Internet Blocking and Democracy - Exec Summary : 1.4 Technical Aspects of Internet Blocking

The development and implementation of various types of Internet blocking technology on the internet is not a recent development. For a long time, spam, internet-based viruses and malware and many other content-types that are unwanted and unrequested by the end-user have been targets of blocking efforts undertaken by industry for security and usability

A technical overview of the major Internet blocking systems in use today is essential, as is an explanation on how these are applied to different Internet services. In addition to concerns about the effectiveness of such blocking systems, there are also significant technical impacts and challenges created by these systems. There are also many ways to evade these blocking

Democratic states have promoted the use of Internet blocking technology in various policy areas, citing public interest to demand certain blocks be implemented to uphold various aspects of public policy where the characteristics of the internet caused (international) enforcement issues. Similarly, states with less open information regimes have taken to blocking as a technical resource for extending their practice of information control to online

All of these developments hinge on the availability of internet blocking technology. Depending on their technical characteristics, they differ in effectiveness and potential for circumvention. Techniques for blocking child pornographic content are the main focus, but it is important to note that many blocking technologies can be deployed for other types of content

In order to attempt to block content, identifiers are needed whereby a blocking decision can be implemented. The content that this report focuses on is usually visual in nature, meaning that it contains either still pictures or video footage of child sexual abuse.

• IP addresses
• Domain names and DNS
• URLs
• File content and Filename
• Keywords
• Content Signatures (hash values)

1. It is not possible to express effectiveness as the amount of content that is blocked correctly in comparison to the total amount of available illegal content since the total volume of available illegal content is unknown.
2. Since it is often unclear where hits on a website come from, figures quoting volume of hits on an existing list are a very crude indicator at best.
3. Analysis of over-blocking and under-blocking potential can be used as indicator of the effectiveness of Internet blocking technologies.
4. Another indicator for effectiveness is the ease of circumvention of a block If it is easy to circumvent or disable a block, the availability of the blocked material is likely to remain unaffected.
5. The availability of alternative methods of access to the same content, by whatever means, can be seen as a measure for effectiveness of blocking in the absence of precise data.
6. The availability of other enforcement options that offer other more effective methods of preventing access to the material can also be assessed - especially if they are less costly, less intrusive or more effective towards the availability of the material.

• Allow-list versus Block-list - Filters that are configured by default to “allow” content

to pass unhindered but have specific lists of content to block are usually called blocklists,

• Human intervention (dynamic and non-dynamic blocking) - Typically, child pornography filters are based on consumer complaints and law enforcement

• Blocking Point - Blocking strategies can be differentiated by the level at which they are executed. User level filters allow parents and computer administrators to select and block content types. Other filtering techniques are employed at the organisation, ISP or even state level. They typically require sending all traffic through central machines that analyse incoming traffic.

• IP Addresses - Blocking an IP address means that other Internet services and users that use the same address will also be blocked.
• Domain-Names - Blocking by a domain-name will block all content residing under that domain.
• Uniform Resource Locators (URL’s) – Best results in terms of specificity will be obtained by filtering on a URL basis. Due to the ease of evading these filters, blocking by this identifier can lead to a significant risk of under-blocking.
• Content Signatures - content can be blocked using signatures that allow for classification of content that was previously categorised as illegal. New content is easily missed by the filter. Encryption of the content will render this method useless.
• Keywords - blocking based on keywords found either in the filename or the URL or the text at the location of the content being accessed. Complex analysis of the recognised keywords in the context of their use needs to be performed.

Child pornography can be distributed across the Internet using various methods via high speed broadband Internet connections. In addition to the distribution of static content (pictures and video material), they also serve as a launch pad for other, related activities such

• Websites

Websites are one of the foremost distribution methods for content on the internet. Usually, web content resides on the server but content can also be retrieved dynamically or created dynamically, whereby a database is often used to hold relevant data. It is common for many different web-servers operated by different owners to be attached to one IP address.

• Email and Spam (unsolicited email)

Email is still the most widely used service on the Internet, even more than web or social networking websites.

• Usenet Newsgroups

The important difference between newsgroups and email is that streams of messages passed between Usenet servers (often called “newsfeeds”) are organised into groups that suggest references to the content of the messages being exchanged.

• Peer to Peer networks (P2P)

Peer-to-peer file-sharing is based around the exchange of files directly between end users’ computers, bypassing intermediate servers. Although the technology has legitimate uses it lends itself to the sharing of music and movie files, causing major challenges for copyright holders.

• Search engines

By indexing the content of websites, search engines are able to identify relevant content by way of keyword searches and complex search algorithms.

• IM and Other

• Website Blocking

Blocking of websites is usually executed using one of two different identifiers.

