Leaky Content: An Approach to Show Unblocked Content on Blocked Sites in Pakistan - The Baloch Case (November 2006) [method pdf]
Leaky Content: An Approach to Show Unblocked Content on Blocked Sites in Pakistan - The Baloch Case (November 2006) [story pdf]
Two Providers, Two Internets. The Case of the United Arab Emirates (November 2006) [pdf]
The Internet Treats Censorship as a Malfunction and Routes around it? A Semi-manual Approach to Internet Censorship Circumnavigation (June 2005) [updated pdf]
A Censor's Network: Iranian Social, Political and Religious Sites. A Hyperlink Analysis Method for Censored Website Discovery (June 2006) [updated pdf]
Wednesday, December 13, 2006
Censorship Visualizations
Some censorship visualizations from govcom.org that were part of the Protect the Net event:
Friday, December 8, 2006
MSN's live.com
MSN's search engine at live.com detects the HTTP header, "Accept-Language", and then sets, via a Cookie, your "market". Currently, there are three Chinese options zh-cn (China), zh-hk (Hong Kong) and zh-tw (Taiwan). Your "market" will be set depending on which one of these your browser sends to the server. If your browser send the more generic "zh" without specifying a region, live.com will default to zh-cn.
Unlike Google which uses geolocation by IP address (e.g. if your IP adddress is allocated to Canada you'll be directed to www.google.ca) to redirect you to your localized Google (with the exception of China in which case you are redirected to the Chinese-language version of google.com), if your default setting is Chinese Simplified but you are not in China you will also be redirected to the zh-cn version of live.com. This is significant because the zh-cn version of live.com is the censored version for China. This means that people outside of China whose browsers are set to Chinese Simplified will receive, by default, the censored version of the live.com search engine.
You can, of course, go to the settings page and manually specify your market.
Still, this appears to be a problem because the English version of live.com seems to do a very poor job of indexing Chinese sites. I am not a Chinese speaker, so I would appreciate feedback on this. Also, are the HK and TW versions compatible (give the simplified vs. traditional and so forth)? Is it sufficient to expect Chinese simplified users to use the HK or TW versions of live.com?
Unlike Google which uses geolocation by IP address (e.g. if your IP adddress is allocated to Canada you'll be directed to www.google.ca) to redirect you to your localized Google (with the exception of China in which case you are redirected to the Chinese-language version of google.com), if your default setting is Chinese Simplified but you are not in China you will also be redirected to the zh-cn version of live.com. This is significant because the zh-cn version of live.com is the censored version for China. This means that people outside of China whose browsers are set to Chinese Simplified will receive, by default, the censored version of the live.com search engine.
You can, of course, go to the settings page and manually specify your market.
Still, this appears to be a problem because the English version of live.com seems to do a very poor job of indexing Chinese sites. I am not a Chinese speaker, so I would appreciate feedback on this. Also, are the HK and TW versions compatible (give the simplified vs. traditional and so forth)? Is it sufficient to expect Chinese simplified users to use the HK or TW versions of live.com?
Tuesday, November 28, 2006
ISPs Filtering in Canada
The Toronto Star reports:
Some good discussion over at Michael Geist's blog.
Canada's biggest Internet service providers have agreed to block hundreds of offending websites in an effort to stamp out child pornography.
Telecom companies such as Bell Canada, Rogers, Shaw, SaskTel, Telus, Videotron and MTS Allstream are partnering with Cybertip.ca to launch "Project Cleanfeed Canada" that will block between 500 and 800 offending websites.
Cybertip.ca, a national child sexual exploitation hotline, will provide the names of sites to be blocked. The hotline relies mostly on tips from the public.
Some good discussion over at Michael Geist's blog.
Saturday, November 25, 2006
COPA
I have not had much time lately, but I've been following the COPA proceeding via Seth's blog. Seth has posted copies of the expert report on filtering technology submitted as part of the government's case, remember, the one which touched off the Google subpoena controversy. (I've mirrored them stark-report.pdf stark-supp.pdf stark-supp2.pdf)
I only had a chance to briefly browse the report but one thing caught my attention. The reports estimates that only 1.1% of the websites indexed by Google and MSN are "sexually explicit adult entertainment websites". But 6% of queries in AOL, MSN,
and Yahoo! return at least one sexually explicit site. The report estimates "that 1.7 percent of the AOL, MSN and Yahoo! search results are sexually explicit and notes that this is higher than expected. the report notes that the "most popular searches retrieve far more than their share of sexually explicit results."
I found it rather odd that they used a search for "jenna jameson", which was the 20th most popular, as an example that if you search for things you may get porn in the results. in my view, if you search for "jenna jameson" you probably *want* to have porn in your results. How many of the "popular" search terms were actually intended to retrieve porn? Do these words have any relevence to terms that children would be using?
Was "Safe Search" (a type of filtering) turned on when searching in search engines? Given that the effectiveness of filtering was being tested, one would think that the report would distinguish between filtered and unfiltered search results.
There does not seem to be any effort to distinguish between trying to find porn and stumbling across porn.
Also, transcripts fo the case can be found here.
I only had a chance to briefly browse the report but one thing caught my attention. The reports estimates that only 1.1% of the websites indexed by Google and MSN are "sexually explicit adult entertainment websites". But 6% of queries in AOL, MSN,
and Yahoo! return at least one sexually explicit site. The report estimates "that 1.7 percent of the AOL, MSN and Yahoo! search results are sexually explicit and notes that this is higher than expected. the report notes that the "most popular searches retrieve far more than their share of sexually explicit results."
I found it rather odd that they used a search for "jenna jameson", which was the 20th most popular, as an example that if you search for things you may get porn in the results. in my view, if you search for "jenna jameson" you probably *want* to have porn in your results. How many of the "popular" search terms were actually intended to retrieve porn? Do these words have any relevence to terms that children would be using?
Was "Safe Search" (a type of filtering) turned on when searching in search engines? Given that the effectiveness of filtering was being tested, one would think that the report would distinguish between filtered and unfiltered search results.
There does not seem to be any effort to distinguish between trying to find porn and stumbling across porn.
Also, transcripts fo the case can be found here.
Friday, October 20, 2006
Canada: Access to Information Leaks
From The Star:
When Ken Rubin wanted to know what information Canada planned to share with the United States about airline passengers, as both countries beefed up security after 9/11, he applied under the federal Access to Information Act, as any Canadian has the right to do.
But Canada Border Services Agency officials in early 2004 seemed far more eager to alert Anne McLellan, who was public safety minister at the time, to Rubin's identity and to the possibility of embarrassing media reports, than to process his request, according to a memo he later obtained. That is plain wrong.
And when Canadian Press reporter Jim Bronskill more recently asked for information on Central Intelligence Agency aircraft landing in Canada, his name was shared among government officials during a conference call. Notes were later circulated to other officials, including top aides to Prime Minister Stephen Harper. That is wrong, too.
RSF Cuba Report
RSF has released a new report on Cuba. The report reflects experiences I have had testing the Cuban Internet, very few sites are blocked. The report notes that expensive, restrictive access and slow speed (lack of fibre optic cables due to the US embargo) are the main issues.
This, however, is the first time I've heard of the local software installed on PC's. The software described appears to be some sort of key logger.
One of the things I noticed a lot of people are doing, and it is noted in this RSF report is saving emails in a "draft" folder instead of sending them thinking that it will protect them from electronic surveillance. In most cases it is either irrelevant or not protecting you at all..
This, however, is the first time I've heard of the local software installed on PC's. The software described appears to be some sort of key logger.
One of the things I noticed a lot of people are doing, and it is noted in this RSF report is saving emails in a "draft" folder instead of sending them thinking that it will protect them from electronic surveillance. In most cases it is either irrelevant or not protecting you at all..
Friday, October 6, 2006
Petition Against Unwarranted Surveillance
Online Rights Canada has started a campaign against unwarranted surveillance. Sign it today:
Bill C-74, the Modernization of Investigative Techniques Act, would have allowed law enforcement agencies to obtain identifying information about you without a warrant. Even worse, it would have forced communications providers to build surveillance back-doors into the hardware that routes our phone calls, Internet traffic, and more. Tell the new Parliament not to erode your privacy - sign our petition today!
Friday, September 22, 2006
HK Filtering? Or Just an Error?
There have been a wide variety of reports suggesting that ntscmp.com is being filtered in Hong Kong. Global Voices has a great round-up of the discussion. It is clear from the discussion that users are reporting various results, some are able to access the site others are not.
ntscmp.com is hosted on a web hosting company in the U.S. Its IP address is 69.49.101.19 [reverse DNS - hostedc10.megawebservers.com] and at least 5,439 other domain names are also hosted on that IP address.
I issued traceroute requests from 7 different locations in Hong King (different AS numbers). None of the 7 were able to sucecssfully reach the IP address, but the last hop for all was outside of Hong Kong.
Unfortunetly, I was not able to test on PCCW (the biggest telecom in HK and ISP netvigator) -- the for which there is speculation as to a political motive for the blocking -- but the fact that there is inaccessiblity on other unrelated ISP's and that this is a result of something happeneing upstream it is unlikely that filtering is occuring, rather there are various network errors occuring.
If filtering is occuring (perhaps by upstream providers) it could be targetting one of the other 5,439 hosted on that same server. At this point there does not seem to be evidence of targeted filtering by Hong Kong ISP's.
ntscmp.com is hosted on a web hosting company in the U.S. Its IP address is 69.49.101.19 [reverse DNS - hostedc10.megawebservers.com] and at least 5,439 other domain names are also hosted on that IP address.
I issued traceroute requests from 7 different locations in Hong King (different AS numbers). None of the 7 were able to sucecssfully reach the IP address, but the last hop for all was outside of Hong Kong.
Unfortunetly, I was not able to test on PCCW (the biggest telecom in HK and ISP netvigator) -- the for which there is speculation as to a political motive for the blocking -- but the fact that there is inaccessiblity on other unrelated ISP's and that this is a result of something happeneing upstream it is unlikely that filtering is occuring, rather there are various network errors occuring.
If filtering is occuring (perhaps by upstream providers) it could be targetting one of the other 5,439 hosted on that same server. At this point there does not seem to be evidence of targeted filtering by Hong Kong ISP's.
Monday, September 18, 2006
ISP's vs. the State
The recent CRTC/Warman case has generated much discussion. One of the issues brought forward is that this case sought to have the CRTC authorize ISP's to voluntarily block sites, something that distinguishes this from government-mandated censorship. While true, it rasises several issues.
Firstly, it is not neccessarily a positive thing. ISP's have engaged in misguided vigilantism in the past, blocking content the ISP feels it is entitled to block (and doing so in a manner that blocked nearly 800 non-related sites in order to block just one site). ISP's are not equipped or qualified to make judgements on content and will always default to the lowest common denominator which has serious repercussion on freedom of speech and expression. Putting "the issue in the hands of ISPs" is not necessarily a better option than state censorship.
Secondly, as the case of China illustrates, the government will often authorize certain topics to be censored leaving the decision on what is specifically blocked to private firms. As the N.Y. Times reported:
Domestic Chinese blog providers in China have told me how they create lists of what terms to filter themselves. Governments delegate responsibilty for censorsing to ISP's and ICP's (content providers). Often, ISP's will become very conservative, blocking more than they are required to block. In Iran, the ISP ParsOnline is known for block more content than required by the government.
Thirdly, the filtering systems in use to block child pornography also suffer from serious problems. In addition to the fact that filtering does not contribute to the removal of child pornography from the Internet and does not contribute to the arrest and prosecution of criminals who traffic in this material it is also easily circumvented. At best, it prevents casual or inadvertent access to designated websites. (Websites are not neccessarily the most common way this material is transmitted, p2p systems for example are unaffected by this type of filtering). Also, there is often no review process (once on the list always on the list) or appeals process (if content is removed or a mistake made). And although the technology is getting better there is often significant over blocking -- blocking content that was never intended to be blocked in the first place.
For example, a Pennsylvania state law that required ISP to block access to web sites suspected of hosting child pornography violated the First Amendment, according to the Federal District Court in Philadelphia. The ruling details the process, both legal and technical, that lead to the blocking of 1.5 million legitimate websites while trying to block access to approximately 400 websites suspected of containing child abuse images.
