Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/696 Thanks!
Well, tell me, was there any proposal
to censor porn also this year,
there were even I know
I'm quite sure there was, but I don't
trust the cloud, so I'm totally fine
with my partner parties.
Anyways, this talk today will
be about the state of Internet censorship
in 2016.
We got real reserves
and studies and
measures the censorship across the world,
obviously, when he's not in North Korea
and Phillip Phillip
is his just Phillip
and his awesome thanks.
But what needs to change?
All right, yeah, great.
OK, so we're going to
talk about sort of what's changed in
Internet censorship this year
and so many people, I think
sort of the classic view of Internet
censorship is seeing something
like this. This is what one
of the block pages that you might see in
Iran looks like.
And I think sort of the
the high level thing around this
is that this really is the view
of censorship for a very small fraction
of the world.
When you look at the Freedom House report
on on the state of the Web this year,
we see that two thirds of Internet users
experience censorship of some form.
And for most of them, this is not what it
looks like.
Right.
For most people, censorship appears as
content, not loading.
You get a blank page, you get a server
error. It appears as stories
that aren't in your news feed and content
that's not in Twitter or not on Facebook
anymore.
And this is a much more subtle form of
censorship that I
think we're still sort of getting our
heads around that change and whether it's
the same word that describes both of
these things.
So the way we're going to
structure this talk is first try
to pull out some of the trends in
sort of how Censorships evolved over
sixteen.
We'll give you a bunch of sort of the
states of countries around the world
and what things look like in terms
of new laws and new policies that have
gone in place there.
And then in the second half of the talk,
we'll sort of look at how we know these
things, the state of measurement.
And so the projects that are out there
trying to collect data and understand
what's being taken down, where and how,
and then hopefully will we'll end leaving
you with things that you can do to make
the world a better place.
So we've
got this thing of censorship.
I think it's also and this is
that first point again, which is.
The fact that we're using the word
censorship is.
Playing into one narrative, right,
censorship is one view into
information control, into
surveillance, into
the shifting of public opinion.
It's one technique there.
The fact that we're focused on censorship
and it's worth being there's cognitive
through this. This is a very Western
view of a problem.
And this piece of it,
I think in 2016, as much as any
other year is really normalized.
It's really a thing that we
are not going to oppose in any real way.
Um, one thing that I've done a couple of
times, I think it's worth like asking you
guys as well, is by show of hands, do you
think there should be no Internet
censorship?
So that's like about half of the people.
And and think about this crowd, like,
if we're not, like, completely
in favor of this, can we really expect
general society to, um.
And so I wonder if we're really going to
end up in a place where we can have this
absolutist view that
we want an Internet without any
censorship.
Right. We have limits on freedom of
speech in the physical world.
There's limits of it in other media.
And the Internet has been a very special
place for a while.
But I think even now, in sort of
our original community, we're trying to
grapple with, is that
something that's going to be able to
continue?
So we can look at this from a
technical side as well.
We can ask who censors and
where? Where is this limit and its
limits within the network, its limits of
the people we've given power.
The organizations that that run our local
networks will often censor the ISPs
that give us connection to our
organizations censor.
And we have state actors who limit
and they all have different motivations,
although they overlap. Right.
So why do we censor?
We censor to keep content within social
norms or protect things that we think are
important. Right.
This is this is the justification for
for things around pornography or
lewdness.
We we censor because of
economic protection, because we want
our economy to be better.
This is this is or because we want our
services that our ISP provides to
to win over competing ones.
And we censor for our national security
and for for reasons of
protecting ourselves from from hacks,
hackers and other countries or in other
places.
So with that as the backdrop,
let's let's talk through a few friends.
So the first thing is the censorship this
year, I think is pretty much all legal,
right? When we think about censorship, as
you know, from 2002, when the
first Harvard thing came out saying, look
at all of these things China is blocking,
it was very opaque in the sense that
there was this thing happening
technically and there was no one talking
about it at all.
And most of the stuff that we see now,
there is a legal framework behind it
where where the censorship is in line
with the laws of those countries.
We've seen a lot of stuff happen in terms
of the US EU relations.
Safe Harbor went away in twenty
fifteen and we now have an
EU privacy shield that's coming
into place to replace it.
This has new copyright implications.
There's the potential for a requirement
that the content being uploaded by EU
users needs to go through an upload
filter where it will be scanned against
copyrighted material proactively before
it can appear on content.
We're dealing with providers being
more scared about what they take down
there. They're worried about additional
liability and risk because that risk is
shifting to them. They don't have quite
the same level of DMCA safe
harbors and things where they can say
it's user generated and so it's not our
liability. And so you're seeing more
proactive take down from the content
producers.
We also see there was a new
Chinese cyber security law this year
that that adds a bunch of
legal framework behind
really a lot of things that China's
already been doing.
But it regulates
that, that Internet services companies
operating in China need to store logs on
their users.
If you have user content, you should
be storing the real identity
of users you need to collect.
There are their national ID and know who
this person is.
There's requirements supporting
cooperation with government access to
data.
And then I think the thing
that got sort of foreign company
concerned more than most in here
is that there's
sort of this broad class of
sort of critical infrastructure and
critical services.
