When blocking imposes borders on the Internet

For years, I have visited a website dedicated to automotive mechanics. It offered diagrams that helped me identify parts and understand how different components of my vehicle fit together. One day, those diagrams disappeared. The site itself still worked: I could read descriptions and look up part numbers, but the images would not load.

I initially thought the website was malfunctioning. So I ran a simple test: I connected through a different Internet service provider without changing computers or moving from where I was. The diagrams appeared again. The only thing that had changed was the network I used and, with it, the public IP address through which I accessed the site.

From what I was able to find out, the vehicle manufacturer had sent the content provider a notice concerning intellectual property rights. A geolocation-based restriction, known as GeoIP blocking, had apparently been applied, limiting access according to the country associated with an IP address. I had crossed no border; the system was interpreting my connection differently.

An IP address is not a physical address

Internet connections use IP addresses, identifiers that allow data to be routed between networks. Neither IPv4 nor IPv6 contains a field revealing the country or city where a person is located. When an online service tries to determine a visitor's location, it relies on external information to produce an estimate.

That is why two geolocation databases may associate the same IP address with different places. Regional Internet Registries, such as LACNIC, maintain administrative information about the organizations that receive Internet number resources. That information does not establish the physical location of each user. A company may administer addresses in one country and use them in another, or provide services across several territories.

Geofeeds allow network operators to publish information about where particular blocks of IP addresses are used. RFC 8805 and RFC 9632 describe how to publish and locate this information; the latter also provides for an optional authentication mechanism. Even then, an IP address does not become an exact geographic coordinate, nor does it identify an individual.

“An IP address does not, in itself, contain the user’s exact geographic location.”

When an estimate determines access

IP geolocation has legitimate uses: selecting a language, directing a connection toward nearby infrastructure, or managing territorial rights to certain content. The difficulty arises when an estimate is treated as a certainty and used to decide who is allowed in and who is kept out.

Geolocation and blocking are not the same thing. Geolocation estimates where a connection originates; blocking imposes a restriction. If the estimate is wrong, the access decision may be wrong as well. In my case, the diagrams returned when I changed providers, although my physical location had not changed.

The risk of affecting third parties

There is another form of restriction: an authority may order an Internet service provider to block an IP address associated with a particular service. In that situation, the restriction is applied within the provider's network, rather than by the website the person is trying to visit. But one IP address does not always correspond to just one website.

Shared hosting, cloud platforms and content delivery networks (CDNs) can place numerous domains behind the same IP address. Blocking that address to restrict one particular piece of content can also make unrelated services inaccessible. This unintended effect is known as overblocking.

RFC 7754 and RFC 9505 examine the limitations of blocking mechanisms and their potential effects on third parties.

“A measure may therefore block too many people who were never its target while failing to block enough of those who were.”

A restriction may not achieve the intended result

IP-based restrictions can be both too broad and incomplete. Someone who was not a target may lose access to a service that shares infrastructure with the blocked content. At the same time, another person may still be able to reach that content by switching networks or using a VPN or proxy, depending on how the restriction works.

This does not mean that every access restriction is unjustified. Copyright protection, responses to fraud, cybersecurity and compliance with court decisions may call for legitimate interventions. But a lawful objective does not guarantee technically precise implementation. Ordering access to certain content to be prevented is not necessarily the same as blocking an IP address.

Before imposing such restrictions, it is worth assessing which services share the infrastructure, how reliable the location estimate is, whether narrower alternatives exist and what mechanisms can detect and correct mistakes. The duration of the measure also matters, as does whether the harm to third parties is proportionate to its objective.

A signal, not a border

The Internet was not designed around national borders. An IP address helps route data and, when combined with external information, may offer clues about where a connection originates. It is neither a border nor a personal identity. Using it to restrict content can affect people and services unrelated to the reason for the block.

My experience with the automotive website illustrated this clearly: I was still in the same place, but my access changed because I was using a different network. When assessing a blocking measure, the question should therefore be not only what content we want to keep out, but also who might inadvertently end up on the other side.

Article originally published on the LACNIC Blog: https://blog.lacnic.net/bloqueos-geolocalizacion/