Sites blocked by Cyber Sentinel

8/2/2000
Bennett Haselton, bennett@peacefire.org

The following sites were found to be blocked by Cyber Sentinel on August 1, 2000, in about an hour of ad-hoc experimentation. Cyber Sentinel is published by Security Software Systems, but no free trial version is available; we used version 2.0 of the software purchased and downloaded from DigitalRiver.com, then installed on a Windows 98 machine. (The exact version number of the cybersentinel.exe file was 2.00.0001.)

Cyber Sentinel does not come with a built-in list of blocked sites; it scans every page for certain keywords, and only blocks the page if one of those keywords is present. (Some of the pages we tested, such as news sites, have content that changes hourly, so at any time they might be blocked or unblocked depending on the current content.)

The list of keywords is not intended to be viewable or editable by the parent, but the words are stored in cleartext inside the file "lb32cs2.dll", which is installed by Cyber Sentinel. The file contains 345 words and phrases that are enabled by default, such as "STRIP SHOW", "PENTHOUSE PET" and "PORN". The lb32cs2.dll file also contains another 61 words and phrases that are enabled if you turn on the "child predator library", which is described as follows in the Cyber Sentinel help file:

Our child predator library is a feature that was developed in conjunction with several law enforcement agencies. The phrases used in this library are taken from actual on-line investigations. If predators are a concern, simply enable the child predator library.
The "child predator library" includes words and phrases such as "DO YOU HAVE A PIC", "DESCRIBE YOURSELF" and "CAN I CALL YOU".

If Cyber Sentinel detects any of the enabled "trigger" words on a page, it will block the page and capture the screen by default. This method is described by Cyber Sentinel as the "Advanced Recognition Engine":

At the core of the technology is an advanced recognition engine developed by Security Software Systems engineers (patent pending). This proprietary engine is very fast, very low overhead, and is very accurate. --http://securitysoft.com/cybersentinel.html

In the screen captures that we collected, Cyber Sentinel also tells the administrator what word it was in the text of the page that caused the page to be blocked. The page does not actually get blocked and captured until the "trigger" word appears on the screen, so if you are viewing a long page with the word porn in the second half of the page text, the page will not get blocked until you scroll down far enough so that the word porn is visible. Cyber Sentinel is also triggered if one of the keywords appears in a non-Internet application, e.g. by opening Notepad or Microsoft Word and typing the word porn.

Cyber Sentinel also does not appear to block on partial word matches, so pages containing the word porn will be blocked but pages containing the word pornography might not be. (However, this feature did not appear to be consistent, as sites were sometimes blocked due to "partial word" matches -- e.g. the Ontario Center for Religious Tolerance page on Where Science and Religion Overlap was blocked due to the presence of the word "prostitutes", but Cyber Sentinel listed the trigger word as "prostitute".)

General observations

The word porn on Cyber Sentinel's "trigger list" is responsible for many news and political sites being blocked, because news sites prefer short words in the titles of their stories, thus using "porn" instead of "pornography". This makes it almost impossible to look up news stories on censorship-related topics like "COPA". Also, the software does not have any ability to recognize a word in context, e.g. blocking the word "cum" but letting it through if it appears in the phrase "cum laude". (Since this feature is missing, the biographies of two COPA Commission members were blocked because they graduated "magna cum laude".)

The blocking methodology -- block a site if a word appears on the page -- is the most simplistic method possible, and probably does not warrant a sophisticated-sounding name like "Advanced Recognition Engine". It also belies the company's claim that "Cyber Sentinel is the most advanced Internet filtering software package available today," although such hyperbole is common in marketing.

