The ease with which a system can be by-passed, will be principally determined by the system selected by the ISP itself. What may be easy in some cases may not apply to others.
Among the products tested was the Marshal M8e6 Deep Packet Inspection content filter, this baby is an exceptional product that can not only perform simple URL re-direction, P2P Contennt filtering, but interrupt your connection to various other sites and services based upon the content of the information buried in the packet stream. And believe me, this product was tested.
With the ACS recommending a multi-faceted approach things could get reasonably difficult.
DNS Re-direction
One example of a simple product might be one that employs re-direction. the product sees your DNS request to access a site, it compares that site to it's blacklist and if its present re-directs you to a 'Whose being a naughty boy then' page.
By-Passing this may simply be a case of changing your DNS server in your connection settings to one of the numerous public OpenDNS services (be careful though this may open you up to serious risk). The major risk behind this is that you are trusting someone external to your ISP to handle your DNS requests. Some DNS servers may be poisoned or have records that have been tampered with, you may think you're logging on to your banks website but in fact its a site thats going to log your password and username. This stuff does happen.
But if you combine DNS re-direction with Deep Packet Inspection, the product can simply re-direct your request if your TCP/IP stream contains any reference to a blocked site particularly in the packet header.
By-passing Deep Packet Inspection
Its possible by encrypting your traffic, and by using services such as TOR, however TOR can also be blocked from operation. TOR is also run by volunteers and can be very slow.
SSL Proxy-ing
This is a novel concept where you access an SSL secured site through what is effectively a third party device. Your encrypted session is established with the third party device, which then in turn establishes a connection to the secure website. everything appears to be functioning normally, but the device in the middle can see all your traffic plain as day and filter it.
The trick would be for the proxy to be a CA. The user would grab a CA client certificate from the proxy (using a magic URL) and install it in their browser as a trusted CA. The proxy could then generate synthetic certificates on the fly for SSL sites that the browser would trust. This would allow real SSL proxying: the browser would talk via SSL to the proxy using certificates generated by the proxy, and the proxy would talk via SSL to the requested sites using (and verifying) their own certificates.
To my mind the most likely options for by-pass involve the utilisation of VPN connections to resources outside Australia, but these connections can also very simply be IP blocked, especially in circumstances where no good legal reason can be found/argued for permitting access to the off-shore resource.
As I said Ease is relative, it is depnedant entirely upon the type of product deployed at the ISP.