The protection of children, the elimination of child pornography and combatting hate speech are extremely important concerns. Actions taken to fight the production and dissemination of child pornography and hate speech should be designed to be effective while not impinging on the free speech rights of citizens or placing the responsibility to determine offending content on Internet Service Providers (ISP). To combat child pornography on the Internet, government, law enforcement the ISP/web hosting industry and civil society organizations must come together to work collectively on this serious problem.
Firstly, it is not neccessarily a positive thing. ISP's have engaged in misguided vigilantism in the past, blocking content the ISP feels it is entitled to block (and doing so in a manner that blocked nearly 800 non-related sites in order to block just one site). ISP's are not equipped or qualified to make judgements on content and will always default to the lowest common denominator which has serious repercussion on freedom of speech and expression. Putting "the issue in the hands of ISPs" is not necessarily a better option than state censorship.
Secondly, as the case of China illustrates, the government will often authorize certain topics to be censored leaving the decision on what is specifically blocked to private firms. As the N.Y. Times reported:
American Internet firms typically arrive in China expecting the government to hand them an official blacklist of sites and words they must censor. They quickly discover that no master list exists. Instead, the government simply insists the firms interpret the vague regulations themselves.
Domestic Chinese blog providers in China have told me how they create lists of what terms to filter themselves. Governments delegate responsibilty for censorsing to ISP's and ICP's (content providers). Often, ISP's will become very conservative, blocking more than they are required to block. In Iran, the ISP ParsOnline is known for block more content than required by the government.
Thirdly, the filtering systems in use to block child pornography also suffer from serious problems. In addition to the fact that filtering does not contribute to the removal of child pornography from the Internet and does not contribute to the arrest and prosecution of criminals who traffic in this material it is also easily circumvented. At best, it prevents casual or inadvertent access to designated websites. (Websites are not neccessarily the most common way this material is transmitted, p2p systems for example are unaffected by this type of filtering). Also, there is often no review process (once on the list always on the list) or appeals process (if content is removed or a mistake made). And although the technology is getting better there is often significant over blocking -- blocking content that was never intended to be blocked in the first place.
For example, a Pennsylvania state law that required ISP to block access to web sites suspected of hosting child pornography violated the First Amendment, according to the Federal District Court in Philadelphia. The ruling details the process, both legal and technical, that lead to the blocking of 1.5 million legitimate websites while trying to block access to approximately 400 websites suspected of containing child abuse images.
The protection of children, the elimination of child pornography and combatting hate speech are extremely important concerns. Actions taken to fight the production and dissemination of child pornography and hate speech should be designed to be effective while not impinging on the free speech rights of citizens or placing the responsibility to determine offending content on Internet Service Providers (ISP). To combat child pornography on the Internet, government, law enforcement the ISP/web hosting industry and civil society organizations must come together to work collectively on this serious problem.
Wednesday, September 6, 2006
CRTC asked to block websites
[UPDATE: The CRTC has denied Warman's claim. The CRTC documents are available here. ]
The Canadian Radio-television and Telecommunications Commission (CRTC) is being asked to authorize ISP's in Canada to block web sites:
Canadian ISP, Telus, blocked access to a Union related website during a labour dispute in the past without CRTC authorization. But there have been increasing moves to push for a formalized system through which ISP can block websites. Currently the focus is on hate sites and child pornography as is usually the case when arguments are made to introduce national filtering systems.
The actual issue appears to be the posting of death threats against Richard Warman posted on neo-nazi sites (one of which was hosted on Blogspot and has been removed). Mr. Warman should pursue his legal options in this matter but this should not be used as a trojan to introduce blanket filering (which does not remove the death threats or really prevent anyone from getting access to them or facilitate the criminal prosecution of the accused). The case appears to be more about "precedence" than it is about the death threats against Warman and I'm particularly troubled by this quote from Warman:
Making ISP's liable for content is not the right thing to do, not for copyright or hate speech. Giving ISP's permission to voluntarily block web sites is also dangerous. As has been shown with copyright, ISP are not equipped or qualified to make judgments on content and will always default to the lowest common denominator which has serious repercussion on freedom of speech and expression.
There's a great discussion on this at http://www.digital-copyright.ca/.
The Canadian Radio-television and Telecommunications Commission (CRTC) is being asked to authorize ISP's in Canada to block web sites:
One of two U.S.-based hate websites was taken offline Wednesday as an Ottawa lawyer and a Jewish lobby group asked Canada's telecommunications regulator to take the unprecedented step of blocking access to the sites from north of the border.
Canadian ISP, Telus, blocked access to a Union related website during a labour dispute in the past without CRTC authorization. But there have been increasing moves to push for a formalized system through which ISP can block websites. Currently the focus is on hate sites and child pornography as is usually the case when arguments are made to introduce national filtering systems.
The actual issue appears to be the posting of death threats against Richard Warman posted on neo-nazi sites (one of which was hosted on Blogspot and has been removed). Mr. Warman should pursue his legal options in this matter but this should not be used as a trojan to introduce blanket filering (which does not remove the death threats or really prevent anyone from getting access to them or facilitate the criminal prosecution of the accused). The case appears to be more about "precedence" than it is about the death threats against Warman and I'm particularly troubled by this quote from Warman:
Internet providers that don't block the sites may make themselves legally liable if a user acts on what they read online, Warman suggested.
Making ISP's liable for content is not the right thing to do, not for copyright or hate speech. Giving ISP's permission to voluntarily block web sites is also dangerous. As has been shown with copyright, ISP are not equipped or qualified to make judgments on content and will always default to the lowest common denominator which has serious repercussion on freedom of speech and expression.
There's a great discussion on this at http://www.digital-copyright.ca/.
NY Times Geolocation Filtering
The NY Times (mirror) recently restricted access to articles on the recent terrorism case in Britain for users in the UK. Although users could see the headline if the link was clicked the following message was shown:
Filtering content by geographic location is nothing new and its use is now becoming widespread.
“On advice of legal counsel, this article is unavailable to readers of nytimes.com in Britain,” is the message they would have seen. “This arises from the requirement in British law that prohibits publication of prejudicial information about the defendants prior to trial.”
Filtering content by geographic location is nothing new and its use is now becoming widespread.
Jonathan Zittrain, a professor of Internet governance and regulation at Oxford University, said restricting information fit with trends across the Internet. “There’s a been a sense that technology can create a form of geographic zoning on the Internet for many years now — that they might not be 100 percent effective, but effective enough,” Mr. Zittrain said. “And there’s even a sense that international courts might be willing to take into account these efforts.
Sunday, September 3, 2006
Media Monitoring
AP reports:
A related article in Rolling Stone details Rendon's involvement in similar info-ops:
The U.S. command in Baghdad is seeking bidders for a two-year, $20 million public relations contract that calls for monitoring the tone of Iraq news stories filed by U.S. and foreign media...
The military last year was criticized for a public relations program in Iraq that included hiring a consulting firm that paid Iraqi news media to carry news stories written by American troops.
Pentagon officials have defended the program as a necessary tool in the war on terror. But critics have said it contradicts American values of freedom of the press.
A related article in Rolling Stone details Rendon's involvement in similar info-ops:
According to the Pentagon documents, the Rendon Group played a major role in the IOTF. The company was charged with creating an "Information War Room" to monitor worldwide news reports at lightning speed and respond almost instantly with counterpropaganda.
Wednesday, August 30, 2006
AIPAC urges U.S. to shut Iranian site
Haaretz reports:
Is terror the new porn?
he American Israel Public Affairs Committee (AIPAC) is urging the United States government to disconnect an Iranian news site from American Internet servers, charging that the site has ties to terrorist organizations. The allegation is based on a report published by Haaretz last month.
Is terror the new porn?
Friday, August 11, 2006
Human Rights Watch Report
Human Rights Watch has released a report on Internet censorship. It particularly focuses on the role U.S. corporations in censorsing their products in order to enter the Chinese market. The report's title, "Race to the Bottom", sums up the situation quite well.
(A mirror copy for those who cannot access the hrw.org website is available here.[9.8mb .zip])
The report's principal researcher and editor, Rebecca MacKinnon, did a great job of weaving together the filtering practices of Google, Yahoo!, MSN and Skype with reactions from the Chinese community, especially bloggers. Chapter 4 in particular is well worth the read. It really highlights the point that Internet censorship and surveillance is not merely an academic exersize, the choices these companies are making are having an effect on people's lives. I know I tend to get bogged down in technical details sometimes (as I am about to do in the next paragraph) and it was a good reminder for me.
(A mirror copy for those who cannot access the hrw.org website is available here.[9.8mb .zip])
The report's principal researcher and editor, Rebecca MacKinnon, did a great job of weaving together the filtering practices of Google, Yahoo!, MSN and Skype with reactions from the Chinese community, especially bloggers. Chapter 4 in particular is well worth the read. It really highlights the point that Internet censorship and surveillance is not merely an academic exersize, the choices these companies are making are having an effect on people's lives. I know I tend to get bogged down in technical details sometimes (as I am about to do in the next paragraph) and it was a good reminder for me.
Wednesday, August 9, 2006
Internet Filtering in Vietnam
The OpenNet Initiative has released a report on Internet filtering in Vietnam. Vietnam purports to prevent access to Internet sites primarily to safeguard against obscene or sexually explicit content. However, the state's actual motives are far more pragmatic: while it does not block any of the pornographic sites ONI tested, it filters a significant fraction - in some cases, the great majority - of sites with politically or religiously sensitive material. Click here for the full report.
Friday, August 4, 2006
Israeli InfoWar
Bomb's couldn't take out Al-Manar, so Israel hacked their signal.
More from Zone-H.
And the defacement war has also been underway.
In the middle of newscasts and programming from Hezbollah's Al-Manar station, Israeli technicians are hacking the signal and replacing it with a 90-second spot that begins with a gun site superimposed on a crude drawing of Hezbollah's leader, Sheik Hassan Nasrallah, looking at the ground.
The image is punctuated by the sound of three gunshots and framed on the top with the words, "Your day is coming, coming, coming." On the bottom of the image of Sheik Nasrallah are the words: "The state of Israel." For the next 90 seconds, the message is clear: Give up. Resistance is futile.
More from Zone-H.
And the defacement war has also been underway.
Thursday, July 27, 2006
Internet Filtering in Uzbekistan
RSF and neweurasia.net report on new blocking in Uzbekistan. www.neweurasia.net, a bridge blogging site, appears to be the latest target of censorship in Uzbekistan.
Although there are variations in blocking among ISP's in Uzbekistan, websites, such as ferghana.ru, that provide alternative information and host discussion forums have long been targetted.
Opposition parties and Islamic movements and Chechnya-related sites are also targetted.
Although there are variations in blocking among ISP's in Uzbekistan, websites, such as ferghana.ru, that provide alternative information and host discussion forums have long been targetted.
Opposition parties and Islamic movements and Chechnya-related sites are also targetted.
X Marks the Spot
After the French Government tried to get GreenPeace to remove a GoogleMap from their site that showed the location of secret, genetically modified maise GP marked the spot with a crop circle.The map has apparently been removed from the GreenPeace France website.
Friday, July 21, 2006
War Censorship
The Associated Press has agreed to follow Israel's censorship rules, and has an article on the subject:
Here's some news you may never hear about Israel's war against Hezbollah: a missile falls into the sea, a strategic military installation is hit, a Cabinet minister plans to visit the front lines.
All these topics are subject to review by Israel's chief military censor, who has -- in her own words -- "extraordinary power." She can silence a broadcaster, block information and put journalists in jail.
"I can, for example, publish an order that no material can be published. I can close a newspaper or shut down a station. I can do almost anything," Col. Sima Vaknin said Wednesday.
