RFC 2057

Source Directed Access Control on the Internet 💖

• RFC number: 2057 🎀
• Author: S. Bradner, Harvard University ✨
• Category: Informational 📚
• Date: November 1996 🌸
• Obsoletes / Updates: neither is listed in this document's title block 🦋

Status of this Memo 🎀

This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

1. Abstract ✨

Okay so this memo started life as a deposition that the author submitted in a challenge to the Communications Decency Act of 1996, which was part of the Telecommunications Reform Act of 1996 💅. The Telecommunications Reform Act is a U.S. federal law that substantially changes the regulatory structure in the United States in the telecommunications arena 🌈. The Communications Decency Act (CDA) part of that law is aimed at protecting minors from some of the material carried over telecommunications networks 🫶. In particular, the law requires that the sender of potentially offensive material take "effective action" to ensure that it is not presented to minors 😭.

A number of people asked the author to publish the deposition as an informational RFC, since some of the information in it might help clear up confusion about the technical feasibility of proposed content control regulations 🧚. Descriptions of how the Internet and its applications work can be genuinely useful for that, bestie 🔥.

2. Control and oversight over the Internet 🌐

No organization or entity operates or controls the Internet 👑. The Internet consists of tens of thousands of local networks linking millions of computers, owned by governments, public institutions, non-profit organizations, and private companies around the world 🌍. These local networks are linked together by thousands of Internet service providers, which interconnect at dozens of points throughout the world ✨. None of these entities, however, controls the Internet. Each entity only controls its own computers and computer networks, plus the links allowed into those computers and computer networks 💜.

Although no organization controls the Internet, a limited number of organizations are responsible for developing the communications and operational standards and protocols used on it 🎀. These standards and protocols are what allow the millions of different (and sometimes incompatible) computers worldwide to talk to each other 🦋. They are not imposed on any computer or computer network. Still, any computer or computer network must follow at least some of the standards and protocols to be able to communicate with other computers over the Internet 🫶.

The most significant organizations involved in defining these standards include the Internet Society (ISOC), the Internet Architecture Board (IAB), the Internet Engineering Steering Group (IESG), and the Internet Engineering Task Force (IETF) 💅. Here's how the author summarizes the relationship between these four organizations 🌸:

The Internet Society (ISOC) is a professional society concerned with the growth and evolution of the worldwide Internet, with the way in which the Internet is and can be used, and with the social, political, and technical issues that arise as a result 🌈. The ISOC Trustees are responsible for approving appointments to the IAB from among the nominees submitted by the IETF nominating committee, and for ratifying the IETF Standards Process 👑.

The Internet Architecture Board (IAB) is a technical advisory group of the ISOC 🧚. It is chartered to provide oversight of the architecture of the Internet and its protocols. It also serves, in the context of the Internet standards process, as a body to which the decisions of the IESG may be appealed ⭐. The IAB is responsible for approving appointments to the IESG from among the nominees submitted by the IETF nominations committee, and for advising the IESG on the approval of Working Group charters 🦋.

The Internet Engineering Steering Group (IESG) is responsible for the technical management of IETF activities and the Internet standards process 💖. As part of the ISOC, it administers the process according to the rules and procedures ratified by the ISOC Trustees ✨. The IESG is directly responsible for the actions associated with entry into and movement along the Internet "standards track," including final approval of specifications as Internet Standards 🔥.

The Internet Engineering Task Force (IETF) is a self-organized group of people who make technical and other contributions to the engineering and evolution of the Internet and its technologies 🫶. It is the principal body engaged in developing new Internet standard specifications 💅. The IETF is divided into eight functional areas: Applications, Internet, IP: Next Generation, Network Management, Operational Requirements, Routing, Security, Transport and User Services 🌈. Each area has one or two area directors, and these area directors, along with the IETF/IESG Chair, form the IESG 👑.

Beyond those, there are a variety of other formal and informal groups that develop standards and agreements about specialized or emerging areas of the Internet 🎀. For example, the World Wide Web Consortium has developed agreements and standards for the Web 🌸.

None of these organizations controls, governs, runs, or pays for the Internet 🙈. None of them controls the substantive content available on the Internet. None of them has the power or authority to require content providers to alter, screen, or restrict access to content on the Internet, other than content that they themselves create 😭.

