How the Belgian Firewall would block naked woman

This week, there has been quite some controversy around the "Great Belgian Firewall". This post clarifies to non-technical people what is going on and what is going wrong.

The website www.stopkinderporno.com is no longer available in Belgium. A court has ordered all ISP's to redirect the traffic to the site to a page from the FCCU. The court order was the result of a case where the website was accused of publishing names and address data of pedophiles. It has been suggested that the judge could have been wrong in assuming that this website published illegal content, but let's not discuss that here.

The Naked Woman

To make it clear to non-technical people what happened, we will compare the publication of illegal data on a website with a naked woman in the street. This is my street, as seen through the window of my house:


Now suppose a naked woman would be standing in the middle of the street:

(naked woman picture used under cc license from clickfarmer)

You would think that the police would remove her, bring her into court and have her convicted by a judge. So far so good. A logical sentence would be to order the woman to wear clothes in public and, if she doesn't comply, remove her from the street.

But what happened in the case of the Great Belgian Firewall is this:

Instead of removing the woman from the street, the court ordered that stickers should be applied to all windows that give a view on the naked woman. This is illogical for a number of reasons:

• it is *my* window, so the police should not be putting stickers on it
• if I wanted to take a peek at the naked woman, I could just take one step to the side so the sticker isn't blocking my view anymore
• if more naked women show up, my window will soon be filled with stickers

Technology of DNS blocking

The technical implementation of how the Great Belgian Firewall has blocked the offending website was through DNS. DNS is the system that translates domain names like www.google.com to the physical number that identifies the server of Google.
Now, if people would mess with the DNS this could lead to dangerous situations. You could for example surf to the website of your bank and end up on the website of a hacker trying to steal your password.
There are alternative DNS servers, like the free and open servers of www.opendns.com. If you want to circumvent the Great Belgian Firewall, you can easily reconfigure your computer to use those servers instead of the servers of your ISP. The Belgian legal system has no jurisdiction over the OpenDNS servers. It is the duty (and part of the service agreement) of ISPs to offer you a reliable, secure and not-tampered-with DNS server. If you don't trust your ISP anymore, you can freely switch to OpenDNS.

The problem

We have illustrated that DNS is not a good way to fight internet crime. But it is a very effective way to censor the internet. Various countries like China and Thailand already use (or abuse) the DNS system to prevent people from accessing information that their government feels is not good for them.
The problem with the Great Belgian Firewall is that the incident with www.stopkinderporno.com has demonstrated that an agreement is in place between the Belgian ISP's and the Belgian Police to block websites that are not wanted by the FCCU (Belgian's internet police).
This illustrates that our government can and will censor websites they do not like. This is bad for freedom of speech and bad for democracy. It gives me a very strange feeling that the difference between Belgium and China is just the number of websites they currently block.

There can only be 1 conclusion: "Don't mess with the DNS!"

ps: if you have the impression that my letterbox is crooked, it is