servers, the traffic is redirected to a transparent HTTP proxy. There, the full Web address is
inspected and if it refers to banned content, it is blocked; otherwise the request is passed on
as normal.
Denial of Service
Where the organization deploying the filtering does not have the authority (or access to the
network infrastructure) to add conventional blocking mechanisms, Web sites can be made
inaccessible by overloading the server or network connection. This technique, known as a
Denial-of-Service (DoS) attack, could be mounted by one computer with a very fast network
connection; more commonly, a large number of computers are taken over and used to mount
a distributed DoS (DDoS).
Domain Deregistration
As mentioned earlier, the first stage of a Web request is to contact the local DNS server to find
the IP address of the desired location. Storing all domain names in existence would be infeasible, so instead so-called recursive resolvers store pointers to other DNS servers that are
more likely to know the answer. These servers will direct the recursive resolver to further DNS
servers until one, the ‘‘authoritative’’ server, can return the answer.
The domain name system is organized hierarchically, with country domains such as ‘‘.uk’’
and ‘‘.de’’ at the top, along with the nongeographic top-level domains such as ‘‘.org’’ and
‘‘.com.’’ The servers responsible for these domains delegate responsibility for subdomains,
such as example.com, to other DNS servers, directing requests for these domains there.
Thus, if the DNS server for a top-level domain deregisters a domain name, recursive resolvers
will be unable to discover the IP address and so make the site inaccessible.
Country-specific top-level domains are usually operated by the government of the country in
question, or by an organization appointed by it. So if a site is registered under the domain of a
country that prohibits the hosted content, it runs the risk of being deregistered.
Server Takedown
Servers hosting content must be physically located somewhere, as must the administrators
who operate them. If these locations are under the legal or extra-legal control of someone
who objects to the content hosted, the server can be disconnected or the operators can be
required to disable it.
Surveillance
The above mechanisms inhibit the access to banned material, but are both crude and possible to circumvent. Another approach, which may be applied in parallel to filtering, is to monitor
which Web sites are being visited. If prohibited content is accessed (or attempted to be
accessed) then legal (or extra-legal) measures could be deployed as punishment.
64
Steven J. Murdoch and Ross Anderson
inspected and if it refers to banned content, it is blocked; otherwise the request is passed on
as normal.
Denial of Service
Where the organization deploying the filtering does not have the authority (or access to the
network infrastructure) to add conventional blocking mechanisms, Web sites can be made
inaccessible by overloading the server or network connection. This technique, known as a
Denial-of-Service (DoS) attack, could be mounted by one computer with a very fast network
connection; more commonly, a large number of computers are taken over and used to mount
a distributed DoS (DDoS).
Domain Deregistration
As mentioned earlier, the first stage of a Web request is to contact the local DNS server to find
the IP address of the desired location. Storing all domain names in existence would be infeasible, so instead so-called recursive resolvers store pointers to other DNS servers that are
more likely to know the answer. These servers will direct the recursive resolver to further DNS
servers until one, the ‘‘authoritative’’ server, can return the answer.
The domain name system is organized hierarchically, with country domains such as ‘‘.uk’’
and ‘‘.de’’ at the top, along with the nongeographic top-level domains such as ‘‘.org’’ and
‘‘.com.’’ The servers responsible for these domains delegate responsibility for subdomains,
such as example.com, to other DNS servers, directing requests for these domains there.
Thus, if the DNS server for a top-level domain deregisters a domain name, recursive resolvers
will be unable to discover the IP address and so make the site inaccessible.
Country-specific top-level domains are usually operated by the government of the country in
question, or by an organization appointed by it. So if a site is registered under the domain of a
country that prohibits the hosted content, it runs the risk of being deregistered.
Server Takedown
Servers hosting content must be physically located somewhere, as must the administrators
who operate them. If these locations are under the legal or extra-legal control of someone
who objects to the content hosted, the server can be disconnected or the operators can be
required to disable it.
Surveillance
The above mechanisms inhibit the access to banned material, but are both crude and possible to circumvent. Another approach, which may be applied in parallel to filtering, is to monitor
which Web sites are being visited. If prohibited content is accessed (or attempted to be
accessed) then legal (or extra-legal) measures could be deployed as punishment.
64
Steven J. Murdoch and Ross Anderson