Beyond the standards setting process, the only Internet functions that are centralized are the allocation of numeric addresses to networks and the registration of "domain names" 💜. Three entities around the world share responsibility for making sure that each network and computer on the Internet has a unique 32-bit numeric "IP" address (such as 123.32.22.132), and that all "domain names" (such as "harvard.edu") are unique 🧚. InterNIC allocates IP addresses for the Americas, and has counterparts in Europe and Asia ✨. InterNIC allocates large blocks of IP addresses to major Internet providers, who in turn allocate smaller blocks to smaller Internet providers, who in turn allocate even smaller blocks to other providers or end users 🦋.

InterNIC does not, however, reliably receive information on who receives each numeric IP address, so it cannot provide any central database of computer addresses 💀. On top of that, a growing number of computers access the Internet indirectly through address translating devices such as application "firewalls" 🔥. With these devices, the IP address used by a computer on the "inside" of the firewall is translated to another IP address for transmission over the Internet 🌈. The IP address used over the Internet can be dynamically assigned from a pool of available IP addresses at the time a communication is initiated 🎀. In this case, the IP addresses used inside the firewall are not required to be globally unique, and the IP addresses used over the Internet do not uniquely identify a specific computer 🙈.

Neither InterNIC nor its counterparts in Europe and Asia control the substantive content available on the Internet, and they do not have the power or authority to require content providers to alter, screen, or restrict access to content on the Internet 💅.

3. Characteristics of Internet communications 💬

There are a wide variety of communication methods over the Internet, including electronic mail, mail exploders such as listserv, USENET newsgroups, Internet Relay Chat, gopher, FTP, and the World Wide Web 🌸. With each of these, the speaker has little or no way to control or verify who receives the communication 🫶.

As detailed below, for each of these communication methods it is either impossible or very difficult for the speaker to restrict access to their communications "by requiring use of a verified credit card, debit account, adult access code, or adult personal identification number." 😭 Similarly, for each of these methods there are no feasible actions that the author knows of that the speaker can take that would be reasonably effective to "restrict or prevent access by minors" to the speaker's communications 💜.

With each of these methods of communication, it is either technologically impossible or practically infeasible for the speaker to ensure that the speech is not "available" to a minor 💀. For most of them (mail exploders such as listserv, USENET newsgroups, Internet Relay Chat, gopher, FTP, and the World Wide Web), there are technological obstacles to a speaker knowing about or preventing access by minors to a communication 🧚. Yet even for the basic point-to-point communication of electronic mail, there are practical and informational obstacles to a speaker making sure minors don't have access to a communication that might be considered "indecent" or "patently offensive" in some communities 🔥. Honestly, it's giving "impossible" everywhere 🙈.

3.1 Point-to-Point Communications 🦋

3.1.1 Electronic Mail 💌

okay so, of all the main ways to talk on the Internet, email is the one where the sender is most likely to actually know who they're writing to (and know their real address) 🫶. so a speaker could send stuff that's potentially "indecent" or "patently offensive" with not a lot of worry that it's "available" to minors 🙈

BUT the risk is WAY higher if you don't know the recipient 💀. as a hypothetical, say an AIDS information organization gets a request for info from some unknown person over email. the org has no practical or effective way to check that person's identity or age 😬

an email address doesn't tell you anything authoritative about the addressee 🦋. people pick their own addresses, and those may or may not use their real names. for millions of people, there's no other info available over the Internet at all. where info does exist (through stuff like "finger" lookup tools), the addressee usually supplied it, so it might not be accurate. this is especially true when a minor is trying to get info the government has restricted to adults 👀

there is no universal, or even extensive, "white pages" of email addresses matched up with names or phone numbers 🌸. with the Internet growing super fast and going global, any attempt at a list like that would be incomplete (and would probably not have anyone's age in it). and there's no systematic, practical, or efficient way to get the identity of an address holder from the organization or institution running the addressee's computer system. not it 💅

also, it's really simple to make an email "alias" and send and receive mail under a different name. so a given address might not even be the recipient's true one 🧚. on some systems, someone who wants to protect their anonymity could easily make a temporary address just to ask an AIDS information resource something. there are also "anonymous remailers," which swap the original address on a message for a randomly chosen new one. the remailer keeps a record of which original name goes with which replacement, so replies still get forwarded to the right person. these get used a lot for discussion and support groups about sensitive or controversial topics like AIDS 🎀

so, periodt: there's no reasonably effective method to get info from existing online sources about an email address that's good enough to make sure it belongs to an adult and not a minor 😭

if you can't comply with the Communications Decency Act using info from existing online sources, the email speaker's only real option is to interrogate the intended recipient to try to verify they're an adult. that verification inherently and unavoidably adds a whole separate exchange of communications before the email even gets sent, and it's likely to be unreliable if the recipient is trying to deceive the speaker 🙃

