Could The DOJ Be Violating SESTA/FOSTA?

from the quite-possible dept

Last week, Gizmodo's Dell Cameron has a great report on how the DOJ's Amber Alert site was configured so stupidly that it could be used to redirect people to any website (this was also true of weather.gov and the National Oceanic and Atmospheric Administration). And it was being used. To redirect people to hardcore porn. Basically, the sites were designed such that just by knowing the right URL and adding a new URL to the end, it would redirect to those sites. Porn sites used this for a couple of reasons: first, since they'd now be getting referrals from high ranking sites, it can help their Google ranking. Second, because the primary URL would come from a trusted source again, it would help their Google ranking. And, finally, the links may look much more legit to people doing searches (though that would be more true of scam sites than porn sites).

Redirect scripts like this used to be fairly common, but they died off long ago. Except in the federal government. From Cameron's article:

“This is like the 1990s called and wants its vulnerable redirect script back,” said Adriel Desautels, founder of the penetration testing firm Netragard.

But, here's the thing: does this mean that the DOJ (and the NOAA) could be violating SESTA/FOSTA? It's possible! And that just goes to show how poorly drafted the law is. Remember, under the law, it is now illegal to "participate in a venture" that "knowingly" is "assisting, supporting, or facilitating" a violation of sex trafficking laws. So, if someone were to create a DOJ Amber Alert redirect to a sex trafficking website (or just an escort site, since people keep insisting those serve little purpose other than sex trafficking) would the DOJ be in violation?

The obvious response is that the DOJ isn't "knowingly" doing this. But... is that true? As Cameron's article notes, every time you hit one of those Amber Alert redirects, the DOJ gives you a nice little parting message:

Is that enough to "knowingly" participate? Maybe. I would bet that if non-governmental websites popped up similar messages, SESTA/FOSTA supporters would argue it's proof of knowledge. After all, Rep. Cathy McMorris Rodgers claimied that merely "turning a blind eye" was enough to prove "knowledge." And here, clearly, the DOJ must be logging those exit pages. Is it ignoring them? Is that turning a blind eye? Does that count as knowledge?

Maybe it's a stretch, but the fact that the language of the bill even makes this a possibility just demonstrates how poorly drafted the bill is, and shame on all the politicians who refused to step up and fix it.

Filed Under: doj, fosta, intermediary liability, porn, prostitution, redirects, sesta, trafficking, unintended consequences

How Even Highly-Targeted Censorship Can Lead To Overblocking

from the unintended-consequences dept

As the battle rages over SOPA and PIPA, censorship is very much on people's minds. But there are many different kinds of censorship, operating at different levels of precision. For example, while some forms are crude and inexact, like Homeland Security's shutdown of 84,000 sites, others are highly targeted, and designed to block in a very specific way.

That's the case for the attempted blocking of Newzbin2 in the UK. The judge, Justice Arnold, ordered the ISP BT to take a two-stage approach (possible thanks to the pre-existing "Cleanfeed" system it had set up to block child pornography).

If an IP address matches one of those contained in the blocking list, the request to access the site is routed to a proxy server where the exact URL � the specific address including the directory and filename � is examined. If that matches too, access is denied. The judge specified this technique, rather than simply ordering the IP address to be blocked, for an important reason, which he explained in one of his rulings:

the Studios now accept that the order should refer to IP address re-routing and not IP address blocking. It appears that IP address blocking could lead to "overblocking" of sites or pages that ought not to be blocked.

However, as James Firth notes in a blog post, overblocking is still likely to occur thanks to the combination of two factors:

The first is that Newzbin will - and there's strong evidence they have done already, several times - change their IP address. It is well known that IP addresses have all but run out. Nearly all IP addresses allocated are recycled - they've been in use before.

Pity the website owner who picks up Newzbin's old IP address. Under Arnold, J's BT ruling the new owner of the IP address would have some solace in that the URL would not match, therefore BT customers would still be able to access the website, albeit via a proxy. Re-routing via the proxy may cause some minor problems, but that's a bit of a side issue.

In the case of Sky, [another UK ISP now blocking Newzbin2] unless Sky happen to also use a 2-stage blocking system [like BT] - and my contacts tell me they do not - then whoever picks up the old recycled IP addresses from Newzbin will find themselves blocked.

As Firth points out, one of the many worrying aspects of the Newzbin2 judgment is that there doesn't appear to be any mechanism for removing IP addresses once they have been placed on the blocking list � even if they are no longer used by Newzbin2. Adding new ones, by contrast, is explicitly permitted:

sites "whose sole or predominant purpose is to enable or facilitate access to the Newzbin[2] website" (para 10) can find themselves blocked, again without re-application to the court. If someone creates a website explaining how to work around the block, and this website did very little else but explain how to access Newzbin, it too could be blocked.

