There's dumb - and then there's really dumb, predicated on people who simply don't understand what they're doing, and should be barred from authoring legislation until they consult with some people who do know what they're doing.
The Combating Online Infringement and Counterfeits Act (COICA) was introduced just one week ago, but it's greased and ready to move, with a hearing in front of the Judiciary Committee this Thursday. If people don't speak out, US citizens could soon find themselves joining Iranians and Chinese in being blocked from accessing broad chunks of the public Internet.
Help us stop this bill in its tracks! Click here to sign our petition.
COICA creates two blacklists of Internet domain names. Courts could add sites to the first list; the Attorney General would have control over the second. Internet service providers and others (everyone from Comcast to PayPal to Google AdSense) would be required to block any domains on the first list. They would also receive immunity (and presumably the good favor of the government) if they block domains on the second list.
The lists are for sites "dedicated to infringing activity," but that's defined very broadly -- any domain name where counterfeit goods or copyrighted material are "central to the activity of the Internet site" could be blocked.
This sounds ok, right? A site that is dedicated to stealing intellectual property isn't a good thing, and setting up a "blacklist" thus sounds pretty reasonable.
Well, it might be. If it could work.
But it won't, because it can't.
When you type http://www.pirate.me.a.movie into your browser what happens "behind the scenes" is as follows:
- Your computer sends a request for an "A" record to your local DNS resolver. This "resolver" is set when you get your IP address (most computers nowdays on personal internet connections get them when they boot up from a protocol called DHCP - this protocol returns your DNS addresses at the same time it returns your IP address.)
- The DNS resolver (typically running a program called "named", known in the bizness as "BIND"), looks up that domain name. To do this it starts at the right most address part and finds the authoritative server for that part and asks it for the next component to the left (it may already know some of the pieces; each request that is answered comes with a timeout, so the server doesn't have to ask again for a while if it gets a valid answer.) This continues right-to-left until it finally gets to the authoritative server for the left-most portion, at which point it has an IP address.
- It passes that IP address, along with it's timeout (so your local machine doesn't have to ask again for a while) back to your client machine.
- Your client machine (assuming a web browser) connects to that IP address, and then in the header of the HTTP request (for a web site) sends the site's domain name down to the server that is on the other end. This is done because there could be dozens - or even hundreds or thousands - of domains on one IP number.
- The server looks at the request domain name, and if it is a server for that domain, returns the page requested.
This proposal attempts to interdict the process at point #2. That is, your internet provider would be required to verify the requested domain name against a "black list" and, presumably, either return a bogus (e.g. a government) response where it could return "you bad boy, that site is blocked" or return nothing (e.g. NXDOMAIN, "no such entry.")
Here's the problem: The site in question is still online.
Problem #2: It is trivially easy to override this.
On a Windows (or Unix-derived!) machine you could put a local "hosts" file on your system that contains the "bad" site name and its ip number. Your local machine will prefer the hosts file to the DNS system, which means voila - you have access to the so-called "bad" address again.
Guess what - this is exactly the method used by those with "rooted" Android phones to block advertising. You simply put the advertising domains in the local hosts file with a bogus IP number (e.g. 127.0.0.1, which is defined as your local computer) and all the ads disappear! Easy as pie!
I predict it will take about an hour after such a law is passed before someone enterprising will write a "shim" that will sit on Windows and Mac machines and intercept the DNS data stream, pointing at alternate resolvers that are not subject to this law - like, for instance, in The Netherlands. This too is trivially easy to do - in fact, 30 seconds with your computer will set your DNS resolvers manually. For performance reasons you probably don't want to do this for every site, thus, the shim - but in point of fact if you know of an open, public DNS resolver somewhere you can do this now.
There isn't much that can be done about that. ISPs could be directed to not allow UDP Port 53 (the standard for DNS) to go anywhere but to their servers, in an attempt to stop a bypass. It won't work though, since there's nothing prevent anyone from running a DNS resolver on any port nor is there anything preventing you from looking for one on some other port (if you know it's there.)
The right thing to do, of course, is for a rights-holder that finds a site that is "dedicated to infringing activity" to file a lawsuit and ask for an injunction to shut the site down - legally.
Unfortunately for the rights-holders, this sometimes doesn't work out all that well, because the site in question might physically be somewhere that doesn't give a damn about intellectual property - say, in China. Bonne chance on getting the Chinese to listen to an American subpoena or injunction.
Thus, this sort of "proposal" in a futile attempt to interdict something across a national boundary by intercepting the resolver request - an action that takes place here, in the United States, and where the baseball bat of the American Government can issue threats aimed at ISPs - and back them up at gunpoint.
David Segal is right to raise the alarm on this issue. Where he's wrong is the belief that this will do anything to stop online piracy - or anything else.
The tools necessary to interdict pirate sites legally already exist for web sites that are hosted in the United States. For sites beyond the United States where US legal challenges are met with raucous laughter, this bill will do nothing at all, as it will be circumvented within literal seconds by anyone interested in the material.
This is just a demonstration of the intellectual vapidity in our so-called legislative process. I, along with thousands of others who know how DNS and The Internet work, could have told these fine legislators that this was totally idiotic and would do nothing - if Senator Leahy, the bill's sponsor, or the 16 co-sponsors, had bothered to ask.
This much I guarantee you: They didn't and all seventeen of them are too stupid to know what they don't understand.
These are the people we trust to write laws in this country? 
