0

For the purposes of this question, let's simplify what VPN operators do as "they allow their customers' internet protocol (aka IP) addresses to appear as other (veneer) IPs to the counter-parties to which those customers connect."

I am fully aware that there are private IPs that are mapped to public IPs for the purposes of routing connections. This is not what's at question here. At question here is the arrangement in which public IPs are masked by presenting traffic to site operators as appearing to originate from the veneer IPs of the VPN operators.

This allows (for example) users in a country A to route their traffic through a commercial VPN operator in a country B and access services in country B which are restricted to users from country A. This can be used to subvert both intellectual property restrictions on traffic and legal restrictions that site operators attempt to enforce by geography-based restrictions.

At first glance, it may seem that it would not be impossible to track all veneer IPs and identify them as such publicly. So a knee-jerk response to this question might be "there is no need for such a law." However, while it may be possible to track all IPs used by a commercial operator of a VPN which engages exclusively in VPN business, it is not possible to track all IPs dedicated to VPN business by an operator which has many other forms of business.

So, for example, NordVPN's IPs can be identified as belonging to NordVPN, but IBM's or Google's IPs cannot be identified as used exclusively in their VPN business.

Since there is a public policy interest (mentioned in the 3rd paragraph of this question) in knowing which IPs are VPN veneer IPs, Congress may decide to require commercial VPN operators to register those veneer IPs in a way which would make them clearly distinguishable from non-veneer IPs used by the same entities.

Would that be constitutional? More specifically, is there any case law which may be relevant to deciding whether this would be constitutional?

2
  • regarding tracking of IPs of a company: IP address range registrations are generally public. For every IP, you can see which company currently owns it (Keywords: ARIN, RIPE database). For most people that company would be an ISP. It is in a company's self-interest that IP address ranges used for different purposes can be distinguished, e.g. so that NordVPN's offices aren't blocked from sites that just want to block VPN users. – amon May 1 at 9:14
  • @amon I know at least Google pools the IPs they use for many purposes. I am not sure if they have a commercial VPN offering or (if they do) if they pool with the rest. – grovkin May 2 at 0:26
6

Such a law would be constitutional

The US Congress could decide to require VPN providers to register the IPs that they provide to VPN customers. The use of such techniques would almost surely be considered "interstate or foreign commerce" and so Congress would have power under the Commerce Clause of the constitution to legislate concerning it.

There would clearly be a rational basis for such a law -- the question outlines such a basis. This is not an area subject to strict scrutiny. None of the previously established limits on the commerce power (and there are few) would seem to apply.

State laws on this topic would probably be preempted by the dormant commerce clause if Congress does not act, and clearly preempted if Congress does act, unless Congress explicitly permits concurrent legislation.

Whether Congress should act on this matter is a policy question not on topic on Law.se. Whether Congress will act is speculation. I can only say that I am not aware of any widespread demand for such action, or any proposed bills, on the topic.

However, there is US caselaw to the effect that anonymous speech (or other communication) is protected by the First Amendment , and that laws effectively banning anonymous speech are not acceptable. But there are other ways of anonymizing online speech, so that would not seem to provide sufficient grounds to overturn such a law.

3
  • I am not aware of any initiatives on the subject, either. I am only trying to think through the implications of some of the concerns which are raised about VPNs. – grovkin Apr 30 at 23:44
  • @grovkin it might make the whole idea of a VPN useless. – Trish May 1 at 11:11
  • @Trish it would put all commercial offerings on the same footing as the VPN-only vendors. – grovkin May 2 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.