USENIX Enigma 2018 - Developing a Science of Internet Censorship Resistance: Opportunities and ...

Censorship resistance is framed as a security problem with politically motivated adversaries willing to invest significant resources to restrict or gain access to information. This is often driven by a desire to monitor political opposition groups.

A substantial market exists for censorship and surveillance products, often developed by Western companies like Websense, SmartFilter, and NetSweeper. These products are then used globally to violate human rights by restricting free speech and conducting surveillance.

The speaker's lab employs a collaborative approach, working with political scientists to gather local context and identify measurement opportunities. They develop network measurement techniques to understand where and how censorship is implemented, leading to the IC lab project.

The IC lab project is a global, ongoing monitor for internet censorship. It focuses on developing techniques to detect and fingerprint censorship devices, aiming to identify not just that a URL is blocked, but also how and by what specific product.

Measurement can influence behavior. A historical example of radio signal jamming in Eastern Europe after WWII showed that simply publishing monitoring reports led countries to reduce jamming, demonstrating the power of transparency in combating censorship.

Simply checking if a website is blocked is insufficient. More detailed measurements, such as analyzing DNS replies and packet captures for TCP reset packets, are crucial to distinguish between censorship, network outages, or other issues, especially when censors are not explicit about blocking.

Researchers are asking more advanced questions: how is content blocked (e.g., DNS, TCP resets), is a sanctioned product being used, and who is doing the blocking (ISP, content provider, accidental transit filtering)?

The IC lab platform supports both basic HTTP GET requests and more advanced techniques, such as manipulating HTTP headers and changing IP TTL values, to identify middle boxes and pinpoint where censorship occurs in the network. The system is designed to be customizable and extensible over time to adapt to new censorship methods.

The IC lab system uses a central control server at the University of Massachusetts to send experiments to vantage points (VPN nodes globally and Raspberry Pis). Clients send results back for analysis, focusing on keeping clients simple and performing analysis centrally. Challenges include authentication, distinguishing failures from filtering, correlating events across clients, and ensuring the safety of volunteers in high-risk regions.

In 2015, during the Yemen conflict, IC lab investigated filtering products (dual-use technologies). By analyzing IP TTL values in HTTP 404 responses compared to block pages, they determined that a 404 message for political content was likely an injected, stealthy form of censorship by NetSweeper, contrasting with overt blocking of other content.

Work with Small Media in the UK examined filtering in Iran, particularly regarding tech sanctions. The study found both local blocking by the National Telco for some content (e.g., Flash Player, Netflix) and server-side blocking by Google (e.g., Google developer sites) enforcing sanctions for clients appearing to originate from Iran. The inconsistency of blocking across different services and vantage points within Iran highlighted the complexity of censorship measurement.

Network measurement effectively reveals and deepens the understanding of internet censorship globally, even when it's stealthy. The IC lab project addresses technical problems like distinguishing censorship from failures and tackling concealment challenges. The collaborative approach with social scientists ensures relevant and impactful measurements, continually uncovering new technical problems to solve.