And if China decides that you are one of
those, then you have to have all of your
data for your service related to Chinese
users stored in country on Chinese
servers.
And so companies are worried
that that their data will be determined
to be critical and that they'll need to
move their data within China,
which which imposes additional
regulation, additional access to Chinese
data.
So earlier this month, we have heard
from a couple of tech companies that they
are starting an effort to create a
shared database.
The purpose of this is to fight terrorist
imagery. So Microsoft,
YouTube, Facebook
came together to create this database,
to basically fight these images.
The way it works is that they hash
these images, they put it in the
database, they have access to it, read
and write access, and therefore it should
be easier to fight terrorist
imagery.
A lot of this is concerning,
most of all, the lack of transparency.
So basically we're being asked to
trust them to do a good job
maintaining this data base.
There is probably very little
accountability.
We won't be able to see what is in the
database and if it, in fact
is being used to fight this terrorist
imagery.
So this is a big problem.
Another problem is that once
you have a database like that, once you
have the mechanism, a lot
of governments are probably already
waiting there, rubbing their hands and
trying to get their piece of
their piece of the cake and
the vague definition.
At this point, we're really just talking
about terrorist imagery is it
enables scope creep.
Right. And it starts by being about
terrorist imagery.
But I'm sure that a lot of file sharing
companies are already very eager to
get in there. So this is another thing
that we have to watch out for, what it
will turn into in practice.
And finally, there are governments,
right? This is a centralized thing.
And I'm sure governments have their very
own idea of what a
database like this can be used for.
So we really have to be vigilant in
the coming months to make sure that
this is actually what it's supposed to
be, what they intended to be used for.
Meanwhile, in Pakistan,
the prevention of electronics crimes
bill was passed again,
the recurring theme of a lack of
transparency.
So while it was drafted, critical voices
weren't really heard.
People proceeded more or less in
isolation.
And the bill has a lot of very
concerning parts.
For example, there is the threat
of seven years in prison for
what is called the glorification of
crimes related to terrorism.
Again, the definition is probably
very vague on purpose,
which means that the government is going
to be able to enforce it on people
whose crimes might have been a little bit
different from what it says now.
Also, in 2016, on the other
side of the world, the citizen
lab was dealing with a
lawsuit of defamation.
So the citizen lab is a research
lab, part of the University of Toronto in
Canada, and it's working
on exposing censorship, surveillance
and digital targeted threats online.
They have done a lot of really great work
on exposing how
companies such as Net Sweeper are
being used in the world.
So net sweeper, for those of you who
don't know, it is a Canadian company.
They are producing web filtering software
and they have the concerningly Laperriere
for who to do business with the citizen.
That was very careful in documenting
what governments Natsui is selling
their technology to.
And as you could imagine, Natsui wasn't
really happy about that.
The citizen that has had problems
with a lot of companies being unhappy
about their research for a long time.
But what is different here is that net
sweeper for the first time went to court.
Luckily they discontinued the lawsuit
three months after it started in January.
Twenty sixteen.
But this is a first so that it actually
went to court and there is probably more
to come in the next couple of years.
Meanwhile, Facebook
is working on a censorship tool
like a lot of other Western countries.
Facebook is very eager to set foot
in China.
Google has tried it in the past.
A lot of other companies have tried it as
well. It turns out to be very difficult
because if you want to set foot in China
as a technology company, you have to
comply with Chinese law.
And there are a lot of cultural
misunderstandings that make it make it
harder to go that way.
Facebook is
now deciding to create a censorship tool.
It is not entirely clear
what that really entails at
this point.
In a news article, someone wrote that
it is supposed to be a tool that enables
the Chinese government to moderate
what is being posted on Facebook.
But again, it's very vague.
There is probably little accountability
or transparency.
And we also have to be aware of
how both China and Facebook
is going to talk about this once it
happens. So we shouldn't get
fooled by China presenting this as
some kind of better relationship
to the West and
there's some kind of victory for
free speech.
So we shouldn't let them fool us
by by phrasing it like that.
Finally, a hot trend
in 2016 was fake news.
This is not entirely new.
And the connection to censorship
is twofold.
So remember that the ultimate goal
of censorship is the suppression of
information. Ultimately, you want certain
bits of information to disappear.
When you think about Internet censorship,
that is usually done by removing block
posts, by dropping network packets,
by getting rid of information
another way, by doing by conducting
censorship is to add information to
basically drown the signal in all
the noise.
We have seen it in the past where
governments hired Spotnitz
to basically hijack discourse
on Twitter, for example.
And in a way, this is a different flavor
of the same problem.
There are opposing voices.
So a lot of people are now saying this is
outrageous. We have to get rid of these
fake news. We have to outlaw it.
Certain countries are looking into that.
But a lot of people are saying this would
be censorship as well.
Right. Publishing news is
a way of free speech,
and that is true to some degree.
It sends fake news isn't a binary thing,
right? A piece of information isn't true
or is not. In fact, it's shades of gray.
Our language allows for ambiguity.
And it's a it's
a degree. Right. You can have something
that is true, but still presented in a
way that it's purposefully misleading.
