While collecting Mexican state legislation, one host answered with unusual candour:
403: Access Forbidden — Your location (BR) has been blacklisted.
Not a captcha. Not a rate limit. A country. Our requests were egressing through an address that geolocates to Brazil, and a state legislature’s legislation portal had decided Brazil was not welcome.
The document behind that URL is public law. It is public in the sense that matters — anyone may read it, no fee, no account, no standing required. It is simply not public from here.
Three refusals that look identical
A 403 tells you almost nothing on its own. Sorting the Mexican ones by what they actually said produced three different situations needing three different answers:
An explicit country blacklist. The one above, which says so in words. A different exit country fixes it outright, and nothing about it concerns automation — a human browser from Brazil would be refused too.
An infrastructure block. “Sorry, you have been blocked.” Reputation, geography, or the two entangled. Worth retrying from elsewhere, and impossible to diagnose from the response.
A bot challenge. “Just a moment… Enable JavaScript and cookies to continue.” This one is different in kind. It is not about where we are; it is about what we are, and the answer it wants is that we should be a person with a browser.
We do not work around the third. A site asking whether you are automated has asked a question, and the answer is yes. A person can open those pages and read the law; a collection pass should not pretend to be one to get at it. Two Mexican hosts sit permanently in that category and will stay there.
One more refused with a bare 403 and no explanation at all, fitting none of the three, which is its own small lesson in how much of this is guesswork.
Why it matters beyond Mexico
Our own records had been describing a set of Mexican sources as blocked. That word was doing more work than it could carry.
“Blocked” reads as a property of the source — this document cannot be retrieved, mark it unavailable, move on. What we actually had was a property of the connection: this document cannot be retrieved by us, from Brazil, this month. An unknown share of what we had filed as permanently unreachable may open on the first try from a Mexican or American address.
That distinction decides real things. A source recorded as unreachable stops being retried. Records depending on it stay at a lower grade forever. A gap gets written into the coverage map and calcifies, and every later reader treats it as settled. All on the strength of a refusal that was about our routing.
So the entries were rewritten to say what was actually observed — the exact response, and where we were standing when we got it — and the list is queued to be re-run from a different exit. Except the bot challenges, which stay closed wherever we run from.
The general form
Any claim that a document could not be retrieved is a claim about a relationship, not about a document. Retrieved by whom, from where, with what address, on what date. Drop any of those and you have converted a temporary condition into a permanent finding, quietly, in a file that will outlive everyone’s memory of the afternoon it was written.
The open web is less uniformly open than it looks from any one place on it. Whether a national or state law is readable turns out to depend, sometimes, on which country your packets appear to come from — which is not a fact about the law, and is worth recording as such.