top | item 18682580

CenturyLink is blocking customer internet, saying Utah legislators told them to

830 points| snapwich | 7 years ago |richsnapp.com

283 comments

order
[+] xahrepap|7 years ago|reply
CenturyLink is totally shady. My wife just yesterday spent a significant amount of time fixing our phone bill. She decided a couple months ago to upgrade to a "fixed" bill plan (apparently they've been raising our prices $10/mo every year for the last few years). This plan price won't change until we change the plan. It's bundled with their internet though, but my wife told them to not send the modem because we weren't going to be using it and didn't want to be charged for it.

Fast forward to yesterday and we had a modem in the mail a $200+ bill for our landline that should be <$60. She called and the guy on the other end was very helpful (surprisingly). He went through the bill line-by-line and almost every time said something to the extent of, "Why is that here?" "I'm going to have to talk to {previous sales lady who 'upgraded' us}". Some of the items he didn't even know what they were and couldn't remove them, so he instead gave us a permanent $10/mo discount or whatever it was billing.

About the modem, he said, "You can keep it or mail it back. I can make a note on our software that you didn't want it and it shouldn't bill you for it. However, I recommend you mail it back because sometimes that note will disappear from our software and start charging you again".

Wait... what!? Did he just acknowledge what some of us has suspected all along? That their software has intentional "bugs" that don't remember to stop billing someone for something?

The whole thing feels like a scam to me. I don't trust them at all. This isn't the first time and won't be the last either.

The reason we haven't canceled? No other traditional landline offerings in our area. Everything is VOIP or Cell. My wife wants something independent for emergencies. She's starting to question the value of it all though.

[+] illumin8|7 years ago|reply
The quickest way to resolve all of these billing shenanigans: file a consumer complaint with the FCC. Magically, you'll almost immediately get a phone call from someone fairly high up in the company (typically executive relations or similar) that has the power to fix things and will make it right.

The sad truth is that these telcos will systematically screw millions of customers with shady fees and fraudulent billing practices, but when the FCC gets involved, they are facing potential fines of tens of thousands for each infraction, so they'll bend over backwards to get you to drop the complaint.

Try it sometime, it sucks that it's necessary, but you'd be amazed at the results.

[+] mrdoops|7 years ago|reply
When municipal fiber started moving into Utah, CenturyLink was a big offender of paying off local authorities to restrict and limit deployment. Lots of cities and areas didn't get upgraded for that reason. Less customers for fiber meant less customers to payback the investment - ends up costing everyone else more. CenturyLink is textbook rent-seeking behavior.

My advice to anyone moving into the Utah area is check the internet service provider options first. Last thing you want is to be in an area serviced only by CenturyLink.

[+] wlesieutre|7 years ago|reply
A friend of mine signed up for them on a promo, got charged 3x the price he was supposed to, then was told “We didn’t apply the promo, but that’s only for new customers and you’re a customer now so we won’t fix it.”

Thankfully he lives in one of the few places with multiple providers, so he told them to stuff it.

[+] lettergram|7 years ago|reply
I had a similar issue with comcast. I sent back a modem I didn't need, took photos and even had a receipt. After around 8 hours of phone calls asking them to remove it from my bill and them giving me the run around. They continued to charge me and sent my bills to collections.

At collections, it continued like this for months, I sent photos, I even had a recording of a comcast manager saying "we shouldn't have billed you, and will remove the charge".

After 18 months of fighting this $300 charge and around 30 hours of debates... I just paid the bill

[+] otakucode|7 years ago|reply
An important bit of law to always keep in mind, as companies bank on consumers being ignorant of it: If a company mails something to your home that you did not expressly order - it's yours. End of story. They cannot request that you send it back, they can not charge you for it. It's yours. This includes if you ordered product A and they sent you product B by mistake. Legally speaking, in that situation you were sent a gift and the company has done nothing to satisfy their legal obligation to send you the product you purchased.

If companies could just send you things and bill you without you ordering anything, we'd all be buried in mountains of garbage and steep debt. Keep the modem as a gift courtesy of CenturyLink. Watch your bill and if they charge for anything you haven't received, if you've got the time, file fraud claims in small claims court to recover the money.

