Subject: [hrpc] Case one: Status code 451

From: Corinne Cath <[email-masked]>
Date: Tue, 19 Jan 2016 21:03:03 +0000

​As promised, case number 1. ​

*Status Code 451*

Every Internet user has run into the ‘404 Not Found’ Hypertext Transfer
Protocol (HTTP) status code when trying, and failing, to access a
particular website. It is a response status that the server sends to the
browser, when the server cannot locate the URL. ‘403 Forbidden’ is another
example of this class of code signals that gives users information about
what is going on. In the ‘403’ case the server can be reached, but is
blocking the request because the user is trying to access content forbidden
to them. This can be because the specific user is not allowed access to the
content (like a government employee trying to access pornography on a
work-computer) or because access is restricted to all users (like social
network sites in certain countries).
As surveillance and censorship of the Internet is becoming more
commonplace, voices were raised at the IETF to introduce a new status code
that indicates when something is not available for ‘legal reasons’ (like
censorship):

The [451 status] code would allow server operators to operate with greater
transparency in circumstances where issues of law or public policy affect
their operation. This transparency may be beneficial both to these
operators and to end-users  (Bray 2012:3).

The status code would be named ‘451’, a reference to Bradbury’s famous
novel on censorship. In practice the code would look like this:

Figure 5. Status code 451 (Source: Website Bray, author of the 451-status
code ID)

During the IETF meeting in Dallas, there was discussion about the
usefulness of ‘451’. The main tension revolved around the lack of an
apparent machine-readable technical use of the information. The extent to
which ‘451’ is just ‘political theater’ or whether it has a concrete
technical use was heatedly debated. Some argued that ‘the 451 status code
is just a status code with a response body’ others said it was problematic
because ‘it brings law into the picture’ [1] . Again others argued that it
would be useful for individuals, or organizations like the ‘Chilling
Effects’ project, crawling the web to get an indication of censorship (IETF
discussion on ‘451’ – author’s field notes March 2015).

There was no outright objection during the Dallas meeting against moving
forward on status code ‘451’, and on December 18, 2015 the Internet
Engineering Steering Group approved publication of "An HTTP Status Code to
Report Legal Obstacles". It is still in the process of becoming an RFC, but
could effectively be used from the day of approval.

What is interesting about this particular case is that not only technical
arguments but also the status code’s outright potential political use for
civil society played a substantial role in shaping the discussion, and the
decision to move forward with this technology.

[1]  http://tools.ietf.org/wg/httpbis/minutes?item=minutes-92-httpbis.html,
discussions on 451 at IETF 92 in Dallas

---

From: Joss Wright <[email-masked]>
Date: Tue, 19 Jan 2016 21:50:59 +0000

I've always been confused by the proposals for status code 451, as it's always
seemed to me largely pointless, apart from the political message sent by the
existence of the code, for a server to respond with an error code for
censorship, as the vast majority of internet filtering occurs in the network
rather than at the server itself.

(Servers with resources blocked by China's Golden Shield, for example, don't
have the opportunity to send a code -- they simply never receive the requests.
Obviously the filtering system is unlikely to inject a 451 itself. Even for
those states that do choose to notify users of blocked content, such as Qatar,
that doesn't seem appropriate for a 4xx series status code.)

It only seems to make sense in situations where a server operator has been
ordered to remove hosted content, or not to serve it to particular classes of
user. As I've not been part of the discussion, I'm interested as to whether that
has been the stated purpose of the code?

Joss

On Tue, Jan 19, 2016 at 09:03:03PM +0000, Corinne Cath wrote:
> Protocol (HTTP) status code when trying, and failing, to access a particular
> website. It is a response status that the server sends to the browser, when
> the server cannot locate the URL. ‘403 Forbidden’ is another example of this
> class of code signals that gives users information about what is going on. In
> the ‘403’ case the server can be reached, but is blocking the request because
> the user is trying to access content forbidden to them. This can be because
> the specific user is not allowed access to the content (like a government
> employee trying to access pornography on a work-computer) or because access is
> restricted to all users (like social network sites in certain countries).  As
> surveillance and censorship of the Internet is becoming more commonplace,
> voices were raised at the IETF to introduce a new status code that indicates
> when something is not available for ‘legal reasons’ (like censorship):
> 
> their operation. This transparency may be beneficial both to these operators
> and to end-users  (Bray 2012:3).
> 
> The status code would be named ‘451’, a reference to Bradbury’s famous novel
> on censorship. In practice the code would look like this:
> 
> 
> 
> Figure 5. Status code 451 (Source: Website Bray, author of the 451-status code
> ID)
> 
> During the IETF meeting in Dallas, there was discussion about the usefulness
> of ‘451’. The main tension revolved around the lack of an apparent
> machine-readable technical use of the information. The extent to which ‘451’
> is just ‘political theater’ or whether it has a concrete technical use was
> heatedly debated. Some argued that ‘the 451 status code is just a status code
> with a response body’ others said it was problematic because ‘it brings law
> into the picture’ [1] . Again others argued that it would be useful for
> individuals, or organizations like the ‘Chilling Effects’ project, crawling
> the web to get an indication of censorship (IETF discussion on ‘451’ –
> author’s field notes March 2015).
> 