Thursday, July 20, 2006
Internet Filtering in India
India is not new to Internet filtering. Back in 2004 India's Ministry of Communications & Information Technologyordered ISP's to start blocking web sites. The target was a particular Yahoo! Group, but the ISP's blocked access to the IP address (see Why Block by IP?) of the groups.yahoo.com domain causing all Yahoo! Groups to be blocked illustrating one of Internet filtering's unintended consequences. India subsequently ordered the extremist HinduUnity site to be blocked as well (which caused additional "over-blocking"). There were variations in compliance but large ISPs such as VSNL did comply.So India's new filtering is not surprising. Once again the Ministry ordered sites to be blocked, some of which are blogs hosted on Blogspot and Typepad. The ISP's blocked the IP addresses of the sites causing all the blogs hosted on them to be blocked.
Monday, July 10, 2006
GFW Discussion
I previously commented on the Ignoring the “Great Firewall of China” paper but 0day pointed me to a good critique of the paper. The critique makes several points on the technical side including noting that circumventing keyword by blocking RST packets would not work for "'hard' IP filtering", that China could upgrade its system to account for other noted deficiencies and that ignoring reset packets is detectable and has security concerns.
Thursday, July 6, 2006
Reality and GFW Redux
Nicholas Kristoff of the NY Times created two blogs on hosting services in China and posted content intended to be provactive. To his "frustration" he was not immediately censored (other than crude filtering, such as replacing keywords with asterizes). This expectation of instant censorship stems from myths surrounding internet censorship in China. Kristoff repeats the 30,000 internet police myth although referring to ineptitude rather than the usual omnipotence. This demonstration leads Kristoff to conclude that "the Internet is just too big and complex for State Security to control" and that he doesn't "see how the Communist Party dictatorship can long survive the Internet".
It's funny. There always seems to be two approaches to the topic of censorship in China: the "1984" and the "technoptimist".
The "1984" approach overstates China's capabilties claiming that legions of internet police monitor everything in "real time" and are just one kick away if you make the wrong click. The "technoptimist" approach understates China's capabilites and claims that the internet is a democracy-battering-ram chipping away at the crumbling walls of oppressive regimes.
Both are short on detail and long on hubris.
So, here's a repost of "Reality and GFW" Part 1 and Part 2.
It's funny. There always seems to be two approaches to the topic of censorship in China: the "1984" and the "technoptimist".
The "1984" approach overstates China's capabilties claiming that legions of internet police monitor everything in "real time" and are just one kick away if you make the wrong click. The "technoptimist" approach understates China's capabilites and claims that the internet is a democracy-battering-ram chipping away at the crumbling walls of oppressive regimes.
Both are short on detail and long on hubris.
So, here's a repost of "Reality and GFW" Part 1 and Part 2.
Wednesday, July 5, 2006
Would you like a Coke with that?
According to a recent report:
In other news, China has launched a"seasonal campaign" against cafe's to restrict access to minors. Internet cafe's in China remain under heavy surveillance although not every action taken to regulate cafe's should be interpreted as an attack on freedom of speech. As my colleague Derek pointed out a while back "[t]here a tendency to see Chinese actions through the lens of political opposition and dissent" which can be rather simplistic.
However, normalizing heavy surveillance, even in cafe where people are more likely to be playng CounterStrike and WorldofWarcraft rather than engaging in political dissent, does have a broader significance. Just as filtering for pornography, for example, is usually the initial reason for implemnting Internet filtering which begins to transition to political censorship, once the technology and policies are in place governments cannot resist expanding its use. This is what many fear will happen with all the security and surveillance equipment being sold to China for the 2008 Olympics.
Who's got stock in China Security & Surveillance Technology Inc. ?
Coca-Cola recently signed a three year deal with Shanghai based Internet cafe chain Eastday to sell its beverage products in Eastday's Internet cafes, Oriental Morning Post reports. Eastday will assist Coca-Cola in promotions.
In other news, China has launched a"seasonal campaign" against cafe's to restrict access to minors. Internet cafe's in China remain under heavy surveillance although not every action taken to regulate cafe's should be interpreted as an attack on freedom of speech. As my colleague Derek pointed out a while back "[t]here a tendency to see Chinese actions through the lens of political opposition and dissent" which can be rather simplistic.
However, normalizing heavy surveillance, even in cafe where people are more likely to be playng CounterStrike and WorldofWarcraft rather than engaging in political dissent, does have a broader significance. Just as filtering for pornography, for example, is usually the initial reason for implemnting Internet filtering which begins to transition to political censorship, once the technology and policies are in place governments cannot resist expanding its use. This is what many fear will happen with all the security and surveillance equipment being sold to China for the 2008 Olympics.
Who's got stock in China Security & Surveillance Technology Inc. ?
Thursday, June 29, 2006
Internet Surveillance
My ISP, Bell Sympatico, has modified their "Service Agreement" so that they can monitor or investigate me "without limitation" and pass that information on to the government.
In The Globe and Mail, Michael Geist suggests that this signals that the Internet Surveillance Bill will be re-introduced.
However, you agree that Your Service Provider reserves the right from time to time to monitor the Service electronically, monitor or investigate content or your use of Your Service Provider’s networks, including without limitation bandwidth consumption, and to disclose any information necessary to satisfy any laws, regulations or other governmental request from any applicable jurisdiction, or as necessary to operate the Service or to protect itself or others.
In The Globe and Mail, Michael Geist suggests that this signals that the Internet Surveillance Bill will be re-introduced.
VOIP Filtering
It is a bit old, but given all the discussion on "net neutrality" it seemed like a good time bring up an old case. In 2005 the FCC ruled that Madison River Communications had to stop blocking VoIP. Countries and companies have been targeting VoIP for some time by port blocking.
Wednesday, June 28, 2006
Ignoring the “Great Firewall of China”
Richard Clayton, Steven J. Murdoch, and Robert N. M. Watson have released a paper "Ignoring the 'Great Firewall of China'" that looks at China's keyword filtering. Previous ONI work discovered the way in which China uses tcp reset packets to terminate connections based on keywords, that after triggering the filtering mechanism further connections between the two hosts will also be blocked for a varying period of time and that the filtering was bi-directional -- it affects in-bound traffic to China as well as outbound traffic from China.
But my technical analysis of the packet level filtering was less than comprehensive and this new research by our colleages at Cambride provides an amazing in-depth analysis of China's keyword filtering at the packet level. The observed behaviours I previously reported have been explained in skillful detail and this paper has also has provided some new insights into the GFW:
1. China is likely using an Intrusion Detection System (IDS) - possibly Cisco's "Secure
Intrusion Detection System" for keyword filtering seperate from their routers.
2. It is possible to "ignore" China's keyword filtering. If both endpoints in a connection ignore tcp reset packets the data intended to be blocked by keyword will go through the GFW.
3. The way in which China filters by keyword can be exploited for Denial-of-Service atacks if one forges the source address and issues requests that contein banned keywords. In this way communication between two targeted endpoints can be blocked.
There are a few ways in which this research can be extended:
- Similar tests can be run from within China to see if the keyword filtering is entirely symetrical.
- Pad the request so that the bad packet appears at different points in the connection. This may help identify if China is only filtering by keyword in the URL path or in the body content of a page. Pehaps only the first X number of bytes are inspected?
- Build a list of terms that trigger the blocking mechanism (I have notice that domain names are often treated as "keywords").
- While there may be some impact on circumvention technologies the problem is that both sides of the connection must be blocking tcp reset packets. Also, since the GFW blocks key sites by IP address -- it is not just a keyword blocking system -- these sites would remain blocked.
- It would be great to investigate with such expertise and detail the way in which China blocks IP addresses (and to correlate IP address blocking with the use of domain names hosted on that IP being used as keywords)
But my technical analysis of the packet level filtering was less than comprehensive and this new research by our colleages at Cambride provides an amazing in-depth analysis of China's keyword filtering at the packet level. The observed behaviours I previously reported have been explained in skillful detail and this paper has also has provided some new insights into the GFW:
1. China is likely using an Intrusion Detection System (IDS) - possibly Cisco's "Secure
Intrusion Detection System" for keyword filtering seperate from their routers.
2. It is possible to "ignore" China's keyword filtering. If both endpoints in a connection ignore tcp reset packets the data intended to be blocked by keyword will go through the GFW.
3. The way in which China filters by keyword can be exploited for Denial-of-Service atacks if one forges the source address and issues requests that contein banned keywords. In this way communication between two targeted endpoints can be blocked.
There are a few ways in which this research can be extended:
- Similar tests can be run from within China to see if the keyword filtering is entirely symetrical.
- Pad the request so that the bad packet appears at different points in the connection. This may help identify if China is only filtering by keyword in the URL path or in the body content of a page. Pehaps only the first X number of bytes are inspected?
- Build a list of terms that trigger the blocking mechanism (I have notice that domain names are often treated as "keywords").
- While there may be some impact on circumvention technologies the problem is that both sides of the connection must be blocking tcp reset packets. Also, since the GFW blocks key sites by IP address -- it is not just a keyword blocking system -- these sites would remain blocked.
- It would be great to investigate with such expertise and detail the way in which China blocks IP addresses (and to correlate IP address blocking with the use of domain names hosted on that IP being used as keywords)
Tuesday, June 27, 2006
CDN Gov't pays Lobby to Lobby
Michael Geist reports that the Canadian government is giving nearly $400,000 to the Creators' Rights Alliance (CRA) to produce "research" on on copyright reform. While some of the CRA's members are small organizations others it also includes organizations that "already employ external lobbyists with millions of dollars budgeted for copyright regulatory hearings and reform."
I don't even know what to say.
Internal correspondence also reveals that the contract was designed to further the department's own policy objectives. A senior official outlined the rationale behind the proposed contract, stating in an email that once the CRA funding was complete, "we should have streamlined, stable funding to an organization whose structure, purpose and activities suit our own policy needs."
Those activities were clearly identified in an email to Canadian Heritage from CRA's co-chair who commented that "the job of taking on the educational sector on copyright reform is clearly a huge and major undertaking," adding that education was a "well heeled, publicly funded lobby . . . devoted to abolishing creators' rights on the Internet."
I don't even know what to say.
Monday, June 26, 2006
You've Been Censored!
When Google launched a censored Chinese search engine it created a storm of controversy. Google has arguably borne a disproportionate amount of criticism, after all Yahoo! had long been censoring their Chinese search service. After Google launched google.cn there were several Congressional inquiries and the issue of U.S. involvement in censorship in China was widely covered by the media.
The willingness of these powerful companies, Google, MSN, and Yahoo! to censor themselves signifies that censorship is now the norm. Now, this is not something entirely new. Chilling Effects has been documenting various cases usually in the area of copyright or hate speech.
The case of China brought up several issues. In addition to being overtly political -- the removal of content widely acknowleged as credible -- issues of transparency and accountabilty emerged as key. In the past information in legal papers and court cases was available which at least documented the process through which the filtering or removal of content was taking place. With China there was simply silence.
Google implemented one small measure of transparency which has now become the norm: they began to inform users when search results were censored. Now MSN and Yahoo! have followed. While there is still a long way to go, I hope that Google will continue to be a leader in implementing transparency. Implementing these measures would be a good start.
Here are some samples of the various "you've been censored" messages:
Babelfish translation: According to the local law laws and regulations and the policy, the part searches the result not to demonstrate.
Babelfish translation: In the search result removed certain contents
Babelfish translation: Already helped you to filter the unnecessary homepage!
*Note: Yahoo! only displays the error message if they've indexed a site but are not displaying results. Often, "sensitive" sites are not indexed so there is no censored message.
The willingness of these powerful companies, Google, MSN, and Yahoo! to censor themselves signifies that censorship is now the norm. Now, this is not something entirely new. Chilling Effects has been documenting various cases usually in the area of copyright or hate speech.
The case of China brought up several issues. In addition to being overtly political -- the removal of content widely acknowleged as credible -- issues of transparency and accountabilty emerged as key. In the past information in legal papers and court cases was available which at least documented the process through which the filtering or removal of content was taking place. With China there was simply silence.
Google implemented one small measure of transparency which has now become the norm: they began to inform users when search results were censored. Now MSN and Yahoo! have followed. While there is still a long way to go, I hope that Google will continue to be a leader in implementing transparency. Implementing these measures would be a good start.
