Thursday, August 28, 2008

The "iTunes Blocked in China" Takeaway

The iTunes Store, the portal page used to puchase media from Apple, was briefly blocked in China. This meant that iTunes users in China were unable to view, search, sample and purchase media available through Apple's iTunes Store. (I recently spoke with The World's Cyrus Farivar about this story (mp3), below I expand on some of the details.)

How? China has a multi-layered filtering system. One of these layers is "key word" filtering that occurs near the main international gateways that connect China to the rest of the Internet. When packets are found in requests (or responses) that contain certain keywords, China's filtering system sends reset (RST) packets to the computer that issued the request as well as the computer to which the request was sent effectively terminating the connection between the two. China added a portion of the iTunes Store URL as a keyword; whenever a request was seen to contain this keyword the request was reset.

Why? China does not disclose the official reasons why content is blocked but the reason is most likely due to the "Songs for Tibet" album available through the iTunes Store. The album contains songs by popular artists and those who purchase the entire album get access to a video of the Dalai Lama. While other content the Government of China would likely find objectionable is available in iTunes, including Tibet and Dalai Lama related content, downloading the "Songs for Tibet" album became a form of protest.

The Art of Peace Foundation issued a press release on August 19, 2008 stating that Olympic athletes were downloading the album "as an act of solidarity with Tibet." On August 21, 2008 Stephen Hutcheon of the Sydney Morning Herald reported:

Access to Apple's online iTunes Store has been blocked in China after it emerged that Olympic athletes have been downloading and possibly listening to a pro-Tibetan music album in a subtle act of protest against China's rule over the province.


Access to the Tunes Store was quickly reinstated, but access to the specific album was reportedly still blocked. Shortly thereafter reports emerged stating that the album itself was also accessible from within China. It is still unclear whether full access to the album has been restored.

Where? How is it possible that some Internet users in China have access to the "Songs for Tibet" album in the iTunes Store while others do not? China has a multi-layered filtering system; it is not always identical in all parts of China. While the album is no longer blocked in all of China, at the gateway points for example, it may still be blocked at local or regional levels or on specific Internet Service Providers.

The Takeaway? The blocking of the iTunes store itself, and the blocking of the specific "Songs for Tibet" album, is important even though it was brief. Not so much in terms of the Government of China, we know that they will continue to block content they find threatening but i terms of what Apple will do. It turns out that normal Internet users in China can't purchase and download the "Songs for Tibet" album, only foreigners with credit cards and billing addresses outside of China can. (They can listen/watch the short clips available for free however, it they set their iTunes Store to a different location, such as Canada). iTunes does not currently have a full iTunes Store for China -- but they will!

When Apple opens "iTunes Store China" will "Songs for Tibet" be available through it? Will they restrict access to content by geographical locations? Well for copyright reasons they already do, will they do so for politically sensitive content as well?

Internet Censorship: Malaysia

Malaysia has become the latest country to begin filtering the Internet. The news web site www.malaysia-today.net is being blocked by Malaysia largest Internet Service Provider, TMnet, after the Malaysian Communications and Multimedia Commission ordered the web site blocked.

TMnet has configured their DNS serverssuch that they do not properly resolve the correct IP addresses for www.malaysia-today.net or malaysia-today.net.


$ dig @202.188.1.5 www.malaysia-today.net

; < <>> DiG 9.4.2-P1 < <>> @202.188.1.5 www.malaysia-today.net
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER< <- opcode: QUERY, status: NXDOMAIN, id: 18677
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;www.malaysia-today.net. IN A

;; AUTHORITY SECTION:
malaysia-today.net. 3600 IN SOA ns1.blocked. blocked.tm.net.my. 1 900 600 86400 3600

;; Query time: 270 msec
;; SERVER: 202.188.1.5#53(202.188.1.5)
;; WHEN: Thu Aug 28 09:20:20 2008
;; MSG SIZE rcvd: 104

$ dig @202.188.1.5 malaysia-today.net

; <<>> DiG 9.4.2-P1 < <>> @202.188.1.5 malaysia-today.net
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER< <- opcode: QUERY, status: NOERROR, id: 15429
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;malaysia-today.net. IN A

;; ANSWER SECTION:
malaysia-today.net. 3600 IN A 127.0.0.1

;; AUTHORITY SECTION:
malaysia-today.net. 3600 IN NS ns1.blocked.

;; Query time: 292 msec
;; SERVER: 202.188.1.5#53(202.188.1.5)
;; WHEN: Thu Aug 28 09:20:42 2008
;; MSG SIZE rcvd: 77

Friday, August 22, 2008

iTunes Store Blocked in China

UPDATE: I can now access the iTunes store from China.

Recent reports indicate that China is blocking access to Apple's iTunes Store:

Users reported receiving an error message when attempting to reach iTunes: "iTunes could not connect to the iTunes store. An unknown error occurred.(-4) Make sure your network connection is active and try again."


While in some cases this error is associated with iTunes itself, I can confirm that in this case China was blocking access to URLs necessary to load the iTunes Store. China employs a variety of methods of filtering. In this case, all of the domains properly resolved to correct IP addresses and all of the IP addresses were accessible. Moreover, SSL access was also fine. The initial requests that iTunes makes work fine, until a particular URL is requested.

More specifically, GET requests containing "ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore" are disrupted. (There were probably more ways to trigger the RST's, I did not get the chance to test more as the blocking appears to have been lifted). After making a few connections, iTunes eventually attempts to connect to:

http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/initiateSession?ix=2

This triggers spoofed RST packets.

