Court ponders Web site-blocking law

Although the law is only a Pennsylvania state statute, it has an international reach. When the Pennsylvania attorney general used it to force MCI to ban access to some sites with suspected child pornography, the company said it had no choice but to block those Internet addresses for all of its North American subscribers.

Two nonprofit groups, the Center for Democracy and Technology (CDT) and the American Civil Liberties Union (ACLU), filed suit against Pennsylvania in September. Their lawsuit claims that the state law's "secret censorship orders" have led to more than 1 million Web sites blocked, nearly all featuring legal material.

"The reason we're looking at this law is that it was at one point seen as a model law by several different states," said Ari Schwartz, CDT's associate director. "We were concerned that this would spread and become a model for blocking content." CDT sent one of its lawyers to testify against a similar proposal in the Maryland House of Delegates last March and says Oklahoma and some national legislative groups have considered the same approach.

CDT and ACLU lawyers have asked U.S. District Judge Jan DuBois to declare the law unconstitutional and bar Pennsylvania from invoking it again. The hearing before DuBois, which begins Tuesday, is expected to last two or three days.

Immediately after being sued in September, Pennsylvania Attorney General Mike Fisher agreed to stop sending additional secret orders while the case was in progress. In December, Fisher resigned to become a federal appeals court judge, and Gerald Pappert replaced him as the state's acting attorney general.

Sean Connolly, a spokesman for the attorney general, called the lawsuit's claim of 1 million sites blocked "an exaggeration...If a million legitimate sites were being blocked, we think we would have heard about that."

"We will defend the state law against this challenge," Connolly said. "This is a law passed by the general assembly to protect children. We believe it has worked in Pennsylvania, and we're prepared to defend it."

Fisher had sent at least 500 letters to Internet service providers, ordering them to cordon off specific child porn sites. In an October deposition, America Online said one letter from Fisher led to the blocking of 400,000 unrelated Web sites and that a second led to blocking tens of thousands of Web sites About.com hosts. In another deposition the same month, a Verizon Communications executive said one letter from Fisher led to "upward of 500,000" Web sites being blocked.

The reason so many legitimate sites were blocked is due to the way the Internet is designed. The original version of the Hypertext Transfer Protocol (HTTP) required each Web site to have its own Internet address, which maps domain names like cnet.com to numeric values such as 206.16.0.29. In response to an apparent shortage of addresses, HTTP 1.1 in 1999 permitted each Internet address to host an arbitrary number of Web domains.

That practice of address sharing means that one censorship order can affect thousands of other innocuous Web sites. A February 2003 study from Harvard University's Berkman Center for Internet & Society suggested that Yahoo hosted 74,000 Web sites at one address; Tucows used one address for 68,000 domains; and Namezero.com pointed 56,000 domains to one address. "More than 85 percent of active domain names are found to share their Web servers with one or more additional domains," the study said.

In a brief it filed last month, Pennsylvania said the ACLU and CDT do not have any reason to sue and asked DuBois to throw out the case. The notices do not "intentionally restrain any constitutionally protected speech," the state said. "ISPs can disable access to child pornography items likely to be identified in defendants' notices without disabling access to any significant amount of legitimate speech."

"A URL is neither a person nor a real forum nor a limited commodity," Pennsylvania said. "It is a little string of letters and numbers that acts as a superficial label. URLs are infinite in quantity. Even complete retirement of one will not diminish speech. Speech can always find another URL, and probably (one) pretty close to the out-of-commission string. The new URL will be in the same cyberspace, accessible in the same physical places, as the retired URL."

The Pennsylvania state law in question, which took effect in 2002, permits the attorney general to seek a court order that forces ISPs to block access to the Internet Protocol address of sites that are suspected of featuring child pornography. Instead of relying on a formal order, Fisher instead sent out hundreds of "informal" notices that direct Internet providers to block access to suspected child porn.

Two CDT and ACLU witnesses, Laura Blain, Webmaster for the Pennsylvania Alliance for Democracy, and Mitchell Marcus, a professor of computer science at the University of Pennsylvania, testified against the law on Tuesday. Blain described how two of her clients, a community recreation center and a school, found their Web sites blocked by an order the attorney general's office sent to Dallas, Pa.-based Epix Internet services.

CDT and the ACLU plan to call two of the attorney general's staff as hostile witnesses on Wednesday, to prove that the law is unnecessary, because Pennsylvania could remove child porn by contacting the hosting service directly.

"We believe the attorney general could contact the Web host directly and get the content taken down from the entire Internet as opposed to one ISP's customers," CDT attorney John Morris said. "We believe there's a proven successful method that is far more effective without risking any innocent, blocked sites."