this separate preliminary communication is required because with email there's a complete electronic and temporal "disconnect" between sender and recipient 💜. mail can get routed through tons of computers between sender and recipient, and the recipient might not "log in" to grab their mail until days or even weeks after it was sent. so at no point in time is there any direct, or even indirect, electronic link that would let the sender interrogate the recipient before sending. which means the Communications Decency Act unavoidably requires the sender to pay the administrative (and sometimes financial) cost of a totally separate exchange of communications with the recipient before the sender has enough info to be sure the recipient is an adult 😩. and even if the sender did establish that an addressee isn't a minor, they still couldn't be sure the addressee wasn't sharing their computer account with someone else who is a minor, which is something that happens all the time 👯

if an email is part of a commercial transaction worth enough to justify the time and expense of getting payment by credit card from the addressee, the sender might be able to use the credit card or debit account options in the Communications Decency Act ✨. BUT right now you can't verify a credit or debit transaction over the Internet, so the sender would have to spend the effort to verify it by phone or through a separate computer connection to the correct bank 📞. and because of current data security worries on the Internet, an email credit card transaction would probably also require the recipient to send their credit card info to the sender by phone or the postal service 📮

same deal with the "adult access code" or "adult personal identification number" options in the statute 🔐. right now, using those would mean creating and maintaining a database of adult codes. that's not an insurmountable technological problem, but it would take a lot of human clerical time to create and maintain the info. just like with credit or debit transactions, an adult code database would also probably need the info sent by phone or postal mail 💌

and honestly, an adult access code would likely be super ineffective at keeping minors out 🙅‍♀️. for the adult access code idea to work at all, the code would have to be sent over the Internet, which means it'd be vulnerable to interception and disclosure. any "information based" code (a code made of letters and numbers sent in a message) could be duplicated and passed around to other users on the Internet. it's highly likely that valid adult access codes would end up widely distributed online, letting industrious minors grab a valid code and get access to the material that's supposed to be protected 🚨

a somewhat more effective alternative to this kind of "information based" access code would be to link the code to the unique 32-bit numeric "IP" addresses of networks and computers on the Internet 🌈. under this approach, "adult" info would only get sent to the particular computer with the "approved" IP address. but for tens of millions of Internet users, IP addresses are dynamically assigned at the time of access, and those users will almost certainly use different IP addresses in later sessions. for example, users of major online services like America Online (AOL) only get a temporary IP address when they link to the service, and the AOL user won't keep that IP address in later sessions 🥲. also, as discussed above, the use of "firewalls" can dynamically change the apparent IP address of computers accessing the Internet 🧱. so any IP address-based screening system would exclude tens of millions of potential recipients, which means it wouldn't be a viable screening option 🙅‍♀️

at the end of the day, unless you're willing to spend the time and expense of getting and charging the recipient's credit card, there are no reasonably effective methods an email sender can use to verify the identity or age of an intended recipient. that's true even in one-to-one communication, and it's true to a degree of confidence that isn't enough to ensure compliance with the Communications Decency Act (and to avoid the Act's criminal sanction) ⚖️💀

---

3.2 Point-to-Multipoint Communications 📣

okay this is where it gets even harder 😤. the difficulties described above for point-to-point communications are magnified many times over for point-to-multipoint communications 🌊. and on top of that, for almost all major types of point-to-multipoint communications on the Internet, there's a technological obstacle that makes it impossible, or virtually impossible, for the speaker to control who receives their speech 🚫. for these types of communications over the Internet, reasonably effective compliance with the Communications Decency Act is impossible 🌈💅

3.2.1. Mail Exploders ✨

Okay so, mail exploders are basically email with a glow-up 💖. Instead of messaging one person, you send ONE email and it reaches a whole crowd 🦋. This is how Internet users swap ideas and info on specific topics with others who are into the same thing. "Mail exploders" is the generic term, and it covers programs like "listserv" and "Majordomo" 🎀. These programs usually take email messages from individual users and automatically resend them to everyone who asked to get posts for that particular list. Lowkey, plenty of email retrieval programs can also receive messages and auto-forward them to other people on a local mailing list 💅.

Setting one up is pretty easy, bestie 🌸. The leading programs, listserv and Majordomo, are free, and once they're running they can generally run unattended 🧚. Nobody can say exactly how many mailing lists exist worldwide, but there are definitely tens of thousands of them covering a super wide range of topics 🌈.

