Web blocking: the Internet is not for porn

Researching for my last class of the year, on Internet pornography (save the good stuff for the end :-) , Pangloss is amused to discover a survey commissioned by no less an institution than Radio 1's Newsbeat, claiming that a quarter of men between 18 and 24 think they watch too much porn online. Notwithstanding this, 8 out of 10 of the male 18-24 year olds questioned admitted to looking at porn on the net compared to only a third of women. Only 4% admitted to viewing such sites for more than 10 hours per week, the lvel required for a diagnosis of compulsion or addiction.

More seriously, it seems worth reminding oneself of the cogent reasons by which Joe McNamee of EDrI persuaded the European Parliament earlier this month that state-mandated, self-regulatory,non-judicial, non transparent web blocking by ISPs was not the path to go down.



This is all the more important as, behind closed doors, Ed Vaizey, the UK Culture Minister, presses on regardless with plans for "voluntary" blocking by the big ISPs of both sites alleged to be complicit in copyright infringement, and even more worryingly, sites hosting "sexually explicit" material - material that in EU parlance may be harmful to, or just disliked by, some, but which is not in principle illegal for all to view or possess as is universally the case with child pornographic images.

If these matters are so important, one wnders, then why does the government not mandate them by the usual tool of legislation? Could it be that, having narowly escaped humiliation at the hands of the judicial review court in respects the Digital Economy Act (for now at least), they know that for an EU government to demand explicit blanket filtering of non-illegal material (which circulates with relative freedom in several EU member states) would almost certainly fall foul of art 10 and probably art 8 of the ECHR, as well as restraining freedom of services and trade across the EU?

At such moments, it never hurts, perhaps, to consult the old classics: The Internet is for Porn.. but not for long?

Welcome to 2011!

Happy new year, gentle readers, slightly belatedly, and for Pangloss it's all new indeed: new job, new title (Professor of E-Governance), new workplace (Strathclyde Law School) and new abode (back in Auld Reekie). All of this makes me very happy if in the short term, slightly, dishevelled, abandoned, hyper and well, fill in the adjective of your own choice :)

Please note AGAIN my new email address is lilian.edwards@strath.ac.uk and my snail address should you conceivably need it is

School of Law

Faculty of Humanities and Social Sciences

Graham Hills Building, Level 7 (GH 7.13)

50 George Street

Glasgow G1 1QE

If any of you can remember the achingly long time ago before the festive season, the burst pipes (oh so don't ask) and the Snowpocalypse, you may remember we were a little exercised about Wikileaks. The nice people at Practical Law Company (PLC) asked me to write a briefing on what issues might be involved for the UK legal system, and you too can read it for free here. Basically I think the key issues are:

- were criminal offences committed of DDOS by UK residents? (almost certainly yes)
- is merely downloading a tool which can be used to help commit DDOS a crime? (yes, though proof of intent may be tricky)
- can IP addresses of attackers be captured & UK ISPs be asked to help identify such persons (yup)
- can ISPs in UK conceivably be asked to block Wikileaks sites or domain names? (A. probably not, unless by some back door means such as invoking copyright laws under s 97A of the CDPA, or by some hitherto latent common law power which would need at least a High Court application in England & Wales or Court of Session in Scotland, and still be pretty uncertain).

The last point, though it seems farfetched, is a topical one given the ill judged comments by Ed Vaizey just before Christmas suggesting that all online "adult sexual materials" sites should be blocked "at source" by UK ISPs , with only adults then allowed to opt back in. Beyond the obvious difficulties of definition of such sites, over blocking, under blocking, the herculean task of assembling such a list, most of which will be overseas, evasion, ULL-jumping, VPNs, proxy servers, the fact that kids are better than adults at hacking this, etc ad nauseam, the simple fact is that such blocking solutions don't work and don't scale on practical terms unless you're willing to devote the resources and the Stalinist control of a country like China to such a pursuit. Just look at Australia for the trouble it has caused there in a smaller country with far fewer ISPs and far more history of state censorship than here.

I'm all for thinking of the children, really (actually, to be honest, as a child's rights lawyer on the side I also wonder if anyone has paid attention to the emergent minor child's right to autonomy, see Gillick, see future possible ECHR applications..?) but right now this seems like an expensive, embarrassing, largely pointless red herring to go down. IF parents want to stop kids accessing porn, there are many good products out there to allow them to do it at home eg |Net Nanny and its ilk. The Daily Mail will like it though :-)

But more than ALL that, what worries me is the huge possibility for scope creep here. As I have noted often, often before, once you have one scheme for blocking huge amounts of URLS without transparency or accountability in place, what is the temptation to start adding other URLs to it you don't like? High , in my cynical opinion. (And whatever the government means by blocking sites "at source" this will have to involve an Internet Watch Foundation style blocklist - because every single adult site closed down by its host service in UK will simply shift to a host abroad in under 24 hours. Indeed the Telegraph story seems to clearly indicate an IWF type list would be used : "Ministers now want companies to use the same technology to stop children accessing adult images".)