• • the server that contains the website could be blocked at the level of its IP address, preventing anyone using the filter from accessing that address. A block-list would then contain only IP addresses of known illegal content.
  • a blocking measure could be adopted based on the domain name or even on the URL of a specific file or page hosted on a website.

If this type of blocking attempt takes place in the access network rather than in the user’s equipment, circumvention is, relatively speaking, more challenging for the user

• Email Blocking

Most email filters operate on, or right before, the receiving mail-server that takes incoming mail for users on a network. There are two ways of email filtering:

• • there are connection based filters that check the originating IP address of the sending mail-server against a number of blacklists.
  • filters can use the content of messages to filter out unwanted content. Potential for over-blocking is present where IP addresses or even entire originating mailservers are blocked due to incidents involving child pornography.

• Usenet Blocking

• Search engine results blocking

• Peer-to-peer and IM Blocking

Blocking attempts of peer-to-peer traffic is a substantial task. Many p2p protocols are distributed - meaning that files being downloaded will be constructed from several sources and so no one stream of data contains the whole file.

• • The first option to attempt to block access to P2P content is by analysing the p2p network content by acting as a user of the service. By requesting certain files or monitoring the request and answers from other users it is possible to find users that have parts of a file on their hard drive. Blocking access to their IP address or disconnecting these users if legally and technically feasible, however, is then the only extreme remedy available.
  • The second option with maximum effectiveness in the attempt to block content in these networks is to use technologies akin to Deep Packet Inspection to recognise the files as they are being exchanged

This table lists characteristics of every blocking strategy discussed. It shows the likelihood off over- and under-blocking according to our estimates, lists the resources required to execute the blocking strategy, the block-list type and maintenance effort required for such a list and, in the last column indicates whether the communications contents needs to be analysed

Whilst the distribution methods may vary, each method can function as a reasonable substitute for each other method. Regardless of the effectiveness of blocking the content on one of the media, any flaw in blocking the same content on any of the others will lead to

Most child pornographic activity on the Internet today involves the use of multiple Internet services and systems. There are several investigated cases where contact between an adult and a child started in public chat rooms, moved to private chat rooms, progressed to personal emails and private SMS (Short Messaging Service) text messages across the mobile phone

Investigating such activity is very challenging and requires broad knowledge on behalf of the

• Proxy-Servers

Circumventing this type of filter is quite trivial. To circumvent a filter blocking access directly, a user can ask a foreign proxy server to access the blocked content on his/her behalf and, as long as that foreign proxy server itself is not being blocked, and the user can thus gain access to the content to bypass local filtering.

• Tunnelling

Tunnelling software allows users to create an encrypted ‘tunnel’ to a different machine on the Internet which prevents the filtering software from seeing web requests. Once a tunnel is created to the other machine, all Internet requests are passed through the tunnel, through the machine on the other side, and on to the Internet.

• Hosting or URL rotation

From the point of view of the content publisher, changing the website configuration to a different address (domain-name, URL or even IP address) is also trivial, and would effectively bypass IP, URL or domain-name based filters.

• Botnets

Domain name rotation or IP address hiding is often done using botnet technology whereby compromised innocent end-users machines are used to act as a portal to the content of the web server. In essence, the user’s computer is turned into a non-caching proxy.

• Evading DNS based filters

Where blocking is done on anything other than a full url (path name) or a content signature, there is a significant potential for over-blocking. However, conversely, url or content signature

Blocking web traffic effectively, (i.e. blocking the access of the user to the content and not merely using DNS filters) requires significant investment in proxy deep packet inspection

Filters have the possibility of providing useful intelligence to criminals operating illegal child pornography websites. If they operate a website which has been placed on a blocking list they then know that the website has been identified by the authorities and is then highly possible

• The criminals can then take steps to destroy any evidence AND take steps to relocate their services to a new location anywhere else in the world.
• They can test their hiding technologies against the detection system to research which techniques provide longer protection against detection and blocking.
• Blocking activities also cause disruption to those accessing such websites thereby forcing the web operators to move their content more frequently. These movements can also be tracked and can offer useful intelligence to investigators tracking their movements and may provide useful research data.

• Security issues

The infrastructure required to execute a blocking strategy is capable of interfering with many critical elements of end users’ internet connections. In addition, the content of block-lists is of prime interest to paedosexual offenders since they have strong motivation to use the blocking list for the opposite reason to the one that it was designed:

• Over-blocking and Under-blocking

No strategy identified in this report that seems able to prevent over-blocking. This is a major concern when balancing the need to protect children versus human rights and freedoms. It seems inevitable that legal content will be blocked where blocking is implemented. Under-blocking is also a universal phenomenon especially present in the more proportionate and focussed blocking strategies.

• Mission creep potential and re-territorialisation

It is important that public debate take place and that this debate consider the essential technical and legal differences between different types of content and the proportionality of blocking to other methods of harm reduction, crime prevention, and cybercrime