So it is very difficult to draw the line
here, which explains why Facebook
has been very hesitant in taking
action in this case.
And the big problem here is
that fake news feeds right into
confirmation bias.
So as people, we tend to be willing
to seek out information that confirms
what we already believe and we don't like
to be challenged that much.
And that makes this a very big problem.
So let's move over to another topic
to deep democratization, so DPI
stands for deep packet inspection
and DPI is
becoming cheaper and cheaper.
Companies are offering it.
It is getting easy to buy.
So it is a piece of technology
that is increasingly getting into the
hands of many different
people and governments.
It is very omnipresent at this point,
and this is reflected in
the cases of Internet censorship
that we have seen over the last
year.
One thing that is particularly
interesting at the moment is what is
happening in Kazakhstan.
We know very little at this point, but
what we have read is that
the country, Kazakhstan, deployed a novel
type of deep packet inspection.
We do not yet know from what
vendor. We do not believe that it is home
baked. Instead, some company
supply them with it.
And at this point, there is reason to
believe that standard tor, including
a couple of obfuscation protocols, are
being blocked.
But again, we don't fully understand yet
how it works. So we have a link here
to Tourist Bug Tracker, where there is a
very long discussion about the technical
findings that a couple of people have
gathered so far.
So any help is greatly
appreciated.
We can visualize the block that
we have witnessed so far.
What you can see here is the number of
directly connecting Tor users over
parts of twenty sixteen.
We have seen a couple dozen thousand
users until June twenty
sixteen where there is a sudden drop
and at the same time we can witness an
increase of bridge users.
So bridges are undocumented, unpublished
tor release.
And basically at the same time, when
the network was experiencing this block,
we have seen a sharp increase in users.
So at least that's something.
But still, we have reason to believe that
the obfuscation protocols are being
blocked.
So far, um,
so beyond these sort
of individual countries using
DPI, we see that it's getting into
much smaller organizations and becoming
pretty ubiquitous.
So this is the dashboard on a Ubiquiti
home Wi-Fi setup.
And you can see that by default it's
capturing traffic and is able to identify
just about all of the major services you
use. It's able to pull out the
types of video sharing, the types of peer
to peer. And this is just something that
I think certainly all our large
organizations and now most businesses
starting into the home are expecting this
sort of behavior and the ability to
discriminate, classify network traffic,
prioritize your small web
browsing that you want to be interactive
over the bulk transfer.
Right. There's legitimate like desires
for a lot of this. But we are making this
form of censorship in this form of
traffic discrimination a very common
thing.
The ray of hope in this picture
is that we have more
and more encryption, 20, 16 really
was sort of the year of let's encrypt.
We're passing 50 percent of the web
having SSL now.
We're getting, you know, tens of millions
of new sites with SSL.
And what that's really allowing
is that DPI
is stuck at host based blocking still
for a lot of these things.
Right. We can block a service, but I
can't block specific pages within it
nearly as easily.
As long as that traffic is encrypted,
this is able to defeat many of
the tools that are trying to discriminate
specific services or discriminate
specific types of traffic.
Right. They're limited to being able to
say, I want to block videos.
And so, OK, I'll check these sites that
have videos commonly, but they can't just
block the actual video stream.
And so this, again,
is an arms race. We have this first layer
of encryption that's helping us.
And we'll see a couple examples later on
of countries and how the nation states
are trying to fight back against that.
We mentioned blog posts a lot, I think
social media,
both in terms of
Facebook and these these ways that we
posed to each other.
Also, the mobile apps that we use to
communicate and chat are becoming
more and more at the focus of censorship,
especially around political events.
We saw this happen in Brazil.
WhatsApp got blocked a couple of times in
May and June as the political climate got
less stable.
And that's again, it happened within
a legal framework for the company.
Brazil asked WhatsApp to provide them
with
with logs of chats that they believed
had incriminating information.
And WhatsApp was unfortunately unable
to provide those because they haven't
done encryption. They don't have the
decrypted logs themselves to provide.
And so Brazil
judges have blocked WhatsApp on and off
and in fact, have for a couple of
services threatened
to jail executives of these companies for
not complying and things of that nature.
We also see social networking
in Gabon this September.
Gabon was interesting.
Just after their election,
the Internet went out entirely for a
little bit. Then it came back on with a
curfew where at the routing
layer, it was turned off at 6:00 p.m.
for about five days in a row
and came back on the next morning.
So you would be able to have it well
while working hours, but not for
organizing in the evenings.
And then after that happened and sort of
general Internet connectivity in the
evening was restored.
There were still blocks on Facebook,
Twitter and WhatsApp for a couple
more weeks afterwards.
So these services that people might use
to organize are being focused on
collective action is continues to be
one of the most sort of sensitive
topics for four states.
And then and then we have a very recent
example in Egypt, which
this month decided to block signal
one of the one of the better end to end
encrypted messaging systems.
And luckily, Signal was able to reply
and respond really quickly.
They are using a domain fronting
sort of circumvention technique now in
their latest update, which gets around
this. And so for people who have updated,
though, they'll still be able to access
it.
But we're seeing it's these chat and
these these things.
Yeah, sure thought the cloud.