So on a brighter more positive start to the new year, here's a few events I plan to be at, be running , be speaking at, and so forth:

Workshop on Free and Open Communication on theInternet (FOCI), to be held February 24-25, 2011 at Georgia Tech in Atlanta,Georgia (invited expert speaker)

BILETA, Manchester Metropolitan University, 11th-12th April

3rd Web Science Conference, Koblenz, Germany - June 15-17

GikII in Gothenberg, Sweden!! GikII goes Scandinavian hardcore:) , contact Matthias Klang for info - 27-28 June

SCL Policy Forum, London, Herbert Smiths, September 15-16th - I'm curating this one on a theme of the new shape of European regulation as the DPD, ECD and other major instruments head for reform.

BERR, the music industry and file sharing: also stupid porn law ideas

Sorry for long silence. A bit of a catch up here of some recent very important stories..

Ray Corrigan helpfully reminds me that the Department for Business Enterprise & Regulatory Reform has published the responses to their P2P filesharing consultation.

"None of the options highlighted in the consultation won widespread support. Rather there was a marked polarisation of views between the rights holder community and consumers and the ISPs over what action should be taken.

A number of key issues were identified by respondents including copyright protection, protections afforded under eCommerce legislation and the impact on the wider economy. Consumers (individuals and consumer organisations) in particular highlighted concerns over data protection and privacy. The role of technology was addressed by most respondents, however there were conflicting views as to whether it could offer all or part of any solution. For almost all the options, questions were raised as to their legality under the existing legal frameworks and again, views varied.

There was a degree of consensus that any solution must involve the provision of new legal sources of attractive content and the need for education on the importance of copyright in the wider economy.

A number of replies suggested alternative models to those options proposed. Copies of all non-confidential responses received have been placed on the BERR website."

Meanwhile documents leaked to the Financial Times apparently show that BERR is planning in the wake of this to introduce an "ISP tax scheme":

"Ministers intend to pass regulations on internet piracy requiring service providers to tell customers they suspect of illegally downloading films and music that they are breaking the law, says the draft report by Lord Carter.

It would also make them collect data on serious and repeated infringers of copyright law, which would then be made available to music companies or other rights-holders who can produce a court order for them to be handed over.

With the creation of a body called the Rights Agency to be paid for by a small levy from the internet service providers and rights-holding organisations, these measures would form the spine of a new code of conduct for the internet industry. The draft report says the code would be overseen by Ofcom, the broadcasting regulator, according to people who have read it.

The guiding philosophy of the report is that the internet and music industries have failed to sort out the problems of illegal downloading between them, and the government sees this as its preferred solution."

As others have commented, that last sentence is posibly accurate :-)

Until we get details it doesn't seem worth commenting much on this. First impression is that it is certainly preferable to either the compulsory filtering of allegedly copyright content out, or the "3 strikes and you're out" type scheme we have feared since March 2008. On the other hand the privacy implications of this scheme are still not good.

Why for heavens sake if we are going to start imposing taxes , can't we simply do the sane thing and install a tax/levy system on broadband use, which would pay for all music to be downloaded "free"? (A: because the music industry don't want it that way. Well, hello.)

According to Becky at ORG,

"The official government response to the consultation will be published as part of the interim Digital Britain report, which is expected at the end of this month."

In other news, DRM is dead. Well for music. I mean if iTunes has decided it isn't worth using, who the hell else is going to?

In still other news, turning from music IP to Net porn, Burnham talks Bollocks. Well, so no change there. I won't address this one in detail here either, because I just have in the (very heavily) revised version of my chapter on pornography, censorship and the Internet which will be appearing in the 3rd edition of Edwards and Waelde Law and the Internet, hopefully soon..

(This bit isn't so bad though. According to the Telegraph " Mr Burnham also wants new industry-wide “take down times”. This means that if websites such as YouTube or Facebook are alerted to offensive or harmful content they will have to remove it within a specified time once it is brought to their attention." The vague definition of "expedient" in the E Commerce Directive Art 14 has long been unhelpful to both hosts and ISPs, so Pangloss approves of this as long as it is practicable.)

Here's a taster of my views , in the new section on the global rise in compulsory top-down invisible Internet content filtering..

