On Tue, 22 Mar 2005, Baker Fred wrote:

I am told (not my expertise) that there are labels that can be put on web pages to prevent search engines from searching them, and that a certain class of pornographer actually uses such. Keeping them out of the search engines is a good thing. That said, not all such do, so one is forced to have a plan B. BTW, HTML PICS don't especially help with virus-bot-originated spam.

Internet Explorer has had provisions to use RSAC ratings forever. One thing that the competing browsers (which I like better) have *never* had. -- JustThe.net - Apple Valley, CA - http://JustThe.net/ - 888.480.4NET (4638) Steven J. Sobol, Geek In Charge / sjsobol@JustThe.net / PGP: 0xE3AE35ED "The wisdom of a fool won't set you free" --New Order, "Bizarre Love Triangle"

thanks steve. i'm distracted. just got bit by red lake.

Steven M. Bellovin wrote:

The news.com article links to the bill: http://www.le.state.ut.us/~2005/htmdoc/hbillhtm/hb0260s03.htm

Steven M. Bellovin wrote:

That is, in fact, similar to a Pennsylvania law that was struck down by a Federal court. CDT's analysis of the Utah law is at http://www.cdt.org/speech/20050307cdtanalysis.pdf

--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

Thankfully, Steve's on the ball, and folks should read those. Presumably, every ISP is a financial supporter of EFF and CDT. If not, now's the time! But the bill goes a lot farther than reported. (1) It takes current Utah prohibition on "pornography" and raises the penalty from a misdemeanor to a felony. Every ISP operator can look forward to MONTHS and YEARS (instead of the previous 7 days) in jail. (2) It adds "harmful to minors" -- and makes it a state attorney general decision on whatever that might be. This is a silly nebulous term that has been used lately by the peeping tom religious right, because every other legal term they've tried has already been struck down by the courts. Just like shrub's administration made up the new term "enemy combatants" instead of the old term "prisoner of war". AFAIK, no court has ever found ANYTHING to be harmful to minors. Making this an attorney general decision is an attempt at bypassing public hearings. Note the list itself will be "access restricted electronic format" -- that is, secret. (3) A new criminal penalty for a content provider's failure to properly rate content. Looks like every hosting provider will have to leave the state. You'll probably have to shut down all outside access to any universities, schools, and libraries. And every corporation will need to move it's data and web presence out of state. (4) Every ISP will have to make sure they have fewer than 7500 customers, because that's the level at which you can charge them for the millions it's going to cost to defend your lawsuits. Presumably, you can do this by creating separate subsidiaries. Alert your CEOs now. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

----- Original Message ----- From: "Scott Weeks" <surfer@mauigateway.com> To: <nanog@merit.edu> Sent: Tuesday, March 22, 2005 11:18 AM Subject: Re: Utah governor signs Net-porn bill

On Tue, 22 Mar 2005, Fergie (Paul Ferguson) wrote:

: : "Utah's governor signed a bill on Monday that would : require Internet providers to block Web sites deemed : pornographic and could also target e-mail providers : and search engines." : :

http://news.com.com/Utah+governor+signs+Net-porn+bill/2100-1028_3-5629067.ht...

Politician lip flappage for votes. It has no chance of passing.

perhaps i'm missing something, but it's passed the state legislature and was signed by the governor. what else would it have to pass, then? -p --- paul galynin

On Tue, 22 Mar 2005 Valdis.Kletnieks@vt.edu wrote:= : On Tue, 22 Mar 2005 06:18:57 -1000, Scott Weeks said: : > : "Utah's governor signed a bill on Monday that would : > : require Internet providers to block Web sites deemed : > : pornographic and could also target e-mail providers : > : and search engines." : > : : > : http://news.com.com/Utah+governor+signs+Net-porn+bill/2100-1028_3-5629067.ht... : > : : > Politician lip flappage for votes. It has no chance of passing. : : Umm... but the Governor *signed* it already? Sort of ups its chances just a tad? : Hopefully, it has no chance of surviving a judicial review... On Tue, 22 Mar 2005, Paul G wrote: : perhaps i'm missing something, but it's passed the state legislature and : wassigned by the governor. what else would it have to pass, then? Ok, passing wasn't the correct term. IANAL. Here's what I saw: "I am having a hard time seeing how this law will survive a constitutional challenge, given the track record of state anti-Internet porn laws--which are routinely struck down as violating the First Amendment and the dormant Commerce Clause," Eric Goldman, a professor at the Marquette University Law School in Milwaukee, Wis., wrote in a critique of the law. and A federal judge struck down a similar law in Pennsylvania last year. That is what I meant, but it has been pointed out that this extract is not accurate anyway. Damn journalists... :-) scott