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

-- 
Dr. Joss Wright | Research Fellow 
Oxford Internet Institute, University of Oxford
http://www.oii.ox.ac.uk/people/?id=176

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 19 Jan 2016 22:06:17 +0000

> has been the stated purpose of the code?

I wasn't very active in this myself but some people with whom I
chatted were convinced by the fact that 451 allowed for automation.
For example if you get a 451 response a UA might be able to
re-try the request via some other n/w path. Similarly, a crawler
might be able to correlate the places in which one gets a 451
and produce e.g. useful statistics or maps.

S.

---

From: Joss Wright <[email-masked]>
Date: Tue, 19 Jan 2016 22:18:04 +0000

On Tue, Jan 19, 2016 at 10:06:17PM +0000, Stephen Farrell wrote:
> > I've always been confused by the proposals for status code 451, as it's
> > always seemed to me largely pointless, apart from the political message sent
> > by the existence of the code, for a server to respond with an error code for
> > have the opportunity to send a code -- they simply never receive the
> > requests.  Obviously the filtering system is unlikely to inject a 451
> > itself. Even for those states that do choose to notify users of blocked
> > content, such as Qatar, that doesn't seem appropriate for a 4xx series
> > status code.)
> > 
> > ordered to remove hosted content, or not to serve it to particular classes
> > of user. As I've not been part of the discussion, I'm interested as to
> > whether that has been the stated purpose of the code?
> 
> I wasn't very active in this myself but some people with whom I chatted were
> convinced by the fact that 451 allowed for automation.  For example if you get
> a 451 response a UA might be able to re-try the request via some other n/w
> path. Similarly, a crawler might be able to correlate the places in which one
> gets a 451 and produce e.g. useful statistics or maps.

How would a UA get a 451, though, if it can't reach the server in the first
place due to network filtering? (This is a long-term and genuine confusion
regarding this proposal -- I really want to know if I'm missing something
obvious.)

> >> network sites in certain countries).  As surveillance and censorship of the
> >> Internet is becoming more commonplace, voices were raised at the IETF to
> >> introduce a new status code that indicates when something is not available
> >> for ‘legal reasons’ (like censorship):
> >>
> >> _______________________________________________ hrpc mailing list
> >> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
> > 
> >

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 20 Jan 2016 10:00:38 +1100

The major use case is on the Web server itself, not the network. E.g., Google, Github, Facebook, etc. are all constantly asked to censor content in various jurisdictions. 451 allows this to be easily discovered, e.g., by the Lumen Database. 

> On 20 Jan 2016, at 9:18 am, Joss Wright <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Jan 2016 11:26:53 +0100

ISPs who are ordered to block content could also serve this message,
right?

The arguments for this are AFAIK:

1. Transparency (reason for blocking, possibility to complain)
2. Measure-ability
3. Possibility for re-try via another path / trigger Tor, VPN, etc.

At 32C3 an argument was made that HTTP error code 451 would somehow
grant legitimacy to censorship. I do not agree with this argument, but
I think it's good to discuss this point.

