Starting with Microsoft Word 2010, you can enable OpenType ligatures in the Advanced tab of the Font dialog.

No normal person would care, but Microsoft has finally added support for OpenType ligatures in Microsoft Word 2010 (Word 14). I’ve posted previously about indications that OpenType ligatures would be supported in Word 2010, but since the Microsoft Office 2010 Technical Preview leaked, we know for sure.

OpenType ligatures aren’t enabled by default, though.

To enable OpenType ligatures, right-click on some text, select Font, select the Advanced tab, and select Standard Only from the Ligatures combo box. This enables the standard ligatures, like fi and ffi.

Depending on the font that you’re using, you can also select from a number of other sets of ligatures. And you can select from available stylistic sets and number forms, as well as change the number spacing.

You can also disable these OpenType features entirely by opening Word Options, selecting the Advanced tab, and checking Disable OpenType Font Formatting Features under the Layout Options that are right at the bottom.

This is all great news for the three people who were looking forward to this support in the next version of Word.

You can check out some more Office 2010 screenshots here and here.

Read full post »

Why does the ACMA blacklist contain ordinary pornography, horror movie clips, anti-abortion sites, pro-euthanasia sites, and poker sites?

When Senator Conroy announced a live pilot to assess, among other things, the technical feasibility of filtering the ACMA blacklist of so-called ‘prohibited content’, he described the list as containing ‘child sexual abuse, rape, incest, bestiality, sexual violence, and detailed instruction in crime’.

So, when three copies of the list were posted on Wikileaks, people were surprised to find it included ordinary pornography, horror movie clips, anti-abortion sites, pro-euthanasia sites, and poker sites.

These are not errors. These sites are on the blacklist because the definition of ‘prohibited content’ under the Broadcasting Services Act 1992 (Cth) is much broader than people assume.

‘Prohibited content’ is not just illegal content. It includes all content classified RC and X 18+, content classified R 18+ that is not subject to a restricted access system (which I’ll explain later), and certain commercial content classified MA 15+ that is not subject to a restricted access system.

A ‘restricted access system’ is a system that requires a person seeking access to online content to apply for that access and either declare that he or she is at least 15, or prove that he or she is at least 18 (for example, by providing a valid credit card number), depending on whether the content is classified MA 15+ or R 18+. This is in much the same way that cinemas require proof of age for screenings of certain films.

It should be clear from the definition of ‘prohibited content’ that such content, as a class, is not illegal. MA 15+ and R 18+ movies screen in public cinemas after all. But what about X 18+ and RC content? Most people have some idea of the type of content that’s classified MA 15+ and R 18+, but don’t necessarily know what’s classified X 18+ or refused classification (RC).

Any real depiction of actual sexual activity is classified X 18+, so long as it doesn’t feature any RC content.

Content that’s refused classification (RC) is quite diverse. It includes depictions of sexual fetishes, like body piercing, application of substances such as candle wax, golden showers, bondage, spanking, and fisting.

It also covers extreme violence, sexual violence, child pornography, incest fantasies, and bestiality, as well as detailed instruction in crime and detailed instruction in the use of certain drugs.

The law regulating X 18+ and RC content in each state and territory of Australia is beyond the scope of this article. Suffice to say that in most places in Australia, possession of X 18+ and RC content is not an offence, though sale of X 18+ and RC content is. Possession of child pornography is, of course, illegal all over Australia.

So, if prohibited content, as a class, is not prohibited, what is it? The answer is that it’s merely a class of content in relation to which ACMA has certain powers when it’s found online.

Under the Broadcasting Services Act 1992 (Cth), when ACMA finds prohibited content hosted in Australia, it must issue a take-down notice directing the provider to cease providing the content to the public or, if it’s in relation to MA 15+ or R 18+ content, to make it subject to a restricted access system.

The provider must comply with the notice as soon as practicable, but no later than 6:00 pm on the next business day. Failure to do so can result in fines up to $11,000 per day for individuals or $55,000 per day for corporations.

