/ 29 June 2006

Surfing with a safety net

Last week, the Virtual Global Taskforce, formed by police agencies around the world, secured its first conviction in the United Kingdom. Lee Costi, a 21-year-old student from Surrey, was found guilty of raping two underage girls and sentenced to nine years in prison. He was caught after a Nottinghamshire mother alerted police to online conversations he was having with her 14-year-old daughter.

A triumph over online paedophiles? Perhaps. With the rows over child abusers becoming increasingly heated in the tabloid headlines, the British Home Office is attacking on a number of fronts. One is online, where it has confronted internet providers with a stark alternative: install web filtering for your domestic broadband customers, or we’ll force you to.

That ultimatum was announced last month by the parliamentary under secretary for policing, security and community safety, Vernon Coaker. In a written parliamentary answer (http://tinyurl.com/mfjg9) he assured MPs that the Home Office was expecting broadband ISPs to install web-filtering technology voluntarily by the end of next year but, if this deadline is not met, he would — he hinted strongly — consider legislation to force them to.

There’s just one problem. ISPs say the costs are huge, running to hundreds of thousands of pounds for a large provider, and that the suggested filters are easily circumvented. Furthermore, a Cambridge professor of computing who has analysed the blocking system developed by BT, which claimed in 2004 to have been used to block thousands of attempted visits to banned sites, says it could be exploited by paedophiles to compile a list of the worst sites.

The move to web filtering will require ISPs to join the Internet Watch Foundation (IWF) and receive its regularly updated, encrypted list of paedophile and race-hate sites, which they would need to block with their filtering software and hardware. But the web-filtering experts and ISPs prepared to talk on this issue said the technology will only help prevent home broadband users (dial-up and business customers are not, apparently, included in the proposals) from accidentally accessing child-abuse sites.

”It’s well intentioned, but irrelevant,” says Simon Davies, managing director of the internet provider IDNet. ”The technology is expensive to have to offer within your normal service, and it will have little effect. Sure, it may stop accidental access but I don’t really see there’s a problem that needs solving.”

Web communication

He points out that web filtering at present is only applied to connections made to the standard ”port” for web connections — port 80. A port is like the window of a hotel — a means of communicating between inside and outside. Any web server has more than 65 000 ports available for connections to other computers.

”Paedophile sites simply need to switch to another port to remain unblocked,” Davies says. ”Very little paedophilia is shared online [by web servers], it’s more often done through peer-to-peer (P2P) networks, which cannot be controlled.”

Tom Newton, product manager at the web-filtering developer SmoothWall, concurs. ”The problem is these sites only go live for a very short amount of time, just long enough for those in the know to be informed, and then they’re taken down again,” he says. ”It means there’s probably very few on the list you’re blocking that are still live. The vast majority of pictures are swapped on message boards, forums and P2P networks so there’s virtually nothing you can do with web filters.”

Could artificial intelligence techniques, blocking sites by the appearance of their content rather than their URL be effective? Not according to Puresight, another web-filtering company: paedophile sites do not have a generic look. ”We can filter out normal porn sites because they have a typical look that an AI engine can pick out,” a spokesperson says. ”We can’t do the same for paedophile sites because they’re just a bunch of pictures that software can’t distinguish from an innocent page of family snapshots.”

So automated methods won’t work, but the cost of providing the service will affect ISPs. It’s the sort of contradiction that you would expect the Internet Service Providers’ Association (Ispa), normally vocal on the issue of government proposals raising its members’ costs, to be bruiting about. Unusually, and like several of its members, it has remained tightlipped.

Ispa said in a written statement that it supported the government’s action against child-abuse sites but cautioned it would only curtail ”casual browsing” and ”will not hinder organised distribution of such images”. It also warns that many of its members will find the costs of web filtering ”disproportionately high” and that there is a ”long tail” of small ISPs that are not Ispa members and so would be difficult to identify and reach within the government’s deadline of the end of 2007.

Cost of responsibility

Tiscali is one of the few ISPs prepared to comment. Its director of media and operations, Neal McCleave, says that by the end of next month, all its broadband subscribers will be blocked from sites on the IWF list. The cost: several hundred thousand pounds. ”It’s a cost we have to bear as part of being a responsible ISP, but it is obviously not inconsiderable,” he admits.