Here are some samples of the various "you've been censored" messages:
Babelfish translation: According to the local law laws and regulations and the policy, the part searches the result not to demonstrate.
Babelfish translation: In the search result removed certain contents
Babelfish translation: Already helped you to filter the unnecessary homepage!
*Note: Yahoo! only displays the error message if they've indexed a site but are not displaying results. Often, "sensitive" sites are not indexed so there is no censored message.
Wednesday, June 21, 2006
Keywords & Google.cn
Google.cn's de-listing of websites (these sites do not appear in search results) has bee failry well documented. The best way to determine if a site is de-listed is to use the "site:" modifier which restricts results to particular websites. For example, a search for site:news.bbc.co.uk in google.cn shows that there are no results but also indicates that the results have been censored (据当地法律法规和政策，部分搜索结果未予显示).
Previously, Ethan and I found that searches for certain terms were restricted to Chinese webpages.
Google.cn has gone further now and appears to be restricting searches for certain terms to sites that have been whitelisted.
I started with a search for 六四 (64) that is restricted to *not* include any .cn, .com, .org, or .net sites. There are no results, and the censored message is displayed. (The censored message will always be displayed if one of these special terms are searched for, no matter if any results are actually censored or not).
I then began to remove some of the restrictions. First, I allowed .net to be included, and only one site was returned. When only .org is allowed there are only 4 indexed domains. And when .com is allowed only 8 domains are indexed. There seemed to be a fair amount of .cn sites when .cn is allowed, I didnt bother trying to fish out the unique domains.
Now, this is not *the* whitelist -- just the sites that are returned for the search 六四 (64). as we find more censored terms, a more definitive whitelist can be built out.
The reason I suspect these sites are whitelisted is because you cannot search other sites -- sites that are indexed and not de-listed -- for these special terms. My blog for example, site:www.nartv.org is indexed. However, if you search my blog for 六四 (64), the results are censored. (There is content on my blog that google.com has indexed with 六四 (64), and google.cn has indexed it too.
Not even Microsoft has been spared, it too is censored :).. And, actually, it seems that results from ccTLD's other than .cn are not displayed when the secial terms are searched for. (I didn't check every single one).
Now, there are some weirdnesses. For example, a search for "falun" with .com, net, .org, and .cn excluded will still return results. Some of this appears to be because IP addresses obviously don't have domain suffixes but also because Google does not properly parse out domains that have a port number attached (this also happens on google.com). But, strange, nonetheless.
(Some more strangeness, opinion.people.com.cn is de-listed and although news.xinhuanet.com is indexed the censor message appears!)
De-listed domains, restricted keywords and whitelisted domains! What's next Google?
Previously, Ethan and I found that searches for certain terms were restricted to Chinese webpages.
Google.cn has gone further now and appears to be restricting searches for certain terms to sites that have been whitelisted.
I started with a search for 六四 (64) that is restricted to *not* include any .cn, .com, .org, or .net sites. There are no results, and the censored message is displayed. (The censored message will always be displayed if one of these special terms are searched for, no matter if any results are actually censored or not).
I then began to remove some of the restrictions. First, I allowed .net to be included, and only one site was returned. When only .org is allowed there are only 4 indexed domains. And when .com is allowed only 8 domains are indexed. There seemed to be a fair amount of .cn sites when .cn is allowed, I didnt bother trying to fish out the unique domains.
Now, this is not *the* whitelist -- just the sites that are returned for the search 六四 (64). as we find more censored terms, a more definitive whitelist can be built out.
The reason I suspect these sites are whitelisted is because you cannot search other sites -- sites that are indexed and not de-listed -- for these special terms. My blog for example, site:www.nartv.org is indexed. However, if you search my blog for 六四 (64), the results are censored. (There is content on my blog that google.com has indexed with 六四 (64), and google.cn has indexed it too.
Not even Microsoft has been spared, it too is censored :).. And, actually, it seems that results from ccTLD's other than .cn are not displayed when the secial terms are searched for. (I didn't check every single one).
Now, there are some weirdnesses. For example, a search for "falun" with .com, net, .org, and .cn excluded will still return results. Some of this appears to be because IP addresses obviously don't have domain suffixes but also because Google does not properly parse out domains that have a port number attached (this also happens on google.com). But, strange, nonetheless.
(Some more strangeness, opinion.people.com.cn is de-listed and although news.xinhuanet.com is indexed the censor message appears!)
De-listed domains, restricted keywords and whitelisted domains! What's next Google?
Monday, June 19, 2006
Internet Censorship Map
In an effort to counter the once borderless Internet, states are seeking to create informational boundaries in cyberspace. This is accomplished through a combination of technical and regulatory means -- including laws, licensing regimes, industry self-regulation, national filtering, and content removal -- thereby creating a matrix of controls.
A Censored Network: Iran
In conjunction with GovCom.org, the ONI has created A Censored Network (PDF), showing censored sites in Iran that have a link relationship. GovCom's IssueCrawler was used to crawl our initial list of blocked sites and captured the outbound links and performed co-link analysis returning an interlinked network. We then checked each of these sites from Iran to see if they are blocked or not. Through this process we found additional blocked sites and it neatly shows connected clusters of content that have been censored.
Thursday, June 15, 2006
Tom-Skype Filtering in China
UPDATE: See the 2008 report which shows that:
Skype's partner in China, Tom Online, has implemented filtering of Skype's text chat for Chinese users. Skype is not being transparent about the filtering fucntionality that has been introduced. Here is my initial attempt at trying to figure out Tom-Skype's filtering.
Tom-Skype can be downloaded from skype.tom.com and I installed in in Chinese and English. I also installed the 2.5 beta version, all appeared to function the same. The tests below are from Tom-Skype 2.0 installed in English.
The first thing I noticed is that Tom-Skype is bundled with an executable called ContentFilter.exe. It is an application developed by Tom Online called Tom Word Review. It is digitally signed by Skype.
Tom's ContentFilter.exe loads after one logs into Skype and runs in the background. It is visible in the process list.
After logging in to Skype several plain text connections are made to Tom's web server, in addition to some to Skype's server. Some are just to get the version number of Skype the user is running while others are for the content that appears in the Tom content tab -- mine had to do with the FIFA World Cup :) . But there are two rather odd connections:
Connection 1
This looks like its checking for a version number.
Connection 2
This connection downloads a file called "keyfile" into Skype's installation directory. I assume its a keyword list file of some sort. It has 123 lines that look like this:
I have not been able to decode this. It looks like hex but does not convert nicely (utf-8, utf-16, gb18030, gb2312 etc...)
(By the way, when you uninstall Tom-Skype the "keyfile" is not removed form your computer.)
However, I could only trigger the filtering with the work "fuck". I tried all the words from the QQ list plus list of political words and phrases. I also tried some mandarin slang and some Chinese sex related words.
Here is what it looks like. I sent text chat from one Skype account using Tom-Skype on one computer to another with the same set-up. (I was able to make a Skype user name through Tom-Skype called "falun99", I thought they may want to filter screen names, but they do not seem to.) When you receive any text -- a word, a sentence or a paragraph -- that contains a keyword, in this case "fuck", the entire message is not displayed to the user using Tom_Skype.
The message sender, using Tom-Skype, can see the text, including the banned keyword. And if that message is sent to a normal Skype user, the receiver can also see it.
However, if a message with banned words is received by a Tom-Skype users (from a normal Skype user or a Tom-Skype user) the message will not be displayed at all.
- The full text chat messages of TOM-Skype users, along with Skype users who have
communicated with TOM-Skype users, are regularly scanned for sensitive keywords, and
if present, the resulting data are uploaded and stored on servers in China. - These text messages, along with millions of records containing personal information, are
stored on insecure publicly-accessible web servers together with the encryption key required to
decrypt the data.
Skype's partner in China, Tom Online, has implemented filtering of Skype's text chat for Chinese users. Skype is not being transparent about the filtering fucntionality that has been introduced. Here is my initial attempt at trying to figure out Tom-Skype's filtering.
Tom-Skype can be downloaded from skype.tom.com and I installed in in Chinese and English. I also installed the 2.5 beta version, all appeared to function the same. The tests below are from Tom-Skype 2.0 installed in English.
The first thing I noticed is that Tom-Skype is bundled with an executable called ContentFilter.exe. It is an application developed by Tom Online called Tom Word Review. It is digitally signed by Skype.
Tom's ContentFilter.exe loads after one logs into Skype and runs in the background. It is visible in the process list.
After logging in to Skype several plain text connections are made to Tom's web server, in addition to some to Skype's server. Some are just to get the version number of Skype the user is running while others are for the content that appears in the Tom content tab -- mine had to do with the FIFA World Cup :) . But there are two rather odd connections:
Connection 1
GET /agent/skypever.php?md5=nofile HTTP/1.1
Content-Type: text/html
Host: skypetools.tom.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)
HTTP/1.1 200 OK
Date: Tue, 13 Jun 2006 17:39:14 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
1
0
0
This looks like its checking for a version number.
Connection 2
GET /agent/keyfile HTTP/1.1
Content-Type: text/html
Host: skypetools.tom.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)
HTTP/1.1 200 OK
Date: Tue, 13 Jun 2006 17:39:15 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2005 11:02:50 GMT
ETag: "1a73b-8166-436f345a"
Accept-Ranges: bytes
Content-Length: 33126
Connection: close
Content-Type: text/plain
This connection downloads a file called "keyfile" into Skype's installation directory. I assume its a keyword list file of some sort. It has 123 lines that look like this:
006F00000000000000C600EA007B00EF000100C900190080007
E000C001B00E7003C006900F80003002B00C000790084008D00
900002005E0018005C00C60067004400B8007C00F5002500F60
061009F00A900F4005600AE0065009100AE007F002A00D400D5
0024005800930033004600A90055005A008500E4006100A30025
00FA00F10030005A005F00E00096005700A6009C00F9008600E5
0083005100FF00A0007700FD000800B70037000300B7006F004C0
0E70047002D00BE00DA004300AB00A500B800210009002B00E1008F
00560055000A004F001900C60004009A004000D20051007B
I have not been able to decode this. It looks like hex but does not convert nicely (utf-8, utf-16, gb18030, gb2312 etc...)
(By the way, when you uninstall Tom-Skype the "keyfile" is not removed form your computer.)
However, I could only trigger the filtering with the work "fuck". I tried all the words from the QQ list plus list of political words and phrases. I also tried some mandarin slang and some Chinese sex related words.
Here is what it looks like. I sent text chat from one Skype account using Tom-Skype on one computer to another with the same set-up. (I was able to make a Skype user name through Tom-Skype called "falun99", I thought they may want to filter screen names, but they do not seem to.) When you receive any text -- a word, a sentence or a paragraph -- that contains a keyword, in this case "fuck", the entire message is not displayed to the user using Tom_Skype.
The message sender, using Tom-Skype, can see the text, including the banned keyword. And if that message is sent to a normal Skype user, the receiver can also see it.
However, if a message with banned words is received by a Tom-Skype users (from a normal Skype user or a Tom-Skype user) the message will not be displayed at all.
- Tom-Skype is bundled with ContentFilter.exe which makes two connectiopns to Tom Online's web server, one appears to download a keyword file.
- Tom-Skype message blocking is done on the client side while receiving messages, normal Skype users can receive messages from Tom-Skype users that contain banned keywords.
- The total amount of keywords appears to be low, so far only "fuck" has been found.
Google Groups Censorship
Proposal to allow Canadian ISPs to remove content
A proposal floated at the Canadian Telecom Summit by the Canadian Jewish Congress would give ISPs the power to remove pornography and hate speech "at their own discretion". Despite the fact that finding content to be illegal takes a " lengthy court process" Bernie Farber, chief executive of the Canadian Jewish Congress, suggests that "[i]t doesn't take a lot to discern what is pornographic and what is hate" and the ISPs "have some expertise to make those decisions". Farber's response to worries about consumer's objections to having content arbitrarily removed is "let them sue you".
There are some very serious problems with this approach. First, pornography is not illegal in this country, second ISP's are not the best judges of legality. They have proven to be horribly inept at it, especially when it comes to takedowns for copyright violations.