[+] krupan|7 years ago|reply
"My wife wants something independent for emergencies."

Have you considered ham radio?

[+] c22|7 years ago|reply
Heh. I've mailed my modem back (twice) and I still get billed for two modems (!) at least once every year.
[+] Jach|7 years ago|reply
Might getting a ham radio and learning how to operate it (getting a technician's license together) be an alternative to a landline for having something in emergencies?
[+] stickdogg|7 years ago|reply
Of course. Companies stating that info has been misplaced, or taken over by a different representative, or whatever has been happening since the dawn of time. It used to be a kind of CYA. As tech has increased to where I can record every call made on my phone or line and specs about it. If you don't know that they have all your data, now you do, because they do. I believe this tactic will stay around for a bit as a last ditch bully attempt.
[+] anoncoward111|7 years ago|reply
I work customer service for a large heating oil company. The system we have really does just have horrible "bugs" like this that make charges to the account. Not fun when you are on Auto Pay either.

It's malicious. Some of us reps try to help you out and get it all reversed. Others don't give a shit at all.

The main thing you can consider is not paying, blasting them on social media, or just keep calling until you get a nice rep who will fix it, hopefully permanently.

Our system deliberately renews/adjusts prices per gallon and service contracts to pretty much whatever price the company feels like extorting. I've seen customers charged $4000 instead of $2000 countless times. Some even pay it.

[+] aviv|7 years ago|reply
Among other things, we run residential VOIP networks for large ISPs and other operators, and it's ridicilous to see the prices CenturyLink, AT&T and others charge their home customers for just phone service... I regularly come across LOAs and phone bills for $60 to $120 single home phone lines - for absolutely no reason other than that they can get away with it.
[+] twhb|7 years ago|reply
“It’s because the law gave them too much leeway” doesn’t make sense. If you have leeway, you choose the easiest and cheapest method, not the one that involves building a whole new communication system.

“They thought it was the only way to satisfy the law” also doesn’t make sense. There’s no reasonable way to get that from the law, they didn’t confirm it was necessary, and they didn’t publicly fuss about being forced into a large expenditure.

Today is, by the way, the one year anniversary of the repeal of net neutrality. ISPs, including CenturyLink, were viciously fighting to end rules preventing the sale of selective internet access, and won. In order to sell selective internet access, you need exactly the system that just showed up. This system would take a while to build—maybe a year. And once it’s built, you would want to test it. The test would put your capitalization on the lack of net neutrality in the spotlight—unless you just serve a legal notice, and pretend you thought you had to. For that to work, you need to make sure people know the “legally required” part; for a legitimately legally-required notice, companies typically don’t say as much. CenturyLink literally highlights it.

[+] B-Con|7 years ago|reply
> “It’s because the law gave them too much leeway” doesn’t make sense. If you have leeway, you choose the easiest and cheapest method, not the one that involves building a whole new communication system.

No, you choose the most self-interested option. That type of criticism is usually levied against laws that provide an incentive to enforce it in a self-serving way.

In this case what CenturyLink did should itself be illegal. CenturyLink knows fully well this was a self-serving move and they likely only did it because they're betting they can avoid lawsuits by blaming the law.

Interfering with traffic on a paying customer's active account should be illegal so there is no option to do this for any reason.

[+] nacs|7 years ago|reply
1) Most ISPs have something like this router/software -- one that is capable of injecting/redirecting web requests to whatever they want. I remember seeing this kind of thing when I was a Comcast customer -- they implemented a bandwidth limit and to warn you that you were about to exceed it, they used this type of web request injection.

2) There's likely a profit motive here as the software that is being advertised via this injected message costs money. They're likely getting a commission/affiliate fee from every customer that installs said software via this notice.

[+] nickodell|7 years ago|reply
>involves building a whole new communication system.

Did this require building a new communication system? Comcast has a similar injection system for reminding you to pay your bill, or to notify you that you've been accused of piracy.