Scott Weeks wrote:

On Tue, 22 Mar 2005, Fergie (Paul Ferguson) wrote: : : "Utah's governor signed a bill on Monday that would : require Internet providers to block Web sites deemed : pornographic and could also target e-mail providers : and search engines." : : http://news.com.com/Utah+governor+signs+Net-porn+bill/2100-1028_3-5629067.ht...

Politician lip flappage for votes. It has no chance of passing.

I consider it proof positive, that our medical system is in dire need of an overhaul. Apparently, mental illness isn't being detected, and treated, as often as it should be. :P

scott

On Tue, Mar 22, 2005 at 08:55:21AM -0800, John Kinsella said something to the effect of:

On Tue, Mar 22, 2005 at 11:50:12AM -0500, Richard Irving wrote:

...

I consider it proof positive, that our medical system is in dire need of an overhaul.

Apparently, mental illness isn't being detected, and treated, as often as it should be.

I always assumed it was working fine and we were sending the Crazies to Utah.

Get demented, early and often! whee, --ra -- k. rachael treu, CISSP rara@navigo.com ..quis custodiet ipsos custodes?.. (this email has been brought to you by the letters 'v' and 'i'.)

----- Original Message ----- From: "Roy" <garlic@garlic.com> To: "Fergie (Paul Ferguson)" <fergdawg@netzero.net> Cc: <nanog@merit.edu> Sent: Tuesday, March 22, 2005 12:03 PM Subject: Re: Utah governor signs Net-porn bill

CNET's extract is wrong.

The article states

The measure, SB 260, says: "Upon request by a consumer, a service provider may not transmit material from a content provider site listed on the adult content registry."

Its entirely voluntary on the part of the consumer.

does pulling the plug on the user's connection count? <g> "your honor, we were just making sure our sinners^H^H^H^H^H^H^Husers couldn't access lecherous content that hasn't made it onto the registry!" -p --- paul galynin

> The measure, SB 260, says: "Upon request by a consumer, a service provider > may not transmit material from a content provider site listed on the adult > content registry." > > Its entirely voluntary on the part of the consumer. It's also voluntary on the part of the service provider. Of course no one would be so foolish as to try to legislate the operation of the Internet without having read RFC 2119, and anyone familiar with that document would understand the difference between "MAY not" and "MUST NOT". :-) -Bill

> > It's also voluntary on the part of the service provider. > What !?! Surely you Jest! Uh, yes, I was joking. Unfortunately, I do believe, on credible evidence, that there are people stupid enough to be trying to legislate the operation of the Internet without having first understood how it's done right now. Case in point. -Bill

On Tue, 22 Mar 2005, Bill Woodcock wrote:

Uh, yes, I was joking. Unfortunately, I do believe, on credible evidence, that there are people stupid enough to be trying to legislate the operation of the Internet without having first understood how it's done right now. Case in point.

