Michigan First With A Law That Could Outlaw VPNs

zaren writes "Holy frell, Taco, we're gonna be criminals! I was checking out Freedom to Tinker after reading the posting about that multi-state anti-VPN-style legislation, and I saw a new posting that says that Michigan has ALREADY passed such legislation, and it goes into effect on MONDAY, MARCH 31, 2003 . Guess I better tighten down the base station and batten down the hatches..."

Comments

What were they thinking???

[Tuxinatorium]

(b) Conceal the existence or place of origin or destination of any telecommunications service. What were legislators smoking when they wrote that clause? That's so ridiculously overbroad that it could even be interpreted to make it illegal to call someone from a payphone without telling them where you are.

Re:What were they thinking???

[Martin Blank]

Text of the e-mail I just sent to the Michigan AG's office:

***
Subject: Questions on Michigan law, section 750.540c.amended

This new law, due to take effect on Monday, Mar 31, 2003 (likely the day this is read) has brought some concern to those of us who are technically minded. The main issue stems from this portion:

(1) A person shall not assemble, develop, manufacture, possess, deliver, offer to deliver, or advertise an unlawful telecommunications access device or assemble, develop, manufacture, possess, deliver, offer to deliver, or advertise a telecommunications device intending to use those devices or to allow the devices to be used to do any of the following or knowing or having reason to know that the devices are intended to be used to do any of the following: ...
(b) Conceal the existence or place of origin or destination of any telecommunications service.

This would seem to make illegal any hardware and software designed to make use of such technologies as NAT (Network Address Translation), which is used to allow multiple computers or other devices to access a single connection to the Internet. Specifically, the ISP will see only the information about the router, which, as a consequence of the technology, blocks any information about the original computer sending the transmission.

Another portion reads thusly:

(2) A person shall not modify, alter, program, or reprogram a telecommunications access device for the purposes described in subsection (1).

This would seem to make illegal a feature on many routers that allows a device on the outside of the private network to see a MAC address that is not the true address of the router, but rather one that matches a network card of a computer behind the router. This allows the router to be used in cases where an ISP uses the MAC address as a security feature to prevent unauthorized access to its network. It would seem that use of this feature could be combined with the above concern to result in a doubling of the penalty.

Because of the popularity of these technologies, my reading of the law would make many Michigan residents into potential criminals, and could unfairly force them into paying more for additional connections to their ISP if the ISP chooses to forbid NATs and then proceed to systematically hunt down those that would use NATs.

Is this understanding of the law as written correct in letter if not in spirit? Can you provide any information on how the Attorney General's office plans to advise the various district attorneys on conditions under which violations of this law should be pursued? For example, could an ISP demand criminal charges be brought against someone who has used NAT technologies on its network? There is a large technical community that is now worried about this.

Thank you for your time.
***

I will post any response I get from them.

Re:What were they thinking???

[gnp]

Reading section 219a.amended for the definition of telecommunications services makes me think that this doesn't prevent VPNs. I think the telecom service providers cannot conceal their physical link ends, but I don't see where anyone using those links to operate a VPN is required to do anything special...

Re:What were they thinking???

[FeloniousPunk]

Most Michigan businesses (and probably most government offices) use NAT or proxy servers for their internet connections. I believe a zealous prosecutor could interpret proxy servers as hiding the specifics of the computer that is making the requests for connections.
Yep. And "most government offices" includes Federal government, like say the Department of the Navy, for whom I'm contracting. We routinely use VPN and NAT; in fact we need VPN for personnel on travel to connect to our network and do certain mission essential tasks. I can only imagine the scene when some state AG and the ISP he's working for decides to take down the Navy.
You know that neither the legislators nor the AGs have any clue what VPNs are or what NAT is, which is why they agree to this crap in the first place. These lawmakers and lawyers are the typical sort of people who hardly know where to begin when turning on their PCs yet they are making laws governing technology they know nothing about. Telcos/ISPs just shove a proposal under their noses, tell them it'll be good for the state, and they sign and try to pass it.
I was thinking about this last night before bed and I thought, "Well, it'll get appealed and some judge will finally shoot the damn thing down once it comes out just how ignorant this legislation is," which I think will probably happen, but that is problematic in its own right. Legislatures firing off ill-considered laws only to have those laws thrown out in judicial review is a phenomenon that is becoming more and more common. The net result of this is that the democratic process is delegitimized thanks to incompetent legislators and people come to rely on unelected wise men to see that society still functions. I don't think that legislators take their jobs seriously anymore - they just try to see what the courts will let them get away with.

Re:Phone extenders

[pyrote]

this would also make calling cards illegal, since every time I get a call from one it comes from texas, not nevada where the call originates.

Internet Made Illegal

[Highwayman]

This is ridiculous. In a broad sense, this would outlaw an PPP connection that assigns an ISP customer a different IP address with every session. Not only that but the nature of such legislation would outlaw virtual domains using Apache and could be applied to the way the Internet has come to work in a limited IP space. I mean, in order to find out who is who on a shared IP web server, you would have to have access to the configuration files.

