UK: How do ISPs Implement Network Based Parental Control Service?

Ofcom has "published a report for Government outlining measures the UK's largest internet service providers have put in place to help parents protect children from harmful content online. This follows an agreement between the Government and BT, Sky, TalkTalk and Virgin Media, the four largest fixed line internet service providers (ISPs), announced in July 2013 [see "UK to Enforce Opt Out Network Based Web Filtering on All ISPs" - here]. Each ISP committed to offer new customers 'family-friendly network-level filtering' by the end of December 2013 [see "UK ISPs for Safer Internet" - here]" 

"The report finds that the four ISPs now have a network level family friendly filtering service .. There are a number of filtering categories common to all four ISPs. Suicide and self-harm, pornography, file sharing, crime, drugs, violence and hate are covered by each provider's classification systems .. All of the ISPs offer some additional services alongside the network family-friendly filters, some including internet security services aimed at protecting the subscriber from issues like viruses or malware. All offer device level filtering or security software for installation on individual computers

All of the ISPs have commissioned third parties to perform the categorisation of 

internet content and services: 

• BT and Virgin employ Nominum
• Sky uses Symantec 
• TalkTalk uses Huawei [see "Huawei's SIG: Policy Enforcement and URL Filtering" - here], although Symantec was also initially involved.

The filtering solutions rely on two basic technologies:

• Filtering by Uniform Resource Locator (URL) blocking: the filtering of sites or services based on their web address – either addresses covering whole websites (http://www.example.com) or individual sections or pages on those sites (http://www.example.com/adultpictures). This involves the ISP checking some or all of the URLs which an opted-in subscriber requests against the list of sites or pages to be blocked. If there is a match, the subscriber request is not fulfilled – typically a page with the message “this site is blocked because it is classified as…” may be delivered instead.

• Filtering by Domain Name System (DNS) alteration: the DNS translates domain names (“www.example.com” into IP addresses “192.0.32.10”), to allow a subscriber’s content request to be correctly directed – this is the first stage in requesting a website or service. When used for filtering, the ISP’s DNS server will not provide the IP address for domains on the list; it may instead direct the subscriber request to an information page with “this site is blocked because it is classified as…”.

Each of Virgin Media, BT and TalkTalk has adopted a slightly different version of URL blocking; Sky’s filtering system is exclusively based on its DNS servers. The use of URL blocking allows a more granular classification of online content and services: Sky’s system will always block whole domains, while BT, Virgin Media and TalkTalk can target specific parts of a domain.

See "Ofcom publishes report on internet safety measures" - here.