This article may require copy editing for grammar, style, cohesion, tone, or spelling.(November 2023) |
Internet censorship circumvention is the use of various methods and tools to bypass internet censorship.
There are many different techniques to bypass such censorship, each with unique challenges regarding ease of use, speed, and security risks. Examples of commonly used tools include Lantern and Psiphon, which combine various approaches to bypass multiple types of safeguards. Some methods, such as the use of alternate DNS servers, use false addresses or address lookup systems to evade less sophisticated blocking tools while the user accesses the site. [1] [2] The drawback of this method is that many censors block the IP address of restricted domains in addition to the DNS, rendering the bypass ineffective. Other tools circumvent the tunnel network traffic to proxies from other jurisdictions that do not fall under the same censorship laws. Through the use of technology such as pluggable transports, traffic obscuration, [3] website mirrors, or archive sites, copies of the site available at other locations can be accessed within regions under internet censorship. [4]
An arms race has developed between censors and developers of circumvention software, resulting in more sophisticated blocking techniques by censors and the development of harder-to-detect tools by tool developers. [5] Estimates of adoption of circumvention tools vary substantially and are disputed, but are widely understood to be in the tens of millions of monthly active users. [6] [7] [8] [9] Barriers to adoption can include usability issues, [10] difficulty finding reliable and trustworthy information about circumvention, [11] lack of desire to access censored content, [12] and risks from breaking the law. [4]
There are many methods available that may allow the circumvention of Internet filtering, which can widely vary in terms of implementation difficulty, effectiveness, and resistance to detection.
Filters may block specific domain names, either using DNS hijacking or URL filtering. Sites are sometimes accessible through alternate names and addresses that may not be blocked. [1]
Some websites may offer the same content at multiple pages or domain names. [2] For example, the English Wikipedia is available at Main Page, and there is also a mobile-formatted version at Wikipedia, the free encyclopedia.
If DNS resolution is disrupted but the site is not blocked in other ways, it may be possible to access a site directly through its IP address or modifying the host file. Using alternative DNS servers, or public recursive name servers (especially when used through an encrypted DNS client), may bypass DNS-based blocking. [1]
Censors may block specific IP addresses. Depending on how the filtering is implemented, it may be possible to use different forms of the IP address, such as by specifying the address in a different base. [13] For example, the following URLs all access the same site, although not all browsers will recognize all forms: http://1.1.1.1/
(dotted decimal), http://16843009/
(decimal), http://0001.0001.0001.0001/
(dotted octal), http://1.1.1.1/
(hexadecimal), and http://0x01.0x01.0x01.0x01/
(dotted hexadecimal).
Blockchain technology is an attempt to decentralize namespaces outside the control of a single entity. [14] [15] Decentralized namespaces enable censorship resistant domains. The BitDNS discussion began in 2010 with a desire to achieve names that are decentralized, secure and human readable. [16]
Cached pages: Some search engines keep copies of previously indexed webpages, or cached pages, which are often hosted by search engines and may not be blocked. [4] For example, Google allows the retrieval of cached pages by entering "cache:some-url" as a search request. [17]
Mirror and archive sites: Copies of web sites or pages may be available at mirror or archive sites such as the Internet Archive's Wayback Machine or Archive.today. The Docker Registry Image Repository is a centralized storage, application stateless, and node scalable HTTP public service and has a performance bottleneck in the multinational upload and download scenario. Decentralized Docker Registry avoids this centralization drawback. DDR uses a network-structured P2P network to store and query mirror manifest file and blob routing, while each node serves as an independent mirror repository to provide mirror upload and download for the entire network. [18] [19] [20]
RSS aggregators: RSS aggregators such as Feedly may be able to receive and pass on RSS feeds that are blocked when accessed directly. [4]
Decentralized Hosting: Content creators may publish to an alternative platform which is willing to host ones content. Napster was the first peer to peer platform but was closed due to centralized bootstrapping vulnerabilities. Gnutella was the first sustainable platform hosting by decentralization. Freenet's model is that "true freedom requires true anonymity." Later, BitTorrent was developed to allocate resources with high performance and fairness. [21] ZeroNet was the first DHT to support dynamic and updateable webpages. YaCy is the leading distributed search.
Anonymity Networks: The anonymity Tor network and I2P provides leads to more willingness to host content that would otherwise be censored. However hosting implementation and location may bring issues, and the content is still hosted by a single entity which can be controlled.
Federated: Being semi-decentralized, federated platforms such as Nextcloud and IRC make it easier for users to find an instance where they are welcomed.
Providers with a different policy: Some platforms relying on the Cloud may have more lax TOS. However nothing by design keeps it so.
