How to build a "great firewall of China" -- do it poorly
Submitted by brad on Thu, 2006-02-16 13:10I'm not in the business of helping countries be repressive, but I started thinking what I would do if I were the Chinese internet censor. I don't think I'm giving them any secrets, but these thoughts may affect our own plans on how to fight such censors.
The most important realization was that I wouldn't want to make my great firewall really strong. That it was not only easier, but possibly better, to make it possible to bypass it with a moderate amount of determination. Not trivial, as in "hold down the shift key" but not requiring cypherpunk level skills.
The reason is that if I allow such holes, I can watch who uses them, and watching them is more valuable to the secret police than plugging them. And if the holes don't require fancy data encryption and hiding techniques, most people seeking to bypass the firewall will do so unencrypted, making it far easier to watch what is done. But even if people encrypt, they do reveal who they are. So long as there are not immense numbers, that's enough to give me a good dissident watchlist.
My goal as censor would be to tune the filtering so that the true dissidents can all bypass it, but make it hard enough that I don't get so many people on my watchlist that I can't handle the size of it. The censors know they can't keep information from the truly determined, even in the most repressive regimes. They just need to keep it from the masses. (Even the masses will hear rumours in any society, but they will always just be rumours.)
This explains why many of the proxies people have put up to let people bypass the firewall remain themselves unblocked. This also can be explained by inefficiency of maintaining the block-list, but this time I am prepared to attribute something to malice rather than incompetence. Especially if the proxies are unencrypted I would not want to block them -- unless they go so popular that I could no longer track the users.
This is one of the problems with the Google China decision. In the past, use of the firewall-blocked google.com was not suspicious, though typing certain phrases into it may have been. Now, with censored google.cn, use of google.com suggests you are trying to get past the censorship at least. A big win for surveillance. Google is, wisely, not keeping logs in China, but that doesn't stop the international gateways from keeping the logs.
(Read on for some anti-censor techniques.)