Web Protection Categories, crossing the line into content censorship

Question

While testing which categories are blocked by the Web Protection component of SAV (via http://www.sophostest.com/index.html ) I've found these categories are blocked: 
 Call Home Criminal Activity Eicar Malware Phishing and Fraud Spyware Violent 
 Most categories here seem obvious for an AV to protect from, as in "hosting malicious content" and/or representing a "significant security concern" , I've interpreted these as content that is a threat to the security of my computer and my personal information. As a user we have absolutely no control in which categories to allow or disallow, more, we have no information about which categories are being blocked. The description the software presents makes sense for all categories except two. 
 "Criminal Activity" and "Violent" are crossing a line I would no expect an AV to cross, it's blocking on the nature of the content not because it offers any threat to the security of my computer or my personal information, this enters the realm of content censorship, and again, it doesn't say anywhere this behaviour is to be expected. I shouldn't have to say this, but I do not have any intention to visit such sites, but that's not the issue. I would like to either: a) Be able to select which categories are blocked b) Have "Criminal Activity" and "Violent" be removed from the blocked categories, because it's content censorship If neither, at least make it clear what exactly is SAV is actually expected to be blocking. Cheers!

bobcook · Accepted Answer

Hello Specimen, 
 
Thanks for raising this important topic. I can assure you that we aren't attempting to censor the web. You have run into an interesting situation that is somewhat specific to our web categorization test site, and not entirely reflective of the real world. 
 
To be clear, we apply two attributes to web sites: category, and risk. The category is intended to classify all the web sites of the world into 50+ groupings. In our business products we allow IT administrators to manage each category individually. The Home Edition product does not use this information at all. 
 
The second attribute, risk, is what all of our products utilize for security purposes. We classify web sites into different risk levels, and any site marked as "high risk" (usually because of known security issues present or past) are blocked. This is true for our business products as well as the Home Edition. 
 
In the case of our test site, several categories are tagged "high risk" as well as having a specific category applied. In the real world, its possible to have a web site categorized as Violence that is not considered "high risk". Don't ask me for examples, I have absolutely no idea where to even begin looking. 
 
Likewise, a web site may be categorized as News (generally safe) but also be "high risk". We would block that site for the same reason. 
 
Our team of researchers in SophosLabs have the flexibility to apply these two parameters independently. These two parameters are independent, although in some cases (Spyware) there is high correlation with "high risk". 
 
Hope that answers your question.