I wrote this in an effort to answer some of the frequently asked questions about internet censorship and filtering in New Zealand. There is also a Technical FAQ that contains more in-depth information about how the system works.
It’ll be updated periodically with new questions and better information (last update 20/10/2009).
Please feel free to ask any further questions in the comments and I will do my best to answer them.
Glossary
DIA – Department of Internal Affairs
OIA – Official Information Act
ISP – Internet Service Provider (e.g. Telecom/Xtra)
Internet address – same as IP address.
Does New Zealand have internet censorship?
New Zealand’s censorship laws forbid viewing or owning certain types of material (e.g. depictions of bestiality or sex with children) and this applies to material accessed over the internet too. A number of people have been convicted for possessing material they have downloaded over the internet.
Does New Zealand have internet filtering?
At this moment it does not. However, the Department of Internal Affairs ran a trial internet filtering scheme in conjunction with Ihug, Watchdog, Maxnet and TelstraClear from May 2007 to September 2008 and is planning to fully implement it in within a couple of months from August 2009 (still not implemented as of 20/10/2009).
When will the internet filtering be implemented?
“Soon”.
What does it cost?
The Department of Internal Affairs has budgeted an additional $617,000 for Censorship Enforcement Activities for the 2009/2010 financial year. This includes $150,000 for the internet filtering software.
The Internet connection used by the filtering system costs $2000/month.
Three people will be employed maintaining the system (although they might have other duties too).
Other costs include include the computer hardware, the time used to implement the scheme, and the work and costs incurred by the ISPs.
Who decided to implement internet filtering in New Zealand?
The decision was made within the Department of Internal Affairs.
Has an internet filtering law been passed?
No it is being done under the Films, Videos, and Publications Classification Act 1993. This gives the responsibility for enforcement to the Department of Internal Affairs. It does not mention internet filtering.
The scheme is currently voluntary for the ISPs (Internet Service Providers) as there is no law to force them to use it.
How does the filtering work?
- A list of banned sites and their internet addresses is maintained by the Department of Internal Affairs.
- The DIA then use a routing protocol to tell the participating ISPs (Internet Service Providers) that the ‘best’ way to the internet address of the banned site’s web server is through the DIA’s filtering server.
- When a person tries to access a site (banned or not) on one of the filtered addresses, their ISP knows to divert the request to the DIA’s server.
- The DIA’s filtering server then looks at the request. If it is to a banned site, the request is refused and a message is sent back to the person. If it is to a non-banned site, the DIA’s filtering server passes the request on to the real server through the DIA’s internet connection.
See the Technical FAQ for more information.
What system are they using to do the filtering?
The software is Netclean Whitebox.
What happens if I go to a banned site?
You will see a message saying that access to the site has been banned. Your internet address will be logged. This will be able to be tracked back to your internet account.
There is a link on the page that allows you to submit an objection to that website being blocked. There is no way to enter your own information and therefore you will not get a reply.
The DIA say that the filter will not be used for law enforcement.
What happens if there are multiple sites on a server and only one of them is banned?
The filter is applied at the level of the internet address but it is common for a web server to host multiple websites on a single internet address. All requests to any of the sites on one of the filtered internet addresses will be diverted to the DIA’s server.
The DIA’s filtering server then looks at the request. If it is to a banned site, the request is refused and a message is sent back to the person. If it is to a non-banned site, the DIA’s filtering server passes the request on to the real web server through the DIA’s internet connection.
Does the filtering work with HTTPS (secure HTTP)?
HTTPS (secure HTTP) is used for security on sites that need it for services such as internet banking and online shopping.
HTTPS requests can’t be examined by the filter server (because they use encryption for the security). This means that all HTTPS traffic to an internet address that has any banned content (possibly for a completely different website) will be passed through the filter.
What happens if the website has a mixture of legal and illegal content?
It is possible to filter down to the level of folders or even individual documents and images on a website. E.g. you could filter http://www.website.com/badcontent but allow http://www.website.com/goodcontent
Will internet filtering slow down the internet?
Due to the way the filtering is implemented there should be no performance issues with any sites that are hosted on web servers that do not have any banned sites.
Visits to non-banned sites on the same servers as banned sites will have to go through the DIA’s filter server and will then be forwarded out to the real server through the DIA’s internet connection. This will have some impact on performance, although the extent will largely depend on how good the performance of the DIA’s filter is, and whether they have enough internet bandwidth to be able to service the requests they pass through.
