Home / Blogs

Protecting Intellectual Property is Good; Mandatory DNS Filtering is Bad

Paul Vixie

It has been about six months since I got together with four of my friends from the DNS world and we co-authored a white paper which explains the technical problems with mandated DNS filtering. The legislation we were responding to was S. 968, also called the PROTECT-IP act, which was introduced this year in the U. S. Senate. By all accounts we can expect a similar U. S. House of Representatives bill soon, so we've written a letter to both the House and Senate, renewing and updating our concerns.

Please note that my co-authors and I are all strong advocates for individual property rights and for that matter we're all copyright owners ourselves. We don't think that "content wants to be free". The parts of the proposed legislation that target online advertising and payment networks are solid work and will have a positive impact. But the part describing how ISP's would filter their DNS results according to lists of bad domains maintained by the U. S. Gov't is a bad idea — it won't have much of an effect on counterfeiting or infringement online but it would surely create a lot of new problems — especially with DNSSEC.

I am especially concerned about the growing number of off-shore DNS services promising free, clean, unfiltered results. The letter below references three such services and our white paper from May 2011 predicted this exact outcome. I think it's now obvious to everybody that there will be dozens or hundreds of "pirate-friendly DNS" services if S. 968 or anything like it becomes law. This would multiply the online perils faced by Internet end users in the United States, as well as mooting the new law.

Let's stop online infringement and counterfeiting, but let's do it sensibly — in a way that works and which won't create new and worse problems.

Internet Engineers' Letter in Opposition To DNS Filtering Legislation PDF, October 12, 2011

Update: ISC is hosting a webinar on this topic on October 26. Domestic ISP's and ASP's should plan to attend. Any interested party is of course welcome.

By Paul Vixie, CEO, Farsight Security. More blog posts from Paul Vixie can also be read here.

Related topics: Censorship, DNS, DNS Security, Internet Governance, Policy & Regulation

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

A hearty "+1" Jothan Frakes  –  Oct 14, 2011 1:32 AM PST

This legislation in and around clamping via DNS at the ISP level is obtuse to how the system works when combined with the human spirit. 

This article about blockaid.me, a new workaround for any government seized domains, illustrates how thin the premise of any real value the legislation might deliver.

It is unlikely to be much other than a minor nuisance to the true 'perps' that the legislature will create.

My concern has always been that a workaround might come in the form of rogue recursive DNS servers being provided to people as a means to mitigate the clampdown their ISP may have made.

Users are still able to override their DNS settings per computer or even per router at the home or enterprise.  Often this might be teens editing their parents machine or one at school.

Once someone can answer DNS authoritatively for every lookup, they can fairly well change ANY site, intercept email or other traffic, disrupt antivirus autoupdates and other bad things.

This is another of the many scenarios that illustrate how the 'cure' can create more problems than the disease.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Domain Name .Africa Faces Hurdles - Q&A with Sophia Bekele

Join Paul Vixie & Robert Edmonds at the Upcoming Distinguished Speaker Series

LogicBoxes Announces Automation Solutions for ccTLD

3 Questions to Ask Your DNS Host About DDoS

Introducing Our Special Edition Managed DNS Service for Top-Level Domain Operators

Afilias Director Wins ICANN's 2014 Leadership Award

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

The Latest Internet Plague: Random Subdomain Attacks

Digging Deep Into DNS Data Discloses Damaging Domains

DotConnectAfrica Contributes at the 9th IGF in Istanbul, Turkey

Nominum Announces Future Ready DNS

Video Interviews from ICANN 50 in London

ICANN London Recap Webinar

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

Neustar to Launch usTLD Stakeholder Council

Sophia Bekele Weighs in on Obama's August US-Africa Leader Summit at the NYF Africa

Dyn Acquires Internet Intelligence Company, Renesys

DotConnectAfrica's Expert Selected to Attend the Hague Institute of Global Justice

DotConnectAfrica Delegates Attend the KHRC Internet & Human Rights Breakfast Roundtable in Nairobi

Introducing getdns: a Modern, Extensible, Open Source API for the DNS

Sponsored Topics

Verisign

Security

Sponsored by
Verisign
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
Afilias

DNS Security

Sponsored by
Afilias
dotMobi

Mobile

Sponsored by
dotMobi