Technical, Business, and Legal Dimensions of Protecting Children from Pornography on the Internet: Proceedings of a Workshop (2002)

Donald Eastlake

I co-wrote a personal Internet draft in the Internet Engineering Task Force (IETF) about the problems with mandatory labeling.¹ People often come up with ideas about how to segregate or label all bad material to magically solve the content selection or child protection problem. This idea is simple and easy to understand, but it does not work. There are a lot of problems with it, which this draft tries to summarize. The problems can be divided into several categories.

The first category of problems is philosophical. The idea of finding a way to categorize content in the global context of the Internet is absurd. There are 200 countries and they all have different laws. For example, laws on nude modeling differ. In one country you can have a magazine consisting entirely of nude pictures of 17-year-olds, but this is obviously a felonious and criminal act in another country, where nude models have to be 18. Yet another country might not permit any noticeable amount of the female body under any circumstances in a magazine or publication. There is no hope of getting a consistent point of view on this sort of thing. And this is just one criterion.

Moreover, there are more cultures than there are countries. There are literally thousands of cultures, all of which have their own particular

quirks and ideas regarding what sorts of things children should be allowed to access or the age at which children become adults. Going one step further, the concept of community has made it easier to develop standards, one way or another. But there are literally millions of communities.

Another category of problems is legal. If you require everyone who has a certain type of content to be in the dot-xxx name space, then you are, in effect, forcing speech on them. This seems to be a problem with respect to certain legal rights in the United States and some other countries. It obviously depends on the circumstances and whether this sort of speech is commercial or noncommercial, and so on. But, in effect, you are requiring people to label themselves, which runs into legal problems and effectively limits their free speech.

One difficulty in thinking about this sort of thing is the malleable nature of the Internet. Some parts of it are similar to commercial broadcast television, which, at least in the United States, currently has a system of labeling. But other parts of the Internet are more like someone strolling through a park and talking to whomever they bump into—activities that are entirely noncommercial, spontaneous, and unorganized. Imagine, if you are strolling through a property and bump into someone and you want to say something that some people could construe as objectionable, that you had to wear a large, yellow star. I think people would consider this to be objectionable. In some respects, labeling of Internet content could be considered similar to the yellow star.

Another category of problems is technical. The labeling system has to be realistic. The use of dot-xxx is not linguistically complicated. But if you try to label in an understandable way the various different axes of heresy or derogatory speech—whatever people object to—then you would have problems with the language from which to select the labeling. In addition, the Internet is not technically structured for things to be done in this way. The Internet has a hierarchically distributed control structure, so that one entity controls dot-com, for example, and other entities control the subzones below dot-com. There are multiple levels. Typically what is identified by one of these names is an IP address for some machine that can store data. Of course, we worry about causing a name to somehow correspond to some characteristic of the data in that machine. In fact, the people controlling these different name zones are likely to be independent organizations, and there is no way to stop other people from pointing at your material.

In other words, if you post material on a Web site with a name, there is no technical mechanism to stop someone else who has independent control of a different zone on the Internet from posting a pointer to your IP address under any name that they choose. If you have innocent mate-

rial, there is no way to stop someone from creating a dot-xxx name that points to your project. Similarly, if you have material that is placed correctly in dot-xxx, there is no way to stop someone from creating an innocent-sounding name that points to you. If we had global laws, we could make this practice illegal and go round up all of the people who do it and fine them.

All of these tricks are affordable. It is very simple, for example, to take an arbitrary mailing list, one that is entirely innocent and devoted to some light topic, and create an alternative address that you can send mail to, an address with terrible things about “xxx” in its name. You can have this bad sounding address automatically forward messages to the real, innocent mailing list and change the envelope information—things not normally seen around a message—and the headers. There is no software that checks on these functions, so it is easy to cause things to be distributed to individuals or mailing lists while making it appear that the mailing list has a name that is actually forged. In principle, a few of these problems could be solved by globally distributing changed software, but this is unlikely to happen.

