CenturyLink briefly disabled the Internet connections of customers in Utah last week and allowed them back online only after they acknowledged an offer to purchase filtering software.
CenturyLink falsely claimed that it was required to do so by a Utah state law that says ISPs must notify customers "of the ability to block material harmful to minors." In fact, the new law requires only that ISPs notify customers of their filtering software options "in a conspicuous manner"; it does not say that the ISPs must disable Internet access until consumers acknowledge the notification. The law even says that ISPs may make the notification "with a consumer's bill," which shouldn't disable anyone's Internet access.
Coincidentally, CenturyLink's blocking of customer Internet access occurred days before the one-year anniversary of the Federal Communications Commission repeal of net neutrality rules, which prohibited blocking and throttling of Internet access.
"Just had CenturyLink block my Internet and then inject this page into my browser… to advertise their paid filtering software to me," software engineer and Utah resident Rich Snapp tweeted on December 9. "Clicking OK on the notice then restored my Internet… this is NOT okay!"
Just had @CenturyLink block my internet and then inject this page into my browser (dns spoofing I think) to advertise their paid filtering software to me. Clicking OK on the notice then restored my internet… this is NOT okay! pic.twitter.com/NtCZUeJF8I
— Rich Snapp (@Snapwich) December 9, 2018
“Your Internet service has been fully restored”
Snapp's Internet access went out while he was watching streaming video via his Amazon Fire TV device. Since he wasn't sitting in front of his computer, it wasn't immediately obvious why his whole Internet connection went offline, he wrote in a blog post Thursday.
"After trying to debug the issue for a bit with no success I went to my computer, which was still connected to my ISP, but was also experiencing a strange lack of Internet," Snapp wrote. "Eventually I turned to a Google search on my phone only to be immediately greeted with an official looking notice."
That's when he saw this message from CenturyLink, informing him that he could buy filtering software:
"At first glance I was worried that I had somehow been redirected to a malicious website and that this was some kind of phishing attempt… After all, I didn't navigate here," Snapp wrote. "I attempted to do another search but still ended up at this same notice. I considered the idea that maybe my ISP had detected some kind of threat coming from my network and that's why I was seeing this official looking page."
Snapp eventually clicked "OK" on the CenturyLink message, and his Internet came back. A new message from CenturyLink appeared, saying, "Your Internet service has been fully restored. If you are unable to access the Internet within 5 minutes, please power your modem off [for] at least 30 seconds."
State senator: No requirement to block access
Other Utah-based CenturyLink customers complained about the temporary blocking on Twitter and Reddit. A CenturyLink spokesperson responded to a query from Utah-based news site KSL.com, saying, "As a result of the new law, all CenturyLink high-speed Internet customers in Utah must acknowledge a pop-up notice, which provides information about the availability of filtering software, in order to access the Internet."
But as we previously noted, that isn't what the law says. The law states that ISPs may provide the notice either "by electronic communication," "with a consumer's bill," "or in another conspicuous manner," and does not require ISPs to disable Internet access until customers acknowledge the message.
Bill sponsor Todd Weiler, a Republican state senator, confirmed on Twitter that the law "did not require that—and no other ISP has done that to comply with the law. They were only required to notify customers of options via email or with an invoice."
ISPs have "had all year to comply," and most had already done so, Weiler continued. For example, "AT&T sent [the required notice] with a monthly invoice," Weiler wrote.
We contacted CenturyLink this morning and asked if the company simply misunderstood the law. In response, a CenturyLink spokesperson acknowledged that the law provides several options for compliance but defended the ISP's decision to temporarily block Internet access. CenturyLink's statement to Ars is as follows:
The intent of the Utah state legislation is to ensure that Utah internet consumers are aware of content filtering options to protect minors. The statute provides for various options, but the method of notification is to be conspicuous to ensure the message is read. We felt, given the gravity surrounding the protection of this most vulnerable population, the most conspicuous method of notification is a pop-up. CenturyLink did not engage in DNS hijacking and the pop-up message is being used to adhere to state law.
The message was sent only to residential customers, CenturyLink also said.
[contf] [contfnew] 
Ars Technica
[contfnewc] [contfnewc]