Can ISPs get around this by declaring themselves to be private clubs? ;) There was a rather poorly attended NANOG meeting in Salt Lake City a couple years ago. Between bars, er, private clubs, that required (very cheap) memberships to get in the door, the no more than one watered down beer on the table at a time rule, the guys who looked like secret service agents video taping the the gay pride people (all three of them...) outside the Temple, and the repeated "you want to rent a car? On a Sunday?!?" responses from people in the viscinity of the closed car rental counters, it was a cultural expeience. Regardless of the legal and technical merits of the plan, requiring a watered down web doesn't seem inconsistent. Ignoring the legal and commercial questions and focusing on the technical requirements, there are several ways they could have done this. China and Saudi Arabia accomplish this (China for political content, and Saudi Arabia for "porn") with national firewalls. So, if the same content were going to be blocked for all users in Utah, and if porn sites could somehow be prevented from operating in Utah, a monopoly transit proivder for all Utah ISPs with a big porn blocking firewall in front of it might do the trick. I hear it works in Saudi Arabia... But in this case, Utah hasn't chosen to use China or Saudi Arabia as its model, nor have they copied the first round of attempts at this sort of thing by various US states, which tended to give ISPs the burden of figuring out whether packets flowing through their network were "indecent" and imposed requirements on people in other states. I suspect this will make Utah different enough that a lot of national networks will decide it's not worth doing business there. But for Utah-focused ISPs who can figure out how to make a firewall or proxy server speak the same protocol as the state-run database, this should be an opportunity to charge higher prices in the face of reduced competition. This seems like something that could be implemented on a per-user basis with a little bit of policy based routing. Is it a good idea? Certainly not. Is it legal? I hope not. But is it so badly conceived as to be unimplementable if it ever gets to the enforcement stage? I don't think so. -Steve

On Tue, Mar 22, 2005 at 11:57:43AM -0800, Steve Gibbard said something to the effect of:

On Tue, 22 Mar 2005, Bill Woodcock wrote:

...

Uh, yes, I was joking. Unfortunately, I do believe, on credible evidence, that there are people stupid enough to be trying to legislate the operation of the Internet without having first understood how it's done right now. Case in point.

Can ISPs get around this by declaring themselves to be private clubs? ;)

Good point..! Could they charge a membership fee and be forgiven compliance? Because ISPs certainly don't reap the government bail-outs or assurances (yet) that are afforded to public utilities, either... Regulated as public, levied against as private...where *is* the safe zone or loophole for ISPs? :? <speculative_musing> I'm unclear as to how this level of regulation can be applied to the rolling fields of porn and not swiftly expanded to accommodate other categories of information deemed to be objectionable. (I haven't yet read the complete bill, but will be interested to see how clearly codified the parameters for branding content as "adult" are.) On the other hand...what doors will this open for the converse...for entities who wish to have the government step in and mandate that the ISPs restrict delivery of content *from* them, of their content, or of content to others? This hydra could have many heads...one that looks like the DMCA, one like the RIAA, one that looks like pr0n-haters not wanting anyone to view it, one for each religious or political zealot group out there, one for each brand name... Poorly-conceived bills like this may set precedent for a number of slippery slopes. </speculative_musing> How, exactly, *did* this pass, anyway? --ra

There was a rather poorly attended NANOG meeting in Salt Lake City a couple years ago. Between bars, er, private clubs, that required (very cheap) memberships to get in the door, the no more than one watered down beer on the table at a time rule, the guys who looked like secret service agents video taping the the gay pride people (all three of them...) outside the Temple, and the repeated "you want to rent a car? On a Sunday?!?" responses from people in the viscinity of the closed car rental counters, it was a cultural expeience. Regardless of the legal and technical merits of the plan, requiring a watered down web doesn't seem inconsistent.

Ignoring the legal and commercial questions and focusing on the technical requirements, there are several ways they could have done this. China and Saudi Arabia accomplish this (China for political content, and Saudi Arabia for "porn") with national firewalls. So, if the same content were going to be blocked for all users in Utah, and if porn sites could somehow be prevented from operating in Utah, a monopoly transit proivder for all Utah ISPs with a big porn blocking firewall in front of it might do the trick. I hear it works in Saudi Arabia...

But in this case, Utah hasn't chosen to use China or Saudi Arabia as its model, nor have they copied the first round of attempts at this sort of thing by various US states, which tended to give ISPs the burden of figuring out whether packets flowing through their network were "indecent" and imposed requirements on people in other states. I suspect this will make Utah different enough that a lot of national networks will decide it's not worth doing business there. But for Utah-focused ISPs who can figure out how to make a firewall or proxy server speak the same protocol as the state-run database, this should be an opportunity to charge higher prices in the face of reduced competition. This seems like something that could be implemented on a per-user basis with a little bit of policy based routing.

