The maker of the Firefox web browser has told the government it has no plans to turn a controversial web privacy tool on by default in the UK, despite launching it in the US later in September.
Mozilla has announced it will make the tool, called DNS-over-HTTPS, or DoH, the default for all users in the US.
The decision has prompted concern in the UK, since the technology breaks many of the centralised filtering and blocking systems in place to prevent easy access to child abuse images, piracy and terrorist material, as well as optional parental controls.
In a letter sent to Nicky Morgan, the culture secretary, seen by the Guardian, Mozilla’s vice-president of global policy, trust and security, Alan Davidson, said the non-profit organisation “has no plans to turn on our DoH feature by default in the United Kingdom and will not do so without further engagement with public and private stakeholders”.
DNS-over-HTTPS is a significant rewrite to one of the basic layers of the internet, the domain name system, which computers use to turn a readable web address, such as theguardian.com, into an IP address that tells the computer which specific server to connect with. Typically, that search is carried out in an unencrypted fashion, which can allow attackers to hijack requests. By adding encryption, DoH adds extra security to the browsing process.
Davidson added in his letter to Morgan: “We do strongly believe that DoH would offer real security benefits to UK citizens. The DNS is one of the oldest parts of the internet’s architecture, and remains largely untouched by efforts to make the web more secure.
“Because current DNS requests are unencrypted, the road that connects your citizens to their online destination is still open and used by bad actors looking to violate user privacy, attack communications, and spy on browsing activity. People’s most personal information, such as their health-related data, can be tracked, collected, leaked and used against people’s best interest. Your citizens deserve to be protected from that threat.”
One side-effect of DoH is that it also bypasses UK web filters, which use the same technique, hijacking DNS lookups, to prevent easy access to websites blocked by internet service providers.
The Internet Watch Foundation, which provides ISPs with a list of websites that host child abuse imagery, for filtering purposes, expressed its concern over the technology for that reason. “We feel that the way in which DNS-over-HTTPS is proposed to be implemented could expose millions of people across the world to the worst imagery of children being sexually abused and could mean that the victims of such abuse could be exposed to countless sets of eyes,” a spokesperson told the tech site the Register.
The trade body for British ISPs even nominated Mozilla as one of its “internet villains of the year” in July over the issue. The ISPA cited as its reason “their proposed approach to introduce DNS-over-HTTPS in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK”.
A month later, the body withdrew the nomination and cancelled the “award” entirely, saying it “clearly sent the wrong message”.
Google has also announced plans to test DoH in its Chrome web browser, starting in October. The company will not turn on DoH for every user, but says it will default to DoH for those relatively technical users who have already chosen to switch their DNS provider to companies such as Google, Cloudflare and OpenDNS.
A Government spokesperson said: “Child sexual exploitation is an abhorrent crime that this Government is committed to tackling.
“While we look to support security and privacy online, it is vital that all sectors of the digital industry consider child safety when developing their systems and services. We are working with industry on solutions to any potential problems as part of our ongoing work to make the UK the safest place in the world to be online.”
AMD, Ballard Power and two other stocks that are breaking out