Internet Content Rating Association

Document status:
This is version 1.1 and includes corrections and suggestions from Michael Radwin to whom I am most grateful. Any further feedback, positive, negative or indifferent is welcome.

Introduction

In order to label a site effectively, each and every page on the site needs to carry a label... which is wholly impractical for the majority of professionally run, commercial sites. There are essentially three options:

Policy maker's overview

This document sets out the technical detail of the most effective, efficient and flexible way we know to label a large website or network of properties. It details how to set ratings labels to be sent with content at all levels from "default" which would be applied to all content served from a given physical server through to individual page level via domain names, branches and file groups.

If Apache servers are used (the majority of websites use this software), it is possible to put in place rules such as: any URL that includes the word chat should have this label while any page that ends in -pg should have this label. These labels can even be maintained and stored in a separate file if required.

The other important server - Microsoft IIS - provides a great deal of flexibility too.

Whilst this document gives technical detail, the policy implications are explained in each case.

Webmaster's overview

The key concept behind labelling websites is pretty straightforward - content is delivered to the client with a set of encoded descriptors which filtering software can block or allow, depending on parental settings. Sounds like a censor's dream? No - and here's why:

In order for content to be labelled, the rating must either be delivered with the content, or already be in the filter's cache. If a filter application is to store a label in cache, extra data needs to be sent telling the filter which URLs are covered by the label. Configuring your server to include PICS labels in the HTTP header means that no such extra data need be sent - just send the rating with each file and that's it.

When the PICS standard was developed by the W3C, it was assumed that this would be the method by which labels were delivered. Meta tags are a workaround for people who don't have access to their server configurations.

Label generation

The information below is enough (just) for you to simply write an ICRA rating label - and ICRA doesn't mind a bit if you do that. However, there are easier ways and, from our point of view, preferable ways.

At the time of writing the ICRA website includes a labelling engine which interfaces directly with our database. Alternatively, there is what we call the Offline Form - a self-contained HTML/JavaScript tool which you can use to bash out ICRA labels and HTML meta tags at will. Further tools, including variations of the above will be available in the (very) near future.

At present, these tools both turn out meta tags from which you will need to extract the key elements for use in HTTP headers. The key thing is that they include the rating questionnaire - tick the boxes, hit go and out comes your label.

Use of ICRA labels, whether generated automatically or written by hand, are subject to the organization's terms and conditions which are available on the ICRA website.

Elements of a PICS label

RATING SERVICE URL A quoted URL that is always in double quotes (which plays merry havoc with the web authoring tools but never mind). As it is a URL, it serves as a unique identifier for the rating service as well as being a location from which information about the service can be obtained. In ICRA's case, the rating service URL is https://icra.org/ratingsv02.html.

l This is a lower case "L" and is short for labels (optionally you can write the word labels in full). This declares the beginning of the label or list of labels that follow, all of which use the defined rating service.

r Short for ratings (which optionally you can write in full). This is the actual rating according to the rating service.

Example 1: A basic ICRA label

The ratings shown in this example are ICRA-code for "none of the above" in all categories. So this label is making a positive statement that the site contains:

As mentioned earlier, if labels are used within an HTML meta tag, additional information is added to control how filtering applications should cache and apply those labels to content which is not individually labelled.

As ICRA grew out of the old RSACi rating system, which at the time of writing is still the default service embedded within Microsoft Internet Explorer's Content Advisor, and is included in other older software (NetWatch in Netscape 4.x, NetNanny and CyberPatrol), it is advisable, but not essential to include RSACi elements too. Such a combined label looks like this:

Example 2: A combined ICRA/RSACi label

'(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'

Again, the RSACi ratings, which are scalar and subjective in nature, are detailed at https://icra.org/decode.html. It is perfectly possible to extend these labels to include elements from other PICS ratings services if you wish.

Extracting the actual PICS label from an ICRA meta tag

Just to make this explicit - if the label generator you are using doesn't have the option to just generate the string you need for use in HTTP headers, you'll get a meta tag that looks like the one below. The highlighted elements are needed for HTTP response headers.

Apache configuration

The following explanation assumes you have at least a grounding in Apache configuration.

Example 3: Setting a default label for all content served from a single machine

Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'

Put this in your config file outside any block directive and the job's done. Every file served will include this label in its HTTP header.

