|FilterGate, or Knowing What We're Walling In or Walling Out|
|by Art Wolinsky, Southern Regional High School • Manahawkin, New Jersey|
|MultiMedia Schools • May/June 2001|
I decided to take a closer look at the technologies and the blocking strategies
used by filtering companies, a task I warmed to for reasons you'll see
very soon below. As I did so, it appeared to me that the public has a picture
of filtering that is much like the picture of the elephant in the parable
of the Elephant and the Blind Men, in which six blind men were asked to
describe an elephant. The first one felt its side and said an elephant
was like a wall. One felt the leg and said it was like a tree. Another
touched the tusk and said it was like a spear, and so on. They were all
partly right, but no one had the full picture.
Elephants, Blind Men, and Internet
The ACLU and the ALA are challenging the Children's Online Protection Act (CIPA) and its filtering mandate (see "The Children's Online Protection Act, Filtering, and Legal Challenges" on page 26), but from what I've learned in my look at filtering technologies, it's clear to me that even if the ACLU and the ALA suits succeed, these groups will have only treated the symptom rather than the cause of the problem. The way filters function results in erroneously blocked sites. Defeating the law on constitutional grounds would not change filtering practices. Filtering companies might not get the windfall created by CIPA, but neither would the companies be required to change their technologies, and it would be business as usual.
However, a possible private
sector class-action lawsuit being considered against one or more filtering
companies is not aimed at the legislation. If implemented, it would send
ripples throughout the filtering industry and have significant impact on
filtering decisions already made or yet to be made. I have been conducting
investigations relating to this issue and lawsuit, so let me tell you a
little more about it.
I Thought It Would Be Easy
Now I'm no novice when it comes to filtering. I've been working with national and international organizations on online safety and privacy issues for 2 years and thought I knew all the arguments about filtering. I thought it would be simple to resolve. All I would have to do is call the company in question, let them know we were being blocked in error, and that would remedy the situation. I was wrong.
I was told they would look
into it and get back to me about the situation. To my amazement, I was
told that there was no way of getting our site unblocked.
FilterGate: Donning the Trench Coat
After numerous phone calls to the company and some muscle flexing to get through the multiple layers of customer assistance, I was able to get a more detailed explanation. I was told that our Web site was hosted on a computer that housed a significant number of adult sites, and that the ISP used technology called Round Robin DNS that made it impossible for the filtering company to block individual sites on the computer. As a result, the company had to make a decision either not to block the adult sites or to block all the sites hosted on this ISP's server. That made a sense in an Orwellian way, but if I punished an entire school because of a few misbehaving students I would probably be out of a job.
After talking with system engineers and other experts, I found out that Round Robin DNS has been around since before the Internet was popular. They told me that this technology shouldn't pose a major problem to filtering companies. It appeared that the representatives of the company that was blocking the OII site were not up on their technology, or that they were still trying to treat me like a mushroom by keeping me in the dark and covering me with fertilizer.
If the technology wasn't
new and the filter shouldn't have a problem with it, what was the real
problem? More digging revealed that it stems from something called IP-Independent
How Filtering Technology Works or Doesn't
When it comes to blocking Web sites, everyone wants to know what sites are on a company's blocked list. Since almost all lists are encrypted, this can be difficult to determine. However, with access to firewall logs, some technical background, an understanding of ISP technologies, and a little creative thinking, it isn't difficult to get a clearer picture of what is happening.
We know every filter misses adult sites simply because of the sheer volume of existing sites and the number of new sites popping up daily. Filtering critics point this out, and filtering companies readily admit this.
We are also familiar with
the argument that some companies have blocked sites inappropriately based
on political or religious agendas. Unfortunately, there are very few companies
that will confirm this kind of information, and, as mentioned, encrypted
lists make it difficult to see how pervasive the practice is.
So What's the New News?
I suspect that many filtering companies want to keep your eyes on the sites blocked for political or religious reasons. This is because the filtering technology of some companies has not kept pace with the evolution of Internet technologies, and so the number of sites being inappropriately blocked has increased tremendously in the past 2 to 3 years. It is difficult to determine how dramatic this increase is, but I wouldn't be surprised to see a nearly exponential growth curve.
If we take a step back from this filtering elephant and focus on how a blocked-sites list is compiled rather than what is on the list, we get a much different picture.
A Web site can be blocked
by URL, by IP number, or different combinations of the two methods. The
URL is the name you type into a browser. The IP number is the numerical
representation of what you typed. People type URLs that are translated
into IP numbers that computers use. The method chosen by a filtering company
makes a big difference.
URL and IP Blocking
To avoid huge lists, a single IP number can be used to block hundreds of sites. For example, a server that houses hundreds of adult sites can be blocked by a single IP number (or four, if Round Robin DNS is used).
