Is there a way to circumvent Google's censorship in China?

Google.cn is a Chinese language search service targeted towards users in the People's Republic of China. It was launched on January 25 2006 and it filters search requests to content deemed to be "sensitive" by the government of China. (You can compare search results between the uncensored Chinese language Google.com and the censored Google.cn using the OpenNet Initiative's Search Comparison tool.)

The filtering takes place in at least three ways:

• de-listed domains: specific websites are removed entirely from search results; it is as if the website never existed.
  
• de-listed urls: specific urls are removed from search results if they contain a de-listed domain.
  
• restricted keywords: specific keywords are restricted to searches of web pages hosted in China only.
  

The New York Times reports that the Chinese government did not give Google a list of sites to block. Rather, Google set-up a computer in China and tested to see what content was accessible and content found to be inaccessible was deemed to be sensitive and added to Google's blocklist.

For example, the website for Human Rights Watch (hrw.org), which is blocked in China, has also been de-listed from Google.cn. A normal web request to hrw.org from within China triggers an error and the content of the site never loads in a users browser. A search in Google using the modifier "site:" for content on hrw.org (site:hrw.org) on Google.cn yields no results. In China, it is as if hrw.org does not exist.

Is there a way to circumvent Google's censorship in China?

Google has an advertisement program, Google Adsense/Adwords, that allows one to purchase certain keywords that will display an ad on Google when users search for those words. I created an account with Google Ads and selected that my ad be shown in Chinese to users in China. I noticed that a warning appeared indicating that there may be restrictions on advertising in China.



Google describes some specific categories of content that require licensing (local pdf). This list does not include content that may be sensitive for political reasons.

Due to advertising regulations and laws of the People's Republic of China, Google AdWords requires advertisers to submit business licenses and approval certificates for the following product categories: Agricultural Chemicals Books/Periodicals Cosmetics Food/Foodstuffs Health Supplements Medical Appliances Medical Services Patents Real Estate Veterinary Medicine

I created my ad (which does not appear to fall under these categories) for hrw.org, which is censored by google.cn, and it was held in a queue waiting to be viewed and labeled "Family Safe". Only "Family Safe" ads are allowed to be shown by Google in China. Eventually my ad was approved as "Family Safe" and was labeled as currently being shown.



However, my ad was initially not shown on Google.cn.



Google indicates that there is an ad for the search terms I selected, but it is not shown. I emailed Google for an explanation of why my ad was not being shown and was informed that there may be a technical error.

My ad was being shown on the uncensored Chinese language Google, but not the censored Google.cn. Google checks what ads to deliver by location (determined by IP address) and the language setting of your browser. Despite both of these showing that my language was Chinese and my location was in China the ad did not properly appear.

Eventually, my ad began to be shown on Google.cn. While my ad does not appear every time the keywords are searched, it does periodically appear. (See possible explanation below).



Although there are no search results available for hrw.org, my ad for a censored website did appear on some occasions. (See below for a possible explanation.)

This is a neat way to circumvent Google's censorship. It may be possible to extend this even further. Mirror sites and alternative URLs for censored web sites can be displayed through the use of Google Ads.

Who chooses what to filter?

In a very interesting article in the New York Times it becomes increasingly clear that "self discipline" is the major driving force of censorship in China. Clive Thompson reports that companies -- not the government of China -- are deciding what specific content to block.

American Internet firms typically arrive in China expecting the government to hand them an official blacklist of sites and words they must censor. They quickly discover that no master list exists. Instead, the government simply insists the firms interpret the vague regulations themselves. The companies must do a sort of political mind reading and intuit in advance what the government won't like. Last year, a list circulated online purporting to be a blacklist of words the government gives to Chinese blogging firms, including "democracy" and "human rights." In reality, the list had been cobbled together by a young executive at a Chinese blog company. Every time he received a request to take down a posting, he noted which phrase the government had objected to, and after a while he developed his own list simply to help his company avoid future hassles.

I have wondering for sometime how Google, for example, decides what sites to remove from google.cn. Does Google select the sites or are they given a list of what to block?