See: Darknets
Web proxies: Proxy websites are configured to allow users to load external web pages through the proxy server, permitting the user to load the page as if it is coming from the proxy server and not the (blocked) source. [4] However, depending on how the proxy is configured, a censor may be able to determine the pages loaded and/or determine that the user is using a proxy server. [2]
For example, the mobile Opera Mini browser uses a proxy-based approach employing encryption and compression in order to speed up downloads. This has the side effect of allowing it to circumvent several approaches to Internet censorship. In 2009 this led the government of China to ban all but a special Chinese version of the browser. [22]
Domain fronting: Circumvention software can implement a technique called domain fronting, where the destination of a connection is hidden by passing the initial requests through a content delivery network or other popular site which censors may be unwilling to block. [23] This technique was used by messaging applications including Signal and Telegram. Tor's meek uses Microsoft's Azure cloud. However, large cloud providers such as Amazon Web Services and Google Cloud no longer permit its use. [24] Website owners can use a free account to use a Cloudflare domain for fronting. [25] [26]
SSH tunneling: By establishing an SSH tunnel, a user can forward all their traffic over an encrypted channel, so both outgoing requests for blocked sites and the response from those sites are hidden from the censors, for whom it appears as unreadable SSH traffic. [27]
Virtual private network (VPN): Using a VPN, a user who experiences internet censorship can create a secure connection to a more permissive country, and browse the internet as if they were situated in that country. [1] Some services are offered for a monthly fee; others are ad-supported. According to GlobalWebIndex in 2014 there were over 400 million people using virtual private networks to circumvent censorship or for increased level of privacy, although this number is not verifiable. [9]
Tor: More advanced tools such as Tor route encrypted traffic through multiple servers to make the source and destination of traffic less traceable. It can in some cases be used to avoid censorship, especially when configured to use traffic obfuscation techniques. [5]
A censor may be able to detect and block use of circumvention tools through deep packet inspection. [28] There are efforts to make circumvention tools less detectable by randomizing the traffic, attempting to mimic a whitelisted protocol or tunneling traffic through a whitelisted site by using techniques including domain fronting or Meek. [5] Tor and other circumvention tools have adopted multiple obfuscation techniques that users can use depending on the nature of their connection, which are sometimes called "Pluggable Transports". [29]
Functionality that people may be after might overlap with non-internet services, such as traditional mail, Bluetooth, or walkie-talkies. The following are some detailed examples:
Datacasting allows transmission of Web pages and other information via satellite broadcast channels bypassing the Internet entirely. This requires a satellite dish and suitable receiver hardware but provides a powerful means of avoiding censorship. Because the system is entirely receive-only for the end user, a suitably air-gapped computer can be impossible to detect. [30]
A sneakernet is the transfer of electronic information, especially computer files, by physically carrying data on storage media from one place to another. A sneakernet can move data regardless of network restrictions simply by not using the network at all. [31] One example of a widely adopted sneakernet network is El Paquete Semanal in Cuba. [32]
Circumvention tools have seen spikes in adoption in response to high-profile blocking attempts, [33] [34] [35] however, studies measuring adoption of circumvention tools in countries with persistent and widespread censorship report mixed results. [6]
Measures and estimates of circumvention tool adoption have reported widely divergent results. A 2010 study by Harvard University researchers estimated that very few users use censorship circumvention tools—likely less than 3% of users even in countries that consistently implement widespread censorship. [6] Other studies have reported substantially larger estimates, [7] but have been disputed. [8]
In China, anecdotal reports suggest that adoption of circumvention tools is particularly high in certain communities, such as universities, [36] [37] and a survey by Freedom House found that users generally did not find circumvention tools to be difficult to use. [1] Market research firm GlobalWebIndex has reported that there are over 35 million Twitter users and 63 million Facebook users in China (both services are blocked). [7] However, these estimates have been disputed; [38] Facebook's advertising platform estimates 1 million users in China, [8] and other reports of Twitter adoption estimate 10 million users. [39] Other studies have pointed out that efforts to block circumvention tools in China have reduced adoption of those tools; the Tor network previously had over 30,000 users connecting from China but as of 2014 had only approximately 3,000 Chinese users. [40]
