Filter trial vendor sceptical over Internet clean-feed
- 12 March, 2010 12:43
- Comments (25)
Internet filtering won't prevent people deliberately looking for inappropriate material from accessing blocked content, according to security vendor, M86 Security.
Six of the nine ISP participants in the URL-based Internet filter trial last year used M86’s R3000 filtering kit.
The technology was originally developed for the education sector and was then applied to enterprise businesses.
“When the filter was first launched 10 years ago, I don't think anybody would have thought it would be applied on a national scale,” M86 COO, Bruce Green, said.
“We talk hundreds of thousands of users and even the biggest enterprise might have half a million. Now we’re talking about millions of users when you go into the consumer section and it was never really designed for that purpose.”
Nonetheless, the technology can still be applied to ISP networks.
While a filter may be effective in guarding against accidental access of inappropriate content online, it may not be as useful in preventing people who are seeking to access such material, according to Green.
“To stop a child accidentally hitting a bunch of keys and accessing something, is doable,” he said. “But a lot of investment goes into cybercrime and if somebody is trying to bypass the filter to share something they want, they’re going to bypass anything you’ve got up.
“In some ways, because it is such a publicised issue, I’m sure people are already working to get around it.”
Having worked at UK telco giant, British Telecom, Green can understand ISPs' apprehension over a mandatory clean-feed.
“As soon as you step into any form of censorship – and some people do perceive it as that – companies would want to stay away because it then becomes political,” he said.
Green shares Prime Minister Kevin Rudd’s sentiments regarding the need to protect citizens against ‘indecent’ material but questions how far the filter will go in terms of deciding what content to block.
"But once you implement these sorts of things, I think what everybody is concerned with is how can you control where it goes then?" Green said.
The Federal Government conceded ISP-level filtering is not a silver bullet to preventing access to inappropriate material. It claimed the filter will only block refused classification content which will encompass content depicting child pornography.
M86 has yet to settle on pricing should it chose to supply technology for the proposed Internet filter. The vendor typically charges a set amount per user but due to the large scale of the project the company is contemplating a cost per server implementation pricing model for ISPs. But Green said it will depend on whether the Federal Government is paying for the technology and how much it is willing to fork out.
Marshal8e6 rebranded itself as M86 late last year.
- Bookmark this page
- Share this article
- Got more on this story? Email ARN
- Follow ARN on twitter
-
Managing the Human Factor in Information Security - How to Win Over Staff and Influence Business Managers
-
Teach Yourself Visually iMac
-
Twitter Tips, Tricks, and Tweets
-
The Hidden Power of Flash Components (Includes CD-ROM)
-
Microsoft Office Project 2003 Bible
-
Professional Alfresco
-
Professional ASP.NET 2.0 Design
-
Testing ASP.NET Web Applications
-
Hacking Firefox



















Comments
Doug Wilson
You make the same mistake everyone else mentioning this proposed filter does. Child Pornography is NOT RC material in Australia. It is ILLEGAL material in Australia.
While that may seem like a worthless distinction it actually gets to the heart of the matter that every one of the content types stated by Senator Conroy for implementing the proposed net filter are already illegal in Australia and already filtered by the ACMA blacklist.. That includes Child Pornography, Sexual Violence against women, instructions in committing crime, Instructions in drug use, and beastiality. If you come across a website that includes these things you can already report it to the ACMA and if they determine that it is illegal in Australia the ACMA will block Australians from getting to it through a Blacklist that Every ISP runs.
What Conroy actually wants to block is stuff that isn't determined to be Illegal in Australia but fall under the much much broader category of Refused Classification. Things which may be Refused Classification include content that:
* Depict, express or otherwise deals with matters of sex, drug misuse or addiction, crime, cruelty, violence or revolting or abhorrent phenomena in such a way that they offend against the standards of morality, decency and propriety generally accepted by reasonable adults to the extent that they should not be classified.
* Depict in a way that is likely to cause offence to a reasonable adult a minor who is, or who appears to be, under 16 (whether or not engaged in sexual activity).
* Promote, incite or instruct in matters of crime or violence.
As you can see the guidelines for RC and Illegal materials are quite different.
Mr1979
FFS just drop the stupid idea Krudd.
Ben
Even the vendors are saying their solutions don't work on a mandatory scale, yet our pig-headed government persists.
There is no way the benefits outweigh the consequences, even if everyone in Australia wanted the policy in place.
Is blocking a few hundred or thousand URLs (which can be easily bypassed) out of trillions REALLY worth several hundred million dollars and opening our communications infrastructure up to attack?
Asmodai
The vendor is just doing the smart thing.
They want to sell millions of bucks worth of software and support, but they know you can get around them very easily so they don't want the government to be able to come back griping that solution doesn't 'work'.
We use a Marshal product at work. Going off proxy is simple if you're an admin because you just use and alternate browser while your userbase is locked down by policy to only use the proxied IE browser (so even if they bring in a portable version of Firefox, for example, they can't get around the system).
