One challenge for DSLs leading on filtering and monitoring is trying to navigate the technical language and concepts of these systems and translate them into more familiar and accessible terms that relate to safeguarding children.
DSLs must have a sound understanding of their systems and the extent to which they protect children from harm. To help, we will be publishing a series of short articles which aim to explain some key filtering features and what they mean for keeping children safe.
In this first article, we will explore why HTTPS Decryption is critical for your filtering systems and for protecting children from inappropriate and harmful content.
When you browse the internet, you might notice a tiny padlock next to the website address, or that ‘https’ is at the start of most web addresses. This represents HTTPS, a security standard that encrypts (converts into unreadable code) internet traffic to keep personal data private. While encryption is great for data security, it presents an unintended hurdle for school safeguarding because the filtering system cannot inspect all the webpages in a website.
Without enabling HTTPS decryption, your school’s filtering is essentially operating with a blindfold. It can only see the domain name of a website (such as youtube.com or wikipedia.org), but it remains completely blind to the specific page or the exact terms a user types into a search bar.
For example, many Google Sites exist that contain thousands of games. If you have not enabled HTTPS decryption and allow ‘Google’ (which all schools probably do), then you will be allowing all the Google Sites with games on, because the filtering can only see that these are related to google.com, rather than identifying these as game sites.
Another example is that the US Justice website is categorised as "Government", which most schools will allow through their filtering. However, all of the documents associated with the Epstein files are housed on this website, and although we have categorised these pages as adult content, you will be allowing them in your school if you have not enabled HTTPS decryption, as the filtering cannot see the categorisation of these individual pages.
For a DSL, this creates a safeguarding issue because you will be allowing content that you have no idea about, some of which will be inappropriate or even potentially harmful to children.
Additionally, without enabling HTTPS decryption, if a pupil uses a search engine to look up concerning topics, the exact terms they searched for will remain entirely hidden from your logs. Therefore, reporting is limited.
Your filtering systems should allow you to identify, as a minimum:
device name or ID, IP address, and, where possible, the individual
the time and date of attempted access
the search term or content being blocked
By enabling HTTPS decryption, your filtering system securely unlocks and inspects the full URL path/string (e.g. bbc.co.uk/eatingdisorders), rather than just seeing the domain (e.g. bbc.co.uk). From a safeguarding perspective, this delivers two vital benefits. First, it allows the filter to block single, inappropriate pages within an otherwise safe website (such as the examples above). Second, it prevents the disruption of "overblocking" (which KCSIE asks you to avoid). Without decryption, if a single sub-page on a valuable educational site contains harmful content, IT teams will be forced to block the entire website, which directly restricts what children can be taught.
Enabling decryption ensures you can review individual pages and exact search queries in your safeguarding reports, allowing you to catch early warning signs and intervene before a risk escalates.
Take a look at our why decryption video for more information on why it is not only important for compliance but also for safeguarding children.
No, we would recommend your IT team enables decryption and then excludes any particular sites where the internet traffic should not be inspected, e.g. internet banking.
If you are a school that uses LGfL filtering, we have a Health Check on the filtering platform that will show you and your IT team if decryption has been enabled. We would strongly encourage DSLs to log in to SchoolProtect and look at this health check, or alternatively, please ask IT Support colleagues to show this to you.
For all other schools, please work with your IT leads to ensure decryption is fully rolled out across all school devices to meet Department for Education expectations. If you use the testfiltering.com tool as part of your filtering checks, this will also indicate if HTTPS decryption is enabled.