Best,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9

On 01/20/2016 12:00 AM, Mark Nottingham wrote:
> The major use case is on the Web server itself, not the network. 
> E.g., Google, Github, Facebook, etc. are all constantly asked to 
> censor content in various jurisdictions. 451 allows this to be
> easily discovered, e.g., by the Lumen Database.
> 
> 
>>>> I've always been confused by the proposals for status code
>>>> 451, as it's always seemed to me largely pointless, apart
>>>> from the political message sent by the existence of the code,
>>>> for a server to respond with an error code for censorship, as
>>>> the vast majority of internet filtering occurs in the network
>>>> (Servers with resources blocked by China's Golden Shield,
>>>> for example, don't have the opportunity to send a code --
>>>> they simply never receive the requests.  Obviously the
>>>> filtering system is unlikely to inject a 451 itself. Even for
>>>> those states that do choose to notify users of blocked
>>>> content, such as Qatar, that doesn't seem appropriate for a
>>>> 4xx series status code.)
>>>> 
>>>> It only seems to make sense in situations where a server 
>>>> operator has been ordered to remove hosted content, or not
>>>> to serve it to particular classes of user. As I've not been
>>>> part of the discussion, I'm interested as to whether that has
>>>> been the stated purpose of the code?
>>> 
>>> I wasn't very active in this myself but some people with whom
>>> I chatted were convinced by the fact that 451 allowed for 
>>> automation.  For example if you get a 451 response a UA might
>>> be able to re-try the request via some other n/w path.
>>> Similarly, a crawler might be able to correlate the places in
>>> which one gets a 451 and produce e.g. useful statistics or
>>> maps.
>> 
>> How would a UA get a 451, though, if it can't reach the server
>> in the first place due to network filtering? (This is a long-term
>> and genuine confusion regarding this proposal -- I really want to
>> know if I'm missing something obvious.)
>> 
>>> 
>>> S.
>>> 
>>> 
>>>> 
>>>> Joss
>>>> 
>>>>> Every Internet user has run into the ‘404 Not Found’ 
>>>>> Hypertext Transfer Protocol (HTTP) status code when
>>>>> trying, and failing, to access a particular website. It is
>>>>> a response status that the server sends to the browser,
>>>>> when the server cannot locate the URL. ‘403 Forbidden’ is
>>>>> another example of this class of code signals that gives
>>>>> users information about what is going on. In the ‘403’ case
>>>>> the server can be reached, but is blocking the request
>>>>> because the user is trying to access content forbidden to
>>>>> them. This can be because the specific user is not allowed
>>>>> access to the content (like a government employee trying to
>>>>> access pornography on a work-computer) or because access
>>>>> is restricted to all users (like social network sites in
>>>>> certain countries).  As surveillance and censorship of the
>>>>> Internet is becoming more commonplace, voices were raised
>>>>> at the IETF to introduce a new status code that indicates
>>>>> The [451 status] code would allow server operators to
>>>>> operate with greater transparency in circumstances where
>>>>> issues of law or public policy affect their operation.
>>>>> This transparency may be beneficial both to these operators
>>>>> The status code would be named ‘451’, a reference to 
>>>>> Bradbury’s famous novel on censorship. In practice the
>>>>> code would look like this:
>>>>> 
>>>>> 
>>>>> 
>>>>> Figure 5. Status code 451 (Source: Website Bray, author of 
>>>>> the 451-status code ID)
>>>>> 
>>>>> During the IETF meeting in Dallas, there was discussion
>>>>> about the usefulness of ‘451’. The main tension revolved
>>>>> around the lack of an apparent machine-readable technical
>>>>> use of the information. The extent to which ‘451’ is just
>>>>> ‘political theater’ or whether it has a concrete technical
>>>>> use was heatedly debated. Some argued that ‘the 451 status
>>>>> code is just a status code with a response body’ others
>>>>> said it was problematic because ‘it brings law into the
>>>>> picture’ [1] . Again others argued that it would be useful
>>>>> for individuals, or organizations like the ‘Chilling
>>>>> Effects’ project, crawling the web to get an indication of
>>>>> censorship (IETF discussion on ‘451’ – author’s field notes
>>>>> March 2015).
>>>>> 
>>>>> There was no outright objection during the Dallas meeting 
>>>>> against moving forward on status code ‘451’, and on
>>>>> December 18, 2015 the Internet Engineering Steering Group
>>>>> approved publication of "An HTTP Status Code to Report
>>>>> Legal Obstacles". It is still in the process of becoming an
>>>>> RFC, but could effectively be used from the day of
>>>>> approval.
>>>>> 
>>>>> What is interesting about this particular case is that not 
>>>>> only technical arguments but also the status code’s
>>>>> outright potential political use for civil society played
>>>>> a substantial role in shaping the discussion, and the
>>>>> [1] 
>>>>> http://tools.ietf.org/wg/httpbis/minutes?item=minutes-92-httpbis.h
tml,
>>>> 
>>>> 
>>>> 
>>>>> _______________________________________________ hrpc
>>>>> mailing list [email-masked] 
>> -- Dr. Joss Wright | Research Fellow Oxford Internet Institute, 
>> University of Oxford http://www.oii.ox.ac.uk/people/?id=176
>> 
> -- Mark Nottingham   https://www.mnot.net/
>

