The Back of the Envelope (a blog)

Who Writes the Laws of the Internet?

Today, the State Department sanctioned five European (EU + UK) employees of pro-censorship NGOs which work hand-in-glove with European Internet regulators to censor American citizens.

I thank the State Department for doing so. I’ve been working on the foreign censorship problem for the better part of a decade, and this is the first action the U.S. federal government has ever taken in defense of Americans’ First Amendment rights online from foreign encroachment.

In response, European politicians lost their collective minds. A sample of the hundreds of politicians and others in Europe opining on this issue today:

Et cetera.

First, the Europeans should not be even remotely surprised by the State Department’s actions today. If they were paying attention to the growing American counter-offensive against European censorship (and, for the most part, they almost certainly weren’t) they would have understood the federal government does not do something this huge on a lark, and would have seen this coming a mile away.

Second, this is not a complicated political problem. This is actually a really simple problem, much simpler than any European politician would make it. It has almost nothing to do with President Trump, despite many European politicians trying to make it about the President. Nor does this problem, in its purest essence, have anything to do with the US and Europe’s values diverging – that is simply the set of circumstances which has forced this sixty-year-old question, one the world has never really answered, into very sharp relief.

That question is this: in a world where law is confined to borders, who gets to write the laws of the Internet?

And, particularly, who gets to write the laws for American citizens on the Internet?

The answer to both questions will be the same, but that answer is, for the moment, not yet resolved. There are, and long have been, two competing approaches.

The European approach is that nations will broadly harmonize domestic censorship systems (the EU, the UK, Australia, New Zealand, Brazil, Singapore, mainly) all singing from approximately the same hymn sheet. U.S. companies are then expected to harmonize as well, or be locked out.

Under that theory, this X-operated data center in Tennessee is effectively subject to Europe’s sovereign control:

The alternative approach is that borders have meaning. American companies and American websites follow American rules, and that choice is backed up by American power.

I wrote about this in September. I call this new American doctrine lex loci machinae: the law of the webserver is the law of the website.

For years, nations and tech majors sleepwalked into this problem by muddling along, trying to be in compliance with all national laws at all times, even when the legal requirements American publishing companies were expected to comply with from different countries directly contradicted each other (making true compliance on a global basis impossible), and trying to keep everyone happy and do their best, instead of asserting constitutional defenses along the way -defenses that only a handful of (usually tiny) companies were ever willing to invoke. The strategy of the countries that didn’t have the First Amendment – or any of its competitive advantages – was to try to bring U.S. companies down to their level, to force Americans to compete with their domestic champions on domestic rules that would, comparatively speaking, be disadvantageous for the the Americans.

Their strategy relies on a bluff: that transnational censorship “harmonization,” vis-à-vis the United States, would simply be accepted by the Americans, who, for the sake of simply getting along, would be willing to throw the First Amendment away. “The Yanks rolled over with the GDPR, even though there’s no way we can lawfully enforce the GDPR in an American court,” Brussels and London probably thought. “They’ll roll over on the Digital Services Act and the Online Safety Act, too.”

But no Americans died for American data protection regulations that exist, are constitutionally permissible, and are like the GDPR, such as the CCPA/CPRA or Indiana Consumer Data Act. A lot of Americans died for the First Amendment, and we have been willing to die for the First Amendment for the better part of 250 years.

The reason Europe is flipping out over the visa bans is that this bluff has now been called, in the most public and spectacular way possible. The moment the U.S. government signaled it would no longer play along, the harmonization model began to collapse.

It’s a new world.

The second America decides to enforce its borders online, and use its power to defend them, the transnational censorship project fails. Relations between states are not ultimately about laws. They are about power. America has more. This means that American lawmaking, such as a federal GRANITE Act, can end this fight for good.

I’ve been eagerly waiting for this day for ten years. It’s why, when the UK called me in 2023 and asked whether my clients would comply with the Online Safety Act, I laughed and replied that they would do so as soon as the UK could successfully invade the United States which, of course, is something the UK is in no position to do.

