Netflix will have trouble blocking VPNs used to stream blocked content

The cry “Netflix to crack down on VPNs” reverberated in discussions on Reddit and then escaped onto Facebook and the press over the past week. The urgency of the alarm was more fitting of the repeal of the First Amendment of the U.S. Constitution than simple restrictions of a video service.

Ultimately, internet privacy technologies used to foster free speech in repressive countries will prevail over Netflix’s ability to block VPNs.

Until recently, most of the world’s population was restricted from watching Netflix streaming services. The restrictions weren’t set by censors or authorities in the countries themselves, but are laid out in the licensing agreements from the studios that provide Netflix video content. VPNs and smart DNS proxy services circumvent these restrictions by making subscribers who live in restricted regions appear to be streaming within U.S. boarders.

Worries about Netflix policing VPN and smart DNS proxy services began when the company announced it is expanding its streaming service to 130 new countries. This necessitated revisiting its many agreements to license content for each of the 130 countries, or the fraction of those countries that the studios would allow. Each country has a catalog of eligible video content available for streaming within its borders. In order to both provide content to new countries and meet its agreements with studios, Netflix would need to crack down on the services that allow ineligible content from reaching the wrong regions.

Demand for access to Netflix’s U.S. catalog among international subscribers is expected to keep growing until Netflix “can offer people the same films and TV series everywhere,” according to a blog post by Netflix VP of Content Delivery David Fullagar. He also said that “in coming weeks, those using proxies and unblockers will only be able to access the service in the country where they currently are.” Fullagar’s comments suggest an arms race between Netflix and its international subscribers.

It is technically impossible for Netflix to block all of its international subscribers. Even if the company could, it would lose substantial revenues from places like China, where it has over 20 million users (some of whom already use anticensorship and privacy technologies). To fulfill its obligation to its content licensors, Netflix will block the most obvious users of the most easily detectable unblocking services. In response, most of them will shift to better anti-censorship services.

Netflix will be able to detect the smart DNS proxies because they don’t mask the subscribers’ country-specific IP address, which must match a whitelist of the allowed addresses from the country for which the video content is licensed.

VPNs, however, can be much harder to detect and block. Netflix will be able to easily identify and block all the IP addresses in the regional internet registries, such as ARIN and RIPE, allocated to VPN services. There will be many dynamic and residential IP addresses allocated to entities that can’t be traced to the VPN services that are owned through another controlled entity or are leased from an Internet Service Provider. VPN services, especially those serving people in politically repressive countries, avoid being associated with the IP addresses used to deliver undetectable encryption and proxy services.

Compounding the difficulty of identifying the IP addresses associated with VPN services, VPN protocols can be obfuscated to look like normal traffic so that sensor can’t detect them. For example, projects such as OpenVpn and the Tor network use openvpn_xorpatch to slide encrypted traffic past internet censors.

Privacy technologies such as the Tor Project and OpenVPN are funded by a diverse group of public and private entities, such as Reddit, Princeton University, Federal Foreign Office of Germany,  SRI International, and the U.S. Department of State, all of which will continue to improve technologies used to avoid detection by the censors in repressive regimes. VPN services that help foreign subscribers watch Netflix will also benefit from this research in privacy technologies.

Netflix will make enough of an effort to block the most obvious unblocking services, but it won’t be able to technically – and won’t want to, financially – block all 54 million of its users that GlobalWebIndex says access the service via VPN.