Actually ISPs are already removing content at their discretion. And in contrast to the optimism expressed by some, it does not solve the problem. When sites are taken down they simply move to other providers.
This is where the slippery slope begins. The calls for "takedown" immediately move to blocking and filtering. In discussing the proposal, Det. Don McKinnon, of the hate crimes unit, supports filtering:
The introduction of a system plagued with procedural and technical problems simply because the legal solution involves a "lengthy court process" ignores the issue at hand. If judicial speed is the issue fix it, don't bypass our system of checks and balances in way that has proven to be detrimental to freedom of speech and expression. ISPs and techies should not be considered replacements for judges and lawyers. Yes, there are challenges to combating hate speech online but difficulty should not be a deterrent.
There are some very serious problems with this approach. First, pornography is not illegal in this country, second ISP's are not the best judges of legality. They have proven to be horribly inept at it, especially when it comes to takedowns for copyright violations.
Actually ISPs are already removing content at their discretion. And in contrast to the optimism expressed by some, it does not solve the problem. When sites are taken down they simply move to other providers.
This is where the slippery slope begins. The calls for "takedown" immediately move to blocking and filtering. In discussing the proposal, Det. Don McKinnon, of the hate crimes unit, supports filtering:
"The technology that is available . . . is much similar to call blocking," said McKinnon, explaining it's basically a website blocker.
The introduction of a system plagued with procedural and technical problems simply because the legal solution involves a "lengthy court process" ignores the issue at hand. If judicial speed is the issue fix it, don't bypass our system of checks and balances in way that has proven to be detrimental to freedom of speech and expression. ISPs and techies should not be considered replacements for judges and lawyers. Yes, there are challenges to combating hate speech online but difficulty should not be a deterrent.
Sunday, June 11, 2006
Network or Nodes?
Canadian media coverage has focused on the recent arrests of seventeen Canadians suspected of planning to detonate bombs in Ontario. In addition to the predictable sensationalist, wildy speculative coverage, which truly was awful, reports of Canada's electronic surveillance capabilities are emerging.
Police credited Internet surveillance with playing a key role in the recent arrests while simultaneously claiming that the technical sophistication of terrorists requires better technology and less restrictions on wiretaps. In conjunction with electronic eavesdropping, Canadian authorities have been moving away from collecting evidence to use in criminal cases and have been engaging in the "disrupting" suspected groups.
However, the RCMP admit that they have never "sought greater authority to conduct monitoring and surveillance" because in Canada, law enforcement only needs Ministerial approval to engage in wholesale surveillance -- not specific calls or emails but broad wholesale monitoring.
The arrests come at a time when Canad's "Anti-Terrorism Act" is set to be renewed by Parliament. Despite the fact that many of the new powers granted law enforcement were never used law enforcement and major news media in Canada want the Act renewed.
As Gwynne Dyer points out in one of the few dissenting articles in this country the rationale behind the need for these increased powers is fundamentally flawed. The case for increased surveillance powers to protect Canadians is based on the presumption of an international terrorist network when in fact the threat is from small, isolated nodes:
The expansion of increased surveillance technology and powers while decreasing the amount of oversight is a threat to the civil liberties and privacy of Canadians. The fact that fear is exploited to push these powers through is deplorable.
Police credited Internet surveillance with playing a key role in the recent arrests while simultaneously claiming that the technical sophistication of terrorists requires better technology and less restrictions on wiretaps. In conjunction with electronic eavesdropping, Canadian authorities have been moving away from collecting evidence to use in criminal cases and have been engaging in the "disrupting" suspected groups.
However, the RCMP admit that they have never "sought greater authority to conduct monitoring and surveillance" because in Canada, law enforcement only needs Ministerial approval to engage in wholesale surveillance -- not specific calls or emails but broad wholesale monitoring.
The arrests come at a time when Canad's "Anti-Terrorism Act" is set to be renewed by Parliament. Despite the fact that many of the new powers granted law enforcement were never used law enforcement and major news media in Canada want the Act renewed.
As Gwynne Dyer points out in one of the few dissenting articles in this country the rationale behind the need for these increased powers is fundamentally flawed. The case for increased surveillance powers to protect Canadians is based on the presumption of an international terrorist network when in fact the threat is from small, isolated nodes:
Any terrorist attack on Canada is bound to be homegrown, because there is no shadowy but powerful network of international Islamist terrorists waging a war against the West. There are isolated small groups of extremists who blow things up once in a while. There are Web sites and other media through which they can exchange ideas and techniques, but there is no headquarters, no chain of command, no organization that can be defeated, dismantled, and destroyed...
The contrast between the received wisdom—that the world, or at least the West, is engaged in a titanic, unending struggle against a terrorist organisation of global reach—and the not very impressive reality is so great that most people in the West believe the official narrative rather than the evidence of their own eyes. There must be a major terrorist threat; otherwise, the government is wrong or lying, the intelligence agencies are wrong or self-serving, the media are fools or cowards, and the invasion of Iraq had nothing to do with fighting terrorism.
The expansion of increased surveillance technology and powers while decreasing the amount of oversight is a threat to the civil liberties and privacy of Canadians. The fact that fear is exploited to push these powers through is deplorable.
Tuesday, June 6, 2006
Spoof site shut down in Canada
Joe Volpe, a candidate in the Liberal leadership race accepted campaign donations from children as young as eleven in an apparent effort to stretch the campaign rules which limit contributions to $5400 per person. In one case, an entire family -- mom, dad, and four kids -- with connections to Canada's largest generic drug manufacturer each donated $5400.
A spoof website -- youthforvolpe.ca -- was setup in response. The spoof site encouraged children to contribute to Volpe's campaign using mommy and daddy's credit card.
The website was quickly shut down. The domain name was cancelled after the registrar (Canadian Domain Name Services Inc.) was alerted by a Globe and Mail reporter that the contact phone number for the domain registrant was not valid. The Canadian Internet Registration Authority (CIRA) required valid information for domain registrations and after reviewing the information for youthforvolpe.ca the registrar concluded that the information was fabricated and canceled the domain name.
The domain and website now appear to be restored.
A spoof website -- youthforvolpe.ca -- was setup in response. The spoof site encouraged children to contribute to Volpe's campaign using mommy and daddy's credit card.
The website was quickly shut down. The domain name was cancelled after the registrar (Canadian Domain Name Services Inc.) was alerted by a Globe and Mail reporter that the contact phone number for the domain registrant was not valid. The Canadian Internet Registration Authority (CIRA) required valid information for domain registrations and after reviewing the information for youthforvolpe.ca the registrar concluded that the information was fabricated and canceled the domain name.
The domain and website now appear to be restored.
Thursday, June 1, 2006
Microsoft responds with omissions
Amnesty International's campaign urging Microsoft not to engage in human rights abuses has triggered a response from Microsoft. Microsoft claims it "has increased the ability of Chinese citizens to engage in free expression" and that Amnesty's claims of Microsoft's censorship are misleading. A first glance indicates that Microsoft may have a few points:
1. Microsoft says it has not signed "Public Pledge of Self Regulation" for the Chinese Internet industry (Microsoft is not listed as a member of ISOC). Still, Microsoft does self-censor its blog and search services in China.
2. Microsoft says that its beta search engine in China "does not block searches for particular key words, including 'democracy,' 'freedom,' 'human rights'". Indeed, searches for these terms (in English and Chinese) do produce results. (The results do seem to be weighted in favour of content hosted in China, but I'll leave it to others to investigate that further.)
However, beta.search.msn.com.cn does, in fact, censor its search results. Rather than restrict what keywords a user can search for MSN simply removes specific web sites from the results displayed to the user. Following, Google.cn's example, MSN indicates that results have been removed. MSN provides a link to a page that explains their filtering policy which states that sometimes, in accordance with local law, certain results will not be shown.
(* Click for larger image)
For example, using the "site:" modifier which restricts results to a particular website, a search for "site:news.bbc.co.uk" returns a page that indicates that although there are millions of items there were no results found and that some results have been removed. MSN China has removed the BBC News website from its results set.
(* Click for larger image)
The reality is that Microsoft does censor is MSN China search engine.
3. Microsoft says that users of its MSN Spaces blogging service in China "are not prohibited from using the words 'democracy,' 'freedom,' or 'human rights' in blog titles or blog content." But it admits that there are restricted terms when it comes to the "account name, space name, or space sub-title – or in photo captions." Microsoft claims that the key words 'democracy,' 'freedom,' and 'human rights' are not on their restricted term list. Microsoft states that "MSN Spaces does not filter blog content in any way."
Microsoft is choosing the terms used very carefully, ostensibly to obfuscate the fact that MSN spaces does censor users. Note the distinction between blog titles and blog content. Blog content seems to refer to the "body" of a blog post, which does not appear to be filtered, but blog titles are in fact filtered. Although the specific words noted are no (or no longer) filtered, terms such as 天安门事件 ("tiananman massacre" in Chinese) are in fact filtered. If a blog post title contains such terms the user receives a warning indicating that the post contains prohibited language and the blog entry is not posted.
(* Click for larger image)
MSN Spaces content is in fact censored, just not in the "body" of a blog post.
Microsoft appears to be trying to divert attention from their censorship practices focusing on the specifics of their filtering system. Researchers are at a distinct disadvantage as Microsoft keeps the exact list of censored terms secret and can modify the list at anytime. In fact, Microsoft's main claim that Amnesty International is inaccurate by stating that the words 'democracy,' 'freedom,' and 'human rights' (presumably they mean in Chinese) are censored by MSN is because MSN modified their original restricted term list.
Research conducted by Rebecca MacKinnon in June 2005 clearly shows that MSN Spaces prevented a blog titled 我爱言论自由人权和民主, which translates to "I love freedom of speech, human rights and democracy" from being created.
While the words identified by Amnesty International are not filtered for specific blog entries or in the MSN China search engine they were used as part of MSN Spaces' filtering and Amnesty is rightly drawing attention to this. Microsoft, on the other hand, is using precision to deflect criticism and make it appear that they don't censor their services at all.
This underscores the need for anti-censorship community to be thorough in our research. Since these companies (and countries) can change how and what they filter at anytime they may use this to attempt to discredit critics. It is very important for free speech advocates to accurately identify companies that are complicit is censorship world wide.
Microsoft claims that it "has increased the ability of Chinese citizens to engage in free expression" when in fact all they have done is introduced censored services that domestic Chinese firms already provide. Instead, Microsoft is, as Amnesty International states "aiding repression, censorship, and violation of fundamental freedoms". By introducing yet another censored service in China -- to compete for market share with other censored services -- Microsoft is normalizing censorship. Rather than being the exception, censorship is becoming the rule and when the largest and most powerful technology companies on earth support it, it becomes increasingly difficult to fight against.
1. Microsoft says it has not signed "Public Pledge of Self Regulation" for the Chinese Internet industry (Microsoft is not listed as a member of ISOC). Still, Microsoft does self-censor its blog and search services in China.
2. Microsoft says that its beta search engine in China "does not block searches for particular key words, including 'democracy,' 'freedom,' 'human rights'". Indeed, searches for these terms (in English and Chinese) do produce results. (The results do seem to be weighted in favour of content hosted in China, but I'll leave it to others to investigate that further.)
However, beta.search.msn.com.cn does, in fact, censor its search results. Rather than restrict what keywords a user can search for MSN simply removes specific web sites from the results displayed to the user. Following, Google.cn's example, MSN indicates that results have been removed. MSN provides a link to a page that explains their filtering policy which states that sometimes, in accordance with local law, certain results will not be shown.
(* Click for larger image)
For example, using the "site:" modifier which restricts results to a particular website, a search for "site:news.bbc.co.uk" returns a page that indicates that although there are millions of items there were no results found and that some results have been removed. MSN China has removed the BBC News website from its results set.
(* Click for larger image)
The reality is that Microsoft does censor is MSN China search engine.
3. Microsoft says that users of its MSN Spaces blogging service in China "are not prohibited from using the words 'democracy,' 'freedom,' or 'human rights' in blog titles or blog content." But it admits that there are restricted terms when it comes to the "account name, space name, or space sub-title – or in photo captions." Microsoft claims that the key words 'democracy,' 'freedom,' and 'human rights' are not on their restricted term list. Microsoft states that "MSN Spaces does not filter blog content in any way."