Does the internet filter only apply to web browsing or does it apply to other traffic as well?
All traffic (web, email, P2P, etc) for a filtered internet address will be forwarded to the DIA’s server.
All non-web Internet traffic will be forwarded through the filter to the destination site.
Does the filter automatically detect objectionable material?
No, the website must be manually added to the filter list.
What type of material is censored?
The trial scheme was used to filter child pornography including video, photos, and text articles. Other illegal material (as defined by New Zealand law) is not filtered.
What is the process for a site to be added to the filtering list?
The Censorship Compliance Unit within the Department of Internal Affairs has developed a list of over 7000 sites with child pornography. All sites added to the list have a report that identifies the investigating officer and what they saw on the site.
The DIA says that new sites are added to the list by the agreement of 3 or more warranted inspectors of publications, and that the list is reviewed monthly by a manual process to ensure it is up-to-date.
The DIA claims to be developing a code of practice, and that an independent reference group will be established to oversee the operation.
Is the list of banned sites available?
The Department of Internal Affairs has refused to release the list of banned sites. They claim that they are allowed to do so under section 6 (c) of the Official Information Act. This allows them to refuse on the grounds that the release would be “likely to prejudice the maintenance of the law, including the prevention, investigation, and detection of offences, and the right to a fair trial”.
This can be contrasted with the legal responsibility that the Chief Censor has to publish their decisions to ban films and publications.
A complaint about this refusal has been sent to the Ombudsman who has taken it up with the Department of Internal Affairs.
The Department of Internal Affairs has since deleted the records from the trial period. A complaint has been made to the Chief Archivist as this would seem contrary to the Public Records Act.
Is it possible to check whether a website is on the filtered list?
The only way to check whether the website is filtered is by attempting to access it.
If a website is filtered is it possible to find out why?
No.
Can a website block be appealed?
The “this website is blocked” screen includes a link to anonymously request that the website be checked.
Can other types of material be censored in the future?
There is no technical reason why the same technology could not be extended to block websites with other types of content.
Apparently the NetClean software is contractually restricted to only being used to block child pornography.
Does it censor by content as well as by address?
No, the system is only used to restrict access to individual websites. If the same or similar material is published on a different website it will be available until the new website is added to the list.
Which ISPs will be part of this voluntary scheme?
The following ISPs were part of the trial scheme: Ihug, Watchdog, Maxnet and TelstraClear. Apparently Telecom (Xtra) and Vodafone have also expressed their willingness to participate.
IDC reported that as at June 2008, these ISPs represented over 94% of the market.
See Which ISPs? for the current list of which ISPs will or won’t be participating.
Is the scheme really voluntary?
ISPs can choose whether to subscribe to it or not.
Can people choose to opt out of the internet filtering?
The only way to opt-out of the filtering is by switching to an ISP that doesn’t implement it. ISPs that have implemented it so far have not provided a way to opt out of it.
However, it is not technically difficult to circumvent the filtering by using an internet proxy in another country.
This FAQ is in the public domain. As the FAQ is continually being updated as new information comes to light, I suggest including a link back to it if you use any part of it.
1Tatjna on Jul 10, 2009 at 3:20 pm:
Thank you. That answered a lot of the questions I had about the issue.
2Jevon on Jul 11, 2009 at 5:00 pm:
Some other questions:
1. When was this originally proposed?
2. How was this approach made legal? Was there a bill passed? Or has the department always had the opportunity to filter the Internet?
Thanks!
3Jevon on Jul 11, 2009 at 5:02 pm:
I read through the answers again and realised my questions were already answered… oops ;)
4thomas on Jul 12, 2009 at 9:03 pm:
Jevon – we’re fast and efficient that way! :)
5Dave Lane on Jul 13, 2009 at 10:45 am:
When will the registering of web requests (as per “What happens if I go to a banned site?”) be expanded to include registering people’s web addresses (a hugely flawed way of identifying an individual) for the purposes of supporting accusations of copyright infringement a la Section 92a? Surely, DIA won’t just use this to prevent access to child pornography – the government has to pander to the big, obsolete-but-still-influential media establishment to appease the US for ACTA and an FTA, right?
Also, has anyone worked out the cost of this system to the next tiers of ISPs besides the handful of big ones out there?