Is it a good idea? Certainly not. Is it legal? I hope not. But is it so badly conceived as to be unimplementable if it ever gets to the enforcement stage? I don't think so.

-Steve

-- k. rachael treu, CISSP rara@navigo.com ..quis custodiet ipsos custodes?.. (this email has been brought to you by the letters 'v' and 'i'.)

that's EASY: there is hyperconcern for the welfare of children in Utah,

Finally, someone who recognizes what this bill is all about. It merely asks ISPs to provide parents with a filtering tool that cannot be overridden by their children because the process of filtering takes place entirely outside the home. Once Utah ISPs come up with a good way to do this, I suspect there will be a market for such services elsewhere in the USA as well. And while the law focuses on the blocking aspect, i.e. blacklisting, let's not forget that the same service can also be used in a whitelisting mode. Can you imagine an Internet service in which parents subscribe to various "channels" by choosing from a menu of whitelists? I can. This is not your father's Internet any more... --Michael Dillon

Oki all, Over the holidays I had the opportunity to pick up some pin money experting for a case involving just this business model and the media ignored sides of some rather well-known persons who work the church markets in the US.

...

that's EASY: there is hyperconcern for the welfare of children in Utah,

Finally, someone who recognizes what this bill is all about. It merely asks ISPs to provide parents with a filtering tool that cannot be overridden by their children because the process of filtering takes place entirely outside the home.

In the instance of policy and mechanism I reviewed, this was "deinstall AOL and all others, install <name withheld pending>, stuff some obscure bits into hidden files on DOS boxen to prevent replay with a possibly different permissible policy threshold, and prompt the adult/user/owner/installer for threshold definition". Clunky, IMHO, because the step after "mistake" is "reinstall OEM os", but tastes vary.

Once Utah ISPs come up with a good way to do this, I suspect there will be a market for such services elsewhere in the USA as well.

In the instance of policy and mechanism I reviewed, this was "interpose a proxy on all http methods, and evalute some property of some of object according to some rule(s). If permissible (above), forward to the edge, if not, do something else. It could have been localized ad insertion, or bandwidth aware content frobbing, instead of ... what it was. Is it "easy" as a business proposition? Everything was on the rising side of the bubble. On the falling side of the bubble even AOL had to work its numbers. With "more moralists" dominant in public policy, market plans that replace public morality policy with private morality policies seem to me to be less likely to penetrate the "high" morality affinity-based markets than when "less moralists" dominant in public policy. To paraphrase my friend Bill, why would the little asshats settle for a private Idaho or Utah when the big asshats have promissed them the whole enchilada? Anyway, it was presents for the kiddies and some of the winter's heating oil, and I now know more about some people than I wanted to. Eric

On Wed, 23 Mar 2005 Michael.Dillon@radianz.com wrote:

...

that's EASY: there is hyperconcern for the welfare of children in Utah,

Finally, someone who recognizes what this bill is all about. It merely asks ISPs to provide parents with a filtering tool that cannot be overridden by their children because the process of filtering takes place entirely outside the home.

To Quote Peter Tolan (Cowriter of the TV Show "Rescue me") on another censorship issue: "The idea that government feels they have to regulate this stuff because the people they're governing can't turn it off is insulting" Why is it the ISP's responsibility to assume an operational burden of enforcing the religious morality of one group? I think the phrase "Chilling effect" has been used in this thread previously, and I believe it was apt. If there's a demand to an alternative internet service by, for example, Mormons, why not start an ISP with filtering, and offer it? Niche businesses service narrow segments of the market have been very successful, even if they charge slightly more, based on their specialized appeal. If aol/comcast/rboc/etc see that they are loosing customers to competition, they may choose to offer similar services or choose to let the customers go.

On Tue, Mar 22, 2005 at 02:59:20PM -0600, Rachael Treu wrote:

How, exactly, *did* this pass, anyway?

