COMPREHENSIVE STUDY ON CYBERCRIME - United Nations ...

CHAPTER EIGHT: PREVENTION
traffic for known signatures, although some amount of targeting is required to make this effective. A
review from the European Network and Information Security Agency concluded that: ‘Identifying
botnet traffic among benign, regular traffic is like searching for a needle in 100 million haystacks.’ As noted above
and in Chapter Five (Law enforcement and investigations), general traffic monitoring may also, in
some circumstances, risk conflict with data protection and privacy laws. 130
Content filtering – As discussed below in the context of ISP liability, laws in some countries
require ISPs to block access to illegal content such as child pornography. There are various ways in
which ISP can do this, with different methods making tradeoffs between speed, cost, effectiveness
and accuracy. Using DNS Filtering, ISPs can control the answers given to users by their DNS server,
thereby restricting access to a domain, such as ‘google.com’, but not a specific page or set of search
results. This is easy to bypass as users can simply use alternative DNS servers that will give genuine
results. IP Header Filtering can be used to block individual computers based on their addresses or
even partially to block specific services such as web or email. As many websites may be running on a
single internet server, it can affect unrelated websites – sometimes in very large numbers. Deep Packet
Inspection can be used to examine the main body of internet traffic. This allows extremely flexible
filtering, but requires expensive hardware on high-speed ISP links, and can slow all user
connections.
In practice, many filtering regimes employ a combination of these approaches, forming a
hybrid filter. Often, simpler filters, such as those based on DNS, are used to identify traffic to be
redirected to more complex filters. This hybrid approach allows sophisticated filtering with greatly
reduced resources.
Another possible ISP response to illicit content is to slow down traffic rather than blocking
it altogether. This approach can be used to make a service sufficiently inconvenient that users avoid
it. Examples of this include the slowing of encrypted web connections, to force users onto
unencrypted and thus inspectable versions of websites, and the practice of ISP ‘throttling’ of
filesharing traffic such as BitTorrent.
Possibilities for filtering or blocking of content, including with the aim of cybercrime
prevention, have raised a number of human rights concerns. The Human Rights Council has
emphasized, for example, the importance of internet access to freedom of expression and other
human rights. A resolution adopted at its 20 th session ‘Affirms that the same rights that people have offline
must also be protected online, in particular freedom of expression,’ and ‘Calls upon all States to promote and facilitate
access to the Internet.’ 131 The Special Rapporteur on the promotion and protection of the right to
freedom of opinion and expression, has similarly called the internet ‘an indispensable tool for realizing a
range of human rights, combating inequality, and accelerating development and human progress… facilitating access to
the Internet for all individuals, with as little restriction to online content as possible, should be a priority for all
States.’ 132
Intermediary liability – Internet content filtering is closely linked with the possibility of
imposition of service provider liability for content. ISPs typically have limited liability as ‘mere
conduits’ of data. However, as discussed below, particularly in the context of internet hosting,
modification of transmitted content can increase liability in some legal systems, as can actual or
130 Hogben, G., (ed.) 2011. Botnets: Detection, Measurement, Disinfection & Defence. ENISA, pp.73-74.
131 A/HRC/20/L.13, 29 June 2012.
132 A/HRC/17/27, 16 May 2011.
251