Privacy Risks of Blocking Internet Sites via URL

29/07/2024

By Miguel Ignacio Estrada

In recent years, there has been a significant increase in legislative initiatives and regulations aimed at restricting access to specific websites by blocking domains, IP addresses, and URLs. Although these efforts are driven by the intention to combat illegal activities and protect users, they raise serious concerns about privacy and Internet freedom.

The difference between IP addresses, domains and URLs

It is essential to clearly distinguish between the three elements that are usually included in such legislative or regulatory measures for site blocking: IP addresses, domains, and URLs.

An IP address uniquely identifies a device on a network. A domain is a human-readable name associated with an IP address. A URL is a complete address that includes the domain and the specific path to access a resource on the Internet.

An IP address identifies a device on a network through a series of numbers, while a domain is a human-readable name associated with an IP address to facilitate navigation. On the other hand, a URL specifies the address within a website to a particular resource, usually a webpage.

We can better illustrate  each of these concepts with some examples:

• IP address: 190.210.32.126
• Domain: ejemplo.com
• URL: https://ejemplo.com/secciones/política/proyecto-de-ley-de-bloqueos.html

What does URL blocking involve?

Earlier, we addressed the risks associated with blocking sites through domains and IP addresses. These risks can include the accidental disconnection of third-party sites and the total shutdown of operator networks within a specific region, which could extend to an entire country.

In recent years, many legislative and regulatory projects in the region have used the term “URL” as a synonym for “domain.” However, as explained above, these are technically different terms and require different technical measures for blocking.

Blocking Internet sites via URL offers greater precision compared to blocking domains or IP addresses, as it allows targeting a specific page within a website without affecting access to the rest of the site’s content. However, blocking via URL requires the use of deep packet inspection (DPI) techniques and other monitoring methods.

DPI involves the automated inspection of the contents of data packets by network equipment before they are reassembled by the end user’s device. It would be the equivalent of checking each letter that a post office receives, opening its envelope and checking the contents for specific items and then resealing the envelope to deliver it to the final recipient.

This technique enables those who implement it to perform advanced security functions, data mining, eavesdropping, and censorship. It allows Internet Service Providers (ISPs) and authorities not only to identify and block specific URLs suspected of illegal activity, but also to illegally monitor and record users’ online activities in detail.

Additionally, requiring or allowing deep packet inspection creates incentives for both legitimate and malicious actors to weaken or break end-to-end encryption, which is essential for end-user trust in digital communications.

Privacy risks

The improper use of deep packet inspection can lead to unintended consequences and significant privacy risks for Internet users.  Some of these risks include:

• Extensive monitoring of online activity. The implementation of URL blocking requires Internet Service Providers (ISPs) to inspect the content of data packets traveling through their networks. This means that every web request made by a user can be analyzed to determine if it matches a blocked URL. This level of inspection can lead to extensive and continuous monitoring of users’ online activity, representing a significant invasion of privacy.
• Misuse of user activity logs. In order to implement URL blocking, ISPs may claim the need to keep detailed logs of user activities. These logs can contain information about the websites visited, specific URLs accessed, and the content of online communications. The collection of this data poses a substantial risk of misuse, whether by government entities, private companies, or cybercriminals who manage to access this information.
• Potential for abuse and over-surveillance. The ability to monitor and block URLs can be misused for purposes beyond their initial intent. Authoritarian governments, for example, might employ these tools to censor political content, monitor dissidents, or repress free speech. Even in well-established democracies, there is a considerable risk that these tools could be used for mass surveillance, especially in national security contexts.
• False sense of security. URL blocking can give both governments and citizens an illusion of security. Users may feel protected from harmful or illegal content, while genuinely malicious actors may always find ways to evade these blocks by altering URLs or registering multiple domains different from those originally blocked.
• Additional risks. Compromising or removing end-to-end encryption exposes users to additional privacy and security risks. This undermines the confidentiality of communications for not only suspected criminals but also for all legitimate users, including businesses, governments, and civil society organizations, impacting their communications and transactions.

Conclusion

At LACNIC, we recognize that URL blocking is a powerful yet controversial tool for managing online information access. Although it can be effective in addressing certain harmful content at the content or access provider level, it also raises significant concerns about user privacy and freedom, particularly when its use is forced by regulation.

It is essential that any such measures be implemented only as a last resort and, if implemented, be carried out with transparency, oversight, and adequate safeguards to protect the rights and privacy of individuals. Ultimately, the balance between security and freedom must be carefully managed to preserve the open and free nature of the Internet, which fundamentally supports the human and civil rights of our society.