3News » Home

Internal Affairs to filter URLs in New Zealand

Wed, 17 Feb 2010 3:18p.m.

By Liz Quilty

Many people have heard of other countries having web filtering, and even New Zealand recently had a protest about Section 92a with a decent amount of success.

But though the battle may have been won, the war is far from over. The DIA (Department of Internal Affairs) has gone ahead with content filtering despite the fact it’s a waste of taxpayers' money, and it’s due to be launched at the end of next month.

Now many people get stuck on the ethics and morals of it, this is well talked about. Everyone is entitled to their opinion; however let’s look at the technical aspects.

According to sources the cost of the software is $150,000, plus customisation costs.

Then there would be costs associated with getting the list of 7000 sites they have already, two years testing, and any ongoing maintenance.

The system will be overseen by a 'Independent Reference Group'  made up of various people from law enforcement, welfare groups, Office of Film and Literature Classification, ISPs and internet users.  This will all cost, and that money will come from the Tax Payers.

Now, most people have heard of torrenting and downloading movies, music, images illegally from the internet, they may even do it.

Some may have even heard of news groups and other similar things. Generally you get illegal things from various ways, usually using protocols that are not on webpages.

The same goes for child pornography. How many of you have ‘accidentally’ stumbled over child porn? honestly? And do you think paedophiles will stop abusing children just because they cant view web pages?

How the filtering works.

Going even slightly more technical again, the ISP has a list of IP addresses in which the websites are hosted on.

If you request a website that happens to be on the same server as child porn you get redirected through the URL filter to check that its not that actual website. This is transparent proxying, you don't see it happen, you don't know its happening without checking.

One failure of transparent proxying is that it does not work on HTTPS (e.g. secure web pages using SSL, TLS, etc). Therefore as soon as you have a webserver that requires https:// - usually ones with logins or taking credit cards, the entire thing is pointless. It just doesn't work.

One option would be to block all https requests to those server IPs, but what if you were unlucky enough to run your ecommerce store on it, and used https on that particular IP?

What happens when they implement virtual hosting for SSL websites and multiple websites host an HTTPS on a single IP that also happens to have a child porn website on it?

Worse yet, what happens when a child porn site uses SSL because they require a credit card for paid content. It’s then no longer blocked. Not only this, but anonymous proxies are fairly well known and easy to setup to bypass any filtering, most students at schools are well versed on how to do this

Whilst the filtering may seem like nothing now, in a few years down the track perhaps they decide to block Islamic extremists, or something mild and acceptable, then slowly move that up the scale onto more unacceptable things, and eventually potentially we end up much like China  blocking things like Youtube, Facebook, Twitter, Myspace and many many more that don't agree with their policy.

Now onto the ethical side of things, whilst you may not want your children to view this accidentally, it’s not going to stop a paedophile from picking them up on clubpenguin. It’s not going to stop them from befriending them on stardoll, runescape, or any other site (which in all likelihood is where they will be more often). A lot of people seem to think this is what its’ going to do - stop people from stumbling upon it, it wont.

It’s designed to prevent would-be or curious people from hunting it up with a gentle warning. They don't even log who goes to the site. Now I know by now a few people are saying "but it’s optional!" Which to ISP's it is - however how about those people paying for it through taxes and aren’t even using it?

The debate has been fairly vocal, and most people are against.

Even Internet New Zealand issued a statement stating they reject centralised filtering as a centralised approach, however the DIA seem to have ignored it.

People in New Zealand, its time to state your opinion.

You don’t need to agree with anyone elses, you just need to be heard.

Go out, tweet, blog, and Facebook.

For those in support of scrapping the filter, then go back to the black avatar on social networks, explain to people why.

For more facts, check out http://thomasbeagle.net/2009/07/09/nz-internet-filtering-faq/

Liz Quilty

Liz works as a Linux System Administrator at Rimuhosting.com and has been using Linux and Open Source software for well over 10 years.
 
She is an active member in several projects, and you can find her on twitter at @velofille or @RHLiz
 
 

Previous Geek life entries

Comments [26]

IWT
07 May 2011 1:35a.m.

Web filter is really useful. Saving Internet users from moving to the wrong direction. But if people themselves want to do illegal act then what can be the solution? :)

Prague hotels
23 Apr 2011 11:03p.m.

Web filter is doing its work and producing the filtered content. But media is also responsible for downgrading the people!

SuperBurger
13 May 2010 12:33p.m.