In Thailand, internet censorship has existed since 2002, and there is sporadic and inconsistent filtering. [41] In a small-scale survey of 229 Thai internet users, a research group at the University of Washington found that 63% of surveyed users attempted to use circumvention tools, and 90% were successful in using those tools. Users often made on-the-spot decisions about use of circumvention tools based on limited or unreliable information, and had a variety of perceived threats, some more abstract and others more concrete based on personal experiences. [11]
In response to the 2014 blocking of Twitter in Turkey, information about alternate DNS servers was widely shared, as using another DNS server such as Google Public DNS allowed users to access Twitter. [42] The day after the block, the total number of posts made in Turkey was up 138%, according to Brandwatch, an internet measurement firm. [33]
After an April 2018 ban on the Telegram messaging app in Iran, web searches for VPN and other circumvention software increased as much as 48x for some search terms, but there was evidence that users were downloading unsafe software. As many as a third of Iranian internet users used the Psiphon tool in the days immediately following the block, and in June 2018 as many as 3.5 million Iranian users continued to use the tool. [34]
Circumvention and anonymity are different. Circumvention systems are designed to bypass blocking, but they do not usually protect identities. Anonymous systems protect a user's identity, and while they can contribute to circumvention, that is not their primary function. Open public proxy sites do not provide anonymity and can view and record the location of computers making requests as well as the websites accessed. [4]
In many jurisdictions accessing blocked content is a serious crime, particularly content that is considered to be child pornography, a threat to national security, or an incitement of violence. Thus it is important to understand the circumvention technologies and the protections they do or do not provide and to use only tools that are appropriate in a particular context. Great care must be taken to install, configure, and use circumvention tools properly. Individuals associated with high-profile rights organizations, dissident, protest, or reform groups should take extra precautions to protect their online identities. [4]
Circumvention sites and tools should be provided and operated by trusted third parties located outside the censoring jurisdiction that do not collect identities and other personal information. Trusted family and friends personally known to the circumventor are best, but when family and friends are not available, sites and tools provided by individuals or organizations that are only known by their reputations or through the recommendations and endorsement of others may need to be used. Commercial circumvention services may provide anonymity while surfing the Internet, but could be compelled by law to make their records and users' personal information available to law enforcement. [4]
There are five general types of Internet censorship circumvention software:
CGI proxies use a script running on a web server to perform the proxying function. A CGI proxy client sends the requested url embedded within the data portion of an HTTP request to the CGI proxy server. The CGI proxy server pulls the ultimate destination information from the data embedded in the HTTP request, sends out its own HTTP request to the ultimate destination, and then returns the result to the proxy client. A CGI proxy tool's security can be trusted as far as the operator of the proxy server can be trusted. CGI proxy tools require no manual configuration of the browser or client software installation, but they do require that the user use an alternative, potentially confusing browser interface within the existing browser.
HTTP proxies send HTTP requests through an intermediate proxying server. A client connecting through a HTTP proxy sends exactly the same HTTP request to the proxy as it would send to the destination server unproxied. The HTTP proxy parses the HTTP request; sends its own HTTP request to the ultimate destination server; and then returns the response back to the proxy client. An HTTP proxy tool's security can be trusted as far as the operator of the proxy server can be trusted. HTTP proxy tools require either manual configuration of the browser or client side software that can configure the browser for the user. Once configured, an HTTP proxy tool allows the user transparently to use his normal browser interface.
Application proxies are similar to HTTP proxies, but support a wider range of online applications.
Peer-to-peer systems store content across a range of participating volunteer servers combined with technical techniques such as re-routing to reduce the amount of trust placed on volunteer servers or on social networks to establish trust relationships between server and client users. Peer-to-peer system can be trusted as far as the operators of the various servers can be trusted or to the extent that the architecture of the peer-to-peer system limits the amount of information available to any single server and the server operators can be trusted not to cooperate to combine the information they hold.
Re-routing systems send requests and responses through a series of proxying servers, encrypting the data again at each proxy, so that a given proxy knows at most either where the data came from or is going to, but not both. This decreases the amount of trust required of the individual proxy hosts.