Now think about all of Australia. Each user can be the admin of their own PC. How can the gov. stop you circumventing the filter apart from forcing you to join a domain which prevents you being the admin of your own PC? They can't (and they would never get away with that).
Who are these people?
Bet some politico knob got p!ssed one night and came up this stupid idea. Australia censors it's internet along with Russia, North Korea, etc. Don't these idiots know that it you want to get content you can. Proxy servers, changing IP's and the more common, just running a temporary server for a couple of months. Are they gonna stop peer to per too?
So when it's implemented and not working who is gonna pay to keep it going who is gonn pay to bandage the holes and who the hell is going to decide what poor sensitive Australians are allowed to see? Some stuffy group of old farts gathered around a table? Who knows what private agenda they have? How open to corruption is this! The whole thing stinks, my tax is gonna go up, no doubt my ISP will charge me more and I can't wait to see the slowdown on access. Bloody idiots. Another giant waste of my money. Lets just go buy some more submarines or set up a national ticketing system, oh hang on that was a total waste too.
Once people realise what is really happening and how it doesn't just affect the techi's and the nerds, the brown stuff is gonna hit the spinny thing for sure.
Dave
@Doug - NO ISP currently, apart from WebShield, runs any kind of blacklist. While you are correct in that child porn is NOT RC(and never will as to be RC it needs to be submitted for classification) but is illegal, there are no ISP-based filters preventing access to it. Normal people just don't look for this stuff, and nor do they "accidentally" find it on the net, it just isn't there.
YankDownUnder
I'm left to wonder, regardless of the actual "objective" in this, WHO is pocketing the vast amounts of Australian tax dollars - with the $400 million failed NBN stuff, and now this Conroy proposal - what companies - what contracts - are being paid off - failed or not - this is what Australians should truly be digging into.
Dylan
@Who are these people? - Russia doesn't filter its internet. Check out Reporters Sans Frontiers internet report. And just in case the pollies are reading this (yeah right they can't read.) Finland has determined that internet access is a human right, if you guys are going to stealing idea for overseas could you at least steal the good ones?
Gilles
Are we going to take performance hit for this filtering ? If all requests are being checked and filtered were bound to.
Foo
@Asmodai:
Wow, you've never heard of "trans proxies" (Transparent Proxies) have you?
Your ISP is probably already running all of their users, including you, through a trans proxy: any outbound traffic on tcp/80 (i.e.: web traffic) gets intercepted at the ISP's border routers and flicked back to a Squid (or other) proxy server to service the requests. This saves the ISP big dollars on traffic bills to their upstream peers as all the regularly hit traffic (like stylesheets, images, videos, etc. on Facebook, GooTube, etc.) will be in the Squid cache and can be served up locally instead of downloaded across the internet again.
Once you've got that kind of infrastructure in place it's literally "trivial" to add a blacklist-style content filter. Of course, it's also trivial to bypass such a system, too.
Cynic
@Foo - whilst transparent proxies have been in use for quite some time, they are not without their own problems. I can remember a couple of points in the last ten years or so where Tier One ISPs have had issues with their transparent proxies that impacted a large percent of their user base.
What happens when the big-web-filter can't cope with millions of users surfing the web between 4pm and 10pm every night? Who is going to compensate the paying customers? The ISP, nope, they are only doing what they were told by the Government. The Government, not likely, they'll pass the buck back to the ISP.
The only loser out of all this will be the average consumer, who could probably achieve the same level of protection with a little education and by taking some notice of what their children are doing when on the computer.
The parents of this nation need to start taking some responsibility for the protection, education and (shock, horror!) supervision of their children and stop crying to the Governement "won't someone think of the children"
The other issue with KRudd's big-web-filter is that it only filters a tiny portion of internet access methods (ie: ports). It doesn't take much skill with google to work out how to use ssh to tunnel all your web surfing and mail over an encrypted link to an end point in another country - and no amount of real-time government snooping will be able to see what you are transferring.
Arthur
Senator Conway the current (wanna-be) minister for communications of Australia, is a man without qualification. He was a former union leader, and as the unions in Australia are just over-powerful, they blackmail their into politics.
This man is bad bad news for Australian tax payers several fronts. It makes my heart bleed seeing him squandering gazillions of tax payer funds, while he himself is slowly and surely turning into a millionaire.
It will take the government after him and the people of Australia years to clean up the mess created by this man.
Arthur
Bruce
We should be demanding full visibility into how our tax dollars are being spent on this incredibly shortsighted endeavor.
bpwnz
@Asmodai
"...which prevents you being the admin of your own PC? They can't (and they would never get away with that)."
A few years ago you may have said they'd never get away with a national internet filter.
This needs to be stopped NOW before they get the chance to chisel away more at liberties.
Michael
The issue is the block list cannot be kept up to any semblance of current.
The internet has ~100,000 new domains a day. ref http://www.domaintools.com/internet-statistics/ Lets assume on average each is a website (and ignore sites that change over time!!!)
Any of these sites can be banned content. So the Govt must check each of these sites. So How many websites can you check ALL the links on each day? 10 if you are very lucky. (BTW this page had 274 links to other pages when I checked it).
