Re: [saag] Ubiquitous Encryption: content filtering

I would at least like this to acknowledge that it's possible to do
filtering at the endpoint. As you can imagine, I would argue another
term for content filtering is censorship. best, Joe

On Thu, Jun 18, 2015 at 3:58 AM, Natasha Rooney <nrooney@gsma.com> wrote:
> Hi all,
>
> I have a new submission for the Ubiquitous Encryption draft. I must admit,
> this one is a little controversial, and certainly is not something I believe
> in. However, I had a good think about it, and figured that this is an
> "effect" of ubiquitous encryption, and maybe would be beneficial for the
> draft. I am not expecting anything comes out of adding it past education for
> members of the IETF community that this is an issue for some organisations,
> governments and maybe users. Please feel free to tweet me if you want to
> discuss personal views! Anyway, here we go:
>
>
> 2.3.X Content Filtering
> Law agencies may request Service Providers to block access to particular
> sites such as online betting and gambling, sites promoting anorexia, or
> access to dating sites. Content filtering in the mobile network usually
> occurs in the core network. A proxy is installed which analyses the
> transport metadata of the content users are viewing and either filters
> content based on a blacklist of sites or based on the user’s pre-defined
> profile (e.g. for age sensitive content). Although filtering can be done by
> many methods one common method occurs when a DNS lookup reveals a URL which
> appears on a government or recognised block-list. The subsequent requests to
> that domain will be re-routed to a proxy which checks whether the full url
> matches a blocked url on the list, and will return a 404 if a match is
> found. All other requests should complete.
>
> Even in encrypted connections transport and lower layer metadata is able to
> be viewed so for many systems content filtering should be able to continue.
> Cases when they may not work is when TLS proxies are being used which
> obscure metadata with the proxy metadata, and future versions in HTTP and
> TCP may encrypt metadata again stopping content filtering software from
> working (this is currently not the case and has not been standardised).
>
> Some sites involve a mixture of universal and age-sensitive content and
> filtering software in these cases may use more granular (application layer)
> metadata to analyse and block; this will not work on encrypted content.
>
>
> I do have a few questions about what I have written, maybe someone can
> answer:
> [1] Does HTTP2 multiplexing do anything to content filtering software, i.e.
> when sending multiple requests for one webpage (loading images in
> particular). I don’t think it does it’s just that my brain isn’t working
> this afternoon...
> [2] Is it fair to mention future versions of HTTP and TCP when nothing has
> been standardised yet? I don’t think so in which case maybe this should be
> removed.
>
> Hope this didn’t ruin everyones morning! Thanks!
>
> Natasha
>
>
> Natasha Rooney | Web Technologist | GSMA | nrooney@gsma.com | +44 (0) 7730
> 219 765 | @thisNatasha | Skype: nrooney@gsm.org
> Tokyo, Japan
>
>
> This email and its attachments are intended for the above named only and may
> be confidential. If they have come to you in error you must take no action
> based on them, nor must you copy or show them to anyone; please reply to
> this email or call +44 207 356 0600 and highlight the error.
>
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
joe@cdt.org
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871