Below is a list of different Internet censorship circumvention software:
Name | Type | Developer | Cost | Notes |
---|---|---|---|---|
alkasir [43] | HTTP proxy | Yemeni journalist Walid al-Saqaf | free | Uses 'split-tunneling' to only redirect to proxy servers when blocking is encountered. Is not a general circumvention solution and only allows access to certain blocked websites. In particular it does not allow access to blocked websites that contain pornography, nudity or similar adult content. |
Anonymizer [44] | HTTP proxy | Anonymizer, Inc. | paid | Transparently tunnels traffic through Anonymizer. |
CGIProxy [45] | HTTP proxy | James Marshall | free | Turns a computer into a personal, encrypted proxy server capable of retrieving and displaying web pages to users of the server. CGIProxy is the engine used by many other circumvention systems. |
Flash proxy [46] | HTTP proxy | Stanford University | free | Uses ephemeral browser-based proxy relays to connect to the Tor network. |
Freegate [47] | HTTP proxy | Dynamic Internet Technology, Inc. | free | Uses a range of open proxies to access blocked web sites via DIT's DynaWeb anti-censorship network. |
Hyphanet [48] (originally Freenet) | peer-to-peer | Ian Clarke | free | A decentralized, distributed data store using contributed bandwidth and storage space of member computers to provide strong anonymity protection. |
I2P [49] (originally Invisible Internet Project) | re-routing | I2P Project | free | Uses a pseudonymous overlay network to allow anonymous web browsing, chatting, file transfers, amongst other features. |
Java Anon Proxy [50] (also known as JAP or JonDonym) | re-routing (fixed) | Jondos GmbH | free or paid | Uses the underlying anonymity service AN.ON to allow browsing with revocable pseudonymity. Originally developed as part of a project of the Technische Universität Dresden, the Universität Regensburg, and the Privacy Commissioner of Schleswig-Holstein. |
Psiphon [51] [52] | CGI proxy | Psiphon, Inc. | free | A simple-to-administer, open-source Internet censorship circumvention system in wide-scale use, with a cloud-based infrastructure serving millions. |
Proxify [53] | HTTP proxy | UpsideOut, Inc. | free or paid | An encrypted, public, web-based circumvention system. Because the site is public, it is blocked in many countries and by most filtering applications. |
StupidCensorship [54] | HTTP proxy | Peacefire | free | An encrypted, public, web-based circumvention system. Because the site is public, it is blocked in many countries and by most filtering applications. mousematrix.com is a similar site based on the same software. |
Tor [55] | re-routing (randomized) | The Tor Project | free | Wikinews has related news: |
Ultrasurf [56] | HTTP proxy | Ultrareach Internet Corporation | free | Anti-censorship product that allows users in countries with heavy internet censorship to protect their internet privacy and security. |
An Internet filter is software that restricts or controls the content an Internet user is capable to access, especially when utilized to restrict material delivered over the Internet via the Web, Email, or other means. Such restrictions can be applied at various levels: a government can attempt to apply them nationwide, or they can, for example, be applied by an Internet service provider to its clients, by an employer to its personnel, by a school to its students, by a library to its visitors, by a parent to a child's computer, or by an individual user to their own computers. The motive is often to prevent access to content which the computer's owner(s) or other authorities may consider objectionable. When imposed without the consent of the user, content control can be characterised as a form of internet censorship. Some filter software includes time control functions that empowers parents to set the amount of time that child may spend accessing the Internet or playing games or other computer activities.
In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. It improves privacy, security, and possibly performance in the process.
China censors both the publishing and viewing of online material. Many controversial events are censored from news coverage, preventing many Chinese citizens from knowing about the actions of their government, and severely restricting freedom of the press. China's censorship includes the complete blockage of various websites, apps, and video games, inspiring the policy's nickname, the Great Firewall of China, which blocks websites. Methods used to block websites and pages include DNS spoofing, blocking access to IP addresses, analyzing and filtering URLs, packet inspection, and resetting connections.
Privoxy is a free non-caching web proxy with filtering capabilities for enhancing privacy, manipulating cookies and modifying web page data and HTTP headers before the page is rendered by the browser. Privoxy is a "privacy enhancing proxy", filtering web pages and removing advertisements. Privoxy can be customized by users, for both stand-alone systems and multi-user networks. Privoxy can be chained to other proxies and is frequently used in combination with Squid among others and can be used to bypass Internet censorship.
IP address blocking or IP banning is a configuration of a network service that blocks requests from hosts with certain IP addresses. IP address blocking is commonly used to protect against brute force attacks and to prevent access by a disruptive address. It can also be used to restrict access to or from a particular geographic area; for example, syndicating content to a specific region through the use of Internet geolocation.
The Great Firewall is the combination of legislative actions and technologies enforced by the People's Republic of China to regulate the Internet domestically. Its role in internet censorship in China is to block access to selected foreign websites and to slow down cross-border internet traffic. The Great Firewall operates by checking transmission control protocol (TCP) packets for keywords or sensitive words. If the keywords or sensitive words appear in the TCP packets, access will be closed. If one link is closed, more links from the same machine will be blocked by the Great Firewall. The effect includes: limiting access to foreign information sources, blocking foreign internet tools and mobile apps, and requiring foreign companies to adapt to domestic regulations.
A darknet or dark net is an overlay network within the Internet that can only be accessed with specific software, configurations, or authorization, and often uses a unique customized communication protocol. Two typical darknet types are social networks, and anonymity proxy networks such as Tor via an anonymized series of connections.