In addition to take-down notices, ACMA can also issue a service-cessation or link-deletion notice. These notices apply to live prohibited content (such as live video) and links to prohibited content respectively. They operate the same way, requiring the provider to cease providing the live content or the link.

When ACMA finds prohibited content hosted overseas, it notifies the content to the makers of the ‘Internet Industry Association Family Friendly Filters’ pursuant to an industry code that’s been registered under the Act. Under this code, each ISP provides at least one IIA Family Friendly Filter to users who want one, at cost.

IIA Family Friendly Filters are software packages approved by the IIA that users can optionally install on their systems to filter their Internet connections. It was from one of these filters, Integard, that the three ACMA blacklists posted on Wikileaks were extracted.

So, the regulation as it stands effectively creates an opt-in filtering regime for prohibited content hosted overseas, while at the same time making hosting prohibited content in Australia impractical, since providers have to remove such content when a notice is inevitably issued. Importantly, though, it’s not an offence to host or link to prohibited content in Australia. It’s only an offence to fail to comply with a notice from ACMA.

After Whirlpool was threatened with an $11,000 per day fine for linking to a blacklisted anti-abortion site, some people expressed concern that they’d be fined for linking to a site on a secret list, even though they had no way of knowing what was on that list.

As explained above, this isn’t the case. You could get a notice from ACMA if you host or link to prohibited content, but you won’t be fined unless you fail to comply with it. (Particular content may be illegal under state or territory law though. For example, possession and copying of RC content is illegal in Western Australia.)

Understanding that the ACMA blacklist is of prohibited content and that prohibited content is not just illegal content, it is clear why the sites mentioned earlier are on the list.

Ordinary pornography sites are on the list because they feature real depictions of sexual activity. Such content would be classified X 18+ or, if it featured a sexual fetish, RC.

A clip from a horror movie posted on YouTube is included because it would be classified R 18+. YouTube requires users to declare that they are at least 18 before viewing the clip, but in order for this site not to be listed as ‘prohibited content’ a restricted access system would have to require proof of age.

The anti-abortion sites on the list contain graphic images and video of abortions and aborted foetuses. The content is not subject to any restricted access system. Presumably, these images and videos would be classified R 18+ or RC.

The pro-euthanasia sites on the list provide detailed instruction in the use of drugs like Nembutal. Under current guidelines, such instruction is classified RC.

Finally, the list also contains some sites that don’t host prohibited content, like a Queensland dentist’s website and an astrology website. These sites were added to the list because, at the time, they had been defaced with prohibited content. The legislation makes no distinction between sites intentionally hosting prohibited content and those that have been defaced with such content.

But what about the poker sites? Poker sites, and other gambling websites, aren’t prohibited content under the Broadcasting Services Act 1992 (Cth), but they are ‘prohibited Internet gambling content’ under the Interactive Gambling Act 2001 (Cth).

Under that Act, ACMA has essentially the same powers in relation to overseas-hosted prohibited Internet gambling content as it does in relation to overseas-hosted prohibited content. That is, it notifies the content to makers of IIA Family Friendly Filters. This is why websites like PartyPoker.com end up on the blacklist too.

The most important thing about all of the above is that this is regulation that’s been in place since 2000. The current Government hasn’t clearly stated what it proposes to change.

Initially, the Government indicated it would mandate filtering of the existing ACMA blacklist. The Department of Communications website still says that ‘filtering would block content using a blacklist of prohibited sites … which are defined as “prohibited” under Australian legislation which has been in place since 2000.’

More recently, the Government said in a media release that it ‘has indicated an interest in [filtering] content that is Refused Classification’ (emphasis added). Senator Conroy made corresponding statements on SBS’s Insight and Triple J’s Hack programs. In the latter, he insisted that this has always been the case.

Even if that is the case, the nature of Internet filtering is such that any blacklist will have to be secret, mistakes will be made, and circumvention will be easy. And RC is a broad category that includes material that many Australians find unobjectionable.

Perhaps it would be better if each Australian could decide for him- or herself what is objectionable. This is how the Internet has always worked in Australia, and we haven’t descended into anarchy yet.