Guarantee this will be a process of "creep" to being internet content under all NZ's outdated censorship laws. "Child porn" is the loaded power-term that will be used to justify extreme control measures (just as "terrorism" is used to erode human rights) and will be used as justification to screen and erode people's rights to information, this could just as equally be applied to block content on ANY other information deemed undesirable according to a secret and undisclosed list.

Tim
11 Mar 2010 2:10p.m.

I've just written this email to censorship@dia.govt.nz Hello I would just like to register my extreme disappointment at the activation of the filter to limit the information available from the internet. Not only has this been done without any wide ranging public discussion about the virtues of such a system, it has been carried out in such a way that the general public was not aware of the decision nor the activation. The internet has become a great tool for advancement of all society because ALL information is available without interference from government. It is not the role of a Government, especially in a free society, to decide what information its citizens can and cannot access without communicating and discussing these decisions with them. I for one will be cancelling any contract with any ISP that implements this filter, not because of what it blocks now, but because of the way in which it was introduced and the potential (certainty) that it will be abused in the future. Regards. We live in New Zealand, not North Korea!!!!!!

Warren Matthews
25 Feb 2010 12:44p.m.

I would like to voice my support to those opposing censorship. To those who do support it on the grounds of 'protection', may I ask you take the emotive driver out of the censorship request as such? Would you be happy if this was installed to censor 'information' for your 'protection'? With the leak of the Australian 'censored' list, with politicians abusing credit cards and positions, can you trust mere mortals with this great responsibility?

Anonymous
24 Feb 2010 4:30p.m.

Mark Harris, How do you expect for this to stand, i would say 90% of people who will read this article will say its completely useless and a waste of money, you have no right to censor anything, i can understand the need to censor child pornography and such, but as the article said its not going to reduce pedophilia anywhere, my personal opinion is the government is just trying to censor things because they are losing control over the media available to the public, such as all the hidden war crimes or corruption, the public will find out about these things regardless.

Unknown
24 Feb 2010 7:38a.m.

most people download from the internet. Ive allready downloaded alot of games movies and muisc from torrent websites. I just dont realy care i wont pay $120 for a game or $30 for a cd or movie when i can get it for free

Trevor
22 Feb 2010 6:30p.m.

As an IT engineer and software developer, I find it unbelieveable that they would suggest this could ever do what they claim it would do. URI's can be quickly changed and no filtering system will ever keep up. I don't think pedophile networks even use URI's. You can set up an IP Address on any of 65536 ports to transmit data and you dont have to use TCP/IP you can use any number of protocols. I can assure them they are waisting our money. This raises many human rights issues: Did we ever get asked if we wanted the internet arbitrarily censored. What happens when they don't like sites with different political views, will that be next? Does this follow Australia's/China's censorship, does this covertly monitor other things under the guise of stopping pedofiles? Will it be better than Telecom/Yahoo anti spam filter that still incorrectly marks legitimate emails as spam?

Mark Harris
20 Feb 2010 10:23p.m.

I've blogged this issue over on http://tracs.co.nz/gripping-hand/censorship-and-the-dia-filter/ Before anyone on this board takes issue with my comments, I urge you to read that and the discussion happening there. I am on the Independent Reference Group and welcome your comments. Liz, I agree with your general tenor, but some of your details need more research. What you provide is a technical description of how you would do it, if it were up to you. While it's possible it might be more efficient the way you propose, it is not what is happening. DIA has stated explicitly that https traffic is not included, as there are technical issues to do with authentication and performance. DIA is not hosting a transparent proxy. They are managing a list which the participating ISP checks requests against. If the URL is on the list, the ISP does not source the materia to meet the request, but delivers a message to the requestor. The list is not an IP filter, it is a URL (perhaps more correctly, URI) filter. IP addresses may appear, where a distributor has not used a DNS-based address, but is supplying the raw IP address as the URL. DIA is not doing look-ups on the DNS address to ascertain the IP address, which IP filtering would require. Part of the reason for this is, as you note, a single IP address can host a multitude of machines. IP address filtering is more performance efficient, but not as fine grained as URL filtering. ~mark

Tony
19 Feb 2010 12:56a.m.

What the hell is wrong with NZ? The Internet is total rubbish there already, Caps on data at 40GB for the biggest and best package?! The possibility of getting Internet cut off because someone might suggest I downloaded a song, but not proving it?! Now people filtering browsing?! What a joke. Sort it out, It's preventing me coming back and setting up a company.

Post a comment

Name:
Email: (Won't be published)
Comment:


3News Video 3News Audio