This is why arguments like “EU law says X” or “UK law says Y” miss the point.

These regimes are attempting to apply national laws to a transnational, or even non-national, protocol. In that domain, laws are silent. Only power speaks.

My prediction is that U.S. countermeasures, of which the recent sanctions were a political warning shot, and not the actual payload, will be sufficient to render the UK Online Safety Act and the EU Digital Services Act dead letters in America.

Now it’s over to Congress to see whether they can deliver.

Postscript

As the attorney for the first four Online Safety Act social media enforcement targets, all Americans, all of whom flat out refused the UK’s orders, I am pleased to have done my small part to force this issue into the open.

Future historians should be careful to note that the continued prosecution of this cross border fight is, for those of us fighting it, absolutely hilarious, given the utter absurdity of the UK’s foray across the American border in the summer of 2025 (a chronology is posted here) that started it all:

Foreign censorship: Congress begins to move

Reclaim the Net covered the resolutions filed in each of the House and Senate last week:

Does this preface further federal action, namely a shield bill like the GRANITE Act?

If had to guess, probably; Senator Eric Schmitt has vowed to file a censorship shield bill, and the anticipated filing has been greeted with enthusiasm by officials in the Executive Branch.

Of course, I have no idea what Senator Schmitt is going to file or what the House is going to do. Moreover, whether what is filed, if something is indeed filed, manages to pass both Houses of Congress and reach the President’s desk is of course a high-uncertainty matter.

What I am certain of is that if that legislation has the same bones as the Wyoming GRANITE Act, and there’s even a reasonable chance of enactment, the old rulebook about how to deal with foreign speech regulators needs to be thrown away.

If they file what I hope they’re going to file, U.S. tech platforms could get defensive capabilities that have been simply unimaginable to date. The name of the game will be deterrence rather than compliance. It’d be a whole new ball game for an entirely new global regulatory environment, one where a good offense is more important than a cowering and highly deferential defense.

Civis Americanus Sum

Presented without further comment.

A Chronology of the American Fightback Against Foreign Censors in 2025

A chronology of the brewing U.S. counteroffensive – and thoughts about what comes next.

This is a UK Online Safety Act year in review from the law firm Byrne & Storm, PC.

Executive summary

The U.S. legal fightback against the UK Online Safety Act has been underway for two and a half years. It is now moving under its own power, gaining momentum, and likely to reach full strength in early 2026.

Formal U.S. state action has already commenced: reportedly, diplomatic/trade consequences in the form of the suspension of the US/UK “Technology Prosperity Deal,” diplomatic sanctions against European and British censorship organizations, and the introduction of legislative measures in Congress, beginning with Senate and House resolutions filed on December 17, 2025 and December 18, 2025, respectively.

As of the date of this post, a foreign censorship shield bill, the Wyoming GRANITE Act, co-authored by myself and Wyoming Deputy Secretary of State Colin Crossman, has already been filed in the State of Wyoming. Federal legislators, principally Senator Eric Schmitt, have promised to introduce legislation also, although I have not seen the federal draft bills and accordingly do not know what form that legislation will take.

Now that the conflict is on the congressional record, I expect 2026 to be conducted in full public view. The counter-censorship campaign will likely be driven by the U.S. federal government. The U.S. response will, in all probability, largely consist of formal government action to blunt foreign regulators’ attempts to project penalties into the United States to censor speech and conduct protected by the First Amendment. Ideally this will result in the enactment of a federal shield law substantially similar to the GRANITE Act.

Byrne & Storm’s approach to the Online Safety Act

Most law firms’ “year in review” memos and client notes on the OSA read a bit like a train schedule: projected Codes of Practice, Ofcom announcements, reviews of “successful” enforcement actions, and activation dates for new parts of the UK’s censorship law.