With the top programs, users can add or remove their own names automatically, with no human involved 🫶. To join, you email the automated list program. For example, to subscribe to the "Cyber-Rights" mailing list (all about censorship and other legal issues on the Internet), you send an email to listserv@cpsr.org and put subscribe cyber-rights name as the first line of the body, swapping in your name 💜. The listserv program running on the cpsr.org computer then adds the new subscriber's email address to the list automatically. ngl, the name is totally under the subscriber's control, so it might not be their real name 🙈.

To post, you just send your message to the list's address. To post to "Cyber-Rights," you send an email addressed to cyber-rights@cpsr.org 🍓. Some lists are "moderated," which means messages go to a human moderator first, and the moderator forwards only the ones they approve to the whole list 👑. Lots of lists, though, are unmoderated, so posts sent to the mail exploder go straight out to everyone on the list ✨. Most lists end up unmoderated because reviewing every proposed post takes time, and there are just so many people posting 💀.

Here's the tricky part: a poster can't control who subscribes to the list 😭. In a lot of cases, the poster can't even find out who has subscribed. So when you post to a list, you have no way to screen or control who receives your message. Even on a "moderated" list, the poster still can't control who gets it 🥺.

It gets even messier 🌀. A mailing list can itself be a subscriber to another mailing list. That means one of the "subscribers" might actually be another mail exploder program that re-explodes any message it receives from the first list. So a message sent to the first mailing list could end up distributed to many totally separate mailing lists too 🦋.

Based on how the Internet currently operates and what its standards say, it would be impossible for someone posting to a listserv to screen recipients and make sure they're over 17 years of age 🙅‍♀️. Short of not speaking at all, I know of no action a speaker can take today that would be reasonably effective at stopping minors from reading messages posted to mail exploder programs. And requiring that kind of screening for any message that might be "indecent" or "patently offensive" to a minor would basically ban those messages from this type of mailing list 😱.

Even if you could get a list of the email addresses subscribed to a mailing list, you'd still hit the same walls described above for a point-to-point email sender 🚧. The difference is that instead of getting a credit card or adult access code from one intended recipient, a poster might have to collect those codes from a thousand potential recipients. That includes new subscribers who may have only joined moments before the poster wants to send a message 🫠. As noted above, complying with the Communications Decency Act for a single email would already be very difficult. Complying with the Act for a single mailing list posting, with any reasonable level of effectiveness, is impossible 💅💀

3.2.2. USENET Newsgroups 🦋

okay so USENET newsgroups are literally one of the most popular ways people talk on the Internet 💬 they have the same goal as mail exploder lists (finding your people who love the same topic!), but the messages travel in a totally different way 🫶

USENET newsgroups are distributed message databases where people can have discussions and swap stuff about specific topics ✨ they get passed around using ad hoc, peer-to-peer connections between 200,000 or more computers (called USENET "servers") all over the world 🌍 there are newsgroups on more than twenty thousand different subjects 📚 and collectively, almost 100,000 new messages (or "articles") get posted every single day 😭 some newsgroups are "moderated," but most are open access 🌸

For unmoderated newsgroups, when someone with access to a USENET server posts a message, it gets automatically forwarded to the neighboring USENET servers that give access to that newsgroup 📨 then those servers pass it along to their neighbors, and so on 🔁 the messages are temporarily stored on each receiving server, where individual users can review them and respond 💌 then they're automatically and periodically purged from each system after a configurable amount of time to make room for new messages 🧹 replies (just like the originals) are automatically distributed to every other computer receiving the newsgroup 💅 and spreading messages to USENET servers around the world is an automated process that does not need any direct human intervention or review 🤖

An individual who posts a message to a newsgroup has no ability to monitor or control who reads it 🙈 when someone posts, they send the message to a particular newsgroup on their local USENET server, and the local service automatically routes it to other servers (or in some cases to a moderator), which then let their users read it 📬 the poster has zero control over how the USENET servers worldwide handle her message 💀 each server's local manager decides which newsgroups it will accept 🛠️ and there is no mechanism to permit distribution based on characteristics of the individual messages within a newsgroup 🚫

The impossibility of the speaker controlling distribution is even more obvious because new computers and computer networks can join the USENET news distribution system at any time 🌱 to get newsgroups, the operator of a new computer or network only needs to reach agreement with a neighboring computer that already receives them 🤝 speakers around the world don't find out that the new computer joined 👀 so, just as a speaker can't know or control who receives a message, the speaker doesn't even know how many or which computers might receive a given newsgroup 🫠

For moderated newsgroups, all messages go to an individual who can screen them for relevance to the topics under discussion 🧐 but the screening doesn't increase the original speaker's ability to control who receives a given message 🙃 a newsgroup moderator has just as little control as the original speaker over who receives a message posted to the newsgroup 🫤

