AFP abandons legal pursuit over blacklist leak

 

Communications watchdog beefs up security after incident.

The Australian Federal Police has abandoned attempts to prosecute those responsible for leaking the ACMA blacklist last year, the communications regulator said today.

Chairman Chris Chapman told a Senate Estimates Committee hearing that his understanding was the AFP "have not pushed on with any prosecution.

"It's my understanding from the AFP that they considered the prospects of success under their guidelines, but it wasn't sufficient to get a prosecution," Chapman said.

Other operational priorities were also understood to have contributed to the AFP's decision.

But the Australian Communications and Media Authority said it had beefed up security since the leak, which was understood to have been caused by the hacking of one of the filter providers.

It included accreditation re-testing by the Internet Industry Association (IIA) for all providers using a new set of criteria that took into account measures the providers had taken to ensure their storage of the list was secure.

"The industry has put its house in order," ACMA general manager Nerida O'Loughlin said.

"Only those [providers] tested by the IIA under the new set of criteria receive the blacklist from us."

O'Loughlin said ACMA had also introduced stronger encryption techniques between it and internet service providers that would increase the security of list transfers.

She said a six-month ban on distribution of the blacklist to filter providers in the wake of the leak was now lifted.

"We've improved our database management and automatic and manual reviews of content," O'Loughlin said.

"We've certainly raised the level of encryption [to send] the blacklist to current filter providers. But we've also required those filter providers on the family-friendly filter list to improve their security.

"We think what we've got in place now is a more robust system to meet security requirements."

She could not say whether the agency had conducted its own penetration testing of filter systems to determine whether or not they could stand up to a similar hack or leak attempt in the future.

Blacklist breakdown

ACMA also revealed a breakdown of the 1,254 URLs that reside on the current blacklist.

It said that 51 percent of the site addresses were for refused classification (RC) items - those that will be filtered under the Government's plans for mandatory ISP-level filtering.

A further 40 percent were X-rated and eight percent of the URLs were classified as R18+.

O'Loughlin confirmed that ACMA was "working closely" with the Internet Watch Foundation to "use some of their list as an adjunct to our list".

The foundation produced a blacklist that specialised in blocking child sexual abuse material.

"We've been aware of their list for quite some time. It has some similarities in the work we do in listing child sexual abuse material," she said.


AFP abandons legal pursuit over blacklist leak
"That would be the list leaked on wikileaks that the minister denied was the ACMA list. The same list that showed the govt blacklist reached far beyond child porn, and was not reviewed for at least ..."
By Private Citizen
 
 
 
Comments: 3
Bourkie
Feb 8, 2010 4:54 PM

You don't need the list to be 'hacked' for it to be leaked.

A research team at The University of Cambridge poved how any determined student can successfully reverse engineer ISP filter blacklists using simple oracle attack techniques within a matter of hours:

http://www.cl.cam.ac.uk/~rnc1/cleanfeed.pdf
Bourkie
Feb 8, 2010 5:09 PM
Failures in a Hybrid Content Blocking System

Richard Clayton
University of Cambridge, Computer Laboratory, William Gates Building,
15 JJ Thomson Avenue, Cambridge CB3 0FD, United Kingdom

Abstract.

...This paper examines a hybrid, two-stage system that redirects traffic that might need to be blocked to a proxy cache, which then takes the final decision. This promises an accurate system at a relatively low cost. A British ISP has
deployed such a system to prevent access to child pornography. However, circumvention techniques can now be employed at both system stages to reduce effectiveness; there are risks from relying on DNS data supplied
by the blocked sites; and unhappily, the system can be used as an oracle to determine what is being blocked. Experimental results show that it is straightforward to use the system to compile a list of illegal websites.
Private Citizen
Feb 9, 2010 5:17 PM
That would be the list leaked on wikileaks that the minister denied was the ACMA list. The same list that showed the govt blacklist reached far beyond child porn, and was not reviewed for at least two years.

Interesting the proposed filter will be maintained through ACMA, yet ACMA will import other countries lists. What vetting process will they use to verify that the sites on other countries list meets the RC classification?

How do we achieve due process? Which means that ACMA should list the site it proposes to block, the reasons leading to its decision, then we should have the right of appeal.

Then how often will ACMA review each listing to ensure that the blacklisting is still valid?
Comments have been disabled for this article.
 
 
 
Top Stories
Telstra shifts BigPond email to Windows Live
All data to be migrated to Microsoft cloud.
 
Windows 8: Under the hood
Part One of iTnews' enterprise guide to Windows 8.
 
iTnews on tour: The Executive Summit Series
Join us in Sydney and Melbourne to meet Australia's tech leaders.
 
Sign up to receive iTnews email bulletins
   FOLLOW US...

Latest VideosSee all videos »

Latest Comments
Polls
Would you be concerned about your business' email data being hosted offshore?

   |   View results
Yes
  94%
 
No
  6%
TOTAL VOTES: 33

Vote