International Herald Tribune: China's 'Great Firewall' limits Internet

Thomas Crampton International Herald Tribune
Tuesday, October 1, 2002

HONG KONG Some Chinese Internet users are reporting more sophisticated and fine-tuned filtering of their browsing, searching and e-mailing recently, suggesting a newly refined and focused approach in the government's efforts to control Web content coming into and out of China.

Some of the recent restrictions include selective blocking of e-mail that mentions certain words, difficult access to foreign sites that use secure connections and continued interruption of search engines on particular topics, according to reports of Internet users in China and independent analysts elsewhere.

These restrictions are technically possible through software filters used at the level of Internet service providers and cybercafés, which in China are indirectly controlled by the government. Chinese Foreign Ministry officials contacted last week responded with denials of knowledge about any restrictions on Internet use.

Previously, Web users seeking access to Internet sites that the Chinese government did not approve would not be able to reach such addresses at all. Now, users have the impression that they can reach such sites, but certain content and functions remain off-limits. Users have also found that e-mail, which formerly passed into China uninhibited, may be blocked by firewalls.

The new levels of Internet monitoring and blocking can be done through enhanced 'packet filtering,' by which software installed on computer servers analyzes each bit and byte coming in and out to see if they meet certain programmed criteria.

'The Chinese government has started moving beyond the crude blocking of entire Web sites,' said Ben Edelman, a technology analyst who is researching the filters at the Berkman Center of Internet and Society at Harvard Law School. 'The government now appears to have started deploying a more focused and granular filtering system.'

These moves come in the politically sensitive period before the party congress in November that is set to determine the next generation of national leadership and as the Falun Gong spiritual movement continues its effort to broadcast [Falun Gong] messages into China. The extent and exact nature of the government's blocks on the Internet are difficult to determine and quantify. Some users complain of tighter Internet restrictions, others describe sporadic and geographically limited restrictions, while still others report no problems at all.

Conducting tests on dozens of networks in China, Edelman has found signs of such blocking systems at more than half of the sites tested. Working from Harvard, Edelman and his co-researcher connect to the Chinese network so as to simulate access as experienced by ordinary users in Beijing.

Edelman concedes on his Web site that while his tests conducted off-shore from Harvard indicate blocking is 'highly likely,' it is 'by no means conclusive.' He says the inaccessibility 'might be due to network congestion, routing problems or other non-filtering-related disruptions to connectivity.' [..]

An anecdotal survey of a dozen Internet users in Beijing and Shanghai finds people with a variety of surfing problems in recent days:

Difficulty accessing bank sites that use encryption to ensure privacy. Encryption has long been controversial in China, with even low-level encryption considered illegal. The purpose of blocking secure connections would presumably be to stop secret communication rather than study the contents of people's bank accounts.

'Blocks on encrypted communication go to the heart of China's Internet dilemma,' said Duncan Clark, managing director of Beijing-based BDA China, a telecommunications consulting firm. 'You cannot promote e-commerce while attempting to limit information flow on the Internet.'

The blocking of e-mail containing sensitive words. E-mail sent containing sensitive words such as 'Falun Gong,' for example, have been blocked from being downloaded. In some users' experience, all subsequent e-mail messages in their accounts remained blocked until the offending e-mail was deleted via a Web-based e-mail system. 'They appear to have implemented sophisticated keyword searching systems along with Internet filtering,' said Eric Ashdown, China head of Ernst Young's technology and security risk
practice. 'But effective e-mail blocking is very difficult to accomplish, as every recipient of spam e-mails can attest.'

More selective blocks on some Web sites. Visitors from China to the Web site of the BBC, formerly blocked in its entirety, can now reach soap-opera summaries for 'EastEnders' and 'Neighbours,' but nothing related to current events.

Searches now appear to be monitored. While the recent total block on the Google search engine appears to have eased, surfers have now experienced a disrupted Internet service after requesting searches on sensitive topics. Some speculate the restrictions on Google may have been eased because of lobbying by frustrated users in China's high-tech community.

'They have now set up penalty boxes reminiscent of kindergarten,' said Edelman, who is running a research project on government controls on the Internet. 'If you request a prohibited search - such as Falun Gong - they prohibit that search and then block your access to Google for an amount of time that can vary from five minutes up to an hour.'

Such penalty blocks are possible through commercially available monitoring software, according to James Gay, the Hong Kong-based director of information security service at Hill Associates. Users dialing onto an Internet service provider create a unique identity for each session that may be monitored. Controls and limits can be implemented on each user's session either automatically or through a system that warns the authorities to more
closely monitor specific individuals, Gay added.

'A national Internet system can be reduced to run like a firewalled and controlled network,' he said.

The secretive nature of Internet blocks makes it difficult to determine when, where and how such filters are put in place and nearly impossible to know where the software and expertise is coming from, Gay said.

'Once Internet service providers willingly collude, governments can easily monitor Web surfers in many ways,' Gay said.

'Also, don't forget that an Internet connection runs both ways, so a government could even use the Internet to look inside your computer to figure out which Web sites you had visited by checking the 'cookies' deposited in your computer from visits to other Web sites.'

Foreign companies have in the past, however, shown a willingness to comply with limitations Beijing placed over the Internet. The Internet portal Yahoo, for example, was criticized by Human Rights Watch for signing a pledge not to post information on its Chinese version that would 'jeopardize state security and disrupt social stability' in China.

Technically, China's Internet filtering may be accomplished on a national scale by using methods similar to anti-pornography software filters on employees using an office network, Ashdown said.

Websense is one of the most popular software package for filtering, managing, analyzing and reporