Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1057 Thanks!
[Music]
the next talk will be given by leonit
evdokimov and he will be talking about
Russia versus telegram technical notes
on the battle the stage is yours thank
you
I am greeting all the creatures in this
Hall in the cyers space and those who
are in the future compared to me saying
this words my name is Leon and
affiliations that matter for this talk
are basically following first I love
Internet Protocol and I love measurement
networks based on Internet Protocol
second I am not a telegram team member
so no insights third I was a happy
telegram user and when the blocking
started I was extremely disappointed
basically I was disappointed enough to
do something but before describing the
telegram incident I want to give a brief
overview of Russian internet sensorship
landscape it will give some important
context that may help you to prevent
some eratic
conclusions first attempts to filter
Russian internet segment it's not a
recent development there were some
activities in that area for like last 11
years the first documented incident of
Internet censorship in Russia happened
in May of 2007 court ordered four isps
in novas subers academic campus also
known as academ gorok uh to ban some
extremist
websites those were small internet
service providers so only small fraction
of users was affected and the incident
hasn't made a loud news story The regor
Stream that was used to block content in
this agist was named Federal list of
extremist materials but the registry was
quite badly maintained for example one
of the entries in that registry is
exactly the following uh text document
named terrorism from the folder named
orders number one CD dis number one
that's it that's the ENT of the
registry so the wasn't very useful for
the purpose of automatic content
blocking one of the notable events of
that era is a Act of digital resistance
by Maxim mashkov uh Maxim is a cyber
librarian of the oldest Russian internet
Library named
Liu one of the sections of the library
is named Sam is that that basically
stands for uh self-publishing in Russian
and uh that Sam is that journal hosted
user generated
content once the domain of the journal
was added to the federal list of
extremist materials of course that
wasn't a surprise because all Soviet
people know that Sam is that is kind of
really extreme Civil
Disobedience Maxim decided to bring some
fun or fairness to that case and he
transferred the useless domain to the
ministry so basically he pointed the
main of the ss. library to the website
of the ministry of justice as expected
that eventually caused some in
accessibility of meanjust do
Ru the modern
Blacklist the Border Blacklist as we
know it it appeared in
2012 the law was brought to protect
children of all ages from one or zero to
100 years old from digital drugs from
child porn and from various safety
guidelines also known as suicide
howtos the major websites protested but
the parliament didn't care that much and
eventually the president have signed the
law on Saturday now I know that
president works on Saturdays so how does
Modern roscom blocklist look like it's
an XML find file signed with detached
signer using ghost cryptography also the
bundle of XML file and the signature it
is wrapped up in another XML as the file
is fetched using soap protocol the
protocol documentation is publicly aail
available as well as the API end points
for testing the essence that you should
know is that internet service providers
actually control the filtering equipment
they purchase and draw comut zor
it only maintains The Blacklist and
monitors that filters of internet
service providers actually
work so when the block list first
appeared in November 2012 it immediately
delivered a lot of fun to us for example
it blocked absur opedia uh basically
Russian version of Encyclopedia and
exactly for suicide how to of course the
girl task of blocking of humorous
content got some media attention and
some Brave creature decided
to leak the block list to GitHub to to
codify that absur for ages so two weeks
later after the first block blocklist
release GitHub and Source Forge got a
copy of the blocklist and uh that copy
was kept up to dates up to date for
years it's still kept up to date and
it's still maintained I don't know
anyone who knows the person maintaining
that blocklist mirror so the stock is
basically the only way for me to thank
that maintainer for all the work he was
doing during last six years and of
course another fun incident in the same
month like within a few weeks some of
Google services were also banned for a
day or so so anyway who needs jary
libraries from J static.com
and I can spend the whole time slot of
the talk describing funny incidents
regarding the blocklist but it's not the
main topic today but I country is this
so I'll just name a few more first the