Based on the current operations and standards of the Internet, it would be impossible for someone posting to a USENET newsgroup to screen recipients to make sure they were over 17 years of age 🔞 short of not speaking at all, I know of no actions available to a speaker today that would be reasonably effective at keeping minors from having access to USENET newsgroup messages 😤 requiring that screening for any messages that might be "indecent" or "patently offensive" to a minor would have the effect of banning such messages from USENET newsgroups 🚫💔

A speaker also has no means by which they could require listeners to provide a credit card, debit account, adult access code, or adult personal identification number 💳 each USENET server controls access to the newsgroups on that server, and a speaker has no ability to force a server operator to take any particular action 🙅 the message is out of the speaker's hands from the moment it's posted 🕊️

Moreover, even if we imagined a system where a newsgroup server would hold back access to a message until the speaker received a credit card, debit account, adult access code, or adult personal identification number from the listener, there would be no feasible way for the speaker to receive such a number 😩 because a listener may pull up a message from a newsgroup days after the speaker posted it, that hypothetical system would require the speaker to either stay at their computer 24 hours a day for as many as ten days after posting, or finance, develop, and maintain an automated system to receive and validate access numbers 🥲 all of this effort would be required just for the speaker to post even a single potentially "patently offensive" message to a single newsgroup 💸

Moreover, even if such a hypothetical system existed and a speaker were willing to stay available 24 hours a day (or run a costly automated system) in order to receive access numbers, not all computers that receive USENET newsgroups could reasonably transmit those numbers 📵 some computers only receive newsgroups through a once-a-day telephone connection to another newsgroup server ☎️ some of these computers don't have any other type of Internet connection, and some computers that receive USENET newsgroups don't even use the TCP/IP communications protocol that is required for direct or real-time communications on the Internet 🤯 those computers would have no means of communicating a prospective listener's access code back to a speaker 💔

It is my opinion that if this hypothetical access system ever were created, it would be so burdensome as to effectively ban messages that might be "indecent" or "patently offensive" from USENET newsgroups 🙄 the communications standards and protocols that would allow such a hypothetical access system have not been developed as of today, and no Internet standards setting body I'm aware of is currently developing them 📑 specifically, such a hypothetical access system is not part of the "next generation" Internet Protocol that I helped to develop 👑✨

---

3.2.3. Internet Relay Chat 💬

Another method of communication on the Internet is called "Internet Relay Chat" (or IRC) 🎀 IRC allows for real-time communication between two or more Internet users ⚡ it's kinda like a telephone party line, except you use a computer and keyboard instead of a phone 📞 but with IRC, at any one time there are thousands of different party lines available, and tens of thousands of users are collectively chatting, debating, and having conversations about a huge range of subjects 🌈 plus, anyone can create a new party line to discuss a different topic at any time 🧚 lots of IRC discussions are little more than social small talk, but there are often real conversations about important issues and topics too 🫶 although I have not personally operated an IRC server in my career, I'm familiar enough with how IRC servers work to identify the obstacles a speaker would run into trying to identify other participants and verify that they weren't minors 🔍

There's a network of dozens of IRC servers across the world 🌎 to speak through IRC, a speaker connects to one of these servers and selects the topic they want to "join" 🫧 once a speaker joins a topic, all speakers on that topic can see and read everything everyone else transmits 👀 as a practical matter, there's no way for each person who joins a discussion to interrogate all the other participants (sometimes dozens of them) about their identity and age 😵 and because people join or drop out of discussions on a rolling basis, the discussion line would be totally overwhelmed with messages trying to verify everyone's identity 🌪️

Also as a practical matter, there's no way that an individual speaker or an individual IRC server operator could enforce an "adults only" rule for a selection of discussion topics 🙅‍♀️ dozens of IRC servers are interconnected globally so people across the world can talk to each other 🌐 so a speaker connected to an IRC server in the United States can speak directly to a listener in Asia or Europe ✈️ there's no practical way for a speaker in the United States to be reasonably certain that a given IRC discussion is in fact "adults only" 😬

Nor can a speaker, before or at the time of joining an IRC discussion, figure out with any confidence who the other participants are 🥸 individual participants can take part anonymously by using a pseudonym 🎭 a new speaker joining the conversation can see a list of other participants' pseudonyms, but has no possible way of determining the real identity (or even the real e-mail address) of the individuals behind each pseudonym 👻

