In a well-intentioned yet dangerous move to fight online fraud, France is on the verge of forcing browsers to create a dystopian technical capability. Article 6 (para II and III) of the SREN Bill would force browser providers to create the means to mandatorily block websites present on a government provided list. Such a move will overturn decades of established content moderation norms and provide a playbook for authoritarian governments that will easily negate the existence of censorship circumvention tools.

While motivated by a legitimate concern, this move to block websites directly within the browser would be disastrous for the open internet and disproportionate to the goals of the legal proposal – fighting fraud. It will also set a worrying precedent and create technical capabilities that other regimes will leverage for far more nefarious purposes. Leveraging existing malware and phishing protection offerings rather than replacing them with government provided, device level block-lists is a far better route to achieve the goals of the legislation.

  • While I could see maybe the larger companies operating in France agreeing to implement this, I don’t think they would be able to legally force a smaller foreign open source browser developer into the same practice? Take qutebrowser for instance, the developer is from Switzerland. Unless their website is hosted in France, I don’t see how French law applies to him, nor the site he is hosting the browser on? They would have to use ISPs to block the website, but even then, you could still get it through GitHub. Maybe GitHub could be forced into removing the browser as Microsoft probably have a French office, but it still seems like a legal and practical nightmare to actually enforce this through the browser. As someone else mentioned, pushing rules on ISPs seems like a more doable thing if you WANT to oppress people (which I am also against of course).