It's these apps that are more and more
sort of in the targets of of states
wanting to control the dialog.
So distributed denial of service is
something that continues to be with
us, it's alive and well.
One of the big examples of
dogs being used to try and look
for retribution or to take down views
that people didn't agree with was on the
Krebs blog, where a large
Internet of Things I botnet
got sort of weaponized to
manage to take this down for a period of
time despite being hosted on Akamai,
which we would hope that these large CDSs
are sort of above
in terms of their size.
They can handle traffic.
But but we see that botnet can still be
effective
and certainly for smaller things.
So so the Black Lives
Matter movement, we can
see that there's
over 100 incidents that occurred
to their sites over the last year.
And so.
Das is sort of this tool that gets used
when you aren't in the center right.
It's this. It's this.
Maybe you're off on the side
and two people are talking or someone is
talking to an audience where you can't
block their communication.
I'm in another country or I'm not the ISP
itself or I need more anonymity
and I still want to remove that
viewpoint.
And doctors remain sort of an effective
weapon for that attempt at censorship,
where you have resources in money
or in computers or bandwidth, but you
don't necessarily have the position of
power where you can block
an in network communication
or dissemination of information.
There were a bunch more Internet
shutdowns this year, Access Now
is an advocacy group that
monitors the Internet and the situation
and access around the world and tries to
help advocate for for access.
They documented 15 shutdowns
last year and in twenty sixteen, it's
up to 50 one at this point.
This is concerning because it, again,
is talking about sort of this normalization
of countries saying, well, you know,
there have been 50 examples this year
of of other countries that have shut down
their Internet for periods of time, often
around politically sensitive events.
And very few of them have revolted
or had any major consequences.
So this this, again, sort of as these
continue to happen, they they empower
additional countries to say, oh, this
maybe is a solution to this sort of
problem.
Even in the US, we see sort of
continued, uh,
attempts to to have this sort of control,
we want do we want our government to be
able to turn off the Internet in
in situations of national emergency?
This was a debate under Obama and
will continue to be one.
I guess the again, to counter
this sort of depressing narrative,
the thing that maybe provides us with
hope in this sort of situation is,
is cases like Ecuador,
which despite having
the ability to do these shutdowns of
services this
April, there was a large sort of leaks
around the ISPs and
their their cooperation with the
government.
And so it continues to be through the
whistleblowers and through leaks of this
sort of information that we learn about
what's really happening and we're able to
get accountability back.
So one of the major problems here is do
we have accountability and do we
understand these structures and systems
that are being put in place?
I think Ecuador provides
us with one of these examples this year
of how whistleblowing is alive and well
and helps to to provide public insight
and conversation.
So we'll finish sort of what's going
on out there with just a few specific
countries that don't necessarily fall
into these categories.
Thailand
has had for
a long time a set of fairly
narrow. Well, they've had, you know,
their sort of laws. And what really
they've censored is sort of based on
less majesty attacks on the royal
family and defamation there.
With the king dying and the
and his successor being appointed.
There's been tension there.
And so there's been additional sort of
concern around there.
And then this December, they've passed an
additional law giving the government
quite a bit more power.
Over the spring, they floated proposals
that they needed a single Internet
gateway where they would have the ability
to man in the middle with a government
certificate, all of the traffic going
out of the country.
That isn't in the current bill, as I've
read it. But it sounds like that push for
having that additional control continues
and is something that that they're moving
towards. The the current legislation that
passed in December seems to be moving
towards that, though it doesn't get fully
there
in Cuba, the Cuban
Internet remains very expensive and out
of reach for most people.
One sign of good news
there is that recently
Google signed agreements to be able to
put servers in Cuba.
So we're starting to see the ability of
Western and external companies
to locate servers inside and help
invest in infrastructure within the
country.
So maybe this is, I guess we can hope,
an indication that Cuba is going to
start sort of upgrading its
infrastructure and getting more
connected.
Turkey also had a tough year this year.
They're regularly blocking VPN protocols,
they're also blocking Tor and some of
these anonymity software.
And Turkey is the one country
that got downgraded in the Freedom House
report from partially free to not free in
terms of their connectivity.
This correlates to the
political events that we've seen there
and increasing pressure on on
sort of civil society more generally.
Finally, the
U.K. has passed a set of laws and we've
seen sort of additional
restriction, especially in pornography
there.
There's a whole section on this on day
four about sort of what this new set of
laws entail.
But it sounds like it
primarily is a surveillance
thing.
So so your data has to be retained.
There's certainly a chilling effects
of free speech around that of people
trying to second guess what they're going
to say.
But but it's not sort of imposing
major new things of of automatic
takedown of content or removing hosts
beyond what's already there.
A lot has happened in the measurement
space, both in academia and
civil society, so we want to give you a
quick overview of the most exciting
things that have happened over the last
year.
Rooney has made a lot of progress.
So is the open observatory for
Network Interference.
It's a free software project under the
larger umbrella.
And among the more
exciting things that happened is a lot of
outreach and research.
So is based on having
probes, small pieces of software,
often on a Raspberry Pi that are
being deployed in different countries and
in these countries to conduct
measurements and sent them back to
servers where we can analyze them
and visualize the results.
