Pursued by child protection associations who accuse them of not verifying the age of visitors when it has been a legal obligation since June 2020, several pornographic sites are threatened with blocking. A recent decree allows the CSA to ask them to comply, under penalty of paying a heavy fine and blocking them, via the ISPs. But is it really feasible, technically, without any way to circumvent the system? Nothing is less sure.

Why block porn sites?

Since July 30, 2020 in France, it is an offense for a site to allow its Internet users to access pornographic content without verifying their age. The law on domestic violence stipulates that they may be blocked or dereferenced at the request of the CSA, if they do not put in place strict control, other than a “simple declaration”. But without imposing any particular method to be used.

A year later, it is clear that the majority of pornographic sites remain accessible to minors. It must be said that the means of verifying the age of visitors remains a puzzle, in the absence of real guidelines. However, it is not the ideas that are lacking. The Pornhub site has listed several of them: using an official identifier such as FranceConnect, making a micro-payment by credit card, obtaining an SMS code from an operator, or sending a selfie and/or an identity document to a system facial analysis.

To push X sites to go a little faster and find a solution, the government published a decree on October 8, 2021. It allows the CSA to send a formal notice to adult sites, asking them to in accordance with French law, and therefore to verify that Internet users are over 18 years old, within 15 days. On pain of being punished by 3 years' imprisonment and a fine of 75,000 euros, as well as having their sites blocked. At least, their access from France.

How could the CSA block the sites?

To block pornographic sites, the CSA will be able to seize the president of the court of law of Paris, so that it makes inaccessible the sites. And concretely? The decree authorizes blocking "by any appropriate means, in particular by using the blocking protocol by domain name (DNS)." This technique, which is also called “blocking by domain name”, does not consist in closing a site, but just in making it inaccessible in France. Instead, Internet users would be redirected to a CSA information page "indicating the reasons for the blocking measure".

How would that work, technically? First you have to understand what a DNS is and how it works. A DNS is a system that consists of "translating" the URL address (a domain name) of a site into an IP address (a series of numbers and letters). An IP address being the technical and unique identifier of a server (that of the targeted site). This system is useful because it makes it easier for Internet users to remember the address of the site of their choice (between a URL and a series of 000s and letters, take your pick). When you enter a URL address in your browser, your “DNS resolver” (configured in your computer) queries the root DNS server.

In other words, just as it would consult a telephone directory, it interrogates the DNS database, in order to associate the URL address with the IP address, and therefore with the servers, of the requested site. This therefore allows your machine, to which the address has been “translated”, to open the site and then display it on your screen. Now, keep in mind that Facebook's recent giant outage was related to a DNS problem, and you'll already see why this system is crucial to accessing a site.

First parade: change DNS

The decree of October 8 proposes that justice requires Internet service providers (ISPs) to modify the DNS, making it impossible to find blocked sites. The idea: to make the DNS resolver lie, so that it does not respond correctly to the request made by the Internet user. It is therefore a question of modifying the routing of traffic, betting that Internet users will not go any further, not thinking for a moment that it is not really a question of a blockage - since the site targeted still exists, somewhere. And that the blockage with which they are confronted consists only in directing their request elsewhere - here, the site of the CSA.

The technique of DNS blocking is becoming more and more common. So far, it has mainly targeted sites advocating terrorism, sites carrying child pornography content, or even gambling sites that do not have a license to operate in France, as well as sites offering to see streaming pirated movies.

However, Internet users have already found a solution to this system, in particular those living in countries with authoritarian regimes and wishing to circumvent censorship. Just do the same thing as the ISPs: modify the DNS.

Concretely, the idea is to change DNS servers - and to replace those you use (provided automatically by your ISP, via your router or your box) by others, located outside France, which would thus not take into account the CSA guidelines. To do this, you have to get your hands dirty and take a look at the configuration of your computer, more precisely the network connection parameters, and the properties of the TCP/IP protocol. More simply, it is possible to go through an application like DNS Jumper.

On smartphone, same thing by configuring another DNS server for your Wi-Fi connection, or using an application such as DNS Changer for your mobile connection (3G/4G/5G).

Obviously, not everyone will be able to change their DNS on their own. This is also what the system of blocking by domain name, which takes advantage of the ignorance and incompetence of the general public to operate, relies on. You should also know that if it is legal to change your DNS on your machine, it can be risky: indeed, instead of using your ISP's DNS resolver, you rely on a third party... risks and perils.

But don't panic: ordinary Internet users have already found another solution: VPNs.

What if you simply go through a VPN?

VPNs (Virtual Private Networks), which make it possible, among other things, to pass the user's Internet connection through servers located in the country chosen by the latter, are already the favorite choice of Internet users, cases where porn sites comply and implement age restriction systems. Indeed, since such age verification systems are only in place in France, it should suffice to use a VPN to hide the IP address, lie about one's location by passing one's communications on computers based in another country, and ultimately display the targeted site in its unrestricted version.

It is therefore not a question here of circumventing the blocking of X sites which would be sanctioned by the CSA by thwarting the system (based on the DNS), but of thwarting it by displaying the website in the version accessible in another country - uncensored, not "blocked".

Finally, there will remain for the less courageous Internet users a simpler, but more risky solution: to go to other sites, which are not blocked or do not control the age of visitors. More dubious websites, because less visible, but that's another story.

Finally, it is difficult not to be skeptical of what is planned by France to "protect" minors on the web. If we base ourselves on the example of the late Hadopi, then it's a safe bet that this censorship will quickly flop.