Brin's team had one more challenge to confront: how to determine which sites to block? The Chinese government wouldn't give them a list. So Google's engineers hit on a high-tech solution. They set up a computer inside China and programmed it to try to access Web sites outside the country, one after another. If a site was blocked by the firewall, it meant the government regarded it as illicit — so it became part of Google's blacklist.

Interesting. The implementation of censorship does even require the government to provide lists of sites or key words to block. Many people think that there are "30,000" Internet police searching out content to block when in fact the companies involved in providing Internet content, services and access are doing it themselves. Certainly, there is pressure from the government and to do business in China it is understood that one must self-censor but what is the formal mechanism?

There is a lot of talk about "local laws" but if the requirement to censor is merely implied, if it is companies rather than the government that are deciding what specific content to block then what is the true legal status of censorship in China? What laws or regulations are Google/Yahoo et al complying with? Are they just making it up as they go along?

Internet Filtering in Pakistan

Dr. Awab Alvi gave a presentation on the Don't Block the Blog campaign at the which is trying to get Blogspot unblocked in Pakistan. (His presentation can be downloaded here.) Pakistan has experimented with filtering porn in the past and now filters *.blogspot.com among several others. Reba Shahid of spider.tm gave me copies of the block orders received by ISPs in Pakistan which you can download here and here.

Update: Another block order targeting mostly Baluch sites.

Wiggle Room

The Free Expression in Asian Cyberspace in Manila is generating great discussion on aspects of censorship on the Internet. There were some great sessions that discussed the idead of "wiggle room" in confined speech spaces. Kunda Dixit of the Nepali Times talked about the information blackout that occured after the coup in Nepal. He discussed how the newspaper fought back against the imposed censorship through printing articles with whitespace where the censors had remoed parts of the story and through the use of satire. He also stated that Nepal is now blocking 8 or 9 web sites.

The impression of the situation in countries that heavily censor is often that there is an information blackhole or that no political discussion takes place. Or that if mention a sensitive topic the secret police will kick down your door. But sometimes you have to look between lines (in this case literally) to see the creative ways in which people are pushing the boundaries of "accepted" speech. It seems to me that supporting and understanding these creative forms of censorship resistance is extremely important.

Testing through proxies in China

I have been getting a lot of help requests lately as various people attempt to testing China's Internet filtering system through open proxies located in China. While proxies can be useful for testing they should not be solely relied upon. Proxies are a useful way to demonstrate that content is accessible, however, proxies add an aditional possible point of failure when checking to see what is inaccessible.

Scenario 1: A request is made for a webpage that contains a banned keyword, "www.falundafa.org", in the body of a webpage through a proxy in China to see if banned keywords in the body of a web page will be accessible or inaccessible. Both the connection on the computer that is connecting to the proxy (ME) and the connection on webserver (HOST) that the page is hosted on are being sniffed with a packet sniffer. Because I control two of the three computers this allows me to monitor two ends of the connection: the connection to the proxy and the connection from the proxy to the webserver.

I (ME) issue the request through the proxy server (PROXY) and get the requested page that contain banned keywords. It is accessible (200 OK).

0.296887 ME -> PROXY HTTP GET http://www.nartv.org/tests/test.html HTTP/1.1
19.686393 PROXY -> ME HTTP HTTP/1.1 200 OK (text/html)

The webserver (HOST) receives the request and answers the proxy's request (200 OK).

0.338255 PROXY -> HOST HTTP GET /tests/test.html HTTP/1.1
0.341245 HOST -> PROXY HTTP HTTP/1.1 200 OK (text/html)

No problem is found in accessing web pages that include "www.falundafa.org". China does not appear to dynamically block pages based on keywords in their content.

Scenario 2a: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows outbound blocking beween the proxy and the host while allowing the connection between me and the proxy to remain).

I (ME) issue the request through the proxy server (PROXY) and receive an RST packet which terminates the connection (the page never loads). The requested content is inaccessible.

0.302997 ME -> PROXY HTTP GET http://www.nartv.org/tests/www.falundafa.org.html HTTP/1.1
0.602310 PROXY -> ME TCP www > 2207 [RST] Seq=1 Ack=2367417381 Win=1 Len=0

The webserver gets both the request from the proxy and reset packets which terminate the connection.