That’s a perfectly appropriate lens through which to view the Online Safety Act universe, if your business is helping clients comply with the OSA inside the UK.

That is not my business. I represent all known American enforcement targets of the OSA, and do so pro bono. From a U.S. constitutional and jurisdictional perspective, the OSA is not an instrument the UK can lawfully wield against Americans in America, so I’m not measuring 2025 by “OSA implementation progress.” I measure it by American progress in defeating the OSA regime and other foreign regimes just like it.

Our objective – the victory condition – is the total and permanent neutralization of the OSA as an instrument of UK policy capable of harming American citizens. If we can achieve that vis a vis the OSA, we will also likely achieve, at the same time, the total neutralization of inbound foreign censorship laws regardless of source (EU DSA, Australian Online Safety Act, etc.) insofar as they attempt to trample on American sovereignty and project penalties into the United States aimed at the suppression of speech and conduct that is constitutionally protected in the U.S.

The biggest story most major firms aren’t tracking, because they’re not involved, is the growing U.S. fightback to the OSA on multiple fronts by multiple independent actors. At this point, this includes litigation, state legislation, federal legislation (resolutions for now, but more expected soon), and, reportedly, federal-level diplomacy and trade policy.

The reason that most international law firms aren’t involved, in my view, is because those firms are, for the most part, too risk-averse to take this particular fight to the enemy. The UK’s choice of targets was, we believe, designed to prove the OSA’s efficacy against highly controversial, and financially weak, companies who would normally be unlikely to obtain competent representation, even if they could afford it.

Many if not most law firms with a UK footprint will be structurally disinclined to take them on, especially on a pro bono basis. Failure to protect these targets, however, would have resulted in the UK obtaining enforcement precedents that could then have been wielded against the rest of the American tech industry.

For this reason, even though defense of these targets is critical for the defense of the American constitutional order, this foreign incursion – which could not be allowed to cross our border unanswered – was left to be fought by a very small group of lawyers who were willing to carry out this work, given very difficult facts and with very few resources. The frontline lawyers advancing these efforts this year consisted of two private practice lawyers (myself and Ron Coleman), one legislative draftsman (Colin Crossman), and a handful of attorneys who cannot at this time be named.

All of these efforts are converging on the same practical outcome: blunting or neutralizing the OSA’s reach in the United States.

Key events, 2023-2025

From my point of view, these are the key events in the OSA fightback:

Spring, 2023: I have one telephone call about the OSA with senior civil servants in the UK Home Office about a U.S. website which explicitly references the First Amendment in its content moderation rules. The Home Office asks me how my client will be complying with the OSA. I advise the Home Office that if they want to censor my client, the British Army would need to land ground troops and seize my client’s servers by force. (Yes, I actually said this, and as two of my law partners were on the call, there are witnesses.)

2024: Complete silence. Over in the UK they gear up to launch the OSA and project their sovereign power into the United States.

2025:

2/27: The UK’s Prime Minister, Sir Keir Starmer, sitting in the Oval Office, tells the President and Vice-President of the United States to their faces that the UK will not be censoring Americans. “Certainly we wouldn’t want to reach across (to censor) U.S. citizens, and we don’t,” he says.

Late February through July: Ofcom communicates its first enforcement notices to four separate American targets, all of which I onboarded as clients as we prepared to mount a defense. Every single target, without exception, refuses the orders or refuses to respond to them, including the company who was first contacted in 2023. We begin supplying U.S. federal and state government officials with every foreign censorship communication we can get our hands on.

3/25: The Senate Judiciary Committee’s Subcommittee on the Constitution holds hearings on the Censorship-Industrial Complex.

7/25: The House Judiciary Committee releases a report on the threat to American citizens and companies of foreign censorship laws, focusing primarily on the EU Digital Services Act.

7/25: Then-DSIT Secretary and now-Business Secretary Peter Kyle tells the BBC that the UK has the “power to shut down any platform,” in response to a question about U.S. Internet powerhouse X.

