Pandora’s Blog

Found a very interesting piece on a UK website, PCPro.co.uk, that looks at parental control software and asks: does it work?

It’s a pretty good examination of the flaws inherent in trying to control young surfers… but what the article seems to ignore is that rather than trying to control with easily-maneuverable blocks and filters, parents can let kids roam free and hold them accountable if they know what their kids are doing.

The best and only way to keep your kids safe is by monitoring activity. Period. How can you argue against knowledge?

December 24, 2009
Does parental control software work?
Davey Winder exposes the strengths and weaknesses of parental control software – and how kids get around it…

Parental control software has been a part of online life since those heady early days when family-friendly service providers brought a ring-fenced internet experience to an eager public.

Along the way we’ve seen the development of standalone software, plugins for internet security suites, server-based filtering by ISPs, and even the addition of parental controls directly into Windows.

Yet, still a nagging doubt remains at the back of many parents’ minds: does any of it work? As children get online from ever-younger ages, and older kids frequently know more about computers than their parents, many products fail to provide the level of protection expected.

Parental security reviews
We get experts and teenagers to test four leading parental control packages

They’re often too restrictive or difficult to configure. Some parents even abdicate responsibility for looking after the parental control software to their children.

We’ve consulted parents, child-protection experts and software developers to find out how effective parental control software really is. And we’ve asked children aged between 11 and 16 to help us review four of the leading parental control packages to find out if they’re any safer than an open internet connection.

Know your enemy
Before you can understand how best to protect your child online, you need to know what threats they face. If your only metric is the media, you might be forgiven for thinking the internet is a paedophile paradise, with predatory behaviour the norm.

However, Dave Miles, director at the Family Online Safety Institute reminds us that while predation is perceived as the most challenging threat, “the reality is that cyber-bullying is probably a larger problem”.

Children used to be targeted outside school via email and chat; now social-networking sites have become the most popular route to online bullying.

A bully can create a page about a child, and others can join and add hurtful comments. “The speed, reach and relative anonymity that these groups achieve mean that their targets are subject to much greater intimidation and threat than old-style bullying,” said Rob Hopkins of software firm So Protect Me.

Cyber-bullying and peer pressure is also exerted through outlets such as the so-called “Pro-Anna” sites, which promote anorexia and extreme dieting. “Kids who don’t comply can be publicly ridiculed and intimidated, and suffer great distress,” Hopkins warns, leading to “serious physical and psychological consequences, in extreme cases resulting in suicide”.

And then we come to the type of threats that, perhaps understandably, get the tabloids overheated. “Flashing” is one such offence, according to the most recent Child Exploitation & Online Protection Centre (CEOP) strategic review, with children being incited to watch sexual acts accounting for a fifth of the grooming behaviour reported by under-18s.

It isn’t only the behaviour of others that parents need to worry about, as Lucinda Fell, policy and communications manager at Childnet International explains. “Very often now, we’re also seeing children and young people putting themselves and others at risk through their conduct online.”

When it comes to the posting of inappropriate information – everything from a home address to school attended at one end, through to nude images at the other – education is key. Younger children need the equivalent of a Green Cross Code to help them get across the internet. “The simple fact is that teaching about road safety works,” said Colin McKeown from E-Safe Education. “If parents take the same approach with their children and the internet, the risks should decrease.”

Parenting by programme
Abdicating parental responsibility to software clearly isn’t the solution, but that isn’t to say it can’t offer an additional layer of protection. The problem is knowing what the applications are, how they work and whether they’re effective.

Peter Mancer, managing director at Watchdog International has worked with governments and law-enforcement worldwide, advising on web filtering technology. He argues, “it is better to have a filtered connection from your ISP, as this will work on all devices on your home connection such as laptops, iPods and games consoles”.

Yet choosing an ISP on such merits isn’t an easy task, and Mancer admits you’ll still need additional software to deal with IM and social networks. “As there isn’t one solution that does it all, to be safe really needs specific solutions for specific issues,” he said.

So how does locally installed software – be that through your security suite, a standalone application or even operating system integration – actually work? Most apply a combination of white and blacklisting, category-based blocks, keyword analysis, program restrictions and time limits.

Mancer isn’t keen on whitelists, insisting it’s “impossible to keep up to date with new sites, so they end up being too restrictive”, although he does believe a good blacklist can be effective against pornography.

Any blocking needs to be implemented carefully, since it’s all too easy to fall into the trap of cutting off your child from their friends. No sensible parent would confine their child to the house because there are paedophiles in the outside world, yet otherwise rational parents will quite happily ban their teenage offspring from all access to instant messaging and social-networking sites, making them look foolish to their peer groups.

Greg Day, principal security analyst at McAfee, warns that category and application-based blocks are only as good as the organisation that supplies the controls. “If security software is to be effective, it must be constantly updated using real-time threat intelligence,” he said.