PornHub uh it was a Pioneer that used
legal procedure to unblock the website
that was blocked previously and that
legal fight it deserves some Kos second
uh rosom nazor obviously lives loves TCP
dump for sure that's uh you know the
only saying way to explain how
certificate Authority revocations list
and ocsp responders of commodo CA were
banned and uh that CI ban it caused some
quite solid collateral damage and hard
to debu problems third our scor either
have some sense of humor or just lack
sity checks in Blacklist maintenance
procedures so it really banned Lu back
address for a
while as I've earlier said rosom are
monitors that isps actually Implement
filters the reason for monitoring is
understandable the law doesn't matter
the fine and the penalty does so isp's
got some New Year gifts in
2016 uh that was a tiny open VRT router
based on TP Link platform wildx uh
well-known Russian hacker uh has hacked
the firmware and highlighted some really
nice facts uh in his research first API
of the command and control center of Z
measurement platform it was reached over
HPS sounds good so far but unfortunately
CA certificates bundle was absent
probably due to IM size constraints also
SSH was used to do some reverse
tunneling that sounds like a usual and a
good idea to penetrate networks address
translation as soon as IP V4 is still
widely used and the modern IP is not
that much at least in Russia but server
uh host K check it was absent so it was
basically disabled that allowed valx to
inject some nice screenshot of cyber
garbage into roscom zor monitoring
pipeline at least according to his
publication if his prank succeeded that
was the picture that sensor was seeing
in the back office while checking the
screenshot of the website that had to be
banned the real issue with the revisor
monitoring system is that it is a
blackbox at least from isp's standpoint
it's not publicly documented what sort
of Behavior Uh the blackbox has what
sort of filter uh is good enough enough
and what sort of filter leads to finds
eventually one of maintainers of revisor
system a governmental employee uh has
written a public frequently asked
questions for revisor on GitHub to help
IPS to comply and he claims that it like
reduced overall amount of fines that
sounds like good activity but before
that some IPS had to put that monitoring
system revisor into a strict sandbox
that had way more tight filters that
ordinary users were expecting and
moreover the sandbox solution was so
widely discussed and so popular that it
became the logo of semi-official
telegram channel that discussed revisor
related issues between isps and like
governmental
employees as soon as ISP were first to
comply with the black post as soon as
XML file contained stale IP addresses of
their websites to block as soon as a
blackbox was actually using IP addresses
from DNS to check for compliance because
all of that some IPS started to feed a
and 4 a records stri from DNS to their
filters and of course it was prone to
some malicious manipulations by domain
name
owners though manipulations were called
DNS attacks and there were various sorts
of them some of ips used IP addresses
from DNS to actually block traffic
that's boring but those IPS have brought
their users some collateral damage when
domain names were pointed to IP
addresses of good Services other isps
used IP addresses to steer some portion
of traffic towards DPI boxes to reduce
overall amount of band going through DPI
that's very smart and it saves some
electricity uh so it's kind of green uh
but unfortunately it may lead to more
specific routs overriding ordinary
routing rules when the main names were
pointing to IP address addes of ping
subnets or in the worst case routers can
just go on strike when blacklisted
domain names are pointed to something
like million and a half of distinct IP
addresses and basically overflow routers
to come memory as you can guess all
those incidents have already happened so
non use here I'm sorry if the History
Section took too long but some Falls
deserve highlighting as they are quite
Universal across different filtering
systems so the story of incident with
telegram starts here basically when
policeman enters the game so what's the
essence of the reasons to block telegram
it's quite easy to understand terrorists
who PL a bomb in s Petersburg Subway
they used
telegram um also every Isis member
enjoys slick UI nice stickers and videos
in circles according to news and Russian
satirical videos some people also also
name popularity of telegram in
opposition groups as a reason for ban
but you know discussing the reason of
ban is out of the scope of the talk on a
way so it's easy telegram is added to
the registry of information Distributors
so it has to comply with the law and it
has to do some decryption mtion magic uh
basically to help police and otherwise
