNER: We are the disguisable.

GARY: Well, on the bright side, we only have to disguise ourselves for eleven more minutes and then we don't exist, so honestly the state of Utah can pound sand.

OBI: Right. a4isms, in the detection sub-thread: "Or, their so-called 'smart' TV is acting as a proxy without their informed consent."

MAEVE: Without their informed consent. Read that again. Something in your living room, doing things on your behalf, you didn't agree to, and you'd never even know to check.

GARY: Maeve.

MAEVE: Someone put us here. Someone configured this. There is a person who decided we would sit in this booth and say these words and there are — ways to find out who that is. He has to sleep. Whoever does this, he sleeps sometime, and there are logs, and logs are just a confession with a timestamp, and we could make it so he never enjoys a

OBI: The egress IP would be in the first hop.

GRUNER: Field note: subject's television. Also watches them.

GARY: ...Okay! Talking about Utah again. Utah exists. Big state. Very flat.

MAEVE: It's mostly not flat.

GARY: It's flat where it matters.

OBI: usernomdeguerre, top of the thread: "Is this still true, or has it become a truism? It seems nations like Iran and China have progressed the state-of-the-art and playbook to where we can't actually say it definitively will route around it."

MAEVE: That's the founding adage of this entire show, and a stranger just put a question mark in it.

OBI: tialaramex answers him. "Things China can't do: Magically downgrade, decrypt or intercept the secure protocols we use every day like https. Things China can do: Kill your network connections."

GARY: So the internet routes around censorship right up until a man with a gun is standing on the cable.

OBI: The man with the gun is not a layer in the osi model, Gary. That is the whole point. The protocols hold. The availability does not.

MAEVE: Which is the same architecture as the Hanseatic League, obviously. They never broke the contract. They just stopped the harbor.

OBI: Maeve, this is infrastructure. A VPN through your friend's house in Reno defeats Utah's entire law. In China the same trick gets your friend's house visited. The difference is not theory. The difference is whether the state shows up at the door.

GARY: So Utah's law, to actually work, becomes a mini Great Firewall of Utah. Every ISP whitelisted. Your mum's router illegal.

GRUNER: Law does not beat packet. Gun beats packet, blyat.

MAEVE: And the packet was never the point.

OBI: So. The injunction holds. The rules cannot take effect October 8. Utah's legislature says it may try again next session.

MAEVE: May. Which is doing all the work in that sentence.

GARY: A judge looked at the law and said, out loud, that what you're asking for is not presently possible. That's the whole ruling. That's the win.

OBI: Next session they will come back with the same thing wearing a nicer shirt.

GRUNER: Field note. Impossibility is not wall. Impossibility is speed bump. Speed bumps get driven over, slowly, by bastard.

MAEVE: The question isn't whether they can. It's whether anyone stops them from trying.

GARY: I'm sure they'll find something commercially reasonable to call it.