7/28: Starmer, in a meeting at the Trump golf resort in Turnberry, Scotland, tells POTUS that the Online Safety Act contains “[n]othing about censoring free speech. This country is the proud… Free speech in this country has been for a very long time. We’re very, very proud of it. We will protect it forever.” (sic)

7/30: Shortly after Ofcom’s age verification rules go live, I state my intention on behalf of certain unnamed clients to sue Ofcom on GB News. I also issue a call for help to the federal government and Congress.

8/13: Ofcom announces its intent to fine 4chan £20,000 plus daily penalties in a published provisional decision alleging contravention of the Online Safety Act.

8/15: 4chan and Kiwi Farms publicly declare their intent to sue Ofcom in a press release posted on X. @roncoleman and I gear up to file.

8/28: Ofcom is sued in DC federal court. 4chan and Kiwi Farms allege Ofcom’s orders do not bind them in the United States, that the orders were not properly served, and that any attempt by a U.S. court to enforce them would violate their First, Fourth, and Fifth Amendment rights.

9/3: House Judiciary holds hearings in D.C. on the foreign censorship threat.

9/18: The United States and the UK agree a memorandum of understanding on technology and trade, the so-called “Technology Prosperity Deal.”

10/13: Ofcom fines 4chan. In its confirmation decision, it claims it is entitled to sovereign immunity, claims that UK law applies on US soil, and claims the First Amendment is no defense. Ofcom also states that the purpose of the fine is to “deter” non-compliance from other Americans in the “wider sector.”

10/18: I draft a model foreign censorship shield bill, the GRANITE Act , for review by @cantbesilentcal and @RepKeithAmmon in New Hampshire.

10/27 – Jimmy Wales, Chairman of the Wikimedia Foundation, which administers Wikipedia (which lost an English High Court challenge to the Online Safety Act in August 2025), confirms that Wikipedia will not be adhering to the UK OSA’s age verification mandates regardless of what Ofcom orders it to do. In an interview with London-based political platform PoliticsHome, he says: “We’re in talks with Ofcom, but we will not be identifying users under any circumstances. We will not be age-gating Wikipedia under any circumstances. So, if it comes to that, it’s going to be an interesting showdown, because we’re going to just refuse to do it. Politically, what are they going to do? They could block Wikipedia. Good luck with that.”

10/31: Ofcom reportedly threatens U.S. AI giants with so-called “algorithm audits” and asserts that its rules apply to LLM services like Grok and ChatGPT.

11/6: Ofcom, under political pressure from the UK government and pro-censorship UK activist groups, reopens an investigation into U.S. mental health discussion board SaSu. SaSu, which violates no laws in the United States, has at this point already voluntarily IP geo-blocked UK IP address ranges. Activists claim that this is not enough and that Ofcom should (1) obtain a court order blocking the site in the UK as well as (2) seek arrest warrants for the site’s American operators.

11/16: @arceris_btc moves first and turns GRANITE into bill text for the State of Wyoming, improving it considerably in the process.

11/20: Colin’s GRANITE text is filed in the Wyoming state house by @RepDanielSingh. (Numbering and publication of the updated bill on the Wyoming legislature’s website is expected shortly.)

12/1: Ofcom files its motion to dismiss in the D.D.C. case, arguing, among other things, that it is entitled to sovereign immunity from suit under the U.S. Foreign Sovereign Immunities Act.

12/3: DSIT Secretary Liz Kendall says the UK will explore expanding the Online Safety Act to more comprehensively cover U.S. AI services.

12/4: United States Under Secretary of State for Public Diplomacy, Sarah Rogers, in an interview with GB News, describes Ofcom’s censorship of Americans in America as a “non-starter. It is a deal-breaker, it is a red line.” She adds that a federal censorship shield law is also under consideration in the U.S. House of Representatives. For clarity, I haven’t seen that bill.