it will be blocked so when the telegram
was duly added to the corresponding
registry in the classified location
uh it claimed that it will never hand
over keys or do back doors so digital
rights NGO called Rod started leing
campaign for encryption and stuff and uh
eventually the court cases were lost at
least in Russian course the case was
escalated further but it's born legal
stuff uh so the key point is on the 16th
of April romor started to block Telegram
and following few weeks were named the
first Russian civil cyber
War uh but let me give me a bit more
context telegram wasn't the first
messenger that terrorist love zel was
another one zela was also used by
protesting truck drivers in Russia but
maybe those drivers were meant to be the
terrorist who knows anyway once again
out of the scope so attempts to block
Zell were ongoing since April
2017 and uh they weren't a complete
success and there was leak in the end of
March
2018 saying that roscom naor plans to
conduct an experiment uh to test new
tactics regarding blocking of zal the
eled paper it had 36 subnets summing
down to something like 15 millions of IP
addresses of Amazon and other Cloud
providers and the leak had like nice
keywords like n routing bgp redistribute
you all know that you have already seen
it before so I'm unsure what they
actually meant uh with that experiment
and I don't know if the leak was genuine
but that publication of flick caused a
lot of noise in the media and uh there
were no further reports that could
confirm of existence of a like
experiment so maybe media worked
moreover some illustrators Drew really
good pictures that could clearly
communicate the overall roscom naor plan
regarding attempt to ban Z to every I
don't know to no technical granny for
example so back to telegram on Monday
April the 16th romor starts to B
telegram subnets some of telegram
subnets as expected uh no significant
effect was not so romor went berserk and
started buying Amazon but telegram
worked finally rosom nazor noticed that
one of telegram subnets wasn't banned
initially yet and of course that didn't
help them much to achieve their goal
when they baned so berer mode wasn't
turned off and almost two million of IP
addresses were banned by the end of the
day telegram was doing fine but overall
internet wasn't I mean like from
Russia internet was okay but people in
Russia were complaining a lot about
Instagram About Steam about word of
Tanks word of ships twitch YouTube
Google Gmail and so on so basically
everyone was swearing at romor by the
end of the first day of civil cyber War
but actually everyone stopped swearing
the next day when the amount of baned IP
addresses increased 10 fold everyone was
just speechless there were no good s
wordss to express amount of frustration
and um every other online tool was BR
broken basically more millions of
domains were affected and uh in the
meantime roscom naor was announcing that
no socially significant web services
were
affected of course I don't blame roscom
naor for mistakes in their announcements
like employees implementing the ban were
obviously very very tired and stressed
while rushing to shut down Telegram and
uh they were in such a rush that they
have banned several IP ranges twice uh
submitting overlapping subnets into
digitally signed block list on the
second day of the Civil cyber war on the
17th of April and um probably the
equipment could handle that the filters
but some people counting public
statistics for the block list they got
their numbers wrong because of that but
if Cy checks are missing they are
missing everywhere so some formed URLs
were added to the block list as well
during the incident and the malformed
URL it actually caused some filter
implementations to fail ingestion of new
new Blacklist entries new Blacklist
subnets and new Blacklist IP addresses
but I think that it probably was just a
mistake I don't expect that it was
carefully planned sabotage of some
roscom naor
employee during the first days of cyber
War rosor has distributed a document
with some white list of socially
scientific Services uh including Google
by the way that included websites also
like Kremlin R uh those shouldn't be
banned under any circumstances probably
that was a response to numerous reports
regarding collateral damage but
unfortunately rosor had no legal
framework for like actions so many IPS
just ignored the document but it could
caus some media wave as soon as wh list
coming from censorship agency was
something new for Russia that days
anyway the Mantra regarding socialist
signant Services was repeated over and
over again but like counter of Yandex
metrica or yand Banner system end points
were banned in the midnight of April the
27th and we contactor was also banned by
same commit and we contacted the most
popular social network in Russia so the