So that's $400 million PA on just keeping the list up to date. (assuming you can get 10000 people to do this at $40kpa)
No capital cost, not running cost, no support staff, just $400 million PA to keep a list up to date. But we don't have an up to date list. There is 160 million domains to process first!
So if we can all just agree there is no way to block all RC content without making a list that will be prohibitively expensive to maintain then we can get on with our lives.
Oh and BTW the govt is really living in fairyland "The FCSP is expected to cost AUS$189 million (US$123 million) to implement." ref. http://www.arnnet.com.au/article/339394/filter_trial_vendor_sceptical_over_internet_clean-feed/ That's the once off total expected cost.
Angus
@Foo:
> Your ISP is probably already running all of their users, including you, through a trans proxy
No they're not. Most ISPs don't currently do that.
You can test this; if you check your IP address at your modem, and check it at a site like http://whatismyip.com/ , you'll probably see that they match. If they match it means you're not connecting through a proxy.
Fuzzypig
Utterly pointless, this just screams the word challenge to every would be libertarian "hacker". I bet half of them can't wait to see how quickly they can bring this wall crashing down.
You either go mental and do it properly like China, ie throw everything you have at it, hire informers from the populace, hefty fines for ISPs and cafes etc, or you don't bother.
Simply make a token effort to appease the moral minority and make the government look like they are doing something about the seedier side to the internet.
How about a program of education for everyone eh? How about some free personal monitoring software for the parents, how about talking with ISPs to see how they would do it, then get some genuine experts in?
Nope, some government muppet is on the board of directors of this gizmos and they stand to make a killing if they can get a great big huge order through the door!
Like they always say, money talks and...well you know the rest!
Anon
My only concern is Abbott taking over when the filter is already implemented. God know what he will be filtering...
Rhao
@Dave: When I signed up to Internode three years ago, they pointed me at an information page of terms and conditions that included a line saying that there was a government mandated blacklist that they can't route to and not only could they not legally do it, 'you do not want to see these sites'. From this I expect Doug is correct.
You are right about people not accidentally stumbling across child porn though. I've looked for porn all over the net for years and only seen it once (and yes, that was by accident).
If someone wants filtering, the answer is opt-in, not opt-out. Don't expect sites with information on euthanasia to survive the current passel of practising christian frontbenchers.
Josh
It's not that difficult. Various polls have shown the proposed filter is hated by >94% of the population.
SACK CONROY. It's simple.
fd
haha this is kind of amusing, notice the list of countries that filter thier internet...
who would have thought australlia would now join those ranks.
Nick
Hey Guys,
Im not sure if this is relevant, but from my ISP, (optus), i cant acess the ARNNET Site??? I cant ping it or anything...
Im currently posting this through a web based CGI proxy...
I dont suppose filtering is already happening and the objectionable material is already being censored?
Cheesr,
Ian
The ability to get content and sites on the blacklist will be another source of donations and political support for a corrupt government.
Tibetan Buddhists - separatists promoting violence says the Chinese gov.
Palestinians - violent terrorists says the Israeli gov.
Abortion - murder say the Right to Lifers.
Depressive literature - may lead to suicide say the anti-euthanasia whoevers.
Motor bikers - promote criminal behaviour say the police.
etc.
Political parties need lots of donations; to give to the big, boring media corporations; to get elected; to run the money machine.
Tom
What a lot of bull some people come up with to appear as presenting reasonable discourse.
And from the 1st comment, something may be "illegal" but without the will and means to enforce the law then it has no meaning, your interpretation is rubbish, ACMA refuses to rate child Porn RC! it does not rate it! it has no legal classification!
The filter is not to catch people it is to clearly state that this material is not acceptable to our society!
Howard and the liberals can move quickly when it comes to laws removing any rights of native Australian peoples or people not of (colonial) australian origin, but then that may have been a move to punnish those calling for recognition of the bestial way we have and still treat some peoples.
Today the US monitors all internet and phone traffic.
The Howard government proposed a law allowing our security authorities to hack into a persons or corporations PC and to load data to it and without any independent watchdog. I do not know if it was passed.
Anonymouse
Dear Foo, I am a network engineer at a major ISP. Major Australian ISPs don't use transparent proxies these days.
Proxies simply don't scale to the speeds of the modern Internet. You can see that in the pathetic performance of networks which do continue to use web proxies, such as the various school networks.
Proxies these days save about 5% of bandwidth, as web is mostly dynamic content these days and the static items have grown to huge sizes more suited to content distribution networks rather than proxies. ISPs find proxies -- transparent or otherwise -- just aren't worth the cost in help desk calls about the reduced performance and the unreachability of some web sites.
The reality is contrary to your view. There is no "ready to go" facility for web filtering at ISPs. We can drop traffic to or from particular IP addresses, which is useful for filtering denial of service attacks. But a permanent filtering system wouldn't be very good if it blocked the entirety of the New York Times because one article contained enough detail to be considered "instruction in matters of crime" and thus RCed by Australian censors.
Post new comment