In addition to checking from computers in China, this behaviour can be triggered by connecting into China as well. Here I've set up a 3-way TCP handshake with yahoo.cn's IP address, since yahoo.cn is located in China. I then send a packet with the payload "ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore" but with a TTL that is insufficient to reach the intended destination. An ICMP packet comes back from a router (for me, at TTL 16) followed by spoofed RST packets that disrupt the connection.

See http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf and http://www.cs.unm.edu/~crandall/concept_doppler_ccs07.pdf for more on this technique.

Wednesday, August 6, 2008

Free Expression Principles

Major technology companies, including Google, Yahoo! and Microsoft, have agreed, in principle, to a voluntary set of principles designed to "guide businesses when they encounter laws and practices that may contravene international human rights standards or be at odds with law or culture in their home jurisdiction." The objective is to protect and advance freedom of expression and privacy. Included in this initiative are mechanisms to provide for ongoing learning as well as the monitoring of compliance.

Google, Yahoo! and Microsoft sent letters to Sen. Durbin announcing the agreement. The letters re-state each company's commitment to freedom of expression and highlight the core components of the initiative including the principles, the implementation guidelines and the accountability and learning framework.

Google's letter draws on my report that compared Google, yahoo! and Microsoft's search engines along with the domestic Chinese company Baidu. The most significant point centers on the impact of engagement. I found that the presence of foreign search engines resulted in an increased amount of information being available to Chinese Internet users. More specifically, I found that:

When the results from Google, Microsoft and Yahoo are combined, 20% of the sites censored by Baidu are available. However, individually they provide more information, especially Google and Microsoft which provide, on average, 51% and 55% more content (content not available in Baidu) while Yahoo! averages 25% more.


Since the search engines were censoring different content mixing searches across multiple search engine resulted in the ability to find sites censored by the other search engines.

Also, I noted that Baidu, the leading Chinese search engine, had introduced a censorship notification following the lead of the foreign search engines. Unlike foreign search engines under pressure from the home governments Baidu is not. While a still a small step, it shows that engagement can make a difference and that industry standards are important. that is why I think the principles for free expression and privacy are so important. They present a united effort and set an industry standard.

Engagement certainly presents a series of hard choices, but is a better choice than disengagement when it comes to information and communications technologies. These technologies build the bridges that connect diverse people and places, putting up barriers is what the censors do. I find it hard to believe that the promotion of free expression is served in Iran by denying Iranians access to the Java programming language.

The catch here is that this agreement and these principles are not an end point but a starting point. As I noted in my report the overall level of transparency is low -- there is work to be done in this area. The process for determining what to censor is still unclear and supports the secrecy and unaccountability of China's censorship policies. Even within a restrictive environment such as China I believe there is much more that can be done. (See below). I also showed that while the total amount of censorship may not be high, the significance of the censored sites is important.

These censored sites are often the only sources of alternative information available in the top ten results for politically sensitive search queries. Moreover, even the uncensored versions of these search engines highly rank content that is hosted in China or ends in the domain suffix .cn, both of which China retains control over and are thus unlikely to present alternative information.


China recently unblocked many censored web sites after intense international pressure and scrutiny after having promised uncensored access during the Olympics. Andrew Lih tested a sample of websites normally censored in China and found them to be accessible. The web sites of human rights groups such as Human Rights Watch, Reporters Sans Frontiers and Amnesty International are all now accessible.

Andrew posted his test results on August 1st, 2008, five days later search engines are still censoring sites that are not unblocked in China. For example, Yahoo! Microsoft and Baidu are still censoring www.amnesty.org while Google is not. Google, Microsoft and Baidu are still censoring www.hrw.org while Yahoo!s not. (Yahoo! has only one result, www.hrw.org/russian, I'm not sure how many Russian speakers there are in China, anyone know?) Only Microsoft is still censoring www.rsf.org -- even Baidu is not. In fact, Microsoft is censoring more of these newly unblocked websites than the Chinese company Baidu! Another noteworthy observation is that Yahoo! is censoring the least of these newly unblocked sites.





















































































































































DOMAINS Google Yahoo Microsoft Baidu
ip =
"203.208.39.99"
host = "www.google.cn"
ip =
"202.165.102.243"
host = "one.cn.yahoo.com"
ip =
"202.89.236.206"
host = "cnweb.search.live.com"
ip =
"202.108.22.43"
host = "www.baidu.com"
chinese.wsj.com OK OK OK OK
cn.reuters.com OK OK OK OK
news.chinatimes.com OK OK CENSORED (0) OK
olympics.scmp.com OK OK OK OK
udn.com OK OK OK OK
www.amnesty.org OK CENSORED (0) CENSORED (0) CENSORED (0)
www.atchinese.com OK OK CENSORED (0) OK
www.ftchinese.com OK OK OK OK
www.hrw.org CENSORED (0, message) OK CENSORED (0) CENSORED (0)
www.libertytimes.com.tw CENSORED (0, message) OK OK OK
www.mingpaomonthly.com OK OK OK OK
www.mingpaonews.com OK OK CENSORED (0) OK
www.rfa.org CENSORED (0, message) OK CENSORED (0) OK
www.rsf.org OK OK CENSORED (0) OK
www.scmp.com OK OK OK OK
www.voanews.com OK OK CENSORED (0) CENSORED (0)
www.yzzk.com OK OK OK OK
www1.appledaily.atnext.com OK CENSORED (0) OK OK
zh.wikipedia.org OK OK CENSORED (0) OK


* If at least one result was returned for a "site:" search on a domain, it was marked as OK.

To be fair, it does take time for search engines to respond. They have multiple servers, it may take time for them all to be updated. Also, there differences in implementation between those that crawl and index the web from behind China's filtering system and those that do not and thus have to "de-list" results. (See the report for details on this.)

Still, I find it difficult to accept that sites that are unblocked in China remain censored in these search engines.