‘It doesn’t have to be all or nothing’ — ExpressVPN launches privacy-first tool to combat CSAM | Daily Reports Online
- ExpressVPN develops a CSAM blocking tool in partnership with IWF
- OpenBoundary blocks known CSAM domains at the DNS level
- The tool is open-source so other services can integrate it
As regulators worldwide scramble for solutions to boost online child safety, VPN services are frequently targeted due to their alleged role in facilitating anonymous access to illegal content.
ExpressVPN is now taking a proactive stance against one of the internet’s most heinous crimes by building a dedicated tool that halts access to child sexual abuse material (CSAM).
The provider partnered with the Internet Watch Foundation (IWF) to develop OpenBoundary, a server-level toolkit designed to help network operators restrict access to verified CSAM domains safely and transparently.
ExpressVPN maintains that OpenBoundary is built on a privacy-first infrastructure, introducing network-wide safeguards without altering or infringing upon its strict no-logs policy.
Dr. Peter Membrey, Chief Research Officer at ExpressVPN, told TechRadar that the move is a “safe first step to open the conversation” between technologists, child safety groups, and regulators.
He added: “We believe there is no good reason for this material to exist or to traverse our networks — but, it doesn’t have to be all or nothing.” He believes OpenBoundary provides regulators with “sharper tools” that do not weaken encryption or user privacy in the name of safety.
As part of the “Not on My Network” initiative, ExpressVPN is open-sourcing the code for OpenBoundary. The goal is for other VPN services, internet service providers (ISPs), and cloud platforms to adopt the framework.
Fellow Kape Technologies brands CyberGhost and Private Internet Access (PIA) are the first to join the mission. Kerry Smith, CEO at the IWF, applauded the innovative approach, saying the move “balances its commitment to online child safety and online privacy.”
How OpenBoundary works
The technical implementation of OpenBoundary is straightforward. The tool operates at the DNS level, blocking domains that appear on the human-verified IWF list.
This happens automatically when a user connects to the VPN app, preventing known CSAM domains from loading. Membrey explains that if a user attempts to visit a flagged site, the system simply returns an error stating the site does not exist.
Crucially, this process involves no traffic inspection, monitoring, or breaking of encryption. Instead, it is a straightforward domain block.
While some advocates argue that any content filtering contradicts the “neutral” nature of a VPN, Membrey says he is “comfortable blocking” sites exclusively hosting CSAM material.
“We don’t want this stuff going through our network. We don’t want to be part of this,” he told Techradar.
Bridging the gap between safety and privacy
Until now, the battle against CSAM content has largely focused on the detection of illegal materials.
In the EU, the proposed law nicknamed Chat Control, which is now in its final legislative step, has attracted strong resistance from politicians, scientists, and technologists alike. Now, the UK is also fast-tracking CSAM scanning obligations under the Online Safety Act.
In both cases, critics have pointed out how today’s detection technlogies — whether that’s client-side scanning or hash matching — are technically ineffective, while inevitably hurting the privacy and security of all online services that are supposed to implement these checks.
ExpressVPN’s new tool certainly doesn’t come as a technical solution to CSAM scanning and detection, but it’s rather a way to recalibrate the discussion towards what we can do now. A first step to mitigate the issue and bridge the gap between privacy, security, and children’s safety on the internet.
Commenting on this point, Membrey told TechRadar: “Our pitch is simple: ‘Not on my network.’ We urge lawmakers to collaborate and innovate before legislating and regulating. It is much easier to undo a failed technological solution than to undo a blanket law passed by a parliament or congress.”
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