Maybe this was done using hardware and software they had lying around.

[+] pwg|7 years ago|reply
And here we see the disconnect between what politicians say, and what they write into law.

The bill's sponsor's response to the blog authors query:

SB134 did not require that ...They were only required to notify customers of options via email or with an invoice.

And here is the text of the statute that was written:

    (ii) A service provider may provide the notice described in Subsection (2)(b)(i):
     (A) by electronic communication;
     (B) with a consumer's bill; or
     (C) in another conspicuous manner.
Note the difference in language breadth. Bill sponsor: "via email" - text of statute: "by electronic communication".

And note clause (C): "in another conspicuous manner".

Century link is notifing by: "electronic communications" (DNS hijacking to force viewing of the page is "electronic communications") and/or by "another conspicuous manner" (it is definitely "another" and it is clearly "conspicuous" (one will not miss it)).

So, the fault here lies with the politician. He wrote a law that allowed Century link too much leeway to "do whatever they wanted to do to notify". If they were really only required to "notify ... via email or with an invoice", then clause (A) should have said "via email" and clause (C) should not have been present.

[+] dragonwriter|7 years ago|reply
> So, the fault here lies with the politician.

I disagree: the claim by CenturyLink that this particularly intrusive, access blocking method is mandated is simply false. It's true that it is permitted by the state law (just as it would be permitted without any specific law on the topic at all), and even arguable that it is one means of complying with the law. (Though since the notification is not presented to some users, it's arguably not even fully compliant.)

But, even if it were fully compliant with the law, it's not any lawmaker’s fault that CenturyLink chose to implement pretty much the most user-hostile method imaginable (short of, say, posting sings on its customers lawns, facing the windows of their home, illuminated with burning crosses—which would likewise be “another conspicuous manner”) to fulfill the notification requirement.

[+] JohnFen|7 years ago|reply
"So, the fault here lies with the politician."

No. The fault lies with CenturyLink. They're the ones who decided to implement this in the most repulsive way allowed by law.

The law only required notification using normal communications methods, not disruption of services. CenturyLink is the one who chose disruption of services.

[+] acdha|7 years ago|reply
Imagine if it had said “written communication” and CenturyLink had chosen to block your driveway with a sign or toss a note pasted onto brick through your window. Would you be as quick to say it was the fault of the law rather than how they chose to interpret it?

Laws are not source code and they assume some level of good faith interpretation because most real-world activities are complicated and change over time. If “email” was written into the law then we'd get some equally silly complaint about how they're using a system favored by old people while younger users want SMS, Twitter, Facebook, etc. notifications or that an important notice was spam-filtered. Stating “electronic communications” leaves those options open so time doesn't need to be spent revising the law later.

[+] jedberg|7 years ago|reply
It is generally bad practice to write laws with specific technologies listed as solutions, because then the law is easy to skirt by using another technology, or the law becomes stale as technology changes.

That being said, this law already had a specific expiration date, and there was little fear that email would be an old technology by the end of this month.

They should have written a better law.

[+] jay-anderson|7 years ago|reply
Writing laws feels a bit like a monkey's paw. No matter how well written a law is they often have unintended consequences or are implemented manners that weren't imagined.

I don't think the bill's author/sponsor is fully to blame (they aren't guiltless either). Centurylink certain did not have to implement this requirement in the way it was done. The most depressing aspect to this is the lack competition. The author is unable to move to a competitor which did not behave this way.

[+] anthuswilliams|7 years ago|reply
The law required CenturyLink to notify its customers and intentionally did not mandate a particular means of doing so. This is a feature, not a bug.

Now, shady DNS spoofing may be one means of complying with the law (though it may violate others), but it was CenturyLink that chose this non-standard approach. They could instead have complied by sending an email, a physical letter, a messenger physically knocking on a customer's door etc., a flier hung on the doorknob, etc.

[+] patrickyeon|7 years ago|reply
That's still misleading, at best, for CenturyLink to claim that the law "requires them" to do it this way. There are easier methods to provide the notice (email or with a bill), and there's nothing that could even be contsrued as encouraging them to do this DNS hijacking in the text you provided.
[+] rayiner|7 years ago|reply
I don't really see this as an example of a "disconnect." It's simply the difference between talking about a law informally, and the actual formal implementation of the law.