A lot has happened in outreach.
So in more than 10 countries,
there are no partnerships to deploy these
probes and also work on
specific reports about what's happening
in these countries and
when you was also very active on their
blog. So a lot has
happened. We have a URL here, among
other things, in Malaysia, the elections
have been analyzed.
So in that regard, it was
a very exciting year.
There is also a Web interface now.
So if you have an uni probe
and want to help the project, you're not
able to go to this web
interface and both.
It's easier to run and also to analyze
the test results.
The project really went out of their way
that even worked with the UI designer to
make it as easy to use as possible.
And this is what it
looks now.
And there are also a lot of plans for
twenty seventeen.
Among other things, the only
project is thinking about reengineering
the data pipeline.
So a lot of data is constantly being
produced and sent to the central servers.
And there is a series of subsequent steps
of processing that is happening to the
data and ask the amount of data
increases. It's getting harder and harder
to deal with this wealth of information.
And both the project
wants to extract more interesting
information out of these reports, but
also make it easier to process them at
scale.
Another important point is orchestration.
So at this so far
these projects have been mostly
autonomous.
They are sitting somewhere in someone's
basement or at some university in
different countries, and it used to be
really difficult or
to get the right results at the right
time due to the nature
of the autonomous distribution.
So there is a trend towards moving
towards a model where it's easier to
control these probes and
have control over what is being analyzed
and what is coming in there.
And that makes it way more flexible
and easy to get high quality results.
Think about elections, for example.
You don't really want to wait for data to
flow in eventually.
You have probably a very specific idea of
what you're looking for, and that makes
it easier to find probes in a given
region and make them do
the measurements for you in time.
There has also been progress in academia.
We are maintaining a censorship
bibliography and so far in 2016
we counted more than 20 research papers.
There are among all of that.
So both in circumvention and
censorship analysis,
among other things.
We learned about a couple of new insights
about the Great Firewall.
For example, how the DNS poisoning
works on the server side
since people mostly looked at infected
results, but not so much about what is
happening to the poisoned
DNS resolver.
We also learned more about
how the maintainers of the Great Firewall
deal with hardcoded Tor breaches.
So a research group looked into the
blocking delay, which is really exciting
because it gives you some kind of insight
into the operational business that is
going on behind the Great Firewall.
In addition to research,
there has been an ongoing discussion
about the ethics of network measurement.
So a couple of years ago in academia,
almost everything was fair game when it
comes to network measurement.
But two or three years ago, a couple of
controversial research papers came out
that prompted the community to think
deeper about what is acceptable,
in particular because a lot of this
work can actually put people at risk.
And this is something that has been
not entirely ignored.
But people don't think about this as much
as they should be.
One trend is to try and
seek informed consent.
If you work with people on the ground,
it tends to be easy to get consent.
It tends to be a little bit harder to
have to consent be actually informed.
So there are
approaches to make people solve the quiz
before they engage in the measurement
to make sure that they really, really
understand what they're getting into.
Another trend is, of course, to weigh the
risk versus the benefits.
Of course, you always get something out
of an academic research project,
but often there is some risk to it.
Of course, it's difficult because you
cannot just quantify this and come up
with two numbers and put them on a scale.
So this really requires an effort
to get an understanding of on
the ground knowledge.
And this is similar to threat modeling.
Of course, we can look at laws and
countries and try to get a feeling for
what could get people into trouble.
But the way laws are enforced are very
different. So for that, you really need
someone who has a good understanding
of the country and how it interprets
its laws. And this is really difficult.
So the current consensus is
that in case of doubt, academic
researchers tend to air on the side of
caution and ideally just not
do something.
Even though my teachers an interesting
new bit of information,
one exciting project that is happening
in the academic space is this spooky
scan.
So this is a type of network measurement
technique that allows you to
test the connectivity between two
computers, A and B,
say, in China
and in the United States.
And you don't control A or
B, so this is the really exciting part
that it allows you to infer the
connection state between these two
machines, even though you don't control
them.
The way it works is it leverages
a type of site, channel and network
stacks. So some of you might have heard
of the iPad.
It's a feeling the IP header
that is used for fragmentation.
Most modern network stacks tend to
randomize this field.
But a couple of legacy network stacks,
most notably some flavors of windows
and free FreeBSD, have a globally
incrementing counter.
This means that it leaks
information to unrelated network
connections.
And it turns out that you can use that
for the spookies can.
And at the moment, according to the
researchers behind this project,
approximately one percent of the IP
for address space is affected
by this. This might not seem like a lot,
but if you're interested in a certain
country, one percent is a lot.
So you're guaranteed to find probably
a couple of thousand machines that
can be conscripted to be part of the
spookies can.
So all of this is run by Royo at
Princeton University.
There is a research paper.
Another one is in the making
and we can not have a quick look at
Hydroxy in detail.
So in this picture, you can see three
types of cases, the three types
of cases that the spookies can can inform
you.
And the way it works is we have in
all three pictures, we have a reflector
on the left side. It's not under our
control.
We have a site on the right side, also
not under our control.
But both of these systems have to
globally incrementing IPID
counter.
