Skip to content
Naked Security Naked Security

Welcome to HTTP error code 451: Unavailable for legal reasons

It's meant to let you know that you're not seeing what you want to see because a site's been blocked for legal reasons, be it censorship or otherwise.

There’s a new addition to the 400 family of error codes: give a hearty welcome to newcomer 451, the HTTP code that lets you know that you’re not seeing what you want to see because it’s been blocked for legal reasons.

Of course, it’s named after Ray Bradbury’s dystopian 1953 novel about censorship and book burning, Fahrenheit 451.

On Friday, the Internet Engineering Steering Group (IESG) approved publication of 451, the formal name for which is “An HTTP Status Code to Report Legal Obstacles“.

Tim Bray brought the draft to the HTTP Working Group a while ago, inspired in 2012 by a Slashdot thread about British ISPs returning 403 for Pirate Bay requests because of a court order.

The intent of the Error 451 message is to make it crystal clear when such a website has been legally blocked.

Mark Nottingham, chair of the IETF HTTP Working Group, writes that the draft has been in the works for a while, steadily pushed forward by those who argue that the 403 status code – which simply says “Forbidden” – doesn’t highlight online censorship.

There was pushback.

For one, there’s a finite number of name spaces that fit in the 400 to 499 range, which is used for error codes.

But with the rise of online censorship, some sites began to adopt the code experimentally, Nottingham said, and more began to call for the ability to let people know the content was being blocked due to legal reasons:

As censorship became more visible and prevalent on the Web, we started to hear from sites that they'd like to be able to make this distinction.

That includes Lumen, previously called Chilling Effects, a database that collects and analyzes legal complaints and requests for removal of online materials; and Article19, which works on behalf of freedom of expression.

Both expressed interest in being able to spider the Web to look for the 451 status code in their efforts to catalog censorship, Nottingham said.

The code might seem like a victory for free speech: similar to the warrant canary, a puff of smoke rising from the mine in which the canary’s been muzzled.

But as we noted when we wrote about the code a few years ago, those who are dead-set on censorship won’t have much problem stifling the “we’ve been censored” code.

A regulatory body could still bypass it by issuing a court order specifying not only that a page should be blocked, but also precisely which HTTP return code should be used.

Nottingham:

In some jurisdictions, I suspect that censorious governments will disallow the use of 451, to hide what they're doing. We can't stop that (of course), but if your government does that, it sends a strong message to you as a citizen about what their intent is. That's worth knowing about, I think.

There’s a lot to be said for adding a bit of transparency into legally mandated internet opacity.

But we should bear in mind that a legal block doesn’t always neatly translate into the presence of censorship.

“Legal reasons” for blocking sites could have to do with ongoing criminal investigations, for example, or those involving minors.

Nottingham writes that error code 451 can be used both by network-based intermediaries (e.g., in a firewall) as well as on the origin Web server, but he suspects it’s going to be used far more in the latter case, as sites like Github, Twitter, Facebook and Google are forced to censor content against their will in certain jurisdictions, due to right to be forgotten orders, government suppression and other forms of censorship.

Image of error on computer screen courtesy of Shutterstock.com

3 Comments

I think you probably can call all legal blocks censorship, but I don’t think censorship is always a bad thing.

It’s not clear to me exactly what the new code is supposed to apply to. If a website operator notices that they accidentally posted some copyright work without permission should they remove it and serve a 451 code instead of 404 or 410? Or only if they they receive a specific demand to remove that piece of content, rather than the general demand written into the law?

What if there is a legal demand to remove some content but the website operator also wants to remove it for reasons other than complying with the law?

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?