Dave
6nz anonymouse on Jul 13, 2009 at 3:26 pm:
Are there any plans to make the end users liable for going through the filter? I mean .. will it be illegal to try to bypass it through a remote unfiltered proxy? I understand that under the current technical setup such a use won’t be detectable, but in theory if DIA somehow finds out, would the user be prosecuted for circumventing the censorship?
7thomas on Jul 13, 2009 at 4:53 pm:
Re: circumvention.
The advantage of the current approach for the DIA is that they haven’t had to get a law passed to implement it. The disadvantage of the “no law” approach is that it’s not illegal to circumvent the filter.
On the other hand, it might ruin your “I only saw the website by accident!” argument. :-)
8Freedom on Jul 14, 2009 at 8:15 am:
Is this a sensitive topic for Kiwis considering their sheep stigma? I’m not even quite sure how the government is thinking this is a good idea! Hasn’t anyone learned from the Chinese, or Cuban censoring? I didn’t know New Zealand was a Fascist nation. :(
-Freedom
9anonymous while I still can be on Jul 15, 2009 at 2:28 am:
“The only way to check whether the website is filtered is by attempting to access it.”
“Your internet address will be logged. This will be able to be tracked back to your internet account.”
“Whether the details of requests to filtered sites will be given to law enforcement is awaiting clarification from the Department of Internal Affairs.”
Finally, the NZ government has realized the best way to govern its populace is through the fear of arbitrary penalties and discretionary enforcement. The passage of laws by an elected representative government is overrated anyway.
10Charles on Jul 15, 2009 at 12:06 pm:
- Freedom, if NZ is a fascist nation then we’re a fascist nation with a former MP’s who is transsexual and a cabinet minister who is openly gay (both in the former labour govt.) which isn’t really all that fascist if you thought about the accusation for even a moment.
- thomas, there was a law. Read “Has an internet filtering law been passed?” which states “it is being done under the Films, Videos, and Publications Classification Act 1993. This gives the responsibility for enforcement to the Department of Internal Affairs.”.
I do foresee some problems such as:
[1] when an NZ ISP moves to IPV6 which isn’t supported by the filtering and
[2] a BGP failure at the DIA will kill access to the non-banned sites that use the same IPs as the banned sites (and most LAN/WAN technicians know what happens when BGP dies) and
[3] *If* identities of users is passed to the police when you visit a banned site there is currently no way to find out before hand if a site is banned except to visit the site (without messing around with UDP and traceroutes).
– If WikiLeaks is ever banned, then we the DIA is corrupt.
11Martin on Jul 15, 2009 at 3:05 pm:
Errr what does Facism have to do with transsexuals or homosexuality? I think its you who needs to do some reading Charles….
12annon on Jul 16, 2009 at 8:13 am:
“DIA’s Censorship Compliance Unit has developed a list of over 7000 sites containing child pornography. If true, this is an interestingly large figure, being about five times the size of the block list maintained by the UK’s Internet Watch Foundation,..”
http://www.theregister.co.uk/2009/07/15/big_nz_blocklist/
Sort of gotta wonder what else they are ‘blocking’??
13Ryansway on Jul 17, 2009 at 8:07 am:
While we deplore the existence of sites such as those the DIA intends to “filter for us”, we also deplore the fact that the matter hasn’t been thrown in for public debate.
But if it’s voluntary then users can vote with their feet. And in today’s competitive climate, it wouldn’t be a surprise if one of the bigger ISP’s “held-out”, which is probably why Yodafone and Telecrumb didn’t participate in the trial scheme – one wouldn’t trust the other to go through with it and the repercussions for the one who did “could be quite serious”.
We would switch ISP’s if one implemented the filter… and the other didn’t, and that’s the problem they’ll need to consider.
We also think there are other serious crimes going on in this country that deserve more funding and the Government needs to get its priorities straight before wasting money on a system a majority of the public will not receive favorably. This will ultimately become a political hot potato, and when the scheme becomes a victim of public opinion, that’s 150k flushed down the toilet on a long shot.
14Mark on Aug 13, 2009 at 1:19 am:
“The DIA say that the filter will not be used for law enforcement.”
“The Department of Internal Affairs has refused to release the list of banned sites. They claim that they are allowed to do so under section 6 (c) of the Official Information Act. This allows them to refuse on the grounds that the release would be ?likely to prejudice the maintenance of the law, including the prevention, investigation, and detection of offences, and the right to a fair trial?.”
Does anyone else see the inconsistency here?