This is fine if only adult
sites are on the server. However, if other legitimate sites are on the
server, these are also blocked. This is one of the major reasons sites
have been blocked erroneously and is one of the major criticisms of filters.
The practice is not new or unknown. What is new and mostly unknown
to the lay public is that with the rise in popularity of IP-Independent
Virtual Hosting—a technology that enables ISPs to have hundreds or thousands
of Web sites represented to the outside world through a single IP number—the
problem of inappropriately blocked sites has been growing like a cancer,
and the magnitude of the problem has apparently been undetected by watch
Neither Method Works Alone
I don't know that any filtering company uses one method to the exclusion of the other, but the extent to which companies rely on one over the other—and whether or not the companies take virtual hosting into consideration—strongly influences the number of sites blocked in error.
I have examined firewall logs that record blocked sites, and I have used other creative techniques to peek at what is happening inside the filter that is blocking the OII site. I presented my thoughts to a representative of the filtering company in question, and to my surprise the reply I got was, "I can't find anything wrong with your logic."
I estimate that on our ISP's server there are at least 10 sites blocked inappropriately for every site blocked appropriately. I wouldn't be the least bit surprised to find that the ratio was actually much higher.
I believe all filtering
companies use IP blocking of some type. But if IP-Independent Virtual Hosting
is taken into account, the number of sites blocked in error is significantly
lower than for companies that don't take it into account or make a serious
attempt to avoid blocking innocent companies.
Why Haven't We Seen the Whole Elephant?
To make matters worse, some filtering companies confounded things very nicely by providing misleading information on their Web sites. A statement like "Professional researchers compile these lists and organize the sites into categories" may ease the mind of Web site visitors, but this one presented a little problem when I asked which one of the company's professional researchers determined there were sex acts and nudity at the OII site.
Checking via the Web with
a filtering company to see whether a site is blocked can also confound
the issue. In our case, if you type in http://oii.org
or the URL of any of thousands of other sites on the cluster of servers
accessed through the four IP numbers of our ISP, the company's search tool
will tell you that they are not on the blocked list. Though technically
correct, this is deceptive, because if you type in any of the four IP numbers,
it will tell you that those IP numbers are on the list. People don't
use IP numbers, computer do. When was the last time you typed http://22.214.171.124/
to visit CNN?
Will Things Change?
Many filtering companies have been around for a long time, and some of their methods have not evolved with the Internet. I pointed this out to a top executive in the company blocking OII. I also pointed out that I was talking to a high-tech law firm about possible legal action.
Legal challenges to filtering issues are not unusual, but during the course of one of my conversations with the law firm, there was a plot twist that rivaled anything that Hollywood could concoct. The attorneys asked me to take a look at their newly designed Web site and critique it. After I hung up, I tried to visit the site ... and called them back to explain that I couldn't critique the site because it was being blocked. That comment got the rapt attention of the law firm and the filtering company.
Some time later, I received a message from the filtering company indicating that they recognize that they must change some of the things they were doing to keep pace with the industry. Their product support division was working on a solution they hoped to report to me before this article was submitted.
On the day before deadline, I received a call from the vice president of the company. She acknowledged that there was a problem with the 4.0 client version of the software and some versions of firewall software (OEM versions) that companies licensed from them. She stressed that other solutions sold under their name do not have this problem. To address the problem the company is issuing 5.0 software that takes IP-independent hosting into account and contacting its OEM licensees concerning the issue. It will be up to each licensee to determine whether or not to switch technologies.
If nothing else, this reaffirmed
my long-standing opinion that the Internet is a powerful tool for social,
political, and economic change. One person can make a difference, not by
acting in a solitary manner, but by using the power of the network to gather
resources, raise awareness, and tap into the vast amount of talent and
support available for important issues.
More Questions Than Answers
There are two key points you should address regardless of your situation. Before you make a filtering decision, or even if you have a filter in place, ask the filtering company how it handles IP-Independent Virtual Hosting and how it deals with Round Robin DNS. Understanding that a single IP can represent thousands of sites should make it relatively easy to determine whether you are getting a straight answer or the mushroom treatment.
But perhaps the first and
most important question we have to ask is why must we filter? The ones
making the decision must understand the problem and the solution. Instead
of looking at the problem through the eyes of alarmists or those who stand
to profit from filtering legislation, decision-makers need to open their
eyes. They need to step back from the elephant and look at the problem
and the solution in terms of those who are faced with it and have to deal
with it on a day-to-day basis. Media specialists, students, and teachers
are the ones who face the problem and are the ones who hold the solution.
is a Technology Infusion Consultant for the Manahawkin, New Jersey, school
district. Communications to the author may be addressed to him at Southern
Regional HS, 600 N. Main St., Manahawkin, NJ 08050; phone: 609/597-9481,
ext. 337; fax: 609/978-5357; firstname.lastname@example.org.
Copyright © 2001, Information
Today Inc. All rights reserved.