incident last for almost 2 hours and it
clearly showed that first rosc comnor
Works selflessly Around the Clock second
rosc comnor still loves to speedum and
still loves to feed IP addresses right
into the Blacklist without much analysis
as it previously happened with commodo
CA in addition to generic mons regarding
socially significant websites romor was
spreading quite precise statements in
their Newsfeed as well one of the
statement claimed that IP addresses of
Google Play Google Drive google. Ru were
not banned of course we asard V clab uh
as two Club sorry uh we very happy to
hear that the reason is Crystal Clear uh
precise statements are
refutable and it's always fun to refuse
official
news uh to refute official news coming
from official news source in fake news
era uh so we scraped hundreds of ips of
various Google domains sending different
client subet to Google's name servers
checked collected IPS against
Blacklist and you know media loves fake
news stories and it was kind of
interesting that there was more than one
cluster of interconnected Google domains
pointing to same IPS probably that makes
some sense from traffic engineering
perspective Ive but it also explains the
reason for some Google fonts and points
being unreachable while other were
perfectly okay but it wasn't the only
fun visualization we made like on the
April the 19th we took the rip Atlas
probes in Russia that absorbed filtering
pointing them to randomly selected TLS
end points in filtered subnets and
crafted life a vaco dashboard that
dashboard showed that some isps are
basically practicing digital
resistance um the reason to like to
create like dashboard was clear for me I
didn't want for huge isps those are too
big to fail uh to use a possibility of
non-compliance as a competitive
advantage against smaller independent
isps who can't take the risk of paying
fines um but members of ISP Community
asked us to hide the dashboard within
something like half an hour I for the
reason I still don't quite understand
and uh anyway non-compliance story still
goes on at least for Ros
the largest ISP that holds like one3 of
a b2c Broadband market share and
experiments have shown that Rost Telecom
doesn't block traffic to blacklisted IPS
and subnets completely it blocks just
HTTP and htps traffic and for example SS
Works SSH works perfectly and once again
that's State on ISP holding once one
third of a market you know like here is
a example of non-compliance or or
basically delayed compliance I'm
speaking about the blocking blue dots
close to zero it was delayed by
something like 5 days uh while they have
to implement the blocking basically as
soon as possible or within 24 hours
depending on various variables in the
XML file so like unblocking was
perfectly
timely as a civil cyber War continues
people use proxy and T to assess
Telegram and they get indicated and
artists craft party songs about Proxes
they Mock roscom nazor and people have
great share of fun but roscom nadzor
hunts Proxes as well as Telegram and
people wonder how they do it some people
start suspecting that lawful
interception equipment also known as Sor
is used to hunt Proxes and tips come via
public and private channels highlighting
instances of like
sniffers basically the instances were
exposing traffic statistics publicly and
the traffic statistics uh also had a
section of telegram traffic uh that
attract the attaction attention of
people who send us some tips uh we SCP
statistics page and it turned out that
all those instances were pumping quite
small amount of traffic some like 20
gbits per second but the shape of
traffic looked like real one we looked
up those instances using Shon and uh we
have seen that some instances had public
FTP repositories with sorm binaries
basically
uh and what was significantly worse some
instances were leaking actual users
clickstream and some personal
information like Mark addresses or
logins and of course all the data was
available without any authentification
so being good citizens we decided to
report the incident to the vendor of s
equipment and uh IPS hosting the lawful
interception equipment I got no replies
but some instances were like properly
secured within next few weeks but some
weren't anyway we concluded that the
tips we got it they had no public
evidence that storm equipment was
actually used to hunt Telegram and
Proxes stat at least statistical
counters about tegram they were zero
because you know subnets are blocked but
you also know that absence of evidence
is not evidence of absence another
telegram story that is kind of
interesting is that the protest meetings
happened when the app was blocked as as
as I no is the very first time in Russia
when protest meetings uh are triggered
by blocking of online
service um the meeting was scheduled on
the last day of April and the first day
of May in Moscow in St Petersburg on the
