ISP filtering policy is not evidence-based

[David Bird]

Simon Wright

The Federal Government’s proposed ISP-level filtering policy is costly, complicated, and will be completely ineffective. In the coming weeks, the Labor party is tipped to unveil the legislation that will compel Australian Internet Service Providers to filter the entire world wide web, with the intention of blocking access to specific web pages.

The principal objection I have is that the policy mandates that ISPs spend a huge sum of money to deploy and maintain masses of new infrastructure. Whether this burden is passed onto Australians via taxes or via increased ISP fees, we will end up paying for it. We will end up paying, and it won't do anything.

Sure, the technology works as specified; that much has been ascertained. The problems lie in the policy itself.

It is widely assumed that the filter will make life difficult for people trading in material such as child pornography, but in reality, it will have no impact on child pornography rings. Indeed, Stephen Conroy himself admits the policy "is not targeted at the people perpetrating it".[1] He rightfully acknowledges that people knowingly seeking the material can bypass the filter or use non-web systems like peer-to-peer.

The goal, according to Conroy, is to protect the general public by minimising inadvertent access to so-called 'refused classification' material. However, there's no evidence that any inadvertent access is taking place; the infinitesimal trickle of complaints to ACMA is hardly evidence of a national crisis. It must also be noted that the Internet is brimming with legal adult material that -- if inadvertently accessed by children -- has just as much potential to cause distress.

This is not an "evidence-based" approach to policy.

Any claim of a mandate is clearly invalid, as the current policy differs greatly from what the Labor Party took to the last election. There was no mention of a mandatory filter whatsoever.

The original policy called for dynamic filtering by default, with an option to opt out. Because of this, when the minister called for live trials, it was widely assumed that it would fail spectacularly. After all, dynamic filtering is horrendously inaccurate. Relying upon fuzzy algorithms to police the Internet is a fools errand, and would put Internet-enabled industries across Australia at grave risk.

Of course, by the time it got to the trial, the policy was so watered down that it was limited to filtering pre-defined list of URLs, which comprise 0.000001% of today's web (that's ten thousand pages out of an estimated one trillion), to say nothing of the millions of new pages created every minute. This weak set of requirements was of course technically achievable, but in terms of fulfilling the policy's goals, a comprehensive failure. The resulting Enex TestLab report is the answer you get when you 'ask a stupid question', and is therefore irrelevant.

A criticism of the filter is that because its scope is so narrow, its capability so limited, it could only handle a fraction of the internet content the Government might wish to be filtered. It doesn't apply to email. It doesn't work with high traffic websites. It doesn't apply to websites that require a password. It doesn't apply to any website that turns on secure HTTP.[2] It doesn't apply to bit torrent. It doesn't apply to instant messaging.

What's left is 'refused classification' content publicly available on a regular web server, which often means websites that have been unwitting victims of hackers and vandalism. In addition, it may include web pages that discuss issues such as euthanasia, abortion and safe drug use -- politically charged topics that don't enjoy the same near-universal outrage as child pornography.

For anything to be blocked, the URL must pass through the Australian Media and Communications Authority (ACMA). Eighteen months ago, Google said it has counted over "a trillion unique URLs, and the number of individual web pages out there is growing by several billion pages per day." With such rapid change, how can the Government even claim to block one percent of "bad" content with a human edited blacklist? And if the filter will be so ineffective, how can it be justified?

'So you're saying we shouldn't even try at all then?' Conroy might retort.

Not only is that an incredibly bad argument[3], it's also dead wrong. The Government is already directing much-needed resources to the Federal Police, who, in association with the relevant international organisations, can directly target the real-world social networks of child pornography. The broader Internet industry -- along with a dedicated task force of the Federal Police -- have already got effective, working policies and procedures in place.

Whirlpool's survey indicates that our community would like to see Government focus its efforts on educating parents (83%) and children (65%). While some effort has been made in this direction already, a much greater emphasis on cyber-safety education and engagement programs would have a very real and positive impact on our youth.

I also think there's also a role for the Government to incentivize ISPs to offer parents the choice of configurable content filters running at the ISP. If parents want to provide a comprehensively filtered experience to their children, the choice should be there -- a choice that shouldn't rely on dealing with desktop filtering software which requires a level of technical knowledge to install securely.

The policy is opposed by so many business and consumer groups, that one wonders if there's any support for it outside of the Government and the under-informed general public.

The child protection group Save the Children oppose the filter as being ineffective in protecting kids from online dangers. The statement was co-signed by numerous civil liberties groups and the National Children's and Youth Law Centre.

Google Australia said "moving to a mandatory ISP filtering regime with a scope that goes well beyond [child sexual abuse] material is heavy handed and can raise genuine questions about restrictions on access to information."[4]

The NSW Director of Public Prosecutions slammed the policy. "Crime prevention methods need to be practical. The talk of filters and blocking mechanisms, ultimately in a society like ours, would have only limited if any success."[5]

Even Labor senator Kate Lundy has been openly critical of the filtering policy, though not only do her proposed amendments fail to address the underlying problem of waste (ISPs will still be forced to deploy a huge amount of costly infrastructure) it compounds it with significant new complexities.

With such broad opposition and an election looming, one wonders how the policy hasn't already been scrapped.

Footnotes

[1] http://www.zdnet.com.au/blogs/twiste...9300104,00.htm

[2] Any website could use HTTPS security; it's relatively trivial to enable. While the filter could be applied to HTTPS protocol, this would require far more sophisticated filters, and would compromise the trust relied upon by Internet banking, e-commerce, and thousands of online systems that deal with personal details and finances. Indeed, were a filtering system to ever touch HTTPS, it would be slammed down hard by some of the biggest corporate entities across the world.

[3] Too often Governments will do *anything* because doing nothing -- even when nothing is the best response -- is a harder message to sell to the media. (One of my favourite quotes is from the author Peter Drucker, who said "there's nothing so useless as doing efficiently that which should not be done at all".)

[4] http://google-au.blogspot.com/2009/1...filtering.html

[5] http://www.itwire.com/business-it-ne...rime-warns-dpp

Whirlpool