Based on the current operations and standards of the Internet, it would be impossible for someone participating in an IRC discussion to screen recipients with the level of certainty needed to ensure they were over 17 years of age 🚫🔞 short of not speaking at all, I know of no actions available to a speaker today that would be reasonably effective at keeping minors from having access to speech in an IRC discussion 😮‍💨 requiring speakers to screen recipients for any IRC discussions that might be "indecent" or "patently offensive" to a minor would have the effect of banning such discussions 💅💀

---

4.0. Information Retrival Systems 📚

With FTP (or File Transfer Protocol), gopher, and the World Wide Web, the Internet is a vast resource for information made available to users around the world 🌍✨ all three methods (FTP, gopher, and the Web) are specifically geared toward letting thousands or millions of users worldwide access content on the Internet 🙌 and none of them are specifically designed to limit access based on criteria such as the age of the Internet user 🫶 right now, much of this information is offered for free access 🎁

4.1. Anonymous FTP 🌸

okay so "Anonymous FTP" is basically the simplest way a content provider can put stuff out there for everyone on the Internet 💖 FTP is the protocol that moves files from one computer to another, and it's honestly really efficient and error free ✨ To set it up, a provider runs an "Anonymous FTP server" that takes FTP requests from people elsewhere. It's called "anonymous" because when someone connects, they type the word "anonymous" when the server asks for a user name 🙈 By convention, they're asked to put in their e-mail address at the "password" prompt. After that they get into a restricted part of the server's disk and can grab the files in that area 📂

here's the messy bit 😭 even though someone typed in their e-mail address, there's no real validation or screening possible with the FTP server software that exists right now. With the current tools, a provider has no way to screen "anonymous" users to figure out if they might be minors. And even if a provider somehow knew a person's age, the FTP software can't be set up to limit that user to non-"adult" file areas. no cap, that's a lot 💀

FTP server software can let non-"anonymous" users in too. In that mode it can require each person to have an individual password that gets checked against a list that already exists 🔐 But there are two big problems that stop this from being used to give broad access to information over the Internet, the way anonymous FTP can. First, with the current server software, every non-"anonymous" FTP user needs their own account on the server computer. That's a huge administrative burden and drains resources. If more than a small number of people wanted in, managing all those accounts would totally overwhelm the server, because the FTP server software was never built to handle thousands or millions of different user and password combinations 😵 Second, under the existing FTP server software, each of those named users would get complete access to the server's file system, not just a restricted area like the one anonymous FTP offers. Obviously that's a serious security problem 🚨 So for these two reasons, in practice FTP can't give broad access to content except through the anonymous FTP option. And as we said, that option doesn't allow for screening or blocking minors. 🎀

As we'll talk about below with the World Wide Web, even if someone redesigned the current FTP server software so it could screen for minors, the administrative burden of doing that would overwhelm the content provider's resources in lots of cases 🫶

Based on how the Internet currently operates and what its standards say, it's not possible, or even practically feasible, for someone running an anonymous FTP file server to screen recipients with the level of certainty needed to make sure they're over 17 years of age. Honestly, I know of no actions a content provider can take today that would be reasonably effective at keeping minors away from "adult" files on the FTP server, other than not running an anonymous FTP server at all. ☹️ Requiring anonymous FTP server operators to screen people so minors can't reach FTP files that might be "indecent" or "patently offensive" to a minor would have the effect of banning anonymous FTP access altogether. 🚫

---

4.2. Gopher 🍓

gopher is kind of like FTP in that it lets you transfer basic files from one computer to another 🦋 But it's also a precursor to the World Wide Web, because it lets a user seamlessly jump from one gopher file server to another to track down the info they want 🧚 The development of gopher, and all the gopher servers getting linked together around the world, dramatically improved how easily Internet users could find information across the Internet. main character era for information retrieval 👑

Gopher is an improvement over FTP in lots of ways, but it's also simpler, because users don't need to enter any username or password to get to the files on a gopher server ✨ With the gopher server software that's available right now, a content provider has no built-in way to screen users. So a content provider couldn't stop minors from pulling "adult" files. 😭

Same as before: as we'll discuss with the World Wide Web, even if the gopher server software could screen for minors, the administrative burden of that screening would overwhelm the content provider's resources in many cases 💅

Based on how the Internet currently operates and what its standards say, it's not possible for someone running a gopher file server to screen recipients with the level of certainty needed to be sure they're over 17 years of age. Short of not operating a gopher server at all, I know of no actions a content provider can take today that would be reasonably effective at keeping minors away from "adult" files on a gopher server. Requiring gopher server operators to screen users so minors can't reach files that might be "indecent" or "patently offensive" to a minor would have the effect of banning gopher servers wherever there's any such material. 🥲🫶