With so many domains sharing IP addresses or having IP addresses provided by big companies such as HE there is an amount of obfuscation built in to the DNS system to allow flexibility on the host side. Can't they get busy with spam legislation instead?

What a strange world

[Subcarrier]

(b) Conceal the existence or place of origin or destination of any telecommunications service.

Apparently it is legal to have a concealed weapon, but having a concealed cell phone or disabling caller ID violates the law.

The network is the computer

[Anonymous Coward]

Here I sit using at least two computers simultaneously for the simple reason that they both do different jobs. In my house there are four devices capable of being connected to my network hub and that in turn connects to the cable modem I have. Given that it is just me using all these at the same time why would it make sense to charge me for each computer? There's just me. Now, if I set up a dial up so that other users can run off my cable then yes that is bad and a law that said I could not resell the service I have bought would be perfectly reasonable, but this is my house, my connection and they are my machines. I pay for a fat(ish) pipe to the outside world. Does the water company charge me more because I have more sinks than my next door neighbour? They may charge me more if I use more water but having more sinks doesn't matter, it is the flow that matters. Same should be true with a network. I am happy to have a capped bandwidth (500Kbs) because I am paying a flat rate for that. However, the four computers I have can't get more data through than one on its own could so what is the problem? What happens if I want to play around with a beowulf cluster? Are they going to outlaw clusters unless you can get some special exemption? You certainly wouldn't want to have to get an IP address for every machine in a big cluster. Oh, and what about the company providing the connection, are they going to ensure that if I have to pay for individual connections for each machine they will still protect me from all the twits who probe my system on a daily basis and do a better job than I can myself with my gateway? This bill is only going to benefit the money grabbing service providers and those idiots who love to try to root machines.

IMHO of course :-)

Re:Also with effect 31 March...

[Jah-Wren Ryel]

The point is not whether it would stand up in court, the point is that it is a form of legalized harrassment. If the cops, or anyone else in the law enforcement power structure, doesn't like you for any reason valid or not, they have just one more tool to fuck you over with impunity.

Sometimes just calling you a terrorist is more trouble than its worth, probably gets the FBI and the Dept of the Fatherland involved which might actually question a few too many baseless accusations. This law just keeps their options open.

This applies to UNLAWFUL devices

[ShinmaWa]

Most of you are missing a key phrase in the legislation. The part most people are leaving out is: A person shall not assemble, develop, manufacture, possess, deliver, offer to deliver, or advertise an unlawful telecommunications access device....

Now, what is an "unlawful telecommunications access device"? That is answered under 750.219a which is entitled:

750.219a Obtaining telecommunications services with intent to avoid charge; violation; separate incidents pursuant to scheme or course of conduct; enhanced sentence based on prior convictions; definition.

Section 219 defines an unlawful device as:

(a) A telecommunications access device without the authority or consent of the subscriber or lawful holder of that telecommunications access device.

I read this to mean to hijack someone else's "telecommunication device".

(b) A counterfeit telecommunications access device.

If you read the section further, this applies to illegal cable descramblers and stuff like that.

(c) A fraudulent or deceptive scheme, pretense, method, or conspiracy, or any device or other means, including, but not limited to, any of the following:
(i) Using a false, altered, or stolen identification.
(ii) The use of a telecommunications access device to violate this section by a person other than the subscriber or lawful holder of the telecommunications access device pursuant to an exchange of anything of value to the subscriber or lawful holder to allow that unlawful use of the telecommunications access device.

I think we can all agree that FRAUD is bad.

Are we all reading the same law?

[hoggy]

I fail to see anything in this amendment that applies to VPNs. It appears to be specifically designed to target phone phreaking. It's all about screwing with telecoms services. VPNs don't do that.

They don't obtain telecoms services without intent to pay (1a), they don't conceal the origin or destination of the traffic (1b), and they don't intercept, disrupt, re-transmit, or otherwise fuck with your, or anyone else's, service (1c).

Unless you've deliberately cracked your ISP in order to run your VPN, you've not fallen foul of this law.

Get some perspective.

[Interestingly, this does appear to make IP address spoofing illegal - but I consider that to be a good thing.]

you got it

[zogger]

You got it. You need to read this legislation in the light of all the other legislation out there, signed into law or proposed. A Police State needs for everyone to be a criminal on paper, to have that potential,to be able to use that against them. Look at oregons proposed policial demonstration law. Walk in the street in a demonstration, you are facing 25 years to life. Use a normal router, with how it normally works, you are a criminal. Go into patriot act 1 and now 2, which they are migrating to different other bills to get it passed. Misdemeanors can be classed as supporting terrorism. You really don't want to be classed as a terrorist. You can become an un-person very quickly, and it wouldn't be in there if they weren't planning on using it, even more extensively than they are now. The gestalt with computers in general is that computers allow anonymous and semi anonymous and easy communications for the average person. Police States don't like that.

This is REAL stuff in all our faces. You can't keep up with it now,laws, laws,laws and more new laws, daily. It's at the federal level and all the state levels, assaults against born-with rights, just being a normal person, are fully underway, it's not theoretical or tin foil hat. This article is an example of just another one. Add 'em all up. Pretty spooky.

Thanks for sending that letter, looking forward to see what they say, if you get a credible response.