Re: Blocking Offensive Material(??) with Firewall

[Christoph Schneeberger <cschnee () telemedia ch>]

Hi,

> mind, the two first ones being "How?" and "Does the government have any
> idea how the internet works?".

Forget it, they haven't at least for what I can speak, that is Europe
especially Switzerland.
We had a very similar problem about a year ago here in Switzerland:
The federal police called all ISPs to block certain well known Nazi-Websites.
They didn't give any idea how to do it, they just said "Do it, or you will
be charged" as "assisting Nazis in propagating their material" (sorry for
my english!).

The BSPs were feared to death (the munich compuserve case was just some
weeks old then) and immediately blocked the desired IPs on the backbone
routers, too sad, one of them was www.webcom.com which resulted in many
complaints about not reaching regular, legal webpages also hosted by webcom.

After that a discussion was initiated and all ISPs invited. The conclusion
was: It is not possible to block something completely, but ISPs can show
their will for cooperation and block it just somewhere (reasonable measures
...) to keep the standard joe doe user from accessing the blocked page.

> It seems to me that there are two ways of content blocking - at the ISP
> level with application level filtering using proxy servers and at the
> BSP level with packet filtering using routers.

Okay, that one needs only a few words:

-anonymizing proxies and Webservices (anonymizer.com, navy onion routers etc.)
-Webpage by email services
-mirrors of censored content
-getting a colleague from another country to fetch the page and send it by
mail 
etc.etc.

at least anybody with an internet connection and an internet host running
whatever can easily circumevent these measures by setting up a little perl
script which fetches desired pages for citizens of "censor-land".

> Both of these methods cause major problems in the form of performance,
> accidental blocking of legitimate content and easy circumvention of
> proxy servers, routers and schemes like tunnelling.
>
> I understand that proxy servers can block all the sites on a blacklist
> and firewalls block all sites that aren't on an allowed list.

It is impossible with current technology to enforce such a blocking policy
completely, but you can make one's surfing experience an uncomfortable one
- not more.

If you try anyway to implement what you can (proxy filters, IP filters
etc.) you'll have to restrict your users environment so heavily that nobody
would be willing to pay fees for that kind of crippled services. I.e. put
the users behind a filtering firewall or router, blocking on keywords and
urls, IP-filering certain well known services. 
Beside that your routers and firewalls would have a hell of time checking
REGEXes and ACLs.

The right way IMHO would be to hold the author of the content responsible
and not the innocent viewer of this content. If government can't do this
because of different legal systems etc. - then it's not an internet
problem, it's a problem of the underlying society.


Sorry again for my bad english,

Christoph

P.S.: Just to make that clear I am refering to the average ISP cutomer and
not the average corporate user. In a corporation you have another person
paying for your connection and there is nothing wrong if this service is
very restricted.