Header set pics-label: Fairly self explanatory - this tells Apache to set the value of pics-label header to the following value. By using set, as I recommend in all cases rather than append or add, any previously set label is overwritten.

'(pics-1.1 "http://www...)' The label itself, or as far as Apache is concerned, the value of the pics-label header. Notice that it is enclosed in single quotes. You must use single and double quotes as shown here. Unusually for coding, PICS does not permit you to swap their usage.

Controlling labels using Apache's block directives

<none> i.e. act as a default
<Directory> and <DirectoryMatch>
<Files> and <FilesMatch>
<Location> and <LocationMatch>

These block directives support wildcards - that is, "?" to match a single character and "*" to match any number of characters; as well as Regular Expressions for detailed pattern matching. Only <Files> and <FilesMatch> can be set within a .htaccess file. We'll return to these issues shortly.

The order of the above list is important. <Directory> is overridden by <Files> is overridden by <Location>.

For full details of block directives, please consult the official Apache documentation, in particular http://httpd.apache.org/docs/sections.html.

The key thing about all this of course is that you can apply different labels to different sections of your content. As the <VirtualHost> directive does not support HTTP Response Headers, the way to label a given website on a server is to apply a <Directory> block directive thus:

Example 4: Setting headers within a Directory block directive

<Directory dir>
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'
</Directory>

To label a whole website, dir should be the absolute path to the website's root directory on the server.

The same block directive can be used to label a particular section of a website if all its files are stored in a given directory - just set up another <Directory> block directive with dir set as appropriate. As a facetious example, you might want to label www.animals.com/birds/ differently from www.animals.com/insects/.

Apache processes <Directory> block directives in increasing order of the number of elements. So that <Directory "D:/root/website1"> is processed before <Directory "D:/root/website1/section">. Therefore, the label you intend to apply to the section directory will overwrite the previous one correctly.

<Files> and <Location> block directives are processed in the order in which they appear in the config file.

Example 5: Setting headers for a specific file

For our purposes, this is just a logical extension of the <Directory> block directive. As an example imagine you had a site which should carry rating A, but that your index page, uniquely, should carry rating B. This would take care of it:

<Files index.html>
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))' </Files>

Notice that the <Files> block directive takes a relative path (to DocumentRoot) not an absolute one.

Example 6: Using the <Location> block directive

Depending on your situation, this is perhaps the most easy to use block directive since it takes a URL as its argument rather than filenames and paths on your server. Labelling a website called www.testsite.com becomes:

<Location www.testsite.com/>
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'
</Location>

Using Wildcards and Regular Expressions

The examples so far have all been very specific. Apache block directives, however, are far more flexible than we have hitherto discussed. This works very much to our advantage in terms of labelling.

For example, the ICRA labelling matrix includes a section on chat. ca 1 codes for unmoderated chat (or message boards), cb 1 codes for moderated chat and cz 1 declares that there are no chat facilities or message boards. So you might have a default label for most of your site that declares cz 1, but you might also have a full-blown chat facility and the chances are that all the relevant URLs have the word chat in there somewhere. So use a wildcard like this:

Example 7: Using wildcards to label a type of content

<Location *chat*>
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (ca 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'
</Location>

With that in place, no matter how many times the pages are updated, improved and added to by the webmaster team, the chat areas will carry this label.

The danger here, of course, is that any URL that includes chat as four consecutive characters will carry this label. Bad news for a site about the Chatanooga Choo Choo.

This is where some interplay between different people in your organization becomes important! If the block directive in example 7 were amended simply to include a forward slash after the word chat thus: <Location *chat/*> then only content whose URLs included a path which at some point had chat immediately before a forward slash would carry this label.

Example 8: Using Regular Expressions

You can label all the content in the cats, dogs and any other site beginning with "a" through "m" with a block directive like this:

Meanwhile the warthogs, zebras and other latter end of the alphabet wildlife would be taken care of by this block directive:

(You've seen enough PICS labels now, these are just the opening tags for the block directive!)

Example 9: Setting up your own classification scheme

Using wildcards or regular expressions, it is possible to establish your own easy-rating system by simply naming files in a pre-defined way. For example, you might want to divide the content on your site into age-based categories. You may decide, for example, that some content on your site should carry a "PG" rating or a "12" rating. OK - set up these two <Files> directives:

and

Now any file on your site which has -pg. immediately before the file extension will carry your PG rating, any file with -12. immediately before the file extension will have a 12 rating. Any file with neither string immediately before the file extension would carry the default label (if you set one).