Parental controls are features which may be included in digital television services, computers and video games, mobile devices and software that allow parents to restrict the access of content to their children. These controls were created to assist parents in their ability to restrict certain content viewable by their children. This may be content they deem inappropriate for their age, maturity level or feel is aimed more at an adult audience. Parental controls fall into roughly four categories: content filters, which limit access to age inappropriate content; usage controls, which constrain the usage of these devices such as placing time-limits on usage or forbidding certain types of usage; computer usage management tools, which enforces the use of certain software; and monitoring, which can track location and activity when using the devices.
Psiphon is a free and open-source Internet censorship circumvention tool that uses a combination of secure communication and obfuscation technologies, such as a VPN, SSH, and a Web proxy. Psiphon is a centrally managed and geographically diverse network of thousands of proxy servers, using a performance-oriented, single- and multi-hop routing architecture.
Freegate is a software application developed by Dynamic Internet Technology (DIT) that enables internet users to view websites blocked by their governments. The program takes advantage of a range of proxy servers called Dynaweb. This allows users to bypass Internet firewalls that block web sites by using DIT's Peer-to-peer (P2P)-like proxy network system. FreeGate's anti-censorship capability is further enhanced by a new, unique encryption and compression algorithm in the versions of 6.33 and above. Dynamic Internet Technology estimates Freegate had 200,000 users in 2004. The maintainer and CEO of DIT is Bill Xia.
Internet censorship is the legal control or suppression of what can be accessed, published, or viewed on the Internet. Censorship is most often applied to specific internet domains but exceptionally may extend to all Internet resources located outside the jurisdiction of the censoring state. Internet censorship may also put restrictions on what information can be made internet accessible. Organizations providing internet access – such as schools and libraries – may choose to preclude access to material that they consider undesirable, offensive, age-inappropriate or even illegal, and regard this as ethical behavior rather than censorship. Individuals and organizations may engage in self-censorship of material they publish, for moral, religious, or business reasons, to conform to societal norms, political views, due to intimidation, or out of fear of legal or other consequences.
Tor is a free overlay network for enabling anonymous communication. Built on free and open-source software and more than seven thousand volunteer-operated relays worldwide, users can have their Internet traffic routed via a random path through the network.
UltraSurf is a closed-source freeware Internet censorship circumvention product created by UltraReach Internet Corporation. The software bypasses Internet censorship and firewalls using an HTTP proxy server, and employs encryption protocols for privacy.
Flash proxy is a pluggable transport and proxy which runs in a web browser. Flash proxies are an Internet censorship circumvention tool which enables users to connect to the Tor anonymity network via a plethora of ephemeral browser-based proxy relays. The essential idea is that the IP addresses contingently used are changed faster than a censoring agency can detect, track, and block them. The Tor traffic is wrapped in a WebSocket format and disguised with an XOR cipher.
Hotspot Shield is a public VPN service operated by AnchorFree, Inc. Hotspot Shield was used to bypass government censorship during the Arab Spring protests in Egypt, Tunisia, and Libya.
Lantern is a free and open source internet censorship circumvention tool that operates in some of the most extreme censorship environments, such as China, Iran, and Russia. It was used by millions of Iranians during the Woman, Life, Freedom protests in Iran in 2022 and again during the surge in censorship in Russia following the Russian invasion of the Ukraine. Lantern uses a wide variety of protocols and techniques that obfuscate network traffic and/or co-mingle traffic with protocols censors are reluctant to block, often hiding in protocols such as TLS. It also uses domain fronting. It is not an anonymity tool like Tor.
Internet censorship in Switzerland is regulated by the Federal Supreme Court of Switzerland on a case by case basis. Internet services provided by the registered with BAKOM Internet service providers (ISPs) are subject to a "voluntary recommendation" by the Federal Supreme Court of Switzerland, which requires blocking of websites just after 18 December 2007. As of October 2015, this might change soon and additional topics like Online gambling are on the focus now.
Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than that which is discernable to third parties monitoring the requests and connections.
A virtual private network (VPN) service provides a proxy server to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against data profiling or MitM attacks on hostile networks.
Snowflake is a software package for assisting others in circumventing internet censorship by relaying data requests. Snowflake proxy nodes are meant to be created by people in countries where Tor and Snowflake are not blocked. People under censorship then use a Snowflake client, packaged with the Tor Browser or Onion Browser, to access the Tor network, using Snowflake relays as proxy servers. Access to the Tor network can in turn give access to other blocked services. A Snowflake proxy can be created by either installing a browser extension, installing a stand-alone program, or browsing a webpage with an embedded Snowflake proxy. The proxy runs whenever the browser or program is connected to the internet.