Any bill with "anti-pornography" as its title is going to be a freight train in the Utah legislature. Nobody is going to get in front of it for fear of being portrayed as "pro-pornography". I knew this sobering fact early on in the life of this bill. In its original form, it would have used IP addresses for blocking and would have introduced criminal penalties on ISPs if anything managed to slip by. Regardless of whether the ISP's filter was being circumvented or not. The bill's sponsor was good in working with me, the only ISP here that knew or was willing to come out against the bill. However, I was well aware that all I could strive for was to reduce the ISP impact of the bill, not make large deletions or changes. There were also a handful of individuals here who had direct experience with commercial software who were appalled at the nature of the bill and also worked against it. Large nationwide ISPs, who were involved in discussions early on, were strangely silent, instead letting the Internet Alliance write a letter for them. I do not believe the Attorney General's office here knows what they are signing up for. You may remember they had a "porn-czar" a few years back whose position was dissolved over lack of funding. Somehow the AG believes that maintaining and arbitrating an Internet blacklist will be easier and cheaper. In the end the bill itself doesn't have a big impact on this ISP's business. We have used Dansguardian for many years now along with URLblacklist.com for our customers that request filtering. The fact that its lists and software are open for editing and inspection is the reason I chose this over other commercial methods. This bill is a waste of time and money. It also does further damage to the Utah tech industry, portraying it as an idiotic backwater. Please do not generalize and think everyone here agrees with the methods promoted by a select few.

maybe i am slow or jaded, but i am not learning much new from this rather large thread. yes, politicians grandstand on 'moral' issues. yes, it is popular to legislate rather than educate 'morals' (thanks lucy for the reference to <http://www.philip-pullman.com/pages/content/index.asp?PageID=113> and these things seem to play out in the courts, not the mailing lists. <yawn> randy

On Tue, Mar 22, 2005 at 03:49:44PM -0700, pashdown wrote:

In the end the bill itself doesn't have a big impact on this ISP's business. We have used Dansguardian for many years now along with URLblacklist.com for our customers that request filtering. The fact that its lists and software are open for editing and inspection is the reason I chose this over other commercial methods.

What is the plan -- if any -- to deal with the hosting of the porn sites on the computers of the people who they're supposed to be blocked from? What I'm referring to is the occasional spammer tactic of downloading web site contents into a hijacked Windows box ("zombie") and then using either redirectors, or rapidly-updating DNS, or just plain old IP addresses in URIs to send HTTP traffic there. This seems to be a tactic of choice on those occasions when the content is of a dubious nature: kiddie porn, warez, credit card numbers, identity theft tools, that sort of thing. Even *detecting* such things is difficult, especially when they're transient in nature and hosted on boxes with dynamic IP addresses. So how is any ISP going to be able to block customer X from a web site that's on customer X's own system? Or on X's neighbor Y's system? Oh...and then we get into P2P distribution mechanisms. How is any ISP supposed to block content which is everywhere and nowhere? ---Rsk

On Wed, Mar 23, 2005 at 11:23:12AM -0500, Rich Kulawiec wrote:

What is the plan -- if any -- to deal with the hosting of the porn sites on the computers of the people who they're supposed to be blocked from?

What I'm referring to is the occasional spammer tactic of downloading web site contents into a hijacked Windows box ("zombie") and then using either redirectors, or rapidly-updating DNS, or just plain old IP addresses in URIs to send HTTP traffic there. This seems to be a tactic of choice on those occasions when the content is of a dubious nature: kiddie porn, warez, credit card numbers, identity theft tools, that sort of thing.

"That's simple: just block inbound access to port 80 on the customer machines!" Cheers, -- jra -- Jay R. Ashworth jra@baylink.com Designer Baylink RFC 2100 Ashworth & Associates The Things I Think '87 e24 St Petersburg FL USA http://baylink.pitas.com +1 727 647 1274 If you can read this... thank a system adminstrator. Or two. --me

On Tue, 22 Mar 2005, Owen DeLong wrote:

Were I running an ISP of which Utah subscribers were not a large portion of my customer base, I would probably seriously consider simply disconnecting all of my Utah customers.