Then we have a measurement machine at the
bottom that is under our control
and also it must be able to spoof IP
packets.
That doesn't tend to be a big problem in
academic networks where you can bribe
your network operator into
not doing ingress filtering.
So that tends to work fairly
well.
So the first step, you send a signal
to the IP segment from the measurement
machine to to reflector,
and that way you learn the current
state of the iPad counter.
In the next step, you send a spoofed
packet from the measurement machine
to the site.
But the return address of that packet
is the reflector and not the measurement
machine.
So when the site gets to packet,
it sends the response
to the reflector instead of the
measurement machine because it has been
spoofed and now some
magic happens in step three.
We don't know what this is exactly what
we were trying to learn.
Either the packets reach from sites
to the reflector or they are being
dropped, either a server to client or
client to server.
We don't really know, but we can
know by in the final steps
and. Another Sinak segment to
the Reflektor and again measuring
the iPad counter.
So we have two states
of the counter now and we can basically
determine the difference and the
difference between before and after
basically allows us to infer what is
happening between the site that the
reflector.
And it's a little bit complicated.
It took me a while to wrap my head around
it, but it's a really powerful technique.
It doesn't work in all cases, but when it
does work, it really allows you to
infer reliably what is happening between
two remote computers.
And not only is this possible in this
isolated scenario, it turns
out that this is quite scalable.
Even so, in another
research project, some
people deploy the spookies scan at scale
and this is a visualization of it.
So a couple of clients in China were
selected, a source, a couple of
Turrell's and Web servers were selected
as destination's.
And then the people behind this effort
measured the connectivity between all
these computers and
plotted it on the map.
So green lines means
unblocked and red lines means blocked.
And the entire point of this is really
just to show you that this is scalable.
So if it's implemented in the correct
way, it allows you to really
deploy a spooky scan at planet scale.
Like all the other or many other academic
efforts, the researchers had
to struggle with ethical challenges
because you don't really want to
conscript a normal
Internet users laptop for this
measurement, because it could be that
the local government maybe monitors the
Internet connection and might
misinterpret what is happening and
perhaps believe that this user is
doing something that she's actually not
doing.
So as a result.
This problem was solved, but just going
to three hops back in the traceroute
and instead of selecting actual
end users laptops,
it selects routers and
you can model the network load of routers
to get rid of the noise.
And that way you can basically get rid of
the ethical challenges entirely and still
get meaningful results.
A project that I've continued to work on
in the last year is something called
satellite, which is doing a similar thing
to spooky scan at the DNS level
and looking at open DNS resolvers to
understand DNS consistency
and issues in DNS resolution.
There's a paper on this now and we've
we've got now a couple of years of data.
A lot of this is sort of incremental.
So this is how many sites we see
blocked in Iran in the top ten thousand
over the last couple of years, since late
2014 in
in sort of 2015 was a
bit before their election.
We saw a major spike, but it's sort of
doubled over the course of 2016.
So there's been a slow, incremental
uptick in how much is blocked there.
And the sort of more recent work
that we've done in that area is trying to
explain what we think constitutes
blocking or why something is weird.
So we want to be able to say we think
this site is blocked because we found
fifty nine out of seventy four
resolutions.
We're going to an IP that clearly looks
wrong or because almost all
resolutions had a reverse
pointer. The IP address was named
something that looks fishy or wasn't
named in the right way, or most
of the things had the wrong server
header. When we actually ask about those
IP addresses rather than having
the expected server that that we see
globally.
And so we're able to start having these
justifications for why we think something
is anomalous.
That data is now getting posted on the
website and backfilled as we process the
backlog of all the data.
There continues to be a bunch of stuff
that's not coming out of universities as
well. That's really interesting.
Great Fire is a project that
focuses on China.
They released a new thing called
Circumvention Central this year, which
basically provides up to date
testing of LPNs in China.
So they have a set of nodes in the
country. They they try a bunch of popular
weapons and keep tabs on
the speed and the stability of those
things that they see.
And it's really meant as a resource for
users in the country to see which tools
they should be using.
We also see from from Google this year
that Google got a step ahead of many
of the others and released a thing called
Unfiltered News, which is looking at what
news stories are more and less reported
in different places.
So as you search for something like
Trump, you see that it's really those
news stories are read and are
viewed much more in the US and are seen
much less from publications in other
places.
Whereas if you look at something
like Syria, you see a very
different picture of who's seeing it and
you can start to pull out.
Where are the missing dots in this
picture?
There's like no China in this picture.
So China just didn't see that news at
all. And so we're starting to
to be able to tackle this
problem of, OK, there's there's news
that's missing in places.
What are these views that are that are
not being seen?
Right. And so this is the sort of thing
that we're going to need to be thinking
about a lot more as we get into.
OK, so there's content in social networks
being taken down and there's there's
individual conversations that aren't
happening.
It's not just hosts anymore.
And this is, I think, an exciting
project that that helps us sort of
get past just host based stuff.
Another another example of a company that
continues to do great research is, is
Duine, which monitors
from its position in network
infrastructure interruptions
in routing.
So when when there are BGP interruptions,
this is at a level that really
you need to be a core infrastructure
provider to know that there's been
a problem.