Read full post »

Restricted access systems in relation to R 18+ content require proof of age and, in any event, must apply to the content itself and not to a link to the content.

After ACMA issued a final link-deletion notice to EFA in relation to the AbortionTV website, it came out that the Classification Board had classified the relevant page R 18+. A number of people have suggested that you could still link to the AbortionTV website if you made the link subject to a restricted access system.

There are two problems with this under the current system in Schedule 7 of the Broadcasting Services Act 1992 (Cth).

First, a restricted access system in relation to R 18+ content must require applicants for access to that content to provide proof of their age, not merely a declaration. Users aren’t going to hand out valid credit card numbers or copies of their birth certificates just to view links.

Second, the restricted access system must apply to the R 18+ content itself, and not to the link to the R 18+ content. That is, R 18+ content that’s not subject to a restricted access system is prohibited content. A link that’s subject to a restricted access system that points to R 18+ content that’s not subject to a restricted access system is still a link to prohibited content.

The test that ACMA applies when determining whether to issue a link-deletion notice is whether there is a link hosted in Australia that points to prohibited content. It’s not relevant whether the link itself is subject to a restricted access system or not.

I have provided details below.

Proof of Age

Under clause 14, ACMA has power to declare what is a ‘restricted access system’ in relation to particular classes of content. The most recent declaration is the Restricted Access System Declaration 2007.

Among seven requirements for restricted access systems in relation to R 18+ content, clause 13 provides—

• (1) Unless subsection 14(2) or (3) applies, the access-control system must verify that the applicant is at least 18 years of age by:
  • (a) requiring the applicant to provide evidence that the applicant is at least 18 years of age; and
  • (b) applying the risk analysis described in section 15.

So, a restricted access system in relation to R 18+ content must require proof of age, not merely a declaration. Note that subsections 14(2) and (3) merely provide that the access-control system need not verify the applicant’s age more than once.

What types of evidence? Clause 15(2) provides—

• The risk analysis must identify and assess the risk that a kind of evidence of age submitted to the access-control system could be held or used by:
  • (a) a person other than the person it purports to identify; or
  • (b) a person who is younger than the age which the form of evidence attributes to the person being identified.

Examples of sufficient evidence might include valid credit card numbers or copies of birth certificates, which, of course, users won’t be willing to provide to just any website.

Restricted Access Systems Don’t Relate to Links

Clause 20(1) states that content is ‘prohibited content’ if, among other alternatives—

• (b) both:
  • (i) the content has been classified R 18+ by the Classification Board; and
  • (ii) access to the content is not subject to a restricted access system

From this, it’s clear that R 18+ content is prohibited content only if it’s not subject to a restricted access system. Division 5 then requires ACMA to issue link-deletion notices where—

• (a) end-users in Australia can access content using a link provided by a links service; and
• (b) the content is prohibited content; and
• (c) the links service has an Australian connection

So, the test is whether the content that is linked to is prohibited content, not whether the link itself is prohibited content.

If the content linked to were classified R 18+ and were subject to a restricted access system, then it wouldn’t be prohibited content and no link-deletion notice would be issued for the link.

However, if the content linked to were classified R 18+ but weren’t subject to a restricted access system, then it would be prohibited content and a link-deletion notice would be issued for the link. Here, it’s irrelevant whether the link itself is subject to any restricted access system.

In other words, the test for issuing a link-deletion notice is not whether you have a link that’s not subject to a restricted access system to R 18+ content. It’s whether you have a link to R 18+ content that’s not subject to a restricted access system.

There are only two scenarios for linking to the AbortionTV content that won’t risk a link-deletion notice. First, you can host the link itself outside of Australia. Then, the links service won’t have an ‘Australian connection’. Second, you can ask AbortionTV to require visitors to prove that they’re over 18. That won’t happen.

Read full post »

Today, ACMA issued EFA with a final link-deletion notice for linking to the blacklisted AbortionTV page, which it has classified as R 18+.

