The period for submitting comments on the botnet blocking plan of the CRTC (Canadian Radio-television and Telecommunications Commission) is over. Reading the interventions, it is clear that Internet service providers (ISPs) do not all see the situation the same way. Some even go so far as to question the CRTC’s legitimacy in implementing such a program.
Mandatory blocking, no transparency required
In a document signed by Mr. Dennis Béland, Vice-President, Regulatory Affairs, at Vidéotron, we read that “it is possible for the Commission to frame network-level blocking based on a [sic] series of simple and uniform rules.”
Vidéotron advocates a domain blocking approach. Under this approach, an entity yet to be determined would have to maintain a list of malicious domain names to block. According to Mr. Béland, this method should be favoured “because it is already deployed in our network, which will allow the framework to be deployed at lower cost and implemented quickly. This technique strikes a balance between effectiveness and ease of deployment and will not result in additional costs for Internet service subscribers.”
The Québecor Média subsidiary proposes universal blocking, with no opt-out. In its view, it is not desirable for such a system to be optional. Vidéotron considers that, since it is not optional, “transparency measures are not required.”
ISPs against blocking
Vidéotron’s main competitor in Quebec takes a diametrically opposed position. In its document, Bell Canada challenges the CRTC’s legitimacy to implement such a program. It considers that a centralized framework imposed by the Commission is “in opposition to the cooperative and collaborative approach adopted by the government”([^1]:Translated from English by the author) on cybersecurity. Bell refers to the stakeholders identified in the National Cyber Security Strategy, published in 2010, and seems to take malicious pleasure in pointing out that the CRTC is not among them.
Bell takes a dim view of having a blocking program overseen by an independent entity. “The time between the detection of a malicious botnet and the application of mitigation solutions can sometimes be very short.” The need to notify and obtain approval from an external entity would hinder its ability to respond effectively to threats.
Bell opposes the possibility of an opt-out system for the blocking program, but for very different reasons than Vidéotron. Currently, a domain deemed dangerous is blocked without knowing the identity of the person requesting it. Giving customers a choice would therefore involve collecting more personal data than is currently required.
Telus, in its report to the CRTC, considers that blocking botnets does nothing to address the root of the problem. It is a reactive solution applied once devices have already been infected. The company believes the government should put more effort into establishing and enforcing security standards for manufacturers of Internet-connected devices. “Adopting a proactive approach will have a more significant impact on reducing botnet attacks than the proposed network-level blocking.”
Cogeco clearly positions itself in favour of net neutrality. The Montreal-based company is concerned that government-imposed additional blocking rules could erode net neutrality and have the potential to weaken privacy protection.
On the independents’ side
Xplornet expresses its reservations about the CRTC’s plan. For the company, which specializes in rural coverage, blocking will not be effective, because it only tackles the problem once the damage is done. It therefore advocates a prevention approach to protect the public. It is concerned that such a framework would give a false sense of security.
Teksaavy, one of the country’s main independent ISPs, also opposes the plan. The company, which has been present in Quebec since 2020, considers that network-level blocking violates the basic principles of a free and open Internet. It believes such a framework would undermine net neutrality without really increasing Internet security.
Several other parties also filed submissions. The CRTC now has the task of analyzing these interventions. The task will not be easy, as blocking is far from unanimous among the Internet service providers who will be responsible for applying this measure if the Commission decides to adopt it.
photo credit: Martin Abegglen - CC license