The intent of the law is clear: customers should be notified that this content exists. The implementation language reflects that. CenturyLink is simply covering its ass: many people don't use ISP-provided email addresses, so if that's all they did they would be open to criticism that they are not actually trying to achieve effective notice.

[+] xxpor|7 years ago|reply
Politicians don't actually write laws, they have legislative assistants (that work for the body itself usually). I think the entire law is stupid, but how is it his fault that CL took the law and notified its customers in the most obnoxious way possible?
[+] KevinEldon|7 years ago|reply
Nonsense. CenturyLink took an open ended option and made an absolutely terrible implementation decision and then tried to blame the law.
[+] hodgesrm|7 years ago|reply
So what's your preferred language? Can you suggest something that covers all cases without introducing undue limitations?
[+] kodablah|7 years ago|reply
Kinda changing topic, what does the law require wrt filtering? So all ISPs are required to provide harmful-to-minor filtering software? Is it pure DNS, HTTP, or based on initial TLS handshake using the domain? So it won't catch stuff on Reddit, right? And must they have their own filter lists or is there one shared across the state? Who are the arbiters determining what is harmful to minors?

I would really love any links to the implementation side of this bill. The text of the bill itself is vague with words like "good faith" and "generally accepted".

[+] ajross|7 years ago|reply
> So, the fault here lies with the politician.

I'm sorry, what kind of ethical nonsense is that? "Bad behavior is OK as long as some authority didn't expressly disallow it" ???

CenturyLink is simply a bad actor here. They're acting in an anti-customer and anti-consumer way. Sure, we should have regulations to prevent abuse where appropriate, but you certainly can't blame the government for failing to imagine how they'd behave when faced with (let's be honest here) a bleedingly obvious and common sense notification requirement.

[+] fpgaminer|7 years ago|reply
Hmmm, so if I were on CenturyLink and in the "SOL" category the following could have happened.

Attempting to email my state senators to express a political opinion? Freedom of speech: Blocked.

Buying from a company online, located in another state? Interstate commerce: Blocked.

Trying to run an online business? Blocked.

Trying to contact my kids? Blocked.

My elderly grandmother is dying and family was trying to Skype me in since I couldn't make it? Blocked.

The number of constitutional laws, federal laws, and moral laws broken here is mindbogglingly astronomical.

Good luck, CenturyLink.

[+] waffle_ss|7 years ago|reply
The original article title is more accurate. Replacing "CenturyLink" with "Utah ISP" as if they're some podunk lil' no-name ISP is misleading.

CenturyLink is a Tier 1 ISP, and 5th largest in the country by customer count. Maybe city folk haven't heard of CenturyLink but they have monopolies over vast swathes of rural copper networks.

[+] LeoPanthera|7 years ago|reply
I use Xfinity. (It’s my only option for internet.) They would routinely inject crap into unencrypted HTTP webpages, bill notifications, adverts for antivirus, stuff like that.

In the end I configured my (pfSense) router to forward all data on port 80 (and a small selection of other commonly unencrypted ports) through a VPN to a local VPS. Port 443 HTTPS is still allowed to connect directly.

Makes me feel a lot better. Comcast should be a dumb pipe, not fucking with my data.

[+] zapdrive|7 years ago|reply
So what happens if a CenturyLink customer is not using their DNS, and using for example Google's DNS. They will suddenly have their internet disabled and will never see this page, where they have to click "OK" to reconnect their internet.
[+] wl|7 years ago|reply
It's sad that even ISPs seem to think that WWW = the internet these days. If I were traveling and I couldn't VPN into my home network because of this, I'd be really pissed.
[+] kstrauser|7 years ago|reply
I loathed CenturyLink when I had to deal with them. Quick reminder: they never specify which century they're linking you to.
[+] ryanolsonx|7 years ago|reply
This happened to my brother-in-law. He asked for help when his router wasn't "working". Since I'm pretty computer savvy, I agreed to come and "fix" it. Little did I know that it was this BS. I got to that notice and then finally the internet started working again.

