Pakistan's effort to censor YouTube over the weekend ended up briefly blocking the popular online video site around the globe.
"For about two hours [on Sunday], traffic to YouTube was routed according to erroneous Internet Protocols, and many users around the world could not access our site," said a YouTube spokesperson via e-mail. "We have determined that the source of these events was a network in Pakistan. We are investigating and working with others in the Internet community to prevent this from happening again." On Friday, the Pakistan Telecommunication Authority directed the country's Internet service providers to begin blocking YouTube for distributing offensive content.
The country's ISPs carried out that order by altering Internet routing information and the changed data propagated to PCCW, an ISP based in Hong Kong, and from there across the Internet, thus preventing Internet users in other countries from reaching YouTube. Informed of the error, engineers for PCCW fixed the problem, according to the BBC.
YouTube has been blocked many times before by the likes of Morocco, Thailand, and Turkey and the company's response suggests an earnest if low-key effort to avoid similar incidents in the future.
But a number of people posting to the mailing list the North American Network Operators Group, an informal association of ISPs, worry that the incident demonstrates the insecurity of an important Internet routing protocol known as the Border Gateway Protocol (BGP).
"This is a great example of global politics getting in the way of honest corporatism," said Sargun Dhillon, a telecommunications consultant, in a message posted to the North American Network Operators Group mailing list. "This is also an example of how vulnerable the Internet is, and how lax [Internet service] providers are in their filtering policies."
In another NAOG message, Steve Bellovin, a Columbia University computer science professor, said that many in the Internet technical community have been warning about routing problems like this, which have happened before. He called for deployment of S-BGP, a more secure version of the routing protocol, despite deployment and operational issues that still need to be resolved.
"The question is this: when is the pain from routing incidents great enough that we're forced to act?" Bellovin wrote. "It would have been nice to have done something before this, since now all the world's script kiddies have seen what can be done."
It may be that the world's script kiddies, or perhaps more knowledgeable hackers, already are exploiting BGP weaknesses to hijack Web sites. The Internet Alert Registry, an online tool for scrutinizing Internet routing changes, shows dozens of suspicious changes that affect Web sites happening every day (There's also the Prefix Hijack Alert System). Even if data entry errors explain many of the routing changes listed, it's a safe bet that malicious hackers are intrigued by the possibilities raised by the weekend YouTube take down.