Return to top

Using a .htaccess file

It is possible to add/delete/amend PICS labels to web content without stopping/restarting the server by including HTTP Header Responses in a .htaccess file.

NB. Only the <Files> and <FileMatch> block directives can be used in .htacess files, not <Directory> or <Location>.

The pros and cons of using a .htaccess file are well understood (flexibility vs. server load). For our purposes here it is probably most applicable as a mechanism for labelling ephemeral content. However, the suggestion outlined below may be of interest to geographically diverse organizations and networks.

Just a suggestion

You might consider setting up a secondary .hataccess file specifically to handle the labels. Apache supports multiple .htaccess files so one option might be to include a configuration like this:

AccessFileName .htaccess, .filename

The .htaccess file would contain whatever you put in your .htaccess file now with the separate .filename file just used for labelling.

In tests, I used the following <Files> directives

<
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cz 1 lb 1 nz 1 oz 1 vz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'
</Files>

<Files *-12.*>
Header set pics-label: '(pics-1.1 "https://icra.org/ratingsv02.html" l r (cb 1 lb 1 lc 1 nz 0 oz 1 vz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))'
</Files>

Initially, these were tested with one block directive in each of 2 separate files: .htaccess and another file that I called .picslables (the name is not significant) - and it failed. Only the block directive in whichever file was declared second in the AccessFileName declaration in the config file worked. However, putting both block directives in a single file worked perfectly, whether this was declared first or second in the AccessFileName list.

The policy/organizational implication here being that this method makes it possible for a member of staff to maintain a labels file as a separate entity. Give that member of staff FTP access to the relevant directory on your server and s/he can take care of the whole job by remote.

Return to top

Configuring Microsoft IIS

Microsoft has made configuring IIS to include PICS labels very easy. The header information is set in the HTTP Headers property page using the Custom HTTP Headers function. IIS uses a hierarchical architecture with the HTTP Headers property page being configurable at the following levels:

Web server
Home directory / Web site (IIS 4 and later support multiple web sites)
Virtual directory
Folder
Page

To set the HTTP Header properties, select the required level, right click and select properties, then select the HTTP Headers property page. The screen shot below shows the HTTP Headers property page for the default website. As shown, an e-mail address and content expiry date can also be sent within the HTTP Header (these are unrelated to PICS labels).

IIS screenshot

Please do not use the [Edit Ratings] function. If you add the ICRA .rat file (the file that defines the ICRA rating system within the PICS standard) to the System32 folder, then you can see the ICRA ratings in the relevant dialogue. But IIS makes a mess of things by using the old RSACi identifier and writing in a whole jumble of a label which, not surprisingly, the filters can't make sense of. So please, just stick to the custom headers.

Click the Add button, enter pics-label in the Custom Header Name field and the label itself in the Custom Header Value field to give you something like this:

Custom Header in IIS

And that's it. If you have a dedicated server for your site and you can legitimately apply the same rating to every page and you use IIS - this one addition will label the whole site - without a meta tag in sight.

You can apply labels to directories and specific pages by going through the same process as required (just right click on the relevant directory or file). However, some of the "nice touches" that Apache offers - such as maintaining and storing the labels in a separate file are not available with IIS.

Return to top

Testing

The only practical way to test how effective your labelling has been is to browse the site with a filter activated. MSIE Content Advisor will do the job admirably but you will need to install the ICRA .rat file first. Alternatively, you can use our ICRAfilter freeware.

To actually see your HTTP headers, you can either use telnet, or a tool such as DJ Delorie's HTTP Header viewer.

Return to top

Professional website labelling

Contents

Introduction

Policy maker's overview

Webmaster's overview

Label generation

Elements of a PICS label

Example 1: A basic ICRA label

Example 2: A combined ICRA/RSACi label

Extracting the actual PICS label from an ICRA meta tag

Apache configuration

Example 3: Setting a default label for all content served from a single machine

Controlling labels using Apache's block directives

Example 4: Setting headers within a Directory block directive

Example 5: Setting headers for a specific file

Example 6: Using the <Location> block directive

Using Wildcards and Regular Expressions

Example 7: Using wildcards to label a type of content

Example 8: Using Regular Expressions

Example 9: Setting up your own classification scheme

Using a .htaccess file

Just a suggestion

Configuring Microsoft IIS

Testing