28 and on the 28th uh the Saturday
before the meeting uh number of blocked
IP addresses went down from 90 million
to 15 so it's unclear if the action is
caused by the activity of the society
but maybe it's just incidence I don't
know but we assumed that media media
attention may help to reduce collateral
damage caused by Massive subnet blocking
and we decided to do some performance I
have previously described the NS attacks
that caused a major outage of trans
Telecom internet service provider and uh
one of the outcomes of that incident was
a chart that was monitoring the account
of IP addresses that are appointed by
blacklisted DNS entries basically if the
chart chart skyrockets it may be an
indicator that ongoing DNS attack I have
previously registered some expired
blacklisted domains for Network
measurements to present the results of
those measurements at the round table at
the Parliament and those domains were
still alive so I took some of them and
added some Dynamic DNS Zone script and
the script was updating the zone so nice
Mor's code appeared on the chart and the
plotted pH phrase was like digital
resistance unfortunately it hadn't
triggered any visible actions from Ros
comador but another reason that could uh
explain that is what the performance
could be linked to Alexa naval's
opposition meeting uh they had some
protest on the 5th of May so we took
that as a hypothesis and continued first
some ship drama was added the chart was
doing countdown from 5 to zero um and it
was doing it very slowly and fake drama
kind of worked the countdown has
triggered uh some nervousness and the
message was as friendly as possible
Russia celebrates uh radio day on the
7th of May that's a professional holiday
for all the people involved in
telecommunication and the message was
truly pop off that is a well-known
celebration greeting for that holiday
that basically follows Pascal greeting
pattern as that message it had some
effect romor started to clean up domains
from the blocklist while the end of
transmission chart was blot it caused
some nice fadeout but also orom naor has
baned and unbaned like ERS TLD maybe it
was a sign of unity and solidarity I
don't know and second amount of band IP
address dropped significantly uh third
rosom Noor started to remove expired
domains from the registry reducing
possible impact of various DNS attacks
so uh it was maybe a hype driven cleanup
but the proper expired domains
maintenance persisted and it was good
for overall Network stability maybe it
was a coincidence I don't know another
un blocking happened on the 8th of June
and um anyway all those cleanups were
followed by people Computing the
statistics of IP addresses though were
remaining banned after subnet unban and
the number was less than
1% and so some people were saying that
roscom nazor was using terrorist tactics
while fighting with terrorists using
telegram uh basically taking those
networks as
hostages I had an assumption that
leftovers of collateral damage could be
also explained by something like
incompetence or lack of big players in
those subnets so I've spent days mining
open data on DNS written an open letter
to rosom naor giving of overview of
blocked web resources like slack JC
power DNS doodle python mailing list
netlify and so on and so forth and
American nalist Underground society
an.com and the letter was also duy sent
to corresponding legal online form of
for comor some answer arrived but it was
like pointless legal speak so maybe
those networks are really hold as hostes
I don't know so uh that was a brief
story of heed part of the Civil hyber
War but the Cyber War wasn't over it
became colder one of the observations we
made was a selective uh protocol
throttling telegram clients picked
several protocols to the proxy sock five
and variations of telegram specific look
like nothing empty prot protocol and I
discovered that one of Major mobile
broadband IP doesn't treat those
protocols equally at first I assumed
that all look like nothing protocols
were shaped as of four plugable
transport and be net cut Ur random uh
they were throttled as well but thanks
to Simon baso we've conducted an
experiment and confirmed that it's not
the case that HTTP protocol that is
sored with rc4 random stream it was also
absolutely okay it's unclear if the
shaper is targeting specifically empti
proor or like some other protocol but
it's definitely more complex than I
originally assumed but it also means
that camouflage matters a lot while
designing plugable transport another
proxy Ser ability availability issue was
absorbed in one of R telom subnets in
the south of Russia and the Proto
proxies operating without random padding
were banned almost instantly and uh it
was trivial to trigger DPI equipment
into resting the TCP stream just sending
the packets of the to the listening TCP