Tiscali is rare among ISPs in developing its own filtering solution. Several are trialling or are expected to adopt BT’s CleanFeed filtering system, widely accredited with alerting the Home Office to the possibility of blocking child-abuse sites.

However, Richard Clayton, a professor of computing at Cambridge University, believes the system could do more harm than good if paedophiles turn their minds to cracking it. ”The government seems convinced there’s a problem of people stumbling upon child-abuse sites but I don’t see how that can be,” Clayton says. ”The sites don’t normally have everyday names because they don’t want to be found; they’re only used by people in the know and many are based in east Europe and Russia, and so don’t have everyday names you could accidentally type in.”

Major search engines, including Google, already use the IWF list so illegal sites will not appear in search results — cutting the chances of innocent users stumbling on a rogue link.

Clayton suggests the government is likely to exaggerate the effect of people searching for child pornography, and will position itself as being tough on online child abuse by introducing filtering. But doing so runs a risk of making the problem worse if a clever paedophile reverse engineers the CleanFeed system.

”I published a paper [in June 2005] on how the CleanFeed system works and how a clever person … could use software to fire off thousands of potential web addresses at the system, then see if any had been routed back through a proxy server, which is how the system operates for sites on the list,” Clayton says. ”They’d then effectively get the official list of where the really hard core stuff is. It’s not difficult to do. I did it but I obviously haven’t looked at the sites because that would be illegal.”

BT’s director of portfolio infrastructure, Mike Galvin, says Clayton did not get round CleanFeed. ”It took him six months and he couldn’t crack the system, and he’s a Cambridge professor of computing,” he argues. ”Some people may complain about the effectiveness and the cost but it’s either the taxpayer, through the government, or the subscriber, through their ISP, that will pay for this protection — and we think the latter option is fairest.”

A Home Office spokesperson confirmed that the government expects ISPs to bear the cost of web filtering, and that it believes the technology will protect against accidental exposure and help to curtail committed paedophiles. At the same time, UK law enforcement agencies are establishing links with forces around the world to help tackle the problem of sites not based in the UK.

Effective filtering

The fact that sites are hosted abroad should reassure those who doubt the effectiveness of web filters, says the IWF’s communications coordinator, Sarah Robertson. ”Before the IWF [set up in 1996], 18% of child-abuse pictures accessed in the UK were stored in the UK,” she points out. ”Today it’s only 0,4%, thanks to our work in getting these sites shut down. Techie people say, ‘why bother with filtering’, but our success speaks for itself.”

Industry experts are largely agreed that international cooperation between police forces and heavier sentences for those caught with the material is the only solution. But that doesn’t seem to be happening. Mark Taylor, a consultant with computer forensics company Ibas, believes the UK has missed a huge opportunity. As a former detective at the High Tech Crime Unit at New Scotland Yard in London, he knows from experience that not only is web filtering ineffective and irrelevant, but that usually when offenders are caught they are not prosecuted or, in his opinion, not given sentences that act as a deterrent.

Taylor worked on Operation Ore, the UK’s largest investigation of paedophiles, which began in 2002. It was instigated by the US authorities, who passed on a list of 7 000 UK citizens believed to have paid to access child-abuse images from a Texas website, whose owners were each sentenced to more than 100 years in prison.

”It was an amazing, rare opportunity for the UK,” says Taylor. ”Paedophiles collect pictures by swapping them, there’s not normally money involved. That’s why it was so rare for us with Operation Ore to have a money trail and 7 000 suspects, 1 200 of whom have since been convicted. [But] the sentences were really low. The maximum was four years, but most were getting around six to 18 months.

”At Ibas, I’m still investigating suspects’ computers because there’s been such a backlog of cases. The chances of them still having the same computer four years on are minimal. I know my former colleagues who are still in the police are distraught. It was a huge opportunity to crack down that wasn’t fully taken advantage of.”

It’s not clear that web filtering could have made any difference in the Costi case, which involved chatrooms. Does that indicate that paedophiles pose a greater risk in interactive chatrooms than through web access? A Home Office spokesperson said that ”blocking websites is an important initiative, but it is only one element of our work to make the internet safer for children”. – Guardian Unlimited Â