After effectively banning porn, Idaho state government shows visitors... porn.
Most of what we know about Idaho comes from Neal Stephenson's Fall, where various inhabitants and characters are described as "extreme libertarians with a religious bent." They live in isolated compounds, and practice, "a fringy kind of Christianity." We don't know how true that is, as the state barely registers on The Crow's radar on a normal day.
We do know that state lawmakers do not like porn at all. In a world where getting politicians to agree on anything is next to impossible, the Idaho House of Representatives unanimously passed House Bill 498 in February 2024 - requiring adult websites (read porn providers) to make robust checks to ensure their visitors are actually adults.
The bill was passed by the state senate a month later, and was signed into law by the governor on March 20, 2024 - coming into effect on on July 1st, 2024.
No, it doesn't actually ban naughty pictures and movies, but we'd be surprised if anyone had handed over their government-issued ID in return for access.
Idaho allows parents to sue porn providers
That the bill passed was not, in itself a surprise. Sure, people like porn, but they also like bumper payouts, and one of the core functions of legislation is to ensure that underage Idahoans(?) who view material "harmful to minors" (or their parents) are able to sue the entity that provides it. There's even a statutory minimum award of a modest, yet potentially life-changing $10,000.
In case you're wondering what this nebulous term actually means, the bill provides a description:
(a) Material that the average person applying contemporary community standards would find, taking the material as a whole and with respect to minors, is designed to appeal to, or is designed to pander to, the prurient interest. (b) Material that is devoted to or principally consists of descriptions of actual, simulated, or animated displays or depictions of any of the following, in a manner patently offensive with respect to minors: (i) Pubic hair, anus, vulva, genitals, or nipple of the female breast; (ii) Touching, caressing, or fondling of nipples, breasts, buttocks, anuses, or genitals; or (iii) Sexual intercourse, masturbation, sodomy, bestiality, oral copulation, flagellation, excretory functions, exhibitions, or any other sexual act; and (c) Material that, taken as a whole, lacks serious literary, artistic, political, or scientific value for minors.
So far as we're aware, PornHub has yet to be sued, and literotica looks as healthy as ever. This could be because the ID checks are genuinely robust, or perhaps the young inhabitants of the state aren't inclined to look at pictures and images of people doing the dirty.
Maybe it's just that no-one has got around to it yet.
Idaho is astonishingly bad at managing website migrations
Idaho is a great place to start a business, and according to a random 2016 grab of www.trade.idaho.gov, offers "tax reimbursement incentives," "access to markets," and "a skilled workforce." Whether or not that skilled workforce is employed in the state's IT department is up for debate.
Later in 2016, perhaps feeling that the word "trade" wasn't lofty or aspirational enough for the potato state, and in gross defiance of the state motto (Let it be perpetual), the Department of Trade was rebranded as the more dignified "Idaho Department of Commerce."
Naturally, the trade subdomain was scrapped, with 301 redirects pushing visitors towards the new domain at https://commerce.idaho.gov, which offers almost exactly the same incentives and services as the old department.
So far, so good. But at some point prior to 2021, the server configuration was changed, leading to a 502 error, with "No route known for www.trade.idaho.gov." A year later, the 301 was back in place, and visitors to the subdomain homepage were redirected to the International Trade page of the Commerce Department.
Redirects can be tricky - especially if you're migrating an entire website. You want the redirects to be as clean as possible, and for people visiting an existing page to land on the equivalent page on the new site.
The simplest way of doing this is to make sure that aside from the domain name, every part of the URL is identical. In this case, a single line in Apache will do the job.
From what we've been able to see, the URL slugs and paths are identical, so why they didn't do this is utterly beyond us.
In fact, we're not even sure how they did it. You might expect trade.idaho.gov/idaho-business/international-trade to land you on commerce.idaho.gov/idaho-business/international-trade/, but no, it'll take you to commerce.idaho.gov/idaho-business/international-trade/idaho-business/international-trade/, essentially duplicating a section of the URL and resulting in a commerce 404.
Were the redirects added individually and by hand? Did they use a find and replace tool?
It is possibly the worst website migration we have seen in, like, ever.
With the Department of Trade now mothballed, and some redirects in place, the old subdomain was left to rot like an unloved and abandoned building.
And as with any abandoned building, you don't have to wait long until squatters move in.
The state of Idaho even demands age verification for its own "adult material."
Not all pages on the old Department of Trade site will redirect visitors to the shiny new Department of Commerce. Some will redirect visitors of whatever age straight to adult material.
Take www.trade.idaho.gov/video/ahp/video-blue-film-blue-viral-hot-hd-sex-videos-05.html for instance. This is clearly the URL of a porn video, and it's also a legitimate idaho.gov address.
Visit the page without JavaScript enabled, and you'll see a WordPress site with the Twenty Twenty-Five theme. There are are broken images and blocks of text stolen from all over the internet.
Re-enable JavaScript, and a properly working redirect will whisk you away to a membership porn site. We can't say how good the porn is as, in accordance with Idaho law, a credit card is needed to watch it.
We found dozens of Idaho trade URLs - mostly leaning towards Indian tastes, and offering Desi Aunties, Bangla Blue films, Hindi, and more. Most of these will land you on a site called "okporns." Some lead elsewhere.
So... Idaho state government shows you porn. So what?
Imagine for a moment that someone is considering moving their business to Idaho. You'll also have to imagine that whoever hijacked the subdomain has ambitions beyond directing visitors to smut.
With control of an actual factual, genuine, idaho.gov subdomain and some slight degree of competence, it would be the work of five or so minutes to build a website that would fool our hypothetical business owner into creating an account and handing over their details. It wouldn't take an afternoon to create one that could take payment for permits and fees. Hell, you could gather taxes through it and funnel them into your offshore accounts in the Cayman Islands.
You could do a great deal of damage - and it wouldn't even be hard.
Why, exactly, is Idaho pushing porn to visitors?
Take a look at the DNS records for trade.idaho.gov, and you'll see three IP addresses. All of them are owned by Microsoft and are part of its Azure platform.
We're taking a stab in the dark here, but in our inexpert opinion, at some point, Idaho stopped paying the bills for its trade subdomain, and in a shocking display of oversight, didn't update their DNS records.
Microsoft recycles the IP and now another customer is using it to serve their own crappy content.
Shocked, we were. Shocked.
Do the pornsters even know that they are now in possession of some prime Idaho virtual real estate? Have they, perhaps, considered moving their enterprise to Idaho with its low taxes, high quality of life, and access to market? They have an "Entrepreneurial Culture" doncha know?
Want to sue Idaho for serving porn to minors?
With the promise of a minimum of $10,000 in compensation, we're sure that many Idaho residents are rubbing their hands at the prospect of finding porn (there are definitely prohibited human parts, but they're kind of low quality) without robust age checks.
Sadly, you can't. It's a long tradition for lawmakers to protect themselves, and at the bottom of the first page, you'll see that the state awards itself "Sovereign immunity."
It's a long paragraph, but essentially means that the state cannot be sued in court unless very specific conditions are met (they are not).
The bill also makes clear that the law only apples to commercial entities, and that they must "knowingly and intentionally publish material that is harmful to minors."
Even we would have a hard time arguing that Idaho is intentionally pushing smut, but we're alarmed that there isn't a proviso for peddling filth through gross incompetence.
Idaho isn't alone
Idaho's unfortunate dangling DNS issue isn't the first we've seen. Way back at the tail end of 2021, The Crow discovered a similar adult site masquerading as an obscure yet once useful part of the UK's Department of Transport.
Image credits:
Tingey Injury Law Firm on Unsplash
