Re: [saag] Ubiquitous Encryption: content filtering

On Fri, Jun 19, 2015 at 10:07 AM, Smith, Kevin, (R&D) Vodafone Group
<Kevin.Smith@vodafone.com> wrote:
>
> > I would at least like this to acknowledge that it's possible to do filtering at the endpoint. As you can imagine, I would argue another term for content filtering is censorship. best, Joe
>
> Hi Joe,
>
> Indeed, it is possible to filter at the endpoint. However, a mobile operator utilising licenced spectrum must adhere to regulations set by the government licensor, which include content filtering, or risk fines/licence suspension. The rise in end-to-end encryption may well change this situation; as if the regulators cannot constrain access via the operator network, it is likely they will look to other means. I'm in discussion with our legal and regulatory teams and aim to present on this at the workshop.

Text that expresses the intent you've described here I think would be
useful if Natasha's text is pulled in.

> > As you can imagine, I would argue another term for content filtering is censorship.
>
> Fair point, but we should focus on the technical options (e.g. endpoint vs. network filters) for the scope of this workshop.

Totally understood. (workshop? or I-D?)

> All best
> Kevin
>
> Kevin Smith, Vodafone R&D
>
> -----Original Message-----
> From: saag [mailto:saag-bounces@ietf.org] On Behalf Of Joseph Lorenzo Hall
> Sent: 19 June 2015 14:10
> To: Natasha Rooney
> Cc: saag@ietf.org
> Subject: Re: [saag] Ubiquitous Encryption: content filtering
>
> I would at least like this to acknowledge that it's possible to do filtering at the endpoint. As you can imagine, I would argue another term for content filtering is censorship. best, Joe
>
> On Thu, Jun 18, 2015 at 3:58 AM, Natasha Rooney <nrooney@gsma.com> wrote:
> > Hi all,
> >
> > I have a new submission for the Ubiquitous Encryption draft. I must
> > admit, this one is a little controversial, and certainly is not
> > something I believe in. However, I had a good think about it, and
> > figured that this is an "effect" of ubiquitous encryption, and maybe
> > would be beneficial for the draft. I am not expecting anything comes
> > out of adding it past education for members of the IETF community that
> > this is an issue for some organisations, governments and maybe users.
> > Please feel free to tweet me if you want to discuss personal views! Anyway, here we go:
> >
> >
> > 2.3.X Content Filtering
> > Law agencies may request Service Providers to block access to
> > particular sites such as online betting and gambling, sites promoting
> > anorexia, or access to dating sites. Content filtering in the mobile
> > network usually occurs in the core network. A proxy is installed which
> > analyses the transport metadata of the content users are viewing and
> > either filters content based on a blacklist of sites or based on the
> > user’s pre-defined profile (e.g. for age sensitive content). Although
> > filtering can be done by many methods one common method occurs when a
> > DNS lookup reveals a URL which appears on a government or recognised
> > block-list. The subsequent requests to that domain will be re-routed
> > to a proxy which checks whether the full url matches a blocked url on
> > the list, and will return a 404 if a match is found. All other requests should complete.
> >
> > Even in encrypted connections transport and lower layer metadata is
> > able to be viewed so for many systems content filtering should be able to continue.
> > Cases when they may not work is when TLS proxies are being used which
> > obscure metadata with the proxy metadata, and future versions in HTTP
> > and TCP may encrypt metadata again stopping content filtering software
> > from working (this is currently not the case and has not been standardised).
> >
> > Some sites involve a mixture of universal and age-sensitive content
> > and filtering software in these cases may use more granular
> > (application layer) metadata to analyse and block; this will not work on encrypted content.
> >
> >
> > I do have a few questions about what I have written, maybe someone can
> > answer:
> > [1] Does HTTP2 multiplexing do anything to content filtering software, i.e.
> > when sending multiple requests for one webpage (loading images in
> > particular). I don’t think it does it’s just that my brain isn’t
> > working this afternoon...
> > [2] Is it fair to mention future versions of HTTP and TCP when nothing
> > has been standardised yet? I don’t think so in which case maybe this
> > should be removed.
> >
> > Hope this didn’t ruin everyones morning! Thanks!
> >
> > Natasha
> >
> >
> > Natasha Rooney | Web Technologist | GSMA | nrooney@gsma.com | +44 (0)
> > 7730
> > 219 765 | @thisNatasha | Skype: nrooney@gsm.org Tokyo, Japan
> >
> >
> > This email and its attachments are intended for the above named only
> > and may be confidential. If they have come to you in error you must
> > take no action based on them, nor must you copy or show them to
> > anyone; please reply to this email or call +44 207 356 0600 and highlight the error.
> >
> >
> > _______________________________________________
> > saag mailing list
> > saag@ietf.org
> > https://www.ietf.org/mailman/listinfo/saag
> >
>
>
>
> --
> Joseph Lorenzo Hall
> Chief Technologist
> Center for Democracy & Technology
> 1634 I ST NW STE 1100
> Washington DC 20006-4011
> (p) 202-407-8825
> (f) 202-637-0968
> joe@cdt.org
> PGP: https://josephhall.org/gpg-key
> fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
joe@cdt.org
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871