An internet filter that blocks child sexual exploitation imagery from entering New Zealand stopped working for two months, allowing access to images and videos of abuse from banned sites.
Since the two-month outage last year, the Digital Child Exploitation Filter has failed on two other occasions, allowing access to onlinechild sex abuse material.
The failure of the filter emerged in Herald inquiries into our national approach to detecting, investigating, preventing and prosecuting online child sexual exploitation.
The investigation has also raised questions about our national approach, as other Five Eyes countries focus their efforts on national centres of excellence.
New Zealand runs its detection and enforcement through three government agencies staffed by 35 people. We have no national strategy, instead relying on a model approach for nations devised by an international NGO.
The issue with the internet filter, overseen by the Department of Internal Affairs, emerged after the previous provider cut short a contract to provide the service through to July 2023.
The Department of Internal Affairs (DIA) was told on February 28 last year that NetClean would stop providing the filter and managed to negotiate an extension until July 31. With only a few months to go, the tender to find a new provider wasn't put out for bids until May 8.
Asked about the length of time between the contract being cancelled and the tender, DIA said a project team was set up to "clarify our requirements, decide the procurement process and ensure appropriate due diligence took place". Israeli tech firm Allot was awarded the contract on July 6.
Minutes of a meeting with the Independent Reference Group that oversees the filter revealed it was "not fully functional" until September 22. Over that time, website addresses containing child sex abuse material were not blocked.
DIA's digital safety director Jared Mullen told the oversight group that it hadn't been possible to estimate the risk of "extra harm to children" because of the failing filter. He did reveal to the reference group that there had also been outages under the previous provider.
"The short timeframe to get the new filter system implemented meant that DIA's standard implementation and testing protocols were constrained," said a spokesman. "This contributed to the performance issues experienced."
DIA confirmed there were subsequent outages to the filter in November 2020. In one case, scheduled maintenance at an ISP in the voluntary scheme meant it was disconnected from the filter for seven hours overnight. In another case, an ISP had a cable cut by a contractor and lost connection to the filter.
DIA's Digital Safety deputy director operations John Michael said the filter was "a really significant prevention tool" blocking access to sites with child abuse material.
On the two-month long issue, he said: "It means not all of the websites on that filter list were blocked. People could access certain sites if they chose to click on them."
Department of Internal Affairs deputy director of digital safety John Michael. Photo / Hagen Hopkins
The filter catches incoming web traffic and redirects users to a page where there are details of how they can seek help. Like referrals arrangements with Facebook and Pornhub, it is one of our few proactive, preventive measures.
Internal Affairs Minister Jan Tinetti said she had been told by DIA the new filter provider offered "greater resilience" than its predecessor.
A Waikato University 2017 doctoral thesis that investigated New Zealand's handling of online child sexual exploitation found it was technically impossible to block all child sex abuse material. Rather, it said the filter blocked those whose "curiosity" would lead them to breaking the law rather than those who were "knowledgeable and determined".
Details obtained from DIA through an Official Information Act request failed to show data on the operation of the filter, which has existed for a decade. DIA told the Herald it could not provide detailed data around how it sorted sites for inclusion in the filter.
Mullen said DIA began gathering this data in 2020, with 4003 websites checked by its child exploitation team, of which 359 were added to the filter.
In 2021, the proportion of those sites added to the filter rose substantially to March 31 after DIA changed its method of building the list of blocked sites, by adding those found in investigations or on the filter list the year before.
