Re: Amazon AWS cloudfront WAF block

[William Herrin via NANOG <nanog () lists nanog org>]

On Thu, May 29, 2025 at 10:57 AM Andrew Kirch <trelane () trelane net> wrote:
> (A)any action voluntarily taken in good faith to restrict access to
> or availability of material that the provider or user considers to be
> obscene, lewd, lascivious, filthy, excessively violent, harassing,
> or otherwise objectionable, whether or not such material is
> constitutionally protected

Hi Andrew,

The key phrase here is "taken in good faith." After I've notified you
of an error, your action stops being good faith. You've either
investigated my complaint and determined your action is reasonable and
correct, investigated my complaint and fixed your error, or failed to
investigate my complaint. Whichever way you go, it's no longer a "good
faith" matter and this section of the statute no longer applies. Your
following action has to stand the test of reasonability without it.

In the Spamhaus case, their defense was: "We merely published a
summary of our observations about the plaintiff's behavior." That's an
objectively reasonable thing to do.


> I don't have to accept your traffic.  Amazon doesn't have to accept
> your traffic.  No one has to accept your traffic.  I can deny your
> traffic for any lawful reason even if that traffic might be otherwise
> constitutionally protected.

"We reserve the right to refuse service," is a very common sign but it
has no force of law. If you refuse service without a reasoned and
articulable cause, you run afoul of a thousand statutes and precedents
which bound the lawful causes for doing so. Tortious interference is
one of those precedents. It says that if you knowingly prevent third
parties from completing a reasonable and lawful contract with each
other, you're liable for the damage that interference causes.

There are, of course, many more lawful reasons for refusing service
than unlawful ones. But you can't be arbitrary or capricious about it;
you have to be able to articulate a cause for that specific refusal
that a reasonable person would find sensible.

Section 230 doesn't undo the tortious interference precedents. It just
reminds the judge that _knowingly_ is a part of the claim the
plaintiff must prove with specificity. That your interference was
unintentional is a winning affirmative defense.

tl;dr: you claim that section 230 means ISPs can legally do whatever
they want blocking network traffic no matter how reckless. That's
simply not the case. It protects ISPs behaving _reasonably_.

Regards,
Bill Herrin


-- 
William Herrin
bill () herrin us
https://bill.herrin.us/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/GFCQVZFR3N5ZIBHO447XRMM34H7FAOCV/