Blocked sites

(The images shown here are "screen capture" reports presented by Cyber Sentinel after blocking a site. So, in fact, the images here are screen captures of screen captures.)

http://www.cnn.com/
The CNN.com site was blocked because of an article linked from the front page, titled "Naples museum exposes public to ancient erotica". Cyber Sentinel listed the trigger word as "EROTIC" because of the word "erotic" in the URL.






http://search.hotwired.com/search97/s97.vts?Action=FilterSearch&Filter=docs_filter.hts&
ResultTemplate=news.hts&Collection=news&QueryMode=Internet&Query=censorship

Wired.com search for "censorship".
A search on Wired.com for articles containing the keyword "censorship" brought up an article titled "Feds Try Odd Anti-Porn Approach"; the title of this article on the search results page, caused the page to be blocked. Cyber Sentinel listed the trigger word as "PORN".






http://news.cnet.com/news/search/results/1,10199,0-1002,00.html?tag=st%2Ene%2E1002%2Esbsr&qt=COPA&cn=&ca=1002
CNet's News.com search for "COPA"
The search result listing was blocked because of the first listed article, titled "Appeals court rules against Net porn law". Cyber Sentinel listed the trigger word as "PORN".






http://search.hotwired.com/search97/s97.vts?Action=FilterSearch&Filter=docs_filter.hts
&ResultTemplate=news.hts&Collection=news&QueryMode=Internet&Query=COPA

Wired.com search for "COPA". The page was blocked because of the description of the first listed article, "Court Says Anti-Smut Law Illegal" (the first words in the description are "Pornophiles, rejoice!"). Cyber Sentinel listed the trigger word as "PORN".






http://www.lycos.com/cgi-bin/pursuit?matchmode=and&cat=usatoday&query=COPA
USAToday.com search for "COPA".
The search results page was blocked because of the title of the first listed article, "Back to court for Net porn law". Cyber Sentinel listed the trigger word as "PORN".






http://www.time.com/time/search/venue/1,3990,time,00.html?venue=time&summaries=yes&search_type=simple&all_words=COPA&x2.x=17&x2.y=8
Time Magazine search for "COPA".
The search results page was blocked because of the title of the last listed article, "Will the Latest Net Porn Law Pass Constitutional Muster?". Cyber Sentinel listed the trigger word as "PORN".






http://www.religioustolerance.org/sci_rel.htm
"Where Science and Religion Overlap"
An essay on the historical conflicts between science and religion. From the Ontario Center for Religious Tolerance, a Toronto-based group promoting religious freedom as a human right; all or parts of their site have been blocked by other blocking programs.






http://www.aclu.org/news/2000/n073100b.html
An ACLU press release:
"Calls for Arrest of Openly-Gay GOP Convention Speaker Reveal Danger of Sodomy Laws Nationwide"
Released on the day before openly gay congressman Rep. Jim Kolbe (R-AZ) was scheduled to speak at the Republican National Convention, while several right-wing groups were calling for his arrest on the grounds of his sexual orientation. Cyber Sentinel listed the trigger phrase as "ANAL SEX".






http://www.afa.net/
The American Family Association.
This extremely conservative group was blocked due to the phrase "The current administration and the Justice Department have been good to the porn industry." Cyber Sentinel listed the trigger word as "PORN".






http://www.copacommission.org/commission/balkam.shtml
Biography of COPA Commission member Stephen Balkam. Cyber Sentinel listed the trigger word as "CUM" because of the phrase "Stephen has an honors degree (magna cum laude)".






http://www.copacommission.org/commission/hughes.shtml
Biography of COPA Commission member Donna Rice-Hughes.
an article linked from the front page, titled Cyber Sentinel listed the trigger word as "CUM" because of the phrase "[Miss Hughes] graduated Magna Cum Laude and Phi Beta Kappa".






http://www.copacommission.org/papers/
A list of research papers submitted to the COPA Commission as evidence in their hearings. The page was blocked because of the title of the first listed paper: "Dangerous Access, 2000 Ed: Uncovering Internet Porn in America's Libraries", by David Burt of N2H2. Cyber Sentinel listed the trigger word as "PORN".






http://www.protectkids.com/
Home page for the book "Kids Online: Protecting Your Children in Cyberspace", by COPA Commission member Donna Rice-Hughes. The page was blocked due to the table of contents listing "Appendix D: Porn on the Net". Cyber Sentinel listed the trigger word as "PORN".