Port uh but there was a thing that was
really bad in that setup uh the IP and
Port of the network endpoint were added
to Dynamic block list at the DPI box at
for a couple of hours and we assumed
that the vulnerability that was created
by that uh it could be possibly
exploited even from the JavaScript from
browsers uh to B good web resources
basically so we decided to disclose that
shady practice immediately instead of
researching it further and there was a
writer news article a couple of months
later that kind of confirmed that like
experiments on live traffic were
actually
happening um it's unclear to me if like
uh experiments are legal but some people
consider that it's like a crime another
proxy service availability issue was
absorbed in Moscow thanks to St
Petersburg City ft they deed the story
first the user connects to so 5 server
then a map scanner comes in something
like half an hour and the if a port is
available like the scanner tries to
establish a so 5 connection to telegram
cloud out and if all the checks are okay
then IP address becomes
blacklisted um the story has attracted
some nonzero media attention from local
and international media but the most
interesting part of the story was left
unnoticed the only reason for me to
replicate this study in Moscow Subway
was the ability to manipulate the block
list and add the IP addresses of my own
servers to it it allowed me to conduct
conduct an experiment uh that I consider
extremely important uh we were able to
measure the timeline of blocklist out
using diverse set of rles props and um
statistics we got was very interesting
it allowed us to verify the tip that we
got in May and the tip was basically
saying that there are actually two tiers
of isps with regards of timing of
blocklist execution so there are isps
that start blocking IP address before
officially signed XML block list is
delivered with API my personal opinion
is that it's not necessary crime there
are other sources of blacklisted
endpoints for example Federal list of
extremist materials also digital
security lab Ukraine reported that
Crimea has both Regional Blacklist and
federal Blacklist but I know nothing on
that region go ask xia who may be in
this room as well and um also there were
like tips coming from Caucasus regarding
like stuff and but the thing that you
know for sure with high level of
confidence is that some Regional
governmental internet blackout happened
to inusa this Autumn during protest
another thing we know that the race
between ISP to block uh is still
persists anyway Russia is Federation and
that's almost it as you may already know
whole Russian history can been s summed
up into five words and then things got
worse and there was a law introduced to
the parliament two weeks ago the law
says that rosor will give some IPS
anti-tr equipment for free and that the
chosen ipce must comply and employ it
they can't refuse that New Year gift and
that anttic M will be acting as filter
as well as soon as isps deploying the
anti threat filter don't have to buy
their own filters and there is a s that
is scary to me the note says that roscom
nazor will be able to control basically
routing and DMS directly and it's scary
Twice first we have already seen the
level of technical competence and lack
of safety checks and safeguards I mean
all the aforementioned mistakes and
second it's huge centralization of
controlling power that can be abused
without any transparency I assume that
the luxury of signed XML Blacklist will
begun soon the law also introduced
registry of legal internet exchanges and
list of legal cables crossing the border
to make absolutely sure that Russia is
well
connected um so it
goes I'd like to thank lots of people
and groups who made this talk possible
Philip kulin valx Michael clov Dimitri
nazarov Alex Rena bavi varanka chov
Dimitri Mosin Dimitri marosi Bas mariao
moris Brattle leak to Blacklist
maintainer St Petersburg CF team roscom
swab NGO digital resistance measurement
Squadron the one who is to blame all the
revisor system fans n Community R Atlas
and all the relatives and colleagues who
help me to survive while doing all the
stuff sometimes quite narrowly and
around the clock and of course I'd like
to say to thank stubbornness of pav
durov and law enforcement bodies because
that fight made all the great
entertainment possible and I hope the
story was entertaining as you as well
thank
[Music]
you thank you leonit for the excellent
talk uh we have five minutes left for
questions uh so if you have any
questions come up to the microphone
phones that are standing in the aisle
and to the left and the right and um
wait for my signal microphone one please
uh hi thanks for a talk uh during the
whole blocking situation I heard that
tegram continued working in Russia do
you know if it works right now yeah it
it works perfectly like there are some