Of course, you're making sure none of the web servers under your purview are reachable from Utah either. ...Right? -- JustThe.net - Apple Valley, CA - http://JustThe.net/ - 888.480.4NET (4638) Steven J. Sobol, Geek In Charge / sjsobol@JustThe.net / PGP: 0xE3AE35ED "The wisdom of a fool won't set you free" --New Order, "Bizarre Love Triangle"

joshua sahala wrote:

On (22/03/05 20:41), Steven J. Sobol wrote:

...

On Tue, 22 Mar 2005, Owen DeLong wrote:

...

Were I running an ISP of which Utah subscribers were not a large portion of my customer base, I would probably seriously consider simply disconnecting all of my Utah customers.

Yes.

...

Of course, you're making sure none of the web servers under your purview are reachable from Utah either.

...Right?

well, actually, it sounds as if that would be your (the utah isp's) responsibility - unless the state of utah starts trying to apply its law(s) to other states (countries)...

NO, see 76-10-1233(1) "A content provider that is domiciled in Utah, or generates or hosts content in Utah, "... That's why I mentioned that hosters, and other content generating companies of any kind, will have to move out of the state. The reason that generic hosting facilities have to move is obvious, since nobody screens users -- web pages, blog comments, etc. Why other businesses? For example, no drug companies or pharmacies can have their businesses in Utah; they sell contraceptives, and generate information too sensitive for the tender eyes of minors. Since this law takes effect in January, 2006, the time to begin moving your company is Real Soon Now. Unless you just happen to have FELONY bail bond sitting around cash on hand -- typically $100,000 -- and plenty of funds for lawyers. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

On Tue, Mar 22, 2005 at 09:03:17AM -0800, Roy wrote:

CNET's extract is wrong.

The article states

The measure, SB 260, says: "Upon request by a consumer, a service provider may not transmit material from a content provider site listed on the adult content registry."

Its entirely voluntary on the part of the consumer.

The question is is it required to be affordable? "Yes, we offer a pr0n-free internet access for a service fee of $9.95/packet". I remember at a previous job trying to bypass one of these filters to determine how easy it would be (during the eval, it's kinda funny to have someone come by and say "try to reach pr0n now!"). The first person to bypass it was the one that handled postmaster@* only takes moments from a spam msg to get there.. short of having a live person (uh, isn't that called a parent?) review the material invovled, there will always be a way to bypass it, someone could hack some major content providers systems and serve out nothing but content that is restricted.. i don't see much that can be done to prevent those that truly want access to obtain it. - jared

Fergie (Paul Ferguson) wrote:

...

C|Net:

"Utah's governor signed a bill on Monday that would require Internet providers to block Web sites deemed pornographic and could also target e-mail providers and search engines."

http://news.com.com/Utah+governor+signs+Net-porn+bill/2100-1028_3-5629067.ht...

- ferg

-- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg@netzero.net or fergdawg@sbcglobal.net

-- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

In message <20050322173939.4F2F45D08@ptavv.es.net>, "Kevin Oberman" writes:

The law does not require that pr0n be blocked on customer request, only that access to a list of sites (addresses?) on a published list be blocked. A very different beast and a task that is not too onerous. No more so than SPAM RBLs and bogon address RBLs if handled properly.

That is, in fact, similar to a Pennsylvania law that was struck down by a Federal court. CDT's analysis of the Utah law is at http://www.cdt.org/speech/20050307cdtanalysis.pdf --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

on 3/22/05 9:19 AM, Jared Mauch wrote:

The question is is it required to be affordable?

"Yes, we offer a pr0n-free internet access for a service fee of $9.95/packet".

According to the bill: (3)(b)(i) Except as provided in Subsection (3)(b)(ii), a service provider may not charge a consumer for blocking material or providing software under this section, except that a service provider may increase the cost to all subscribers to the service provider's services to recover the cost of complying with this section. (3)(b)(ii) A service provider with fewer than 7,500 subscribers may charge a consumer for providing software under Subsection (3)(a)(ii) if the charge does not exceed the service provider's cost for the software. -Richard