---

From: Joss Wright <[email-masked]>
Date: Thu, 21 Jan 2016 10:59:58 +0000

On Thu, Jan 21, 2016 at 11:44:57AM +0100, Jeroen van der Ham wrote:
> Hi,
> 
> > On 19 Jan 2016, at 23:06, Stephen Farrell <[email-masked]> wrote:
> > 
> > convinced by the fact that 451 allowed for automation.  For example if you
> > get a 451 response a UA might be able to re-try the request via some other
> > n/w path. Similarly, a crawler might be able to correlate the places in
> > which one gets a 451 and produce e.g. useful statistics or maps.
> > 
> 
> To me this seems entirely the wrong argument to convince operators to use this
> status code.
> 
> My impression is that this would be used for content that is removed or
> blocked for legal reasons, for instance copyright infringement, gambling laws,
> child abuse, et cetera.
> 
> It then informs the user about the reason that content is no longer available,
> and perhaps also informs. It should also enlighten them about possible actions
> that could be taken, such as filing a complaint with the authorities. In any
> case it at least informs the user that this is not a technical problem.
> 
> Jeroen.

That makes a lot of sense. Mainly because the use of the 451 only seems to apply
in the more cooperative, legal version of content removal achieved through
requests to providers, rather than the adversarial blocking achieved by a
filtering entity on the network. Using it as a mechanism to provide automated
means to route around such legally-requested filtering seems like it would be
counterproductive.

Joss

---

From: Corinne Cath <[email-masked]>
Date: Fri, 22 Jan 2016 10:17:26 +0000

Dear all,

Thank you for your thoughtful comments and input. I have bunched them
together and added them to the original text. see below.

HRPC – work on 451, Middleboxes, DDoS

Status Code 451

During the IETF meeting in Dallas, there was discussion about the
usefulness of ‘451’. The main tension revolved around the lack of an
apparent machine-readable technical use of the information. The extent to
which ‘451’ is just ‘political theatre’ or whether it has a concrete
technical use was heatedly debated. Some argued that ‘the 451 status code
is just a status code with a response body’ others said it was problematic
because ‘it brings law into the picture’ . Again others argued that it
would be useful for individuals, or organizations like the ‘Chilling
Effects’ project, crawling the web to get an indication of censorship (IETF
discussion on ‘451’ – author’s field notes March 2015). There was no
outright objection during the Dallas meeting against moving forward on
status code ‘451’, and on December 18, 2015 the Internet Engineering
Steering Group approved publication of ‘An HTTP Status Code to Report Legal
Obstacles’. It is still in the process of becoming an RFC, but could
effectively be used from the day of approval.

​[new text]:​

​​
It is however important to note that 451 is not a solution to detect all
occasions of censorship. A large swath of Internet filtering occurs in the
network rather than the server itself. For these forms of censorship 451
plays a limited role, as the servers will not be able to send the code,
because they haven’t received the requests (as is the case with servers
with resources blocked by the Chinese Golden shield). Such filtering
regimes are unlikely to voluntarily inject a 451 status code. The use of
451 is most likely to apply in the case of cooperative, legal versions of
content removal resulting from requests to providers. One can think of
content that is removed or blocked for legal reasons, like copyright
infringement, gambling laws, child abuse, et cetera. The major use case is
thus clearly on the Web server itself, not the network. Large Internet
companies and search engines are constantly asked to censor content in
various jurisdictions. 451 allows this to be easily discovered, for
instance by initiatives like the Lumen Database. In the case of adversarial
blocking done by a filtering entity on the network 451 is less useful.

Overall, the strength of 451 lies in its ability to provide transparency by
giving the reason for blocking, and giving the end-user the ability to file
a complaint. It allows organizations to easily measure censorship in an
automated way, and prompts the user to access the content via another path
(e.g. TOR, VPNs) when (s)he encounters the 451 status code.

On Thu, Jan 21, 2016 at 10:59 AM, Joss Wright <[email-masked]>
wrote:

> chatted were

-- 

'The management of normality is hard work'

---

From: [email-masked]
Date: Fri, 22 Jan 2016 13:51:20 -0500

Isn't there also the possibility of use of 451 by proxy?

Much content is accessed on the web via search engines, indexes, web
page links, etc.

If, e.g., someone not subject to the censorship directly found one of
their link targets censored then rather than retain it as an
unresolvable link or remove it they could return a 451 on behalf of
the target. One would hope with a message indicating this.

This offers the possibility of quite a bit more use of 451 than by
those subject to censorship directly, usefully.

Obviously this could also be used misleadingly or even fraudulently
but "such is the web" as Abraham Lincoln is often quoted.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*