colinnashonline.com

Article from: ISP filtering not scalable: SAGE | Australian IT

If you’re a doctor I’m pretty sure you’ve had moments when you’ve felt like throwing the lounge cushions at the TV in response to some wildly inaccurate depiction of medical evidence on CSI.
Mark Newton

Filtering is a good workload for your PC at home because PCs spend most of their operational life doing nothing but this isn’t the case for ISP filtering, says network engineer Mark Newton

Lawyers would experience the same cringe when they watch the courtroom theatrics featured in Boston Legal, pilots would shout derisively at movies featuring stricken airliners, and parents of all stripes routinely shake their heads at the unrealistic portrayals of family life and conflict on Home and Away.

If you can identify with any of those reactions, you probably understand what it’s like to be an IT professional listening to a politician talk about the internet. Most of Australia has taken to the internet like a fish to water, but for some reason our political folk behave as if they’re visiting the internet from TV land, prattling on about cyber-this and e-that as if the language they’re using actually has some kind of real meaning, and as if the rest of us are supposed to be so wowed by their technological prowess that we won’t stop to think about what they’re actually saying.

Senator Stephen Fielding provided an excellent example in 2006, in what was probably the first salvo of the current internet censorship debate. Referring to some approaches he had received from product vendors, Senator Fielding told the Senate that arguments against the workability of what we now euphemistically call “ISP filtering” were “… just unbelievable. It is technically possible at the PC level. A PC is just a smaller mainframe.” Mainframe?! Do any ISPs even use mainframes? Senator Fielding clearly isn’t an IT expert, even if he does play one on television.

The Senator’s mistake lies in a concept which IT folk call “scalability.” A system is “scalable” if it copes gracefully with additional load. The Sydney Harbour Tunnel is not scalable because too many cars jam it up. Conversely our interstate rail system is scalable because if there’s too much freight we can usually add more carriages or more trains.

Filtering is a good workload for your PC at home because PCs spend most of their operational life doing nothing. To your computer’s nanosecond attention-span the fractions of a second between your keystrokes are like age-long idle wastelands, time the computer could be spending doing something else but can’t because it’s waiting for you. For some homes filtering represents the “something else”.

But when you put 10,000 or 100,000 or a million users through the same computer, the computer is busy looking after other people when it isn’t dealing with you. There’s a limit to how far it can go before, like the Sydney Harbour Tunnel, it fails catastrophically and clogs up the works. ISP filtering is not scalable.

There’s an argument that says you can scale it up by adding parallel systems all censoring at the same time, but those systems aren’t free, so what you’re really doing is spending multiples of the same dollars to achieve the same result, pushing up the cost of internet access for everybody.

Some vendors have an alternative approach, where the computer doing the censorship only involves itself in your internet traffic if you stray too close to a censored URL, thereby minimizing the traffic it is required to censor. But as the UK’s Internet Watch Foundation demonstrated by wrecking Wikipedia for English citizens in December 2008, even those systems gum up when the definition of “too close” is made broad enough to encompass normal users’ normal Internet activities.

In February 2008 one of these systems controlled by the Government of Pakistan accidentally isolated their entire country from the internet and caused YouTube to become unreachable for almost all of the world’s population. The censorware systems are like booby-traps, waiting patiently for the right confluence of events to trigger them to blow up in their designers’ faces. The world’s IT experts have always known they don’t work even while our politicians fool themselves into thinking we’ll be okay if we all just crank out another trial and wish hard enough.

In 1999 the CSIRO released a study which showed that ISP-level censorship systems are unworkable, expensive and slow. Ten years later we’re treated to almost weekly examples of expensive catastrophic failures of these systems in other parts of the world, and despite the delusional embrace of our political class, ongoing research repeatedly shows that today’s censorware isn’t appreciably better than it was when we first started looking at it.

Perhaps acknowledging its limitations, the ALP Government has set the “speed limit” of its live censorship trials to 12 Mbps, which is the absolute minimum speed required of the National Broadband Network (NBN). Are we looking forward to an NBN future where gigabit speeds would be possible if not for the fact that the mandatory censorship was slowing us down to 12 Mbps? Or can we be cynical enough to conclude that even Senator Stephen Conroy knows these systems are unworkable, and has set the speed limit low because he doesn’t think they can perform any better?

In 2005 the New Zealand Government looked at this issue and concluded that the international deployments it was able to observe were impractical and not-fit-for-purpose, specifically noting that the UK system was only 10 – 15 per cent effective even when it was notionally working. The ALP would do well to learn from our trans-Tasman brethren: If we shackle the Australian internet under unworkable, useless censorship systems, how will our national pride cope with electronic proof that New Zealanders are, once and for all, smarter than us?

Mark Newton is a network engineer with a large Australian ISP, and a long standing member of the System Administrators Guild of Australia (SAGE-AU)