Meanwhile, Dan du Preez, education consultant with parental control publisher The Learning Bubble, warns that although application-based blocking has its place, it “can be bypassed by a child who is savvy enough if they know about multiprotocol IM clients or web-based clients”.

A better approach, and one adopted by dedicated chat monitoring services, is the use of contextual word-phrase detection to spot predatory behaviour such as grooming and “sexualisation” as it happens, and then alert parents via email. Such contextual work analysis is also being implemented by web filtering vendors, as Eamonn Doyle, chief executive officer at Bloxx explains.

“Technology is now emerging that operates at the point of user request,” Doyle says. “It looks at language patterns and contextual information previously gathered from a number of web pages across a number of specified categories, and then analyses the requested page to automatically categorise the page based on matching signatures.”

This inline, real-time signature matching allows pages that haven’t been discovered to be filtered with a high level of accuracy.

Some parental controls systems are also turning to “the Cloud” to deal with previously uncategorised pages. Nigel Hawthorn from Blue Coat Systems told us that its free K9 parental software uses the same filtering technology used by its enterprise and government cousins, checking web page categorisation on a remote server.

“If a user tries to access a brand-new web page, the Cloud service rates it in less than a third of a second based on multiple parameters and input from other technology providers, such as AV engines, Google feeds and spam content,” he claims.

Yet despite all this clever technology, it’s still far from guaranteed to thwart the smartest of teenagers. Rik Ferguson is senior security advisor at Trend Micro, and a father of three. He’s remarkably frank in admitting that new blocking methods “encourage the child to find creative ways around the restriction”.

Anonymised, free proxy servers are the most common way around the filters. “There are 1.5 million pages relating to proxy bypass,” warns Colin McKeown, director of E-Safe Education, adding that most of these proxy technologies will “get round many of the default parental products in operating systems and antivirus-based security products”.

They actually place the child at greater risk of identity theft and malicious activity, because all their browsing is being routed through an often unknown third-party.

The parental bypass
The majority of parents we spoke to were blissfully ignorant that their children might be bypassing the parental controls they “trust to protect my kids for me”, as one mum put it.

A frightening number, for example, didn’t know they handed over the keys to the padlock by letting their children log in to their PC’s admin account. One parent even admitted “my son set up our family computer for us”, and didn’t realise by enabling admin access they’re also enabling access to parental control software configuration utilities.

Parents are pretty bad at using hard-to-guess passwords as well. Not that it really matters: the determined child is remarkably adept at bypassing parental controls – as we discovered when we sat down with a group of teenagers who, not surprisingly, prefer to remain anonymous.

They revealed that it was easy to circumvent time limits by resetting the system clock through the OS, as most software doesn’t use internet clocks to get the time.

“Google knows everything”, including how to hack parental control software

One mentioned how parents forget that “Google knows everything”, including how to hack parental control software. “Most kids realise others have tried already,” he explained, “and turn to Google for help”.

Another revealed how Google Images is your porn search friend, since most software is unaware how full of explicit photos it is. “Just switch SafeSearch off” he said, and if the software doesn’t let you then “use a proxy server”.

The proxy not only lets them view Google’s porn thumbnails, but also click through to full images and the sites hosting them. “Mum and dad are none-the-wiser,” one bragged: “the monitoring logs only show the proxy server URL and they don’t know what that is”.

Others have moved to mobile phones to access chat and indulge in “sexting”. “Mum didn’t think to check if the network blocked that kind of content,” one teenager told us.

But perhaps most worrying for parents was the revelation that if all else failed and the monitoring software was too good, teenagers can turn to a Linux distro. “I boot from CD, and can then go anywhere I like and download anything I like, without leaving any trace behind,” one said. Most parents wouldn’t even know how to prevent booting from CD.

A losing battle
Even though most children won’t be circumventing parental controls with Linux distros, it’s clear that, as Rik Ferguson of Trend Micro admits, a piece of software “is not, and never should be the entirety of the answer”.

So what is? Cynthia Crossley, director of Microsoft Online in the UK, believes that “the best way to stay safe online is through education”. And it isn’t only children that need to wise up. Dave Miles recommends that if your child uses a social-networking site then you should too. “It’s only by understanding what these technologies do that, as a parent, you can provide supervisory support.”

Understanding the filtering software as much as the threats is equally vital. Even software that claims to block access to certain types of website often fails to block key areas by default. “What responsible parent would want to allow access to porn, violence and drugs?” asks Rob Hopkins of So Protect Me.

And the most vital thing, according to most of the experts we spoke to, is trust. If your children can’t come to you when they run into trouble online, there’s no software in the world that’s going to solve your problems.

This entry was posted on Monday, December 28th, 2009 at 3:02 PM and is filed under Main. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.