French Govt. Wants to Inject Domain Blocking Lists Directly Into Web Browsers

A coordinated effort to associate online piracy with malware, identity theft and banking fraud, is well underway. As a result, legislation beyond copyright infringement is likely to play a key role in tackling piracy moving forward. The French government's current plan for tackling online harms envisions state-operated domain blocking lists being injected directly into web browsers to prevent fraud. It's a well-intentioned move but will not stop there.

For responsible adults with decades of experience from which to draw their own conclusions, the idea that adults we have never met have the power to govern our online activities is a borderline insult.

Of course, governments have a responsibility to protect all, so for every person who gets upset at politicians poking around in their private business, theory suggests there should be others who stand to benefit from whatever intervention is currently under discussion. And as responsible adults, that is taken into consideration.

The looming problem is that once ‘protection measures’ are put in place for even the most well-intentioned reasons, they are usually there to stay and always vulnerable to mission creep. If the wrong government somehow gains power, outright abuse can never be ruled out. In the meantime, others may claim entitlement to protection too, through the courts if necessary.

Developed by UK ISP BT at an estimated cost of £500,000, the Cleanfeed content-blocking system was launched in 2004 with the stated aim of preventing access to child abuse material. For most people in society, that was considered a positive move but just a few years later, the very existence of Cleanfeed was seen as an opportunity.

In an effort to suppress Usenet indexer Newzbin, Hollywood studios sought and won an injunction that compelled BT to use Cleanfeed to block the site, with the studios admitting that the company was targeted because it had the tools in place to implement blocking. In June 2023 alone, over 850 new entries appeared on UK ISPs’ blocklists.

French Government Says it Wants to Protect

The French government’s drive to prevent children from accessing pornographic content online is well-documented. Few disagree that widely available and openly accessible ‘tube’ sites are unsuitable for minors, but in a world where parental responsibility is considered old-fashioned, not to mention ineffective, France believes that legislation is the only way to protect the country’s children.

In parallel the government is on the verge of passing new law that aims to protect adults from the dangers of online fraud. Given the scale of the problem and law enforcement’s lacking response globally, what could possibly be wrong with that? According to Mozilla, the people behind the Firefox browser, almost nothing – if it’s done properly, at least.

France Demands “Dystopian Technical Capability”

“In a well-intentioned yet dangerous move to fight online fraud, France is on the verge of forcing browsers to create a dystopian technical capability,” Mozilla reported this week.

“Article 6 (para II and III) of the SREN Bill [below, translated] would force browser providers to create the means to mandatorily block websites present on a government provided list.”

Attachment 66453

“While motivated by a legitimate concern, this move to block websites directly within the browser would be disastrous for the open internet and disproportionate to the goals of the legal proposal – fighting fraud,” Mozilla continued.

“It will also set a worrying precedent and create technical capabilities that other regimes will leverage for far more nefarious purposes. Leveraging existing malware and phishing protection offerings rather than replacing them with government provided, device level block-lists is a far better route to achieve the goals of the legislation.”

Of course, major browsers currently make use of Google’s Safe Browsing system, which alerts visitors to flagged sites that there could be trouble ahead. Users can continue to those sites if they so wish, but Mozilla warns that the language in the current proposal is focused on website blocking and contains nothing to ensure privacy or prevent the blocking system being used for other purposes.

“Forcing browsers to create capabilities that enable website blocking at the browser level is a slippery slope. While it might be leveraged only for malware and phishing in France today, it will set a precedent and create the technical capability within browsers for whatever a government might want to restrict or criminalize in a given jurisdiction forever,” Mozilla warns.

“If it successfully passes into law, the precedent this would set would make it much harder for browsers to reject such requests from other governments,” the not-for-profit foundation concludes.

And not just requests from governments either. In 2023, it seems like everyone wants something blocked. Having a system already in place won’t make that any more difficult, nor will it deal with the source of the problem.