Inside Internet Filtering

This week the Australian government called for “Expression of Interest” from ISP’s in Australia to begin a live pilot of ISP Level filtering.  They have asked all ISP’s to lodge questions by November 18th, and hope to begin testing as early as December 24th 2008.  The estimated length of the pilot will be 6 weeks.  The pilot would ideally look at broadband, wireless, and dialup Internet access.

As previously speculated, the government is asking for ISP’s to participate in two different levels of filtering: one that blocks only ACMA blacklist sites, and one that extends the filtering to cover unwanted Internet content.

The government has indicated that limited funding will be available to help defray the cost associated with the pilot program, however, they don’t detail the specific amount available, which likely means it will be negotiated with each ISP.

Another interesting element is the fact that ISP’s will be able to charge customers during the pilot period for any filtering provided that goes beyond simply blocking the ACMA blacklist or illegal content.

The Age, Melbourne’s #1 newspaper, ran a story on page 3 about Senator Stephen Conroy’s proposed ISP-Level filtering initiative.  Read: Filtering out the fury: how government tried to gag web censor critics

This article comes just days after Senator Conroy was questioned on the $44.2 million Internet filtering plan by the Senate Estimates committee, and in particular Senator Ludlam of the Greens.  Transcripts of the conversation are available online at: http://scott-ludlam.greensmps.org.au/content/transcript/cybersafety-net-filtering.

The most interesting element for me was Senator Conroy’s confirmation of early reports that the system will likely be two tiers: one that filters content a family would want to block and one that filters illegal content.  ISP users will be able to opt-out of the family level filter, but the illegal content filter would be mandatory.  Here are Senator Conroy’s exact words:

No. As I said, we are in the early stages. But we are looking at two tiers-mandatory of illegal material and an option for families to get a clean feed service if they wish.

You could make the argument that filtering the illegal content is just enforcement of laws that are already on the books.  I think that argument has some flaws though.  Take the same concept and extend it to driving.  Roads have speed limits and drivers often speed.  Should the government invest in a GPS system that is programmed to know the speed limit and link it into your car’s onboard computer to limit your speed so you can’t speed?  No, we instead setup speed traps to watch for people violating the speed limit, and then deal with the offender.  This is the typical law enforcement model.

Even if this system is established in Australia to limit access to illegal content (ACMA Blacklist) it won’t stem the flow of illeagle content in or out of Australia.  The people trafficking this content will simply adapt and find a way around the filters, it will only take them a matter of hours.  But I don’t think the goverment is really studying the ease of circumvention because they believe that ISP-level filters can’t be circumvented.

There has been a lot of chatter on the internet in the last few days about the ISP level filtering initiative underway in Australia.  The main topic of discussion has been around the concept that there will be no opt-out for people that don’t want the filtering.

Mark Newton, a network engineer for an ISP in Australia called Internode, says:

Users can opt-out of the ‘additional material’ blacklist (referred to in a department press release, which is a list of things unsuitable for children, but there is no opt-out for ‘illegal content

Newton said he got this information from advisers to Communication Minister Stephen Conroy.

A few blogs are reporting that this has been confirmed by a spokespersion for Minister Stephen Conroy.  However, no names have been mentioned and I can’t find any official comment on this.  We will have to wait official word from the Department for Broadband, Communications and the Digital Economy.

Additional Information:
http://www.thestandard.com/news/2008/10/13/no-opt-out-filtered-internet
http://revolutionradio.org/2008/10/17/net-filters-required-for-all-australians-no-opt-out/

The government of Australia, under the leadership of Stephen Conroy, have been pushing forward on the concept of creating and ISP-level “cleanfeed” for the entire country of Australia.  It is envisioned that this system would replace the free filter scheme currently in place in Australia.

In support of this system, the UK Cleanfeed system deployed by British Telecom is often referenced as proof that Internet Filteirng at the ISP-level can be effective and won’t slow down an Internet connection.  However, if you take a deeper look at the system deployed by British Telecom, you find that there are some key differences.

The BT System Only Blocks Illegal Content.
The cleanfeed system in the UK was built and designed to block a fairly small number of sites that contain illegal content (mostly child pornography).  It seemed at the time of launch it was blocking somewhere around 3,600 sites and it was cited as growing at a rate of between 60-100 sites a month.  So today, that would put the total list size at an estimated 6,000 sites today.

So will Stephen Conroy and the Department of Broadband, Communications and Digital Economy only block illegal content or provide for protection for minors from inappropriate content.  The lab-based test was run on both by ACMA and Stephen Conroy has made statements that he wants the cleanfeed to be free of inappropriate and pornographic content.

I mention this because it is much easier and less costly to filter out a small number of sites than it is to filter all sites to determine if they are inappropriate or pornographic.  So if you extend the blocking to include inappropriate content, you can’t point to the UK cleanfeed system as a previous success story as Stephen Conroy does.

The BT Cleanfeed was not government mandated.
British Telecom came up with the cleanfeed system of their own accord.  It wasn’t required by the government.  The list of sites that is blocked by the UK cleanfeed system is created by the Internet Watch Foundation a non-government Internet watchdog group.  So the government doesn’t have to deal with censorship issues head on.