You can you can do some measurements, but
these routing tables are not necessarily
propagated fully. And so it's these guys
who really get to see
the connections within this country got
taken down at a routing level.
So they've got examples of
there was another one of of as sort
of final exams happen, countries like to
take down their networks
to prevent cheating.
In addition to technology, there is a lot
that can be improved when it comes to
cultural understanding.
So a couple of weeks ago, I
was listening to a lecture of a Chinese
American activists that had a lot of
really interesting things to say about
the Great Firewall and how it's being
perceived by people in the West.
One of the things that stuck with me is
he said that people in the West need
informed empathy.
So the ability to look
what the world looks like through the
eyes of a foreign government, this
tends to be difficult because of cultural
misunderstandings and
things that are not very natural
to people in the West, but also vice
versa.
For example, when it comes to political
worst case scenarios in the West,
we tend to be terrified of
totalitarian governments, for example,
the Third Reich.
This is the one thing that we're
ultimately trying to prevent from
happening while in China,
almost the opposite is the case.
People tend to be terrified of the
complete absence of authority and
control, which would completely
destabilize the country.
And this is also reflected
in the way both
spheres handle their Internet.
And the ability to understand what we
are all afraid of would really help
in in moving forward.
There is also the popular opinion among
circumvention people that the truth is
outside the Great Firewall, and if only
we could provide the people in China with
circumvention technology, all of these
problems would just disappear.
Needless to say, that is a little bit
simplistic and patronizing.
For example, ninety eight percent of
network traffic in China is domestic,
and that is the same in many other
countries. Most people simply have no
interest in what foreign news is
saying.
And so it's not so much
a constant access denied.
It's mostly access isn't really wanted in
the first place.
And in addition to that, the United
States, for example, has a history of
destabilizing foreign governments.
And this is another reason why a lot of
countries are a little bit careful of
the way they're handling Western social
media, especially after
what happened with the Arab Spring.
So to finish off, we're going to talk a
little bit about what's driving the space
of measurement and our work here.
A lot of how we learn about censorship
remains through word of mouth, through
conversations that we have at venues like
this one. People go out to countries,
they experience stuff.
They come back to the activist networks
that they know. And that propagates up to
measurement research.
A lot of this remains through through
these conversations that we have at
venues like this.
There's also been a lot that's happened
from from government funding,
particularly the US, but but Western
governments see the Internet as a
liberation tool potentially, and are
funding it as such or have.
And also you see reactions from companies
that experience censorship from
an economic view of trying to push
forward their products.
So in that space, there's potentially
uncertainty in the US going forward.
A lot of that money has come through an
entity called the Broadcasting Board of
Governors, which is a congressional
mandate.
And that seems to be a little bit up in
the air in the next funding year where
there eight hundred million dollars,
which has gone to things like Radio Free
Asia. A lot of these sort of
pro-democracy things is potentially
getting reshuffled and sort of moving in
terms of who's controlling it.
And so we'll see how that goes and how
that changes and reshapes
the measurement and the circumvention
spaces.
We also, you know, here's an example
of a new site in Qatar that got blocked,
you see this sort of service side
measurement where where news,
where where other people who provide
platforms and experience censorship will
be willing to speak out.
We see that also from Google,
who has experienced censorship in places
and now keeps up to date measurements of
the traffic that they see and when they
notice anomalous traffic to their
services. And so this really is able to
provide that other half of the coin
where we can see can we reach you?
But we don't necessarily know for many of
these providers. Well, who can reach
them?
And so I think one of the things that we
really need to both be concerned
about and see as an opportunity is
engaging with these companies in these
major services and, you know,
saying that we expect additional
accountability and transparency from them
to help us understand what's happening.
Right. So so I guess the the
concerns that I want to leave you with.
First is the service side measurement,
how do we understand what's being taken
down by companies and platforms?
How do we understand what is not getting
to them?
We can do some of this from the client,
but we really need their participation.
And I think we are falling behind in our
engagement with the services and with
the platforms.
We're collecting a lot of data.
We're going to be collecting more data.
The measurement community, through things
like spooky scan and these other
measurement projects is now getting
longitudinal data that we can use to find
evidence of censorship at a cost level.
And the thing we need to be concerned
about is, is it the right data and is it
meaningful?
Is this blocking of hosts of individual
protocols really
evidence of censorship?
Or do we need to somehow get one level up
to user experience and to the
conversations that aren't happening?
And are we able to capture that as well?
And finally, all of this is within this
framework of the encryption battle and
whether we have the ability to have
communication and the ability to freely
say what we want to say to people.
So to leave you with something to do,
the first is advocacy, find champions
in government, speak out, find, find
the local networks.
And again, it's sort
of the same final message that we left
you with last year.
Arguing for complete lack
of censorship is going to be a very
uphill battle.
Arguing for more transparency and
censorship and arguing for accountability
is something that many more people can
get behind.
It's about being able to check
those powers that governments are taking
or taking more blatantly and being able
to say that's an overreach and having the
tools to do that effectively, that we
need to make sure we have,
if it's legal, where you are joining
and measuring Rushdoony probe
on other tools that are able to measure,
if you're a coder, develop these new
tools. There's lots of things we're not
good at yet, both
both looking for news and for
messages that aren't being seen in an
open source way. That's that's a huge
effort. Additionally, being able to even
detect things like net neutrality
violations and throttling of specific
services is the thing that we see happen
a lot. The current tools aren't reliably
able to detect.