0.303520 PROXY -> HOST HTTP GET /tests/www.falundafa.org.html HTTP/1.1
0.304453 PROXY -> HOST TCP 4281 > www [RST] Seq=694 Ack=2293838462 Win=1 Len=0
0.304916 PROXY -> HOST TCP 4281 > www [RST] Seq=694 Ack=1 Win=0 Len=0

A request is issued through the proxy to the page that was previously successfully retrieved:

54.784373 ME -> PROXY HTTP GET http://www.nartv.org/tests/test.html HTTP/1.1
58.554942 PROXY -> ME HTTP HTTP/1.1 502 Proxy Error (text/html)

An HTTP error is received from the proxy. At this point divergence occurs with proxies. I cannot access the server that triggered the the blocking but I can still access the proxy but the proxy gives a 502 error because it cannot connect to the host because of continued RST packets.

The server gets more RST packets:

54.468168 PROXY -> HOST TCP 4391 > www [RST] Seq=1 Ack=2236767498 Win=0 Len=0
54.760082 PROXY -> HOST TCP 4391 > www [RST] Seq=1 Ack=1 Win=0 Len=0

Other content on other servers can be accessed through the proxy:

94.795413 ME -> PROXY HTTP GET http://www.gnu.org/ HTTP/1.1

But no content on the server which triggered the blocking can be accessed:

117.253580 ME -> PROXY HTTP GET http://www.nartv.org/ HTTP/1.1
118.435081 PROXY -> ME HTTP HTTP/1.1 502 Proxy Error (text/html)

The server gets more RST packets from the proxy:

117.218448 PROXY -> HOST TCP 4653 > www [RST] Seq=1 Ack=2164037076 Win=0 Len=0
117.500543 PROXY -> HOST TCP 4653 > www [RST] Seq=1 Ack=1 Win=0 Len=0

Sometimes proxies continue to work when accessing sites other than the one that triggered the blocking, as in the situation above, while others fail to connect to any sites because the connection between me and the proxy is disrupted with RST packets. This is a situation where the filtering is occuring on the outbound request.

Sometimes when requesting content that is blocked there is a disruption between me and the proxy because the request I give to the proxy, in plain text, is being filtered on the inbound request.

Scenario 2b: A request is made for a page containing innocuous content from the same previously accessible webserver, however, the file name contains the keyword "www.falundafa.org". This is a test for keyword in URL path blocking. (This case shows inbound blocking beween me and the proxy, further connection between me and the proxy fail).

I (ME) issue the request through the proxy server (PROXY) and receive RST packets which terminates the connection (the page never loads).

52.758824 ME -> PROXY HTTP GET http://www.nartv.org/tests/www.falundafa.org.html HTTP/1.1
53.071331 PROXY -> ME TCP www > 2311 [RST] Seq=1 Ack=3653495283 Win=1 Len=0
53.071337 PROXY -> ME TCP www > 2311 [RST] Seq=1 Ack=3653495283 Win=1 Len=0

The server does not receive a connection from the proxy. the proxy does not issue my request to the server. The blocking occurred between me and the proxy.

Requests for any sites through the proxy will not be sucecssful, instead RST packets are received. This occurs when requests are made to the same previously accessible server as well any other web site. The connection between me and the proxy is disrupted.

73.807658 ME -> PROXY HTTP GET http://www.gnu.org/ HTTP/1.1
74.230743 PROXY -> ME TCP www > 2312 [RST] Seq=1070894714 Ack=2074992522 Win=0 Len=0
74.231351 PROXY -> ME TCP www > 2312 [RST] Seq=1070894714 Ack=2074992522 Win=0 Len=0

Scenario 3: Often, people want to test whether or not specific terms can be used as queries in search engines such as a request to Google for search queries that contain blocked keywords. To be clear, here we are testing if the request will go through to the search engine, not the filtering of results that the search engine itself may engage in.

Because Google appends search terms to its URL path, this is in reality a test for keyword in URL path blocking. It has nothing to do with Google specifically.

Given the behaviours described above one can see how testing search terms in Google can be difficult.

• One cannot determine if the blocking is occuring between the requestor and the proxy or between the proxy and Google.
  
• If the connection between the requestor and the proxy is disrupted (2b) further requests to Google will appear to be blocked. Although you may receive your browser's cached copy of the initial Google search page (by pressing the back button in your browser) the connection to Google is actually blocked and further search requests will appear to be blocked whether or not they contain blocked keywords or random unblocked keywords.
  