Electronic Frontiers Australia (EFA) announced that its host had received a final link-deletion notice from ACMA today directing them to remove a link to a page on the AbortionTV website that EFA included in an article appropriately titled ‘Net censorship already having a chilling effect’.

EFA has since complied, replacing the original link with the following:

REDACTED. The original title of the page was “AbortionTV Pictures #6”, and can presumably be found using major search engines.

One of the ironies is that by issuing these notices, ACMA has probably driven more traffic to the AbortionTV website than any other organisation. If googling the text quoted above is too much trouble, people can always use the notice itself as a handy reference.

The other interesting thing about this notice, as Mark Newton points out, is that Andree Wright from ACMA testified at a Senates Estimates hearing on 23 February 2009 that the AbortionTV site was added to the blacklist because there was a substantial likelihood that it would be refused classification.

From memory, it was a page that contained no text, just pictures. The pictures were of aborted and dismembered foetuses. The graphic nature of the presentation without any contextualisation of the images meant that the images were judged on their own merits for their impact and their severity. We have kept a careful watching brief on the way the Classification Board has handled those types of images. On a previous occasion, we made a referral to the Classification Board on very similar material and it came back as ‘refused classification’. So we juxtaposed the two decisions and judged it on the images.

That meant that, at the time it was added to the blacklist, the content was ‘potential prohibited content’, which meant that the Classification Board had not actually classified the content.

This latest notice states that the content is ‘prohibited content’. That means that the Classification Board has now actually classified it, and the notice states that the classification is R 18+. Presumably, the Board classified this content after ACMA issued Whirlpool’s host an interim link-deletion notice.

Download: Sublime IP Final Link-Deletion Notice (298 KB)

Update: Nic Suzor pointed out that a summary of the Classification Board’s decision is available here.

Read full post »

Forensic Innovations Inc announced on its blog that it has a tool that can identify headerless encrypted data, such as TrueCrypt volumes. It can’t.

Last week, Forensic Innovations Inc announced on its blog that it has a tool that can identify headerless encrypted data, such as TrueCrypt volumes. Yesterday, this story was picked up by Slashdot.

Good ciphers, like AES, output ciphertext that is computationally indistinguishable from random data. An encryption tool that properly implements such a cipher to generate headerless encrypted data will also produce output that is computationally indistinguishable from random data.

For Forensic Innovations Inc’s tool to work, it would have to be able to distinguish between random or pseudo-random data and the output of ciphers like AES. I ran a quick test to see whether it could. It can’t.

I downloaded a trial copy of FI TOOLS for Windows 2.23. I then generated two 10 MB files filled with pseudo-random data. I used a PowerShell script to do this:

$b = New-Object byte[] 1024

$fs = New-Object System.IO.FileStream "C:\Test\random-1.dat", Create
$r = New-Object System.Random
1..10240 | % {
    $r.NextBytes($b)
    $fs.Write($b, 0, 1024)
}
$fs.Close()

$fs = New-Object System.IO.FileStream "C:\Test\random-2.dat", Create
$r = New-Object System.Security.Cryptography.RNGCryptoServiceProvider
1..10240 | % {
    $r.GetBytes($b)
    $fs.Write($b, 0, 1024)
}
$fs.Close()

The first file, random-1.dat, is filled with pseudo-random data generated by the System.Random class from the Microsoft .NET Framework. This class provides a very weak random stream. It should be distinguishable from a truly random stream.

The second file, random-2.dat, is filled with pseudo-random data generated by the System.Security.Cryptography.RNGCryptoServiceProvider from the Microsoft .NET Framework. This class provides cryptographically strong pseudo-random data that should be computationally indistinguishable from truly random data.

Finally, I created a third file, random-3.dat, which was a 10 MB headerless TrueCrypt volume created using the default settings and using a strong random password.

Here is the result:

As you can see, the tool identified each of the files as headerless encrypted data. Only random-3.dat was actually headerless encrypted data. In other words, the tool cannot distinguish between pseudo-random data and headerless encrypted data.

Read full post »