"Effectiveness. Web filtering can be easily avoided by those who really want to, and any government wishing to install it must consider the impact of this on effectiveness. Depending on how filtering is achieved, blocking can often be evaded by a proscribed site changing its URL, or merely its underlying IP address. Users in turn can simply use a foreign proxy server site to anonymise their surfing destinations[1]. Steps can be taken to inhibit avoidance, but they are likely to result in serious over-blocking – for example, the EFA paper on the Australian scheme notes that a serious web filtering system would also need to block the Google cache, the Way Back Machine[2], and numerous other Internet archive sites where content is mirrored. It can be argued that child porn web filtering systems merely inhibit the ignorant or lazy or those who stumble on illegal material by accident[3], and do not stop for a minute those who are ostensibly the real targets of the efforts involved – serious paedophiles who may go on to commit actual abuse.

A key anti-avoidance issue is whether filtering is only to be imposed on websites or on other types of digital content, such as Internet newsgroups[4], P2P filesharing systems, instant messaging (IM) and email, as well as mobile phone traffic. As we have discussed above, illegal content is now known to be more commonly swapped in encrypted P2P “darknets” than on the open Web, which begs the question, why bother to filter the Web at all? In response to such criticisms, the Australians have claimed they intend to extend their reach to cover material traded via the P2P protocol BitTorrent and the EC has instructed research into P2P content blocking[5]. Such research is still likely to prove useless in the face of modern evolving encrypted P2P systems. At present such systems (eg Tor and Freenet) are rarely used by the average EU or US citizen because they are user-unfriendly and slow – but in go-ahead Japan, the leading P2P systems, enabled by their fast next generation consumer broadband networks, are both encrypted and consumer-popular. It will not be long before such systems make the leap to Europe and the US as home broadband networks are upgraded here too. At that point only the most foolish pedophile would attempt to access child porn using the open Web.

A slightly easier target is mobile content. In Europe, many mobile operators already provide filtering software and filtered content for children, and UK operators since 2004 have voluntarily signed up to Ofcom-brokered codes of conduct requiring filtering of content to under 18s and labeling of over 18 content on their servers[6]. Reliably imposing these restrictions on children given cheap anonymous pay as you go phones, may however be a harder than foreseen task.

Resources. Even if we only look at filtering the Web, realistically, classifying the
ever-expanding billions of Internet pages manually as “illegal”, “inappropriate”
or whatever will cost billions of dollars and be an
ever moving target[7].This has not however stopped the Culture Minister Andy
Burnham recently suggesting exactly this for the UK[8].)

The IWF avoids this problem by being complaint-driven - which
means its list is,of course, very partial[9] and thus of questionable success. In reality,
blocklists in commercial filters are usually generated partly by automated and partly
by manual means, which as the ONI note, means they are inevitably prone to both
over- and under-blocking.

---

[2] Interestingly, the Register has also reported that the IWF had added images on the Wayback Machine to its block list, which had lead to some ISPs banning the entire 85 million web page archive. Details were not given as to what images had been banned and ISPs involved gave 404 “page not found errors”. See “IWF confirms Wayback machine porn blacklisting” ,The Register, 14 January 2009.

[3] Mike Galvin of BT, one of the creators of the IWF “cleanfeed” system, admitted in an interview with the Guardian on 26 May 2005, that Cleanfeed “won’t stop the hardened pedophile” and went on to say that its main aim was to stop accidental access by users following links such as those in spam emails.

[4] Internet newsgroups have largely fallen out of common use but are still extensively used for porn trafficking: see January 2009 report of USA conviction of 7 paedophiles following the bust of a well organised network that used Internet newgroups to distribute illegal items to its members over a two year period. See “Child porn in the age of teenage “sexting” “, The Register, 16 January 2009.

[7] The EFA pages (supra n XX) estimate that even if a 1000 people were employed full time for a year , they would fail to categorise more than 0.1% of all the pages on the Web , and at the end of that year the list would be hopelessly out of date.

[8] See BBC report, 27 December 2008 , at http://news.bbc.co.uk/1/hi/uk/7800846.stm .

[9] Testing of the IWF Cleanfeed system for use in New Zealand found that their list contains probably only only about 10-15% of offending websites (statistic cited in EFA pages, op cit supra n XX)

Cyber(in)security roundup

Producing the Macafee VCR makes you more than normally aware that every vendor and their (robo)dog , plus apparently most NGOs, produces a report on some aspect of online spam, crime, fraud etc in that vital run up period to Christmas when apparently our minds are focused on fun, festivity and, er, fraud:

My esteeemed co-author Blogzilla helpfully summarises a few from the US and international organisations:

"Securing Cyberspace for the 44th Presidency — the Center for Strategic and International Studies argues that President Obama should create a comprehensive national security strategy for cyberspace, echoing many of [the Macafee] recommendations.