• In a scenario (2a) where the connection between the requestor and the proxy is fine, but the connection between the proxy and Google was blocked, searches for unblocked terms may appear to be blocked. Further complicating the issue, Google has many different IP addresses, so if the request from the proxy to Google was filtered further requests to that same Google IP will fail, but if the domain resolves to a different IP the request will go through.
  

This creates a situation where it is difficult to determine where the filtering is occuring (inbound or outbound), what is actualy blocked and what appears to be blocked because the connection to Google is blocked. Because Google has multiple IP addresses some search requests may get through (if the connection between the requestor and the proxy is ok as in Scenario A) making the proxy appear like it is functioning correctly. However, when connecting to the Google IP that originally triggered the blocking all search requests to that IP will fail and thus may inaccurately identify some keywords as blocked when in fact they are accessible.

Censorship Maps

The Atlantic has created a censorship map based on ONI data. (I've archived a local mirror of the map and the accompanying article).

The accompanying article is a bit overzealous in its description of China but I liked that fact that the article specifically highlighted that Internet filtering is not exclusive to China but is spreading -- essentially becoming the "norm" -- worldwide. In terms of targetted content, porn is defintely targetted but the numbers are skewed by the fact that the use of commercial lists (there are open source lists too) allow countries to block a lot of porn easily. But in terms of significance porn is, in my opinion, of rather low importance. the blocking of several key sources of local language alternative information or an social movement group is much more important. The sgnificance of the content rather than the total number of sites blocked in category seems, to me, to be of more importance but is much harder to measure.

Wired also made a graphical representation of ONI data a while back.

The graphical representations are quite nice, it gets the concept across, but it is tough to make cross-country comparisons. The categories here are from our "global list" -- a list that we test in all countries. As you can see countries that use commercial filtering products score higher because they block pre-defined categopries such as porn or gambling. They key sites though, not represented in this graphic , that countries target are local language, country or issue specific web sites. That said, this is a great effort in the right direction and we have some ideas for better cross-country comparison, so stay tuned.

Australia: Censorship & Surveillance

A spoof site of Australian Prime Minister John Howard was shut down due to presure from the government. The closure is reportedly due to a phone complaint from the PM's office to the Melbourne IT Ltd (http://www.melbourneit.com.au/) the domain registrar for the website johnhowardpm.org. The compaint contended that the parody website was a "phishing" site, something usually associent with identity theft schemes or other scams.

Now, ICANN has a dispute policy that should be followed in cases such as this. While similar to the borat.kz case mentioned by Reporters Without Borders this case is different because ICANN regulates the .org domain. In this case the registrar appears to have violated the ICANN rules. The changes were made to the domain name without 1) consent from the owner, 2) receipt of an order from a court... or 3) receipt of a decision of an Administrative Panel...

The web host was not the target, but rather just the domain registrar. The website was hosted on Yahoo and is still accessible if you access the the original site by directly connecting to the IP (216.39.58.47) on Yahoo's host and manually feeding in the HTTP HOST header johnhowardpm.org.

As if censorship was not enough Australia has now passed a new surveillance law. MEAA/IFEX explains:

New laws, passed by the Senate yesterday, give law enforcement agencies power to intercept phone calls, emails and text messages of innocent people. This extreme surveillance law poses a severe threat to press freedom - journalists can assume their conversations with sources will be intercepted at any time, says Australia's media union.

Spies, police and other security agencies will be able to use B-party warrants to tap phones belonging to a suspect's family, friends, colleagues and lawyer. Other agencies, such as the Australian Tax Office, Customs, and the Australian Securities and Investment Commission (ASIC), will have the power to access stored communications such as email and SMS.

Groups such as Electronic Frontiers Australia have been monitoring the growing body of censorship laws in Australia. The Labor Party is promising to bring in national filtering if elected -- to protect children of course, not to silence critics. Of course, as we have seen in the past, filtering is subject to mission creep:

Regardless of the initial reason for implementing Internet filtering, there is increasing pressure to expand its use once the filtering infrastructure is in place.

It's not *only* happening in China folks.