Microsoft is choosing the terms used very carefully, ostensibly to obfuscate the fact that MSN spaces does censor users. Note the distinction between blog titles and blog content. Blog content seems to refer to the "body" of a blog post, which does not appear to be filtered, but blog titles are in fact filtered. Although the specific words noted are no (or no longer) filtered, terms such as 天安门事件 ("tiananman massacre" in Chinese) are in fact filtered. If a blog post title contains such terms the user receives a warning indicating that the post contains prohibited language and the blog entry is not posted.
(* Click for larger image)
MSN Spaces content is in fact censored, just not in the "body" of a blog post.
Microsoft appears to be trying to divert attention from their censorship practices focusing on the specifics of their filtering system. Researchers are at a distinct disadvantage as Microsoft keeps the exact list of censored terms secret and can modify the list at anytime. In fact, Microsoft's main claim that Amnesty International is inaccurate by stating that the words 'democracy,' 'freedom,' and 'human rights' (presumably they mean in Chinese) are censored by MSN is because MSN modified their original restricted term list.
Research conducted by Rebecca MacKinnon in June 2005 clearly shows that MSN Spaces prevented a blog titled 我爱言论自由人权和民主, which translates to "I love freedom of speech, human rights and democracy" from being created.
While the words identified by Amnesty International are not filtered for specific blog entries or in the MSN China search engine they were used as part of MSN Spaces' filtering and Amnesty is rightly drawing attention to this. Microsoft, on the other hand, is using precision to deflect criticism and make it appear that they don't censor their services at all.
This underscores the need for anti-censorship community to be thorough in our research. Since these companies (and countries) can change how and what they filter at anytime they may use this to attempt to discredit critics. It is very important for free speech advocates to accurately identify companies that are complicit is censorship world wide.
Microsoft claims that it "has increased the ability of Chinese citizens to engage in free expression" when in fact all they have done is introduced censored services that domestic Chinese firms already provide. Instead, Microsoft is, as Amnesty International states "aiding repression, censorship, and violation of fundamental freedoms". By introducing yet another censored service in China -- to compete for market share with other censored services -- Microsoft is normalizing censorship. Rather than being the exception, censorship is becoming the rule and when the largest and most powerful technology companies on earth support it, it becomes increasingly difficult to fight against.
Monday, May 29, 2006
New Cyber Security Task Force in Canada?
Michael Geist reports that the Canada may be creating a Cyber Security Task Force. Although the Ministry of Public Security and Emergency Preparedness Canada has not announced it the Government Electronic Directory Service now lists a position for a Cyber Security Task Force Secretariat. Geist rasises some key issues including:
As Geist notes, the proposed legislation concerning electronic surveillance requires ISP's to "install new systems capable of capturing data and identifying specific subscriber activities" and lacks judicial oversight -- it allows various law enforcement authorities to simply request subscriber data from ISPs without a warrant.
First, who will be on the task force? It is essential it include representation from privacy and civil liberties groups. Security is critical but must be imbued with full respect for the privacy and civil liberty rights of all Canadians. Revelations of widespread telephone communications surveillance in the United States — frequently with the secret participation of telecommunications firms — has provided evidence of the danger of focusing on security without counterbalancing with a privacy and civil liberties perspective.
Second, what other legislation could be introduced in such an environment? With a cyber-security task force on the way, speculation will increase that the government is also preparing to bring back so-called "lawful access" legislation. Introduced by the Liberal government, the innocuous-sounding Modernization of Investigative Techniques Act envisioned a host of new legal powers associated with near-ubiquitous surveillance technologies.
As Geist notes, the proposed legislation concerning electronic surveillance requires ISP's to "install new systems capable of capturing data and identifying specific subscriber activities" and lacks judicial oversight -- it allows various law enforcement authorities to simply request subscriber data from ISPs without a warrant.
The Most Sophisticated Internet Surveillance In the World
While China is often singled out for its Internet surveillance capabilities, new whistleblower evidence indicates that China's Internet surveillance pales in comparison to the United States' surveillance regime. The latest information reveals that AT&T implemented a sophisticated monitoring and data mining program convering both Internet and telephone communications when asked by the NSA, although the roots of the program appear to be an outgrowth of the Defense Department's Total Information Awareness (TIA) program. The USA's extensive system is able to monitor traffic on essentially the entire Internet due to AT&T's peering links with other major backbone providers:Another Cut-In and Test Procedure document dated January 24, 2003, provides diagrams of how AT&T Core Network circuits were to be run through the "splitter" cabinet. One page lists the circuit IDs of key Peering Links which were "cut-in" in February 2003, including ConXion, Verio, XO, Genuity, Qwest, PAIX, Allegiance, AboveNet, Global Crossing, C&W, UUNET, Level 3, Sprint, Telia, PSINet and Mae West. By the way, Mae West is one of two key internet nodal points in the United States (the other, Mae East, is in Vienna, Virginia). It's not just WorldNet customers who are being spied on -- it's the entire internet.
The program covers Internet and telephone communications. The EFF has filed suit against AT&T:
The lawsuit alleges that AT&T Corp. has opened its key telecommunications facilities and databases to direct access by the NSA and/or other government agencies, thereby disclosing to the government the contents of its customers' communications as well as detailed communications records about millions of its customers, including the lawsuit's class members.
The lawsuit also alleges that AT&T has given the government unfettered access to its over 300 terabyte "Daytona" database of caller information—one of the largest databases in the world. Moreover, by opening its network and databases to wholesale surveillance by the NSA, EFF alleges that AT&T has violated the privacy of its customers and the people they call and email, as well as broken longstanding communications privacy laws.
The US Government's "Internet Police" (I wonder if there are "30,000" of them?) monitor communications in "real-time" from "secret rooms" located in AT&T buildings:
The normal work force of unionized technicians in the office are forbidden to enter the "secret room," which has a special combination lock on the main door. The telltale sign of an illicit government spy operation is the fact that only people with security clearance from the National Security Agency can enter this room.
The combination of the technical sophistication of the system and the illegal way in which it has been implemented confirms what many have suspected: the electronic surveillance regime of the US is far more extensive and sophisticated than any other country in the world.
Amnesty Campaign and Censorship Map
Amnesty International is currently working with the OpenNet Initiative (ONI) to help raise awareness of internet censorship around the world. Amnesty International is launching a campaign to show that online or offline the human voice and human rights are impossible to repress.
The aim of the ONI is to document empirically patterns of Internet content filtering and surveillance worldwide behind national firewalls over an extended period of time. Its reports have documented the scope, scale and sophistication of numerous filtering regimes worldwide, and have helped verify the use of commercial filtering technologies that are used to underpin these regimes. The ONI's flash map of global filtering shows the results of these investigations.
The aim of the ONI is to document empirically patterns of Internet content filtering and surveillance worldwide behind national firewalls over an extended period of time. Its reports have documented the scope, scale and sophistication of numerous filtering regimes worldwide, and have helped verify the use of commercial filtering technologies that are used to underpin these regimes. The ONI's flash map of global filtering shows the results of these investigations.
Friday, May 12, 2006
I can't search for shit?
Seth Finkelstein notes that Yahoo Italy is strangely redirecting searches for words like "shit". Instead of searching the "web" for shit, it redirects to a Yahoo directory search. "merda" is subject to the same redirection.But it seems that most other nasty words are fine. Another thing that's interesting is that when you search for a word like "fuck" a warning appears at the top of the results.
TapOut
No, not the fight gear or what happens when Rickson gets you in an armbar. USA Today reports:
Only Qwest questioned the legality:
Sadly, 63% of Americans say they support this.
The National Security Agency has been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth, people with direct knowledge of the arrangement told USA TODAY.
The NSA program reaches into homes and businesses across the nation by amassing information about the calls of ordinary Americans — most of whom aren't suspected of any crime. This program does not involve the NSA listening to or recording conversations. But the spy agency is using the data to analyze calling patterns in an effort to detect terrorist activity, sources said in separate interviews.
Only Qwest questioned the legality:
Unable to get comfortable with what NSA was proposing, Qwest's lawyers asked NSA to take its proposal to the FISA court. According to the sources, the agency refused.
The NSA's explanation did little to satisfy Qwest's lawyers. "They told (Qwest) they didn't want to do that because FISA might not agree with them," one person recalled. For similar reasons, this person said, NSA rejected Qwest's suggestion of getting a letter of authorization from the U.S. attorney general's office. A second person confirmed this version of events.
Sadly, 63% of Americans say they support this.
Wednesday, May 10, 2006
Who chooses what to filter? Part 2
Here is another recent case that illustrates the transparency and accountability issues that affect national level filtering.
The School District of Palm Beach County uses BlueCoat's WebFilter to block content that BlueCoat classifies as "Gay/Lesbian", including prominent advocacy groups, but not sites that denounce homosexuality. There are two issues here: 1) the decision to block Gay/Lesbian content and 2) the classification of web sites as Gay/Lesbian.
The Children's Internet Protection Act (CIPA) requires schools and libraries to install filtering systems in order to receive E-Rate funding. The filtering systems are to block access to "visual depictions" that are "(a) are obscene, (b) are child pornography, or (c) are harmful to minors" (from FCC Fact Sheet).
The leap from pictures to entire web sites is one that i did not notice earlier, but is a significant case of mission creep. It is even more significant in the context of the decision of what specific content categories to filter.
The decision to block Gay/Lesbian content category, supplied by BlueCoat, seems to have been made by the system adminstrator based on "common sense":
Now, there isn't much "common sense" in blocking human rights sites. And it certainly extends beyond the CIPA requirements. It shows that although the system was put into place based on a narrow set of guidelines with the expressed purpose of protecting children from content such as pornography it has been extended without oversight and left to basically ad-hoc decisions based on the "common sense" of an administrator.
The second part of this concerns how BlueCoat classifies sites. Sites that are against homophobia are classified as "Gay/Lesbian" while homophobic sites are classified as "Health" and "Political/Activist Groups." BlueCoat's classification of sites into secret block lists also determine what sites the School District of Palm Beach County's students can have access to.
The School District of Palm Beach County uses BlueCoat's WebFilter to block content that BlueCoat classifies as "Gay/Lesbian", including prominent advocacy groups, but not sites that denounce homosexuality. There are two issues here: 1) the decision to block Gay/Lesbian content and 2) the classification of web sites as Gay/Lesbian.
The Children's Internet Protection Act (CIPA) requires schools and libraries to install filtering systems in order to receive E-Rate funding. The filtering systems are to block access to "visual depictions" that are "(a) are obscene, (b) are child pornography, or (c) are harmful to minors" (from FCC Fact Sheet).
The leap from pictures to entire web sites is one that i did not notice earlier, but is a significant case of mission creep. It is even more significant in the context of the decision of what specific content categories to filter.
The decision to block Gay/Lesbian content category, supplied by BlueCoat, seems to have been made by the system adminstrator based on "common sense":
Shawn Brinkman, a systems specialist at the District, explained the decision to block gay and lesbian issues websites by citing concerns about the appropriateness of such websites for younger students.
"We have to make judgments for all our users, which include Pre-K users," Brinkman said. "We don't have the technology to disallow and allow for certain age groups."
Brinkman said that the decision was one made on "common sense."
"I think common sense says [these websites are not] appropriate for four- or five-year-olds," he said, adding that these topics featured on those websites are ones parents would probably want to discuss with their children.
Now, there isn't much "common sense" in blocking human rights sites. And it certainly extends beyond the CIPA requirements. It shows that although the system was put into place based on a narrow set of guidelines with the expressed purpose of protecting children from content such as pornography it has been extended without oversight and left to basically ad-hoc decisions based on the "common sense" of an administrator.
The second part of this concerns how BlueCoat classifies sites. Sites that are against homophobia are classified as "Gay/Lesbian" while homophobic sites are classified as "Health" and "Political/Activist Groups." BlueCoat's classification of sites into secret block lists also determine what sites the School District of Palm Beach County's students can have access to.