Financial Aspects of Network Security: Malware and Spam — the International Telecommunications Union develops a framework for assessing the financial impact of malware.

The OECD calls for a global partnership against malware, and a move from reactive responses to proactive threat reduction and mitigation."

But there's also been some more local offerings:

The Garlik UK Cybercrime Report 2008 - which, like our report, top-lines the credit crunch and its effect on cyberfraud. Despite the name the figures appear to relate to 2007. For the UK, it is claimed,we have seen

• Overall cybercrime has risen by 9% from 2006
• Online financial fraud is up by 24%
• Online card fraud is up 45%
• 84,700 cases of online identity fraud
• 40% of all identity frauds are facilitated online
• "More than two million victims suffered abusive or threatening emails, false or offensive accusations posted on websites and blackmail perpetrated over the internet, up from 1,944,000 in 2006." Much of this apparently tookplace on social network sites. Pangloss is curious where they got this figure - must go print out the whole report.

ENISA, the EU's security agency, also produced in early December a rather underlooked report ENISA - Photo Sharing, Wikis, Social Networks –Web 2.0 and Malware 2.0.
This has an interesting analysis of risks primarily to *systems* from the hard technical viewpoint, as opposed to the emphasis most the other reports place on risks to *users* (though of course the two are connected.) The risks of cross - scripting exploits in multi-origin environments like SNSs are highlighted, along with typically weak control of authentication and access privileges. The policy recommendation to governments are interesting:

"Policy incentives for secure development practices such as certification-lite, reporting exemptionsand the funding of pilot actions. These incentives are needed to address the large number of, eg,cross-site scripting vulnerabilities caused largely by poor development practice.
• Address/investigate Web 2.0 provider concerns about conflicts between demands for content
intervention and pressure to maintain ‘mere conduit’ or ‘common carrier’ (US) status. This is
considered a very important problem by Web 2.0 providers because of the strong user-generated
content component.
• Encourage public and intergovernmental discussion on policy towards behavioural
marketing (eg, by the Article 29 Working Party)."


Perhaps unsurprisingly in light of all this, the EU has just announced (9/12/08) its plans to continue funding its Safer Internet Programme to the tune of 55 million Euros:

"The EU will have a new Safer Internet Programme as of 1 January 2009 (to 2013) . ..While 75% of children (aged between 6 and 17 years) are already online and 50% of 10-year-olds have a mobile phone, a new Eurobarometer survey published today shows that 60% of European parents are worried that their child might become a victim of online grooming (when an adult befriends a child with the intention of committing sexual abuse) and 54% that their children could be bullied online.. The new Safer Internet Programme will fight grooming and bullying by making online software and mobile technologies more sophisticated and secure."

The money is to go to:

• Ensure awareness of children, parents and teachers, and support contact points that are providing them with advice on how to stay safe online.
• Provide the public with national contact points for reporting illegal and harmful content and conduct, in particular on child sexual abuse material and grooming.
• Foster self-regulatory initiatives in this field and stimulate the involvement of children in creating a safer online environment.
• Establish a knowledge base on the use of new technologies and related risks by bringing together researchers engaged in online child safety at European level.

So more media literacy, more research, more IWF style hotlines, but no apparent endorsement of the ISP or mobile coms sectors being required to impose mandatory "upstream" filtering: either of the IWF-lead UK Cleanfeed inititiative or the disputed new Ozzy variety. Interesting..

The OPA rides again..

http://www.theregister.co.uk/2008/10/06/obscene_publication_girls_aloud/

Bleeding heck. This and the UK extraditing someone for denial of Holocaust, a crime we don't actually have here, all in one week?

I hate to say it, but both the Lib Dems and the Telegraqh are dead right on this one. I'm all for reasonable restraints on freedom of speech, of which this certainly is one, but the correct approach should then be a public debate in the UK as to whether this is a crime we wish to recognise (or introduce) not a blank cheque to the receiving country's police. That way lies extraditing Western citizens to Saudi Arabia for sever penalties for (say) sleeping with married women. No please.

The Girls Aloud stuff is equally vile but the principle has long been understood: no more prosecutions of literature, stick to obscene pix. Even the IWF now says it is after "images of child abuse" not "child porn". As Wendy Grossman pointed out, if this prosecution is successful, will the IWF have to start considering the artistic worth of stories and fan fiction, so as to add it after complaint to its block list. Really no please. That is for courts.

Are conservative values reasserting themselves in recession or is it just autumn and time for some Internet moral panic stories?

ps this is my first blog post written on my beautiful new and very tiny Acer 1: staggeringly cheap, fast, decent keyboard, virus free Linux OS, built in web cam. I am a total convert. All I need now is mobile Internet sub and I can happily write all my articles on the train to Sheffield :-)