Recalculating: Why Website Blocking Is Ineffective and What Can Be Done When Faced with Illegal Content

16/03/2023

Website blocking to deal with illegal activity responds to a counterproductive logic that does not solve the underlying issues, can inadvertently affect third parties, and generates high administrative costs.

Ignacio Estrada, Chief Strategic Relations Officer

To normalize website blocking for the purpose of limiting an illegal action or behavior is to ignore the consequences that these actions may have for customers and users in the region.

We at LACNIC would like to stress that, while it is technically possible to block access to a website from a specific network, this is not an easy task and the chances that the results will have unintended consequences increase with the number of operators involved, even more so if the operators are geographically distributed among different territories or jurisdictions.

There is generally a false assumption that blocking access to a website or application is a very simple process, yet the reality is much more complex.

For example, let’s consider a typical case of website blocking: a domain through which you can access a website whose content infringes intellectual property or that allows online gambling. In such cases, the rationale is that, by blocking that domain, the website will no longer be visible on the Internet; however, the reality is that websites can have more than one registered domain. If one of these domains is blocked, the website may be accessible through others.

The problem is compounded because the block at the domain level is not fully effective, so the next step is to go for the server where the website is hosted. This server uses at least one IP address to connect to the Internet, so the decision is made to block it. The fact is that each server can host hundreds or thousands of websites: if we block that IP address, we run the risk of blocking all the websites on that server, including those of companies, governments, non-profit entities, and so on.

Likewise, we must not lose sight of the fact that the website may be hosted on servers located in different parts of the world, so the block at the server (IP) level could extend to thousands of websites that have nothing to do with the matter at hand.

Why is website blocking ineffective?

We at LACNIC would like to point out that there are strong arguments to support the reasoning that a website blocking policy does not have the desired effect:

1- Blocking has a high risk of harming unrelated third-party websites and networks

This unintended disconnection of third-party websites is one of the biggest risks of website blocking. When they receive a request to block a website, courts often order the blocking not of a single IP address but of a range of IP addresses, which may include network addresses that will be needlessly affected.

In late August 2022, Cloudflare’s customer support team began to receive complaints about websites on their network being down in Austria, but the service disruption was not the result of a technical problem but of a court order: an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses. In an attempt to block 14 websites that some copyright holders claimed were violating copyright, the court-ordered IP block rendered thousands of websites inaccessible to internet users in Austria for two days.

2- It does not solve the underlying problem

Blocking does not guarantee the removal of the illegal content or activity behind a website and does not provide a real solution to the problem it seeks to solve. The content is not removed; instead, only one path to the content is interrupted.

This means that offenders can quickly circumvent the block. “Experts” in abuse and cybercriminals are prepared to solve their problem almost immediately by migrating to other IP addresses or domain names in other jurisdictions and/or providers and (in many cases) have these options ready in advance.

This generates a complex and ineffective dynamics: energy and resources are invested in keeping a website block applying a “temporary patches” approach that does not go to the root of the problem.

Thus, there is a risk of turning the Internet into a series of blocks of little use that can be easily circumvented, without the genuine solution which would be being able to identify the individuals who are committing the illegal act.

3- It generates a huge administrative burden for everyone involved

Website blocks generate a huge administrative cost both for the governments that maintain the lists of blocked websites as well as for the Internet Service Providers, particularly the smaller ISPs.

It takes a very long time to recover the services of affected third parties who have not committed any illegal activity. The blocking process is fast, but the reverse process is tedious. For example, the regulator will need to notify ISPs and then check their compliance, maintain a public list of blocked websites, and deal with the administrative and financial complaints of those who have been unduly blocked.

4- It represents a gateway to the limitation of human rights

Blocking requests as precautionary measures might be the first step in affecting people’s rights to freedom of expression and information.

Website blokcking under the microscope

When considering website blocking, LACNIC maintains that it is necessary to keep in mind that any measure which seeks to regulate the use of the Internet must meet broad criteria that promote innovation and the development of new uses and services on the Internet, criteria defined with a multistakeholder participation model.

Given this context, our recommendations can be summarized in four points:

• Do not use website blocking as the first option to remove illegal content.
• Consult all stakeholders in case of moving forward with a regulation that provides for website blocking. It is obviously necessary to take into account that urgency varies depending on the type of content, as the transmission of live content is not the same as an online gambling website.
• If there is no solution other than blocking, only block the resource (the domain name or IP address) temporarily, in coordination with the technical department of the entity to whom the request is made (ISP).
• At all times, listen to the advice of the institution’s technical experts or, better yet, of a diverse group of ISPs, operators, and related institutions for the coordination and attention of these incidents.