On the other hand the Australian clean feed system, even if it only blocked illegal content, would likely be blocking the list built by the Australian Communications and Media Authority (ACMA).  This combined with the fact that the system will be mandatory and likely funded by the government to offset the ISP’s operational expenses directly links the government to the filtering.  This of course raises all kinds of issues of Internet censorship.  Electronic Frontiers Australia is already opposing the system on their site nocleanfeed.com.

BT System can only block web content.
The system designed by British Telecom was designed to block only web traffic.  This means that they don’t block peer-2-peer file sharing, Instant Messengers, FTP or a number of other type protocols.

The test conducted by ACMA looked at the blocking capabilities of other protocols.  However, this was only done by “Expert Review”, meaning someone looking at the features of the software.  No test were run to determine the scalability of blocking additional protocols at the scale an ISP would have to be able to deal with.

So what does all this mean?
A low cost system to simply block illegal content on an ISP-level could be built.  However, if you look at this from the angle of Internet safety for kids, you will find that the ISP-Level system potentially reduces the level of protection offered to Australian parents today through the NetAlert free filter scheme.

With an ISP-level filtering system will a parent be able to control the time spent online, review instant messenger conversations, block peer-2-peer filesharing or games?  These are all things that parents can do today with the free filters offered by NetAlert.

Stephen Conroy claims that the new ISP-level filteirng initiative will provide better protection for kids, but is this really true?

The city council for Birmingham, England, recently installed new Internet monitor and filtering software.  However, the filtering policy they have created is meeting with some opposition.

The city council has blocked sites relating to Atheism and the Occult, which fall under what they call “a long-standing Internet usage policy for staff”.  The policy bans sites “that promote witchcraft, the paranormal, sexual deviancy and criminal activity.”

The opposition is coming from the Lawyers at the National Secular Society, who claim the move violates the Employment Equality (Religion or Belief) Regulations 2003.  The regulations make it unlawful to discriminate against employees on the basis of thier religious belief.

One element that the ACMA ISP-Level Filtering Report touched on, was the different circumvention possibilities between PC and ISP based Internet Filtering solutions.  It presented a table of possible work-arounds to both systems, indicating a high, moderate, or low level of possibility to circumvention.

After looking at this table, you are left with the impression that ISP level filtering is nearly bullet proof.  This is not the case though.  They didn’t include in the table at least two methods that I am aware of for bypassing an ISP level Internet filter, and there are possibly more depending on the particular ISP’s deployment model.

It wouldn’t be appropriate for me to go into details about how to circumvent ISP level Internet filters here. But I will say that for at least one of the methods a PC based filter is actually able to filter when an ISP level filter would not.

Last year the Australian government launched its free filter scheme, where any resident of Australia could download a free Internet filter.  InternetSafety.com is a participant in this scheme with Safe Eyes.  A few months after the launch, there was an election which caused a shift in the controlling party of the Australian government, and Labor party had a different view on Internet Filtering.  They felt that it was best performed by the ISP, instead of with software installed on each PC.

They commissioned a study to review the products currently available to determine the state-of-the-art of the industry, and if creating a ISP based clean feed was possible.  They had conducted a similar study in 2005.  The results of the report were released today in the ACMA Report on ISP-Level Internet Filters.

I believe that the software-based filters are better for famlies.  Not just becaue we participate in the current scheme in Australia, but because I think they have the ability to provide the parents with richer features.  Features, like Time Controls, Privacy Controls, Application Control, and IM Monitoring are all things that can be done much more effectively on the local computer.  So what did the report find:

Performance

• One product showed only a 2% speed degradation.
• Three products showed 22-30% speed degradation.
• Two products showed a 75% speed degradation.

Effectiveness

• 88%+ blocking capability for all products.
• 94%+ blocking capability for 4 products.
• 8% or less over-blocking by all products.
• 3% of less over-blocking by 4 products.

Scope of Test

• Products where able to block content on non-web based protocols such as IM, and P2P.
• Products where not able to identify content on these non-web based protocols.

Overall Conclusion

• ISP level filters are faster than they were in 2005.
• ISP level filters are more effective than they were in 2005.
• Non-web based protocols are still a problem.

There is a lot of good information in this report, which I will dig into in future posts.

On Friday leading legislators in New Jersey called on the Office of Legislative Services to install Internet filtering software on all legislative computers.  Currently no Internet filtering software is installed.  They are calling for:

the most aggressive Internet filtering software available on all computers in the Legislature.

The move was motivated by the seizure of Assemblyman Neil Cohen’s computer on Wednesday, which reportedly contained child pornography.

On Tuesday the Child Online Protection Act was affirmed as un-constitutional by 3rd Circuit Court of Appeals.  It was previously ruled as un-constitutional by the U.S. Supreme Court in 2004 because it vioalted the 1st and 5th Admendments because it was vague and broad.

After reviewing the technology available today, the district court ruled that Internet Filtering provides a much better mechasnism for keeping our kids safe online than COPA.

The FCC announced that it is requesting comments for a national wireless broadband network that would have “a requirement to provide a network-based filtering mechanism for the free Internet service in order to protect children and families.”

This request relates to new spectrum that the FCC is auctioning off known as the Advanced Wireless Services (AWS) Spectrum.  The winning licensee will be required to use 25% of its wireless capacity to provide free wireless broadband service.

This new wireless broadband service would offer speeds of at least 768Kbps downstream.  The proposal indicates that the signal should cover 50% of the US within 4 years, with 95% coverage within ten years.

You can read the full announcement here.