Subject: [hrpc] A real-world example of HTTP status code 451

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 15 Jun 2018 14:56:06 +0200

http://www.technicianonline.com/ (from a place geo-located in Europe)

451: Unavailable due to legal reasons

We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time. For any issues, contact [email-masked] or call 919-515-2411.

https://static.mstdn.fr/static/media_attachments/files/000/400/747/original/a73f52e18d8748c5.png

% curl -v www.technicianonline.com
* Rebuilt URL to: www.technicianonline.com/
*   Trying 192.104.183.109...
* TCP_NODELAY set
* Connected to www.technicianonline.com (192.104.183.109) port 80 (#0)
> GET / HTTP/1.1
> Host: www.technicianonline.com
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 451 Unavailable For Legal Reasons
< Date: Fri, 15 Jun 2018 12:51:12 GMT
< Content-Type: text/html; charset=UTF-8
< X-Loop: 1
< X-XRDS-Location: http://www.technicianonline.com/tncms/xrds/
< X-UA-Compatible: IE=edge
< Link: <https://bloximages.newyork1.vip.townnews.com>; rel=preconnect dns-prefetch; crossorigin
< X-TNCMS: 1.39.6; app8; 0.06s; 2.8M
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Vary: X-IPCountry, Accept-Encoding
< Set-Cookie: TNNoMobile=1; path=/; expires=Thu, 2 Aug 2031 20:47:11 UTC
< X-VCache: HIT
< Content-Length: 4264
< Age: 244
< Connection: keep-alive
< 
 <!DOCTYPE html>
...

---

From: "Robert Guerra" <[email-masked]>
Date: Fri, 15 Jun 2018 10:05:54 -0400

While it’s great to see error 451 being used, I would like to know if 
the folks on this list believe the message being displayed is factually 
correct. I say this as the term European Economic Area (EEA)  is the 
combination of countries that form part of the European Union and the 
European Free Trade Association (EFTA). Currently the GDPR is the 
law/regulation of the land in EU member countries.

Countries that form part of the European Free Trade Association (EFTA) 
– the regional trade organization and free trade area consisting of 
four European states: Iceland, Liechtenstein, Norway, and Switzerland 
– have different processes to adopt EU regulations and may not have 
yet adopted GDPR. That likely will occur soon,  but has is not the case 
yet.

https://www.wr.no/en/aktuelt/nyheter/2017/implementing-the-gdpr-in-norway/
https://www.inblf.com/wp-content/uploads/2018/02/GDPR-Norway.pdf

Might a possible correction be to simplify the message leaving out the 
geographical designation and instead state..  We recognize you are 
attempting to access this website from a country  which enforces the 
General Data Protection Regulation (GDPR)..

regards

Robert

--
Robert Guerra
Cel/Tel +1 416 893 0377
Twitter: twitter.com/netfreedom
Email: [email-masked]
PGP Keys : https://keybase.io/rguerra

On 15 Jun 2018, at 8:56, Stephane Bortzmeyer wrote:

> We recognize you are attempting to access this website from a country 
> belonging to the European Economic Area (EEA) including the EU which 
> enforces the General Data Protection Regulation (GDPR) and therefore 
> access cannot be granted at this time. For any issues, contact 
> [email-masked] or call 919-515-2411.
>
>
> ....
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 15 Jun 2018 16:56:42 +0200

On 06/15/2018 04:05 PM, Robert Guerra wrote:
> correct. 

No, it is as wrong as wrong can be. The website is not blocked because
of legal reasons; GDPR does not mandate blocking of any sort.

Actually this is just the most lazy way of copping out of corporate,
social and legal responsibilities imho.

Best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 15 Jun 2018 11:12:11 -0400

> of legal reasons; GDPR does not mandate blocking of any sort.

GDPR does not mandate blocking, but it does require companies to
behave in various ways in order to conform to the law.  It seems that
in this case the operator of the site decided that the safest way to
conform was simply not to interact with anyone who is apparently
covered by the GDPR, and so they are refusing to talk to such people.
I don't see how that fails to meet the following description in RFC
7725, section 3:

   This status code indicates that the server is denying access to the
   resource as a consequence of a legal demand.

The description does not require a specific legal demand; neither does
it say that the legal demand need extend only to the content on the
website.

>From my point of view it's unfortunate that this is the way the
operator has chosen to proceed, but I don't see any way that 451 isn't
a correct code here.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 15 Jun 2018 17:26:25 +0200

> operator has chosen to proceed, but I don't see any way that 451 isn't

I saw GoDaddy use 451 for sites/accounts that did not pay their bills -
so they did not live up to their contractual obligations under contract
law. Do you think such an interpretation would also be fitting?

Best,

Niels

-- 
Niels ten Oever
Researcher and PhD Candidate
Datactive Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 15 Jun 2018 11:28:40 -0400

> law. Do you think such an interpretation would also be fitting?

It's a harder case to make, because in that case the legal demand is
not _on_ the operator, but instead coming _from_ the operator.  On the
other hand, the RFC does not make that distinction.  So I don't know.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Mallory Knodel <[email-masked]>
Date: Fri, 15 Jun 2018 15:35:55 +0000 (UTC)

----- Original Message -----
From: Niels ten Oever <[email-masked]>
To: [email-masked]
Sent: Fri, 15 Jun 2018 15:26:25 -0000 (UTC)
Subject: Re: [hrpc] A real-world example of HTTP status code 451

It does fit better than another error code. And many more possible legal ties not yet identified. It is why, as a side note, that censorship circumvention and censorship monitoring technologists are not happy about 451 because it does not make their job of identifying government filtering/blocking/censorship easier but potentially even harder. 

-M

---

From: Mark Nottingham <[email-masked]>
Date: Sat, 16 Jun 2018 13:01:27 +1000

It looks like they have tried to twist reality to say that they're "blocking due to legal reasons" because of GDPR. However, the spec says 451 is used "when a server operator has received a legal demand to deny access to a resource or to a set of resources that includes the requested resource." The legal demand in the case of GDPR is with regards to data handling, not access to resources.

Unfortunately, that description is in the Introduction of 7725, not the actual description of the status code. 

Cheers,

> On 15 Jun 2018, at 10:56 pm, Stephane Bortzmeyer <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 18 Jun 2018 11:12:55 +0200 (CEST)

> Il 16 giugno 2018 alle 5.01 Mark Nottingham <[email-masked]> ha scritto:
> 
> 
> 

Maybe, after some time and some real world experience, the spec could be revised to clarify which legal situations are fit for 451 and which are not - or there could be a best practice document explaining it. But then, there is no protocol police, so people who want to dump their own responsibilities onto some random government would still happily use 451.

Regards,
-- 

Vittorio Bertola
Head of Policy & Innovation

Cell:+39 348 7015022Skype:[email-masked]
Email:[email-masked]

Twitter: [@openexchange](http://twitter.com/openexchange)- Facebook: [OpenXchange](https://www.facebook.com/OpenXchange)- Web: [www.open-xchange.com](http://www.open-xchange.com)
Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin 
Chairman of the Board: Richard Seibt

European Office: 
Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 
Managing Director: Frank Hoberg

US Office: 
Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA 

Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.