There are other things on the Internet that have domain names that are not really domain names. For example, there is Net News, which has news groups that are hierarchically named but not hierarchically structured. They are more anarchic than domain names because they do not have a root and so on. They are more like a conversation, in that anyone could post anything to any of these news groups and, except for the few that are moderated, it is not clear how you can enforce much control over the names. Similarly, names are used in Internet relay chat and chat rooms that are also very conversation-like. Given all of this, you wonder if you can reasonably come up with an approach that would meet reasonable linguistic criteria and somehow affect all of these different naming schemes in any reasonable fashion.

There is nothing wrong with the mere existence of a dot-xxx domain name,² or with just anybody getting a dot-xxx site. But I feel that, if such a category existed, it would greatly increase the probability of laws requiring people to register there. This is not a technical problem, and there

is certainly no technical difficulty with the mere existence of that utility and the ability of people to get names there, as long as some organization runs a registry for it. There is a slippery slope argument, but it is not currently mentioned in our draft. The main thrust of our draft is to provide a convenient, precompiled answer for people who assert that a mandatory dot-xxx domain name will magically solve the problem they perceive in the categorization of Internet content.

The idea of a dot-kids domain may have a different spin in various ways. It still has the problem that the criteria for what kids are and what is appropriate material for them differ widely among nations, cultures, and communities. But in some sense it is a little better than dot-xxx. Maybe if you put something in dot-kids that is not considered appropriate for children, you would be prosecuted.

I also want to comment on the idea, which is mentioned less often, of categorizing content with a bit of the IP address. All hosts on the Internet have either 32-bit addresses under IPV-4 or 128-bit addresses under IPV-6, which is not widespread but is getting some attention. There are many problems with this approach. It is, in some ways, coarser than the domain names (sometimes the main name structures can be used to address a subset of material for the host). In some sense, like the address of a building, it refers to everything in that building. One problem is that there are no extra bits in IPV-4. Taking even one bit away would cause havoc; there are not enough addresses to go around. The whole reason for the creation of IPV-6 was to overcome the limit of 32 bits in IPV-4.

Another problem is that these bits are not arbitrary. They are topologically significant. As packets are sent through the network, they are routed by comparing the prefix bits on these numbers with a routing table. Essentially, the longest match determines how the packet is sent. I am simplifying this a bit, but at the top level of the Internet, routing tables currently have on the order of 40,000 or 50,000 entries, and this determines where things go at the top level, and they trickle down from there until they get to a particular local machine. If you assign addresses randomly, then you need billions of routes at the top level or else it would not work. There is no feasible hardware today that understands how to do this. For the Internet to work and get the data around, the address bits have to be assigned in a topologically meaningful way, directly related to the actual structure of the Internet and how the IPs are connected to each other.

IPV-6 might sound more hopeful, but it is not. One popular proposal, intended to enable wide deployment, effectively would reduce the routing part of the IPV-6 address to half of the full size. In this scheme, 64 bits would be used for all of the routing control, and the other 64 bits would be used as a unique end-point identifier. Conceivably, you could some-

how get one bit out of the bottom of the 64. But once you consider the need to label things along all the different dimensions and categories you might need on a globally meaningful basis, there is no way to do it in the bits in an IP address.

There is some hope for a technical solution. PICS has multiple modes. The mode in which you have to put a fixed label on your Web page or site has all types of similar problems as does forced speech, and not enough categories, and so on. But PICS does have a mode in which you have separate servers, like a separate rating service. You can ask the servers about certain data, certain sites, and so forth. This, at least, seems not to have the problems of forced speech or the limitations of other labels. You could have literally thousands or millions of different PICS servers that painted the world in different ways, and they would enable you to ask questions as to whether certain parts of the network are approved or not by the vendor of that particular PICS rating service, which could be some particular church, culture, or country. I am not saying that this necessarily would work wonderfully, but it does seem to have at least some technical practicality.