Measuring the Deployment of Network Censorship Filters at Global Scale

Abstract

Content filtering technologies are often used for Internet censorship, but even as these technologies have become cheaper and easier to deploy, the censorship measurement community lacks a systematic approach to monitor their proliferation. Past research has focused on a handful of specific filtering technologies, each of which required cumbersome manual detective work to identify. Researchers and policymakers require a more comprehensive picture of the state and evolution of censorship based on content filtering in order to establish effective policies that protect Internet freedom. In this work, we present FilterMap, a novel framework that can scalably monitor content filtering technologies based on their blockpages. FilterMap first compiles in-network and new remote censorship measurement techniques to gather blockpages from filter deployments. We then show how the observed blockpages can be clustered, generating signatures for longitudinal tracking. FilterMap outputs a map of regions of address space in which the same blockpages appear (corresponding to filter deployments), and each unique blockpage is manually verified to avoid false positives. By collecting and analyzing more than 379 million measurements from 45,000 vantage points against more than 18,000 sensitive test domains, we are able to identify filter deployments associated with 90 vendors and actors and observe filtering in 103 countries. We detect the use of commercial filtering technologies for censorship in 36 out of 48 countries labeled as 'Not Free' or 'Partly Free' by the Freedom House "Freedom on the Net" report [26]. The unrestricted transfer of content filtering technologies have led to high availability, low cost, and highly effective filtering techniques becoming easier to deploy and harder to circumvent. Identifying these filtering deployments highlights policy and corporate social responsibility issues, and adds accountability to filter manufacturers. Our continued publication of FilterMap data will help the international community track the scope, scale and evolution of content-based censorship.

Is remote measurement a better assessment of internet censorship than expert analysis? Analyzing tradeoffs for international donors and advocacy organizations of current data and methodologies

“…Progress has been made to create remotely measured datasets with automated oversight, which may be more accurate than either of the methods reviewed here (Pearce et al, 2018;VanderSloot et al, 2018;Weinberg, 2018;Hoang et al, 2019;Raman et al, 2020). However, the current versions of these datasets fail to meet many of the logistical considerations above.…”

TCPLS

“…Stateful filtering and stateful packet inspection policies did not impact the TCPLS handshake and transparent TLS proxy successfully triggered TCPLS fallback to TLS/TCP. Still, the security appliances that block TLS 1.3 or some of its features [13,57,83] would also block TCPLS.…”

“…When faced with middleboxes that modify TLS 1.3 [13,83], only one type of TCPLS messages can be impacted. The client TLS extensions, that are integrity-protected but not confidential, can be modified by these middleboxes.…”

“…A more complete evaluation of middlebox interference would require measurements in various operational networks that include such devices [46,72,83]. This is outside the scope of this paper and left for further work.…”

With a Little Help from My Friends: Transport Deniability for Instant Messaging

“…Traffic analysis remains an effective censorship mechanism [25,64]. Governments, organizations, and internet service providers (ISPs) filter websites in at least 103 countries [55]. China's "great firewall" actively probes and censors privacy tools [23].…”