So we'll leave you there and take some
questions.
Thanks.
So we got another question from the
Internet. Yeah, the Internet
wants to know if you can elaborate
on how the gentle, graceful
degradation of the use of Todd
Bridges in
Kazakhstan can be explained by the packet
inspection. And if the
packet inspection triggered, filters
wouldn't result in a sharp fall off
of bridge traffic.
So I think in the very beginning we did
have a sharp off.
As for the second part of the question,
we don't know.
So this is part of the problem.
Any help is appreciated.
OK. The Internet has another question,
A, it looks like it probably
if it wasn't most likely covered.
So do you have any idea how
I'll have you seen much change in the
patterns of site blocks by Ross
Carbonator or what
they do for blogging?
So Ross comes, I believe, the Russian
it's the Federal Telecommunications
Authority, something I haven't looked
into that one specifically.
I know that there continue to be,
again, degradation and additional
controls occurring in Russia that have
progressed over the year.
But I haven't looked specifically at what
those are in twenty sixteen.
Yeah.
Hi there.
You mentioned Owen and I really
appreciate the effort only it takes for
measuring censorship.
How about other approaches like Atlas
IPV for wide scanning, all
those things that scale to
to gigabit collaborate
on that.
So, so both, both
spooky scan and satellite that we
mentioned are using IP for scanning
component to, to look for available
services across the web and check on
what services we can find that run things
like DNS infrastructure or open proxies
or these sorts of things that you can
then reflect and get sort of a full view
that stuff.
The major challenge is jumping up to
IPV six.
I think there's been a talk recently
about trying to find active Hosten IPV
six. That was earlier today or yesterday.
And that's still sort of the next area of
development there is can we can we make
that leap and keep these techniques
working as we move to a more IPV six
Internet?
So with respect to Atlas, you have to be
a little bit careful because the people
who run Atlas probes that didn't really
sign up for censorship measurement,
Atlas doesn't allow you to conduct
very comprehensive measurements.
I think you're limited to four or five
different types of measurements.
But still, most people probably
don't know that there are others out
there who might use their probes for
censorship measurement.
So I would be a little bit careful.
There have been some there have
been some papers and some research that's
been done using Atlas probes.
And you can definitely learn stuff
through pinging and trace routing and
that sort of thing.
Um, the
the Atlas sort of
entity rape has definitely had, I
think, struggled with where their line
is of what they're comfortable with and
realize that that is a huge entity with a
lot of different interests.
And some of those interests are not
excited about that infrastructure being
used for advocacy if that potentially
reduces the number and prevents its
ability to be used for reliability and
for for understanding network failure.
Do you have insight into the hijacking
and can you differentiate between
hijackers operating
for commercial gain and sponsorship
attempts?
Technically or sort of by looking
at it and trying to understand what's
going on.
Yes, mostly
technically, but does it take
human intervention?
Do you have some kind of automatic
filtering based on heuristics?
So, I mean I mean, there's there have
been examples of
companies called out for for hijacking in
ways that people feel is inappropriate.
There was one around bot nets where
a security firm sort of took over a space
that they believed had command and
control a botnet in a way that the
rest of the community felt was inappropriate.
So that's not necessarily monetary gain,
but rather to either take control
or limit other things going on
on the Internet.
I think, you know, that that's generally
considered bad behavior in any case.
And hijacking is one of these things
that, um, hopefully
we eventually get to a world with BGP
security where that becomes harder.
I got a question in the beginning.
You mentioned deep packet inspection and
then afterwards you said, luckily there
is, let's encrypt.
But how will that benefit censorship?
Because you can still see to which
websites people go.
Right, let's encrypt.
This may be good for privacy.
Yes. So if you're blocking a full site,
you can do that.
Deep packet inspection previously has
allowed for things like keyword blocking
and for blocking of specific content.
Right. That's that's really often what
you see being the blacklist
that's provided by governments or by
advocacy groups that that are trying to
block a specific content.
It's specific YouTube videos or specific
news stories that they want blocked.
Let's encrypt forces, the ISPs
or the people making that decision to
block a full site.
There's much more collateral damage when
you're blocking the entire domain
or service rather than being able to
target specific content and
has a direct inspection not
evolved by time that they can now also
inspect ISPs traffic
by now only if they
control a root certificate.
And so far that
I think there's very the length of the
content also, but the length of
the content potentially, although
that's a that's harder for videos or that
sort of thing, you have to wait till the
end.
But but I feel like we haven't seen any
governments acting out badly in that
way, whether they're misusing
their government issued search to do sort
of looking within SSL.
And so, uh, I
mean, that's certainly something to watch
out for. It's something that you see as a
threat in several countries that are
proposing laws where they're saying
they're going to have a single gateway
and they want to be able to in the middle
SSL traffic. But we don't see that
actually happening in practice yet at a
wide scale.
I guess we're done great.
Thanks, everyone.