4.3. World Wide Web (WWW) 🕸️

Okay so the "World Wide Web" is lowkey becoming the most famous way to communicate on the Internet 💖, and it's giving because it makes it super easy for users to find and view a vast array of content out there ✨. The Web uses a "hypertext" formatting language called hypertext markup language (HTML), and Web "browsers" can display HTML documents containing text, images, and sound 🎀. Any HTML document can include links to other types of information or resources anywhere in the world. So say you're reading an HTML document that describes resources available on the Internet 📖. You can "click" on the description of a resource with your computer mouse and be immediately connected to the resource itself 🦋. These "hyperlinks" let information get accessed and organized in really flexible ways, and they let people find and efficiently view related information even when it's stored on numerous computers all around the world 🌈.

Unlike USENET newsgroups, mail exploders, FTP, and gopher, an operator of a World Wide Web server does have some ability to interrogate a user of a Web site on the server, and so has some ability to screen out users 👀. An HTML document can include a fill-in-the-blank "form" to request information from a visitor to a Web site, and that information can be transmitted back to the Web server 📝. The information received can then be processed by a computer program (usually a "Common Gateway Interface," or "CGI," script). Based on the results of that program, the Web server could grant or deny access to a particular Web page 🚪. So it's possible for some (but not all, as discussed below) World Wide Web sites to be designed to "screen" visitors and make sure they are adults 🔞.

The primary barrier to this screening is the administrative burden of creating and maintaining the screening system 😩. For an individual Web site to build a software system that can screen thousands of visitors a day, figure out (to the extent possible) whether a visitor is an adult or a minor, and keep a database for subsequent access to the Web site, it would need a significant ongoing effort 💅. Plus, as discussed above with regard to electronic mail, actually establishing a Web visitor's identity or "verifying" a credit card would take a significant investment of administrative and clerical time 📋. Since there is no effective method to establish identity over the Internet, and there's currently no method to verify credit card numbers over the Internet (and given the current cost of credit card verifications done by other means), this kind of identification process is only practical for a commercial entity that charges for access to its Web information 💸.

Beyond the major administrative burden of complying with the Communications Decency Act, the Act presents two additional problems 🙈. First, many Web publishers cannot use computer programs like CGI scripts to process input from a Web visitor. For example, I've been told that major online services such as America Online and Compuserve don't let their customers run CGI scripts or other processes that could be a significant drain on the online services' computers and a potential security risk 🛑. So for this category of Web publisher, the Communications Decency Act works as a ban on any arguably "indecent" or "patently offensive" speech 😭. It's impossible for this category of Web publisher to control access to their Web sites 💀.

Moreover, even for Web publishers who can use CGI scripts to screen access, the existence of Web page caching on the Internet can make that screening ineffective 🙃. "Caching" refers to a method for speeding up access to Internet resources 🚀. Caching is often used at one or both ends of, for example, a transatlantic or transpacific cable that carries Internet communications 🌊. Here's an example: an Internet user in Europe requests a World Wide Web page located in the United States. The request travels over the transatlantic cable to the United States, and the Web page is sent back across the ocean to Europe (and ultimately to the user who asked for it) ✈️. But the operator of the transatlantic cable will place the Web page in a storage "cache" on the European side of the cable. Then, if a second Internet user in Europe requests that same Web page, the operator of the cable will intercept the request and serve the page from its "cache" (which reduces traffic on the transatlantic cable) 🧚. This kind of caching typically happens without the requesting user knowing about it 🫠. And in this scenario, the original content provider isn't even aware that the second user made the request, and has no chance to screen that second user's access. Even so, the original content provider risks prosecution if the content is "adult" content and the second requester is a minor 😱. Caching web servers are rapidly increasing within the United States (mostly to help moderate the all-too-rapid growth in Internet traffic), so they can affect entirely domestic communications too 🇺🇸. For example, a growing number of universities use caching web servers to cut down on usage of the link to their Internet service provider 🎓. Given this kind of caching, efforts to screen access to Web pages can only at best be partially effective 🥲.

Given the existence of Web page caching on the Internet, it would be extremely difficult, if not impossible, for someone operating a World Wide Web server to make sure that no minors receive "adult" content 🚫.