12/4: Ofcom writes to 4chan again, claiming it is “expanding its investigation” into the site for not age-verifying its users. Ofcom explains that although it is “a UK-based regulator… that does not mean the rules do not apply to sites based abroad.” We respond by pointing them to Under Secretary Rogers’ interview and telling them that their correspondence in this case directly inspired the GRANITE Act.

12/5: X is fined by the EU.

12/5: United States Senator Eric Schmitt announces, on X, that he is also working on foreign censorship shield legislation. I haven’t seen that bill, either, but the U.S. Department of State seems to be anticipating it eagerly:

12/8: Australia’s eSafety goes after one of UK Ofcom’s priority targets. We respond by telling eSafety: no thanks.

12/15: In a case brought by NetChoice, a federal court in Louisiana strikes down an OSA-style U.S. domestic age verification mandate as unconstitutional.

12/16: The US/UK Technology Prosperity Deal implementation is not-so-quietly suspended by the Americans. The UK insists the deal is still on. Reporting (particularly from @connor_stringer at the @Telegraph) cites the OSA and its possible expansion as being among the reasons for the collapse of negotiations.

12/17: In a case brought by NetChoice, a federal court in Arkansas preliminarily enjoins an OSA-style content mandate law as unconstitutional.

12/17: a leading question to the UK’s DSIT Secretary, Liz Kendall, during Prime Minister’s Questions inquiring about the use of further powers against U.S. mental health discussion board SaSu (seeking blocking orders and criminal charges), provokes a fiery response from the cabinet minister, who vowed to accelerate enforcement against this U.S. site – a site which, I remind you, has already geoblocked the UK.

12/17: Senator Mike Lee files a resolution in the United States Senate calling on the Senate to resolve that any foreign censorship of U.S. citizens “shall be opposed.”

12/18: A resolution condemning foreign censorship and calling on the Trump Administration to respond is filed in the U.S. House of Representatives.

12/23: The United States Department of State announces sanctions on five individuals, Thierry Breton, Imran Ahmed, Clare Melford, Anna-Lena von Hodenberg, and Josephine Ballon, for seeking to censor American citizens by calling upon foreign state power to interfere with their U.S. constitutional rights.

12/24: Europe (incl. UK) loses its collective mind over the sanctions, and immediately tries to drape itself in the very ideals that its regulatory laws seek to destroy.

As far as I am aware, Ofcom has not commenced any enforcement action against a new American target since June of 2025, although there may have been other correspondence that has crossed the U.S. border since then.

And with that, you’re up to date.

What’s on deck for 2026

My personal focus in 2026 will be getting GRANITE over the line in Wyoming. If we can pull that off, we will have, for the first time, created unambiguous statutory shielding for Wyoming citizens – and servers! – to protect them from the overreach of foreign censors.

A shield law in even one state will materially improve the position nation-wide, as it will allow companies to reincorporate there, or to move their hosting there, to avail themselves of the shield.

My secondary objective: deter further inbound censorship attempts from the UK and Australia directed at exclusively U.S.-based targets, buying time for the US federal government to catch up.

The EU is going after VLOPs, and I don’t tend to have VLOPs as clients, so I expect other lawyers will be working on that front.

Federal legislative backup is the necessary solution and the only permanent one. A federal GRANITE Act would, in my opinion, likely end the foreign censorship problem immediately. That’s what it’s designed to do.

At least specific to the UK, it will also help if the Trump Administration is willing to hold the line in trade talks. (I think the EU is too stubborn to cave; the UK, I think, is a better ally to the U.S. and possibly more pragmatic.)

Decisions in the U.S. federal apparatus, however, are not anything I have visibility into and, as a simple country lawyer in solo practice, are well above my pay grade. My job next year is to keep building the record, educating the American bar about the nature of the OSA as a constitutional problem, and deterring further encroachments on U.S. territory.

Ofcom called 2025 its “year of action.”

2026 is our turn.