Tuesday, May 9, 2006
Circumventing Censorship
The Citizen Lab was recently featured in the Toronto Star. Just to be clear, I do go to the gym and do not wear flip flops :). Seriously though, I've received many emails and read through some of the Slashdot comments and would like to make a few points.
Thursday, May 4, 2006
ONI Releases Belarus Internet Watch Report
The OpenNet Initiative has released a report that presents the findings of ONI's effort to monitor the Internet during Belarus' recent presidential elections.
The full report is available here
The full report is available here
Tuesday, April 25, 2006
Is there a way to circumvent Google's censorship in China?
Google.cn is a Chinese language search service targeted towards users in the People's Republic of China. It was launched on January 25 2006 and it filters search requests to content deemed to be "sensitive" by the government of China. (You can compare search results between the uncensored Chinese language Google.com and the censored Google.cn using the OpenNet Initiative's Search Comparison tool.)
The filtering takes place in at least three ways:
The New York Times reports that the Chinese government did not give Google a list of sites to block. Rather, Google set-up a computer in China and tested to see what content was accessible and content found to be inaccessible was deemed to be sensitive and added to Google's blocklist.
For example, the website for Human Rights Watch (hrw.org), which is blocked in China, has also been de-listed from Google.cn. A normal web request to hrw.org from within China triggers an error and the content of the site never loads in a users browser. A search in Google using the modifier "site:" for content on hrw.org (site:hrw.org) on Google.cn yields no results. In China, it is as if hrw.org does not exist.
Is there a way to circumvent Google's censorship in China?
Google has an advertisement program, Google Adsense/Adwords, that allows one to purchase certain keywords that will display an ad on Google when users search for those words. I created an account with Google Ads and selected that my ad be shown in Chinese to users in China. I noticed that a warning appeared indicating that there may be restrictions on advertising in China.
Google describes some specific categories of content that require licensing (local pdf). This list does not include content that may be sensitive for political reasons.
I created my ad (which does not appear to fall under these categories) for hrw.org, which is censored by google.cn, and it was held in a queue waiting to be viewed and labeled "Family Safe". Only "Family Safe" ads are allowed to be shown by Google in China. Eventually my ad was approved as "Family Safe" and was labeled as currently being shown.
However, my ad was initially not shown on Google.cn.
Google indicates that there is an ad for the search terms I selected, but it is not shown. I emailed Google for an explanation of why my ad was not being shown and was informed that there may be a technical error.
My ad was being shown on the uncensored Chinese language Google, but not the censored Google.cn. Google checks what ads to deliver by location (determined by IP address) and the language setting of your browser. Despite both of these showing that my language was Chinese and my location was in China the ad did not properly appear.
Eventually, my ad began to be shown on Google.cn. While my ad does not appear every time the keywords are searched, it does periodically appear. (See possible explanation below).
Although there are no search results available for hrw.org, my ad for a censored website did appear on some occasions. (See below for a possible explanation.)
This is a neat way to circumvent Google's censorship. It may be possible to extend this even further. Mirror sites and alternative URLs for censored web sites can be displayed through the use of Google Ads.
The filtering takes place in at least three ways:
- de-listed domains: specific websites are removed entirely from search results; it is as if the website never existed.
- de-listed urls: specific urls are removed from search results if they contain a de-listed domain.
- restricted keywords: specific keywords are restricted to searches of web pages hosted in China only.
The New York Times reports that the Chinese government did not give Google a list of sites to block. Rather, Google set-up a computer in China and tested to see what content was accessible and content found to be inaccessible was deemed to be sensitive and added to Google's blocklist.
For example, the website for Human Rights Watch (hrw.org), which is blocked in China, has also been de-listed from Google.cn. A normal web request to hrw.org from within China triggers an error and the content of the site never loads in a users browser. A search in Google using the modifier "site:" for content on hrw.org (site:hrw.org) on Google.cn yields no results. In China, it is as if hrw.org does not exist.
Is there a way to circumvent Google's censorship in China?
Google has an advertisement program, Google Adsense/Adwords, that allows one to purchase certain keywords that will display an ad on Google when users search for those words. I created an account with Google Ads and selected that my ad be shown in Chinese to users in China. I noticed that a warning appeared indicating that there may be restrictions on advertising in China.
Google describes some specific categories of content that require licensing (local pdf). This list does not include content that may be sensitive for political reasons.
Due to advertising regulations and laws of the People's Republic of China, Google AdWords requires advertisers to submit business licenses and approval certificates for the following product categories: Agricultural Chemicals Books/Periodicals Cosmetics Food/Foodstuffs Health Supplements Medical Appliances Medical Services Patents Real Estate Veterinary Medicine
I created my ad (which does not appear to fall under these categories) for hrw.org, which is censored by google.cn, and it was held in a queue waiting to be viewed and labeled "Family Safe". Only "Family Safe" ads are allowed to be shown by Google in China. Eventually my ad was approved as "Family Safe" and was labeled as currently being shown.
However, my ad was initially not shown on Google.cn.
Google indicates that there is an ad for the search terms I selected, but it is not shown. I emailed Google for an explanation of why my ad was not being shown and was informed that there may be a technical error.
My ad was being shown on the uncensored Chinese language Google, but not the censored Google.cn. Google checks what ads to deliver by location (determined by IP address) and the language setting of your browser. Despite both of these showing that my language was Chinese and my location was in China the ad did not properly appear.
Eventually, my ad began to be shown on Google.cn. While my ad does not appear every time the keywords are searched, it does periodically appear. (See possible explanation below).
Although there are no search results available for hrw.org, my ad for a censored website did appear on some occasions. (See below for a possible explanation.)
This is a neat way to circumvent Google's censorship. It may be possible to extend this even further. Mirror sites and alternative URLs for censored web sites can be displayed through the use of Google Ads.
Sunday, April 23, 2006
Who chooses what to filter?
In a very interesting article in the New York Times it becomes increasingly clear that "self discipline" is the major driving force of censorship in China. Clive Thompson reports that companies -- not the government of China -- are deciding what specific content to block.
I have wondering for sometime how Google, for example, decides what sites to remove from google.cn. Does Google select the sites or are they given a list of what to block?
Interesting. The implementation of censorship does even require the government to provide lists of sites or key words to block. Many people think that there are "30,000" Internet police searching out content to block when in fact the companies involved in providing Internet content, services and access are doing it themselves. Certainly, there is pressure from the government and to do business in China it is understood that one must self-censor but what is the formal mechanism?
There is a lot of talk about "local laws" but if the requirement to censor is merely implied, if it is companies rather than the government that are deciding what specific content to block then what is the true legal status of censorship in China? What laws or regulations are Google/Yahoo et al complying with? Are they just making it up as they go along?
American Internet firms typically arrive in China expecting the government to hand them an official blacklist of sites and words they must censor. They quickly discover that no master list exists. Instead, the government simply insists the firms interpret the vague regulations themselves. The companies must do a sort of political mind reading and intuit in advance what the government won't like. Last year, a list circulated online purporting to be a blacklist of words the government gives to Chinese blogging firms, including "democracy" and "human rights." In reality, the list had been cobbled together by a young executive at a Chinese blog company. Every time he received a request to take down a posting, he noted which phrase the government had objected to, and after a while he developed his own list simply to help his company avoid future hassles.
I have wondering for sometime how Google, for example, decides what sites to remove from google.cn. Does Google select the sites or are they given a list of what to block?
Brin's team had one more challenge to confront: how to determine which sites to block? The Chinese government wouldn't give them a list. So Google's engineers hit on a high-tech solution. They set up a computer inside China and programmed it to try to access Web sites outside the country, one after another. If a site was blocked by the firewall, it meant the government regarded it as illicit — so it became part of Google's blacklist.
Interesting. The implementation of censorship does even require the government to provide lists of sites or key words to block. Many people think that there are "30,000" Internet police searching out content to block when in fact the companies involved in providing Internet content, services and access are doing it themselves. Certainly, there is pressure from the government and to do business in China it is understood that one must self-censor but what is the formal mechanism?
There is a lot of talk about "local laws" but if the requirement to censor is merely implied, if it is companies rather than the government that are deciding what specific content to block then what is the true legal status of censorship in China? What laws or regulations are Google/Yahoo et al complying with? Are they just making it up as they go along?
Wednesday, April 19, 2006
Internet Filtering in Pakistan
Dr. Awab Alvi gave a presentation on the Don't Block the Blog campaign at the which is trying to get Blogspot unblocked in Pakistan. (His presentation can be downloaded here.) Pakistan has experimented with filtering porn in the past and now filters *.blogspot.com among several others. Reba Shahid of spider.tm gave me copies of the block orders received by ISPs in Pakistan which you can download here and here.
Update: Another block order targeting mostly Baluch sites.
Update: Another block order targeting mostly Baluch sites.
Tuesday, April 18, 2006
Wiggle Room
The Free Expression in Asian Cyberspace in Manila is generating great discussion on aspects of censorship on the Internet. There were some great sessions that discussed the idead of "wiggle room" in confined speech spaces. Kunda Dixit of the Nepali Times talked about the information blackout that occured after the coup in Nepal. He discussed how the newspaper fought back against the imposed censorship through printing articles with whitespace where the censors had remoed parts of the story and through the use of satire. He also stated that Nepal is now blocking 8 or 9 web sites.The impression of the situation in countries that heavily censor is often that there is an information blackhole or that no political discussion takes place. Or that if mention a sensitive topic the secret police will kick down your door. But sometimes you have to look between lines (in this case literally) to see the creative ways in which people are pushing the boundaries of "accepted" speech. It seems to me that supporting and understanding these creative forms of censorship resistance is extremely important.
Monday, April 10, 2006
Testing through proxies in China
I have been getting a lot of help requests lately as various people attempt to testing China's Internet filtering system through open proxies located in China. While proxies can be useful for testing they should not be solely relied upon. Proxies are a useful way to demonstrate that content is accessible, however, proxies add an aditional possible point of failure when checking to see what is inaccessible.
Scenario 1: A request is made for a webpage that contains a banned keyword, "www.falundafa.org", in the body of a webpage through a proxy in China to see if banned keywords in the body of a web page will be accessible or inaccessible. Both the connection on the computer that is connecting to the proxy (ME) and the connection on webserver (HOST) that the page is hosted on are being sniffed with a packet sniffer. Because I control two of the three computers this allows me to monitor two ends of the connection: the connection to the proxy and the connection from the proxy to the webserver.
I (ME) issue the request through the proxy server (PROXY) and get the requested page that contain banned keywords. It is accessible (200 OK).
The webserver (HOST) receives the request and answers the proxy's request (200 OK).
No problem is found in accessing web pages that include "www.falundafa.org". China does not appear to dynamically block pages based on keywords in their content.
Scenario 2a: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows outbound blocking beween the proxy and the host while allowing the connection between me and the proxy to remain).
I (ME) issue the request through the proxy server (PROXY) and receive an RST packet which terminates the connection (the page never loads). The requested content is inaccessible.
The webserver gets both the request from the proxy and reset packets which terminate the connection.
A request is issued through the proxy to the page that was previously successfully retrieved:
An HTTP error is received from the proxy. At this point divergence occurs with proxies. I cannot access the server that triggered the the blocking but I can still access the proxy but the proxy gives a 502 error because it cannot connect to the host because of continued RST packets.
The server gets more RST packets:
Other content on other servers can be accessed through the proxy:
But no content on the server which triggered the blocking can be accessed:
The server gets more RST packets from the proxy:
Sometimes proxies continue to work when accessing sites other than the one that triggered the blocking, as in the situation above, while others fail to connect to any sites because the connection between me and the proxy is disrupted with RST packets. This is a situation where the filtering is occuring on the outbound request.
Sometimes when requesting content that is blocked there is a disruption between me and the proxy because the request I give to the proxy, in plain text, is being filtered on the inbound request.
Scenario 2b: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows inbound blocking beween me and the proxy, further connection between me and the proxy fail).
I (ME) issue the request through the proxy server (PROXY) and receive RST packets which terminates the connection (the page never loads).