And for Web page publishers who lack access to CGI scripts, there's no possible way for them to screen recipients and make sure all of them are over 17 years of age 🎂. For these content providers, short of not supporting World Wide Web access to their materials, I know of no actions available that would be reasonably effective at keeping minors away from "adult" files on a World Wide Web server 🙅‍♀️. Requiring these Web publishers to screen so that minors can't access files that might be "indecent" or "patently offensive" to a minor would have the effect of banning their speech on the World Wide Web 📵.

The Web page caching described above also makes it harder to figure out, with any precision, how many visitors a particular Web site gets 📉. Some Web servers can count how many different Web clients requested access to a Web site, and some of those clients could be caching Web servers themselves 🤔. Some Web servers can also count how many "hits" (separate file accesses) were made on a particular Web site. A single access to a Web page that contains images or graphic icons would likely be registered as more than one "hit" 🖼️. With caching, the actual number of users who retrieved information originating on a particular Web server is likely to be greater than the number of "hits" recorded for that server 📈.

---

5.0. Client-end Blocking 🛡️

As detailed above, for many important methods of communication on the Internet, the senders (the content providers) have no ability to make sure their messages are only available to adults 🙊. It's also not possible for an Internet service provider or a large institutional provider of Internet access (such as a university) to screen out all, or even most, content that could be deemed "indecent" or "patently offensive" (to the extent those terms can be understood at all) 🤷‍♀️. A large institution could at least theoretically screen a portion of the communications over the Internet, scanning for things like "indecent" words, but not pictures 🔍. A screening program that could handle a high volume of Internet traffic at the point where it enters the institution would take an investment of computing resources of as much as one million dollars per major Internet information conduit 💰. On top of that, it would be quite difficult to configure such a system to control content only for the users who are under-age recipients. In many cases the information goes to a server inside the university, where many users, under-age and not, would have access to it 🏫.

Based on my experience and knowledge of the Internet, I believe the most effective way to monitor, screen, or control the full range of information transmitted over the Internet, and block undesired content, is at the client end. That means using software installed on the individual user's computer 💻✨. That kind of software could block certain forms of incoming transmissions by using content descriptive tags in the messages. Or it could use content ratings developed by third parties to choose what can and can't be retrieved for display on a user's computer 🫶.

6.0 Tagging Material 🎀

okay so I'm told the government might push for special tags or flags in electronic mail, USENET newsgroup posts, and World Wide Web HTML docs to mark "adult" material. ngl, to my knowledge no Internet access software or web browsers can be configured to block material with those tags right now 😭. So the headers and flags the government might push are an ineffective way to stop minors from getting to "adult" material, at least for now.

Even in a predictable future with defined standards for these tags and easily available browsers that can use them, a content provider (like a listserv, a newsgroup poster, or a Web page author) has very little power to make sure the client software receiving their posts was configured to recognize the tags and block access when needed 🙈. So the tagging the government might propose would not really be "effective" at keeping the poster's speech from being "available to a person under 18 years of age," which is what the Communications Decency Act requires 💅.

I strongly support voluntary self-rating and third-party rating, as described in the paragraph before this one. But tags of this type wouldn't satisfy the speaker's obligation to take effective actions so that "patently offensive" material isn't "available" to minors 💀. And since it's impossible to embed such flags or headers in many of the documents currently shared over anonymous FTP, gopher, and the World Wide Web without making the files useless (executable programs, for example), any government proposal requiring tags for "adult" material would not let those methods of communication keep being used for speech that might be deemed "indecent" or "patently offensive" 😩.

With the exception of electronic mail and e-mail exploders, all of the Internet communication methods discussed above require an affirmative action by the listener before the communication takes place 🦋. A listener has to take specific action to receive communications from USENET newsgroups, Internet Relay Chat, gopher, FTP, and the World Wide Web. For e-mail exploders it's generally the same, except when a third party subscribes the user to the exploder list 👀. These communications don't "invade" a person's home or appear on their computer screen unbidden. Instead, a person almost always has to take specific affirmative steps to receive information over the Internet ✨.

7.0 Acknowledgment 💖

I owe so much thanks to John Morris of Jenner and Block, one of the law firms involved in the CDA challenge 🫶. Without his extensive help this document wouldn't exist, or if it did, it would be even more scattered 🌸.

8.0 Security Considerations 🔒

Okay, this part is serious, bestie 😤. To actually be able to do the type of content access control that the CDA envisions, you'd need a secure Internet infrastructure, along with secure ways to determine the minor status of potential recipients around the world. Developing a system like that is outside the scope of this document 🚨.

9.0 Author's Address 🧚

Scott Bradner
Harvard University
1350 Mass Ave.
Cambridge MA 02138 USA

Phone: +1 617 495 3864
EMail: sob@harvard.edu