That would lead to yet more IP addresses being added to the list, which might then be handed out again to new users as they are recycled from ephemeral sites that pop up and then disappear.

What Firth's analysis shows is how even relatively "sophisticated" censorship systems that aim to minimize damage to other sites can lead to overblocking because not every situation can be foreseen or planned for. Now imagine what SOPA/PIPA will do.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: blocking, censorship, copyright, ip blocking, ip filtering, overblocking, pipa, protect ip, redirects, sopa, uk
Companies: bt, newzbin, sky

State Of Alaska Threatens CrackHo After Confusing Redirect With Hijacking...

from the why-lawyers-should-have-some-tech-knowlege dept

It's always bad news when the technically illiterate start filing lawsuits over technology issues. A few folks have sent in the news that the state of Alaska, under Sarah Palin's governorship, has (we're not making this up) sent a cease and desist letter to the website CrackHo.com supposedly for hijacking a page from the state's website and using the official seal of Alaska without permission -- which the state claims violates both state laws (fines up to $500 or six months in prison) and federal copyright laws.

So what did the site CrackHo.com do to deserve this? Well, it simply redirected anyone who went to Crackho.com to Sarah Palin's website on the state webpage. Yes. A simple redirect. And the state claims that this is hijacking the website, a misuse of the seal of the state and a violation of federal copyright laws. Based on that logic, with a few simple magic tricks, I've just made TinyUrl, Bitly and Is.gd guilty of the same things.

I mean... I'm sure the lawyers working for the state of Alaska have some free time on their hands right now... but... seriously? Did no one bother to actually investigate what they were threatening?

Filed Under: alaska, copyright, crackho, hijacking, redirects, sarah palin

Rogers Looks For New Ways To Annoy Customers, Hijacks Failed DNS Lookups

from the nobody-likes-anti-features dept

Rogers -- a Canadian telco -- has been attracting a lot of negative attention lately between deliberately disabling notifications for cellular roaming charges, setting ridiculous iPhone pricing plans and injecting its own content into Google's home page. As if that wasn't enough, Rogers has started hijacking failed DNS lookups. This means that when a user types in a web address that doesn't exist, instead of getting a "page not found" error, the user is redirected to a search page filled with banner ads and sponsored links. Michael Geist notes that there's an "opt-out" feature, but it doesn't take long to see that it's pretty pathetic. The "opt-out" sends a cookie which just redirects the user to a different Rogers page instead -- a fake "Internet Explorer" error page hosted on the same server. It does essentially the exact same thing, only pretending (poorly, for non-IE users) to revert back to expected behavior. And the option is reset whenever the browser's cookies are cleared. The comments on Geist's post are evidence that many Rogers customers are not pleased (myself included).

This isn't just annoying, it's also a security threat. It breaks how the internet was designed to work; a lot of software is written with the expectation that a DNS lookup for a non-existent domain name will return an error. For example, Kevin Dean notes in the comments on Geist's post how this has caused problems for him accessing his VPN. At first, he thought his computer had been compromised, since Rogers' new "feature" ends up resembling a hostile attempt to redirect traffic to an unknown server.

Some American ISPs already do this, such as Earthlink (which was used to demonstrate the security risk), though it seems to have a slightly better opt-out process, instructing users to configure alternate DNS servers instead of setting a browser cookie. VeriSign had originally tried to do something similar with SiteFinder back in 2003 (though not at the ISP level), but it didn't exactly go over too well. VeriSign reluctantly backed off, though it just recently obtained a patent on the concept. Rogers is the first Canadian ISP to implement the practice and it seems to think it won't meet much resistance. In another comment on Geist's post, Ian relates a telling quote from the FAQs page for Paxfire (the American company handling this for Rogers): "What feedback you do receive typically will come from a small group of highly technical users. Even that feedback tends to fall away after just a few weeks -- as they get used to the new behavior."

Rogers thinks it can just brush off complaints from its users, especially since there really isn't a lot of choice in the Canadian ISP market. However, Rogers should be careful in treading so brazenly into what some consider "net neutrality" territory. Bell Canada (one of Rogers' few competitors) has landed itself in front of a national regulatory body over its throttling practices. Rogers wants to have complete control over its network, but by continually pushing the line they only spur on the debate about net neutrality and government regulation. We haven't heard the last of this.

Filed Under: dns lookup, redirects
Companies: rogers