The server does not receive a connection from the proxy. the proxy does not issue my request to the server. The blocking occurred between me and the proxy.
Requests for any sites through the proxy will not be sucecssful, instead RST packets are received. This occurs when requests are made to the same previously accessible server as well any other web site. The connection between me and the proxy is disrupted.
Scenario 3: Often, people want to test whether or not specific terms can be used as queries in search engines such as a request to Google for search queries that contain blocked keywords. To be clear, here we are testing if the request will go through to the search engine, not the filtering of results that the search engine itself may engage in.
Because Google appends search terms to its URL path, this is in reality a test for keyword in URL path blocking. It has nothing to do with Google specifically.
Given the behaviours described above one can see how testing search terms in Google can be difficult.
This creates a situation where it is difficult to determine where the filtering is occuring (inbound or outbound), what is actualy blocked and what appears to be blocked because the connection to Google is blocked. Because Google has multiple IP addresses some search requests may get through (if the connection between the requestor and the proxy is ok as in Scenario A) making the proxy appear like it is functioning correctly. However, when connecting to the Google IP that originally triggered the blocking all search requests to that IP will fail and thus may inaccurately identify some keywords as blocked when in fact they are accessible.
Scenario 1: A request is made for a webpage that contains a banned keyword, "www.falundafa.org", in the body of a webpage through a proxy in China to see if banned keywords in the body of a web page will be accessible or inaccessible. Both the connection on the computer that is connecting to the proxy (ME) and the connection on webserver (HOST) that the page is hosted on are being sniffed with a packet sniffer. Because I control two of the three computers this allows me to monitor two ends of the connection: the connection to the proxy and the connection from the proxy to the webserver.
I (ME) issue the request through the proxy server (PROXY) and get the requested page that contain banned keywords. It is accessible (200 OK).
0.296887 ME -> PROXY HTTP GET http://www.nartv.org/tests/test.html HTTP/1.1
19.686393 PROXY -> ME HTTP HTTP/1.1 200 OK (text/html)
The webserver (HOST) receives the request and answers the proxy's request (200 OK).
0.338255 PROXY -> HOST HTTP GET /tests/test.html HTTP/1.1
0.341245 HOST -> PROXY HTTP HTTP/1.1 200 OK (text/html)
No problem is found in accessing web pages that include "www.falundafa.org". China does not appear to dynamically block pages based on keywords in their content.
Scenario 2a: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows outbound blocking beween the proxy and the host while allowing the connection between me and the proxy to remain).
I (ME) issue the request through the proxy server (PROXY) and receive an RST packet which terminates the connection (the page never loads). The requested content is inaccessible.
0.302997 ME -> PROXY HTTP GET http://www.nartv.org/tests/www.falundafa.org.html HTTP/1.1
0.602310 PROXY -> ME TCP www > 2207 [RST] Seq=1 Ack=2367417381 Win=1 Len=0
The webserver gets both the request from the proxy and reset packets which terminate the connection.
0.303520 PROXY -> HOST HTTP GET /tests/www.falundafa.org.html HTTP/1.1
0.304453 PROXY -> HOST TCP 4281 > www [RST] Seq=694 Ack=2293838462 Win=1 Len=0
0.304916 PROXY -> HOST TCP 4281 > www [RST] Seq=694 Ack=1 Win=0 Len=0
A request is issued through the proxy to the page that was previously successfully retrieved:
54.784373 ME -> PROXY HTTP GET http://www.nartv.org/tests/test.html HTTP/1.1
58.554942 PROXY -> ME HTTP HTTP/1.1 502 Proxy Error (text/html)
An HTTP error is received from the proxy. At this point divergence occurs with proxies. I cannot access the server that triggered the the blocking but I can still access the proxy but the proxy gives a 502 error because it cannot connect to the host because of continued RST packets.
The server gets more RST packets:
54.468168 PROXY -> HOST TCP 4391 > www [RST] Seq=1 Ack=2236767498 Win=0 Len=0
54.760082 PROXY -> HOST TCP 4391 > www [RST] Seq=1 Ack=1 Win=0 Len=0
Other content on other servers can be accessed through the proxy:
94.795413 ME -> PROXY HTTP GET http://www.gnu.org/ HTTP/1.1
But no content on the server which triggered the blocking can be accessed:
117.253580 ME -> PROXY HTTP GET http://www.nartv.org/ HTTP/1.1
118.435081 PROXY -> ME HTTP HTTP/1.1 502 Proxy Error (text/html)
The server gets more RST packets from the proxy:
117.218448 PROXY -> HOST TCP 4653 > www [RST] Seq=1 Ack=2164037076 Win=0 Len=0
117.500543 PROXY -> HOST TCP 4653 > www [RST] Seq=1 Ack=1 Win=0 Len=0
Sometimes proxies continue to work when accessing sites other than the one that triggered the blocking, as in the situation above, while others fail to connect to any sites because the connection between me and the proxy is disrupted with RST packets. This is a situation where the filtering is occuring on the outbound request.
Sometimes when requesting content that is blocked there is a disruption between me and the proxy because the request I give to the proxy, in plain text, is being filtered on the inbound request.
Scenario 2b: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows inbound blocking beween me and the proxy, further connection between me and the proxy fail).
I (ME) issue the request through the proxy server (PROXY) and receive RST packets which terminates the connection (the page never loads).
52.758824 ME -> PROXY HTTP GET http://www.nartv.org/tests/www.falundafa.org.html HTTP/1.1
53.071331 PROXY -> ME TCP www > 2311 [RST] Seq=1 Ack=3653495283 Win=1 Len=0
53.071337 PROXY -> ME TCP www > 2311 [RST] Seq=1 Ack=3653495283 Win=1 Len=0
The server does not receive a connection from the proxy. the proxy does not issue my request to the server. The blocking occurred between me and the proxy.
Requests for any sites through the proxy will not be sucecssful, instead RST packets are received. This occurs when requests are made to the same previously accessible server as well any other web site. The connection between me and the proxy is disrupted.
73.807658 ME -> PROXY HTTP GET http://www.gnu.org/ HTTP/1.1
74.230743 PROXY -> ME TCP www > 2312 [RST] Seq=1070894714 Ack=2074992522 Win=0 Len=0
74.231351 PROXY -> ME TCP www > 2312 [RST] Seq=1070894714 Ack=2074992522 Win=0 Len=0
Scenario 3: Often, people want to test whether or not specific terms can be used as queries in search engines such as a request to Google for search queries that contain blocked keywords. To be clear, here we are testing if the request will go through to the search engine, not the filtering of results that the search engine itself may engage in.
Because Google appends search terms to its URL path, this is in reality a test for keyword in URL path blocking. It has nothing to do with Google specifically.
Given the behaviours described above one can see how testing search terms in Google can be difficult.
- One cannot determine if the blocking is occuring between the requestor and the proxy or between the proxy and Google.
- If the connection between the requestor and the proxy is disrupted (2b) further requests to Google will appear to be blocked. Although you may receive your browser's cached copy of the initial Google search page (by pressing the back button in your browser) the connection to Google is actually blocked and further search requests will appear to be blocked whether or not they contain blocked keywords or random unblocked keywords.
- In a scenario (2a) where the connection between the requestor and the proxy is fine, but the connection between the proxy and Google was blocked, searches for unblocked terms may appear to be blocked. Further complicating the issue, Google has many different IP addresses, so if the request from the proxy to Google was filtered further requests to that same Google IP will fail, but if the domain resolves to a different IP the request will go through.
This creates a situation where it is difficult to determine where the filtering is occuring (inbound or outbound), what is actualy blocked and what appears to be blocked because the connection to Google is blocked. Because Google has multiple IP addresses some search requests may get through (if the connection between the requestor and the proxy is ok as in Scenario A) making the proxy appear like it is functioning correctly. However, when connecting to the Google IP that originally triggered the blocking all search requests to that IP will fail and thus may inaccurately identify some keywords as blocked when in fact they are accessible.
Friday, April 7, 2006
Censorship Maps
The Atlantic has created a censorship map based on ONI data. (I've archived a local mirror of the map and the accompanying article). The accompanying article is a bit overzealous in its description of China but I liked that fact that the article specifically highlighted that Internet filtering is not exclusive to China but is spreading -- essentially becoming the "norm" -- worldwide. In terms of targetted content, porn is defintely targetted but the numbers are skewed by the fact that the use of commercial lists (there are open source lists too) allow countries to block a lot of porn easily. But in terms of significance porn is, in my opinion, of rather low importance. the blocking of several key sources of local language alternative information or an social movement group is much more important. The sgnificance of the content rather than the total number of sites blocked in category seems, to me, to be of more importance but is much harder to measure.
Wired also made a graphical representation of ONI data a while back. The graphical representations are quite nice, it gets the concept across, but it is tough to make cross-country comparisons. The categories here are from our "global list" -- a list that we test in all countries. As you can see countries that use commercial filtering products score higher because they block pre-defined categopries such as porn or gambling. They key sites though, not represented in this graphic , that countries target are local language, country or issue specific web sites. That said, this is a great effort in the right direction and we have some ideas for better cross-country comparison, so stay tuned.
Monday, April 3, 2006
Australia: Censorship & Surveillance
A spoof site of Australian Prime Minister John Howard was shut down due to presure from the government. The closure is reportedly due to a phone complaint from the PM's office to the Melbourne IT Ltd (http://www.melbourneit.com.au/) the domain registrar for the website johnhowardpm.org. The compaint contended that the parody website was a "phishing" site, something usually associent with identity theft schemes or other scams.
Now, ICANN has a dispute policy that should be followed in cases such as this. While similar to the borat.kz case mentioned by Reporters Without Borders this case is different because ICANN regulates the .org domain. In this case the registrar appears to have violated the ICANN rules. The changes were made to the domain name without 1) consent from the owner, 2) receipt of an order from a court... or 3) receipt of a decision of an Administrative Panel...
The web host was not the target, but rather just the domain registrar. The website was hosted on Yahoo and is still accessible if you access the the original site by directly connecting to the IP (216.39.58.47) on Yahoo's host and manually feeding in the HTTP HOST header johnhowardpm.org.
As if censorship was not enough Australia has now passed a new surveillance law. MEAA/IFEX explains:
Groups such as Electronic Frontiers Australia have been monitoring the growing body of censorship laws in Australia. The Labor Party is promising to bring in national filtering if elected -- to protect children of course, not to silence critics. Of course, as we have seen in the past, filtering is subject to mission creep:
It's not *only* happening in China folks.
Now, ICANN has a dispute policy that should be followed in cases such as this. While similar to the borat.kz case mentioned by Reporters Without Borders this case is different because ICANN regulates the .org domain. In this case the registrar appears to have violated the ICANN rules. The changes were made to the domain name without 1) consent from the owner, 2) receipt of an order from a court... or 3) receipt of a decision of an Administrative Panel...
The web host was not the target, but rather just the domain registrar. The website was hosted on Yahoo and is still accessible if you access the the original site by directly connecting to the IP (216.39.58.47) on Yahoo's host and manually feeding in the HTTP HOST header johnhowardpm.org.
As if censorship was not enough Australia has now passed a new surveillance law. MEAA/IFEX explains:
New laws, passed by the Senate yesterday, give law enforcement agencies power to intercept phone calls, emails and text messages of innocent people. This extreme surveillance law poses a severe threat to press freedom - journalists can assume their conversations with sources will be intercepted at any time, says Australia's media union.
Spies, police and other security agencies will be able to use B-party warrants to tap phones belonging to a suspect's family, friends, colleagues and lawyer. Other agencies, such as the Australian Tax Office, Customs, and the Australian Securities and Investment Commission (ASIC), will have the power to access stored communications such as email and SMS.
Groups such as Electronic Frontiers Australia have been monitoring the growing body of censorship laws in Australia. The Labor Party is promising to bring in national filtering if elected -- to protect children of course, not to silence critics. Of course, as we have seen in the past, filtering is subject to mission creep:
Regardless of the initial reason for implementing Internet filtering, there is increasing pressure to expand its use once the filtering infrastructure is in place.
It's not *only* happening in China folks.
Subscribe to:
Posts (Atom)