This is a small reason why NET neutrality is important. Total BS. I'll never use CenturyLink. I've thought about it in the past, but after this, H no.

[+] logfromblammo|7 years ago|reply
I saw something similar with a hotel wi-fi setup.

In order to reach the Internet, you have to agree to the hotel's terms of service. The page to accept the terms of service is presented by redirecting any HTTP request from an unauthorized device. But (!) the redirect page was resolved by DNS, and DNS traffic to the Internet is also blocked. Only the local DNS resolver is accessible.

The instant any machine that specifies a specific DNS resolver tries to connect, the attempted redirect fails silently. In order to get things working, you have to clear your DNS settings to use the DHCP-specified DNS resolver, click the "accept" button on the redirect page, and then re-enter your previous DNS settings.

I wasn't so much angry that this was happening, than angry that they did such a ham-handed, botched job of it. If you're going to block outside DNS, you have to redirect to an IP address rather than a DNS-resolved address.

[+] hartz|7 years ago|reply
More widespread use of DNS-over-TLS/HTTPS/QUIC can't come soon enough
[+] hathawsh|7 years ago|reply
I'm not going to defend CenturyLink, but in the interest of attributing this mistake to incompetence rather than malice, I'd like to suggest how this might have happened. CenturyLink is a multi-state ISP and their generic system has limited ability to support state-specific policies. They have a well-developed system for creating state-specific packet processing rules, but they don't have a well-developed way to notify all customers in a state.

Therefore, when Utah surprised CenturyLink with a new law, they didn't have a way to comply with the law quickly except by changing their packet processing rules. This was the ugly result.

CenturyLink should obviously have some way to add state-specific notifications to customers' bills. I hope they learn that lesson from this ridiculous event.

[+] zzo38computer|7 years ago|reply
The customer might not even see it without compatible software, or if using a different port number or protocol, or if not using DNS to access something, or using a different DNS. Or if you are using a web browser but with customized settings that make it incompatible.

Same with many hotels. If you are not even using HTTP(S), or DNS, then it won't work, and even if you are using HTTP but not with a web browser program, it won't work (there is a HTTP response code (511) defined for this purpose at least), using nonstandard port numbers, etc.

For terms of service requirements, one possibility to avoid these problem is to make the printed terms of service document with the wi-fi password mentioned in that document.

[+] jrnichols|7 years ago|reply
Of all the way to inform customers of something, Centurylink picked the most obnoxious and intrusive way they could think of. wow.
[+] ryanolsonx|7 years ago|reply
This happened to my brother-in-law. They told me that their internet went down and that they need help. Since I'm good with computers, I came over to "fix"
[+] enzanki_ars|7 years ago|reply
I don’t think CenturyLink thought through the implications of what they just pulled. I know that there are a significant number of people that use VoIP services like Vonage.

Imagine waking up in the middle of the night with a need to call 911, but your ISP purposely broke your internet just to sell you a “security offering.”

[+] aplummer|7 years ago|reply
The comments here interesting but nuts for foreigners. I’m so used to a slight mention of an ombudsman being a 15 second turnaround to almost anything I ask for happening with ISPs / telcos. I worry about buying anything in the USA with such scant consumer protection.
[+] ngngngng|7 years ago|reply
Century link is my only option for internet here in rural Utah at a max speed of 3Mbs per second. Luckily our municipal network is going up soon with max speeds of 10GBs per second. I'm very excited.
[+] bradenb|7 years ago|reply
Well this sucks. I have CenturyLink for residential gigabit fiber. Honestly, they've been a fantastic ISP for me. I also haven't received the notice and I'm one of those "SOL" customers that uses non-CenturyLink DNS. We'll see what happens. I'd be surprised if they didn't stop this immediately as soon as it blew up.

I have been noticing comments from people in my area on social media over the last month with the recurring theme "Is anyone else's CenturyLink down?" This must have been it.