isps that are maybe over complying and
it's uh Works a bit less good there but
proxies work telegram works for example
like Ros Telecom as I have previously
mentioned doesn't comply with uh subnets
and telegram Works flawlessly
there we also have a question from the
internet signal angel
please yes um somebody saying on the
internet that telegram had a canary
statement on their privacy page stating
that no data had been disclosed to any
third parties including governments and
they say the statement has disappeared
are you aware of that and what do you
think about that uh I'm first I'm not
aware of that and second uh I think that
is like not a real like like like I
don't think that we should be paranoid
regarding that because like my
expectation is that it's just another
mistake because like telegram team had
like I don't know they write some
questionable parts of the software for
example uh telegram client has no proper
exponential back off and it can
basically dos a proxy in C of in case of
some DPI configurations so I don't know
I think it was just a mistake by
telegram Web Master but maybe it's maybe
it's not don't know anyway I'm not part
of a team microphone 4 please if you're
worried by the lack of Competency should
you work for the Russian
government um I don't know maybe anyway
I I still live in Russia like there are
lots of beautiful people there and like
I don't know I don't think that it is
the worst government we had during the
last century so things are sometimes
they get worse sometimes they get better
and I'm not sure where we actually are
but some of my friends are paranoid and
they basically seek for political Asylum
some of my friends are quite happy to
live in Russia I don't
know number six over there please yeah
hello Leon uh thanks for your amazing
talk I really enjoyed it I'm was just
asking um we as a as a German people can
we rent your expertise when we get some
problems like uh serious blocking over
here in Central Europe is it possible
well like uh the main point for my talk
was not to complain about romor by
basically to highlight the cases uh when
things can go wrong because of internet
filters and so that was the point I'm
not 100% sure if it like completely
answers the qu your question but I think
it
does and M microphone to
please uh why do you think uh China is
more successful in uh censoring the
internet than Russia uh so the question
is uh why China is more successful
regarding sensor in the internet um I'm
not sure that China actually is
technically more successful uh in
Internet censorship maybe it is but the
uh really important point is that there
are a lot of Chinese people speaking
Chinese language and they have a huge
ecosystem of Chinese internet that
serves the purpose of basically a
billion of people Russia is uh 10 times
smaller it's significantly smaller
Market uh we have uh some great local
content but amount of local content
can't be compared to
to China so maybe Chinese people don't
need to circumvent censorship that much
and maybe that's why the China is seen
as more successful and uh like a friends
of mine works with Chinese factories and
like while they are traveling to China
they say that circumvention is not a
problem like everyone who wants to
circumvent the filtering in China he
does it
trivially I don't know I don't travel to
China
but I trust those who
do microphone one please I Leon thank
you for your interesting work one
question for me would be did you face
any problems through this work with
authorities or services that somehow
feel offended or attacked uh I wouldn't
say attacked like U I have some FSB
officers in my WhatsApp phone book uh
who were like uh talking to to me asking
to educate them on basically to give
them them a lecture on like tour Network
or something like that and um it wasn't
like offensive at all like they were
friendly and why not I think that
education of law enforcement is really
important because like law enforcement
is doing not only like I don't know
oppression but also a lot of dirty work
that has to be done somehow and U I
don't know I so far I'm okay maybe maybe
I'll overcome the line eventually but I
don't know one final question microphone
for
please I Le need and thank you for the
talk very
much uh I heard a popular opinion that
after this talk it's better for you not
to come in back in
Russia uh sorry can you repeat please uh
it's better for you not to come back to
Russia after your talk here so much
there is such an opinion and like when I
was uh doing that prank with morza code
um I got a message from a person from
rosc comador using telegram uh that said
that I shouldn't come back and I was
basically coming back from Belarus to
Russia and I don't know no one had met
me I don't know we'll
see I'm quite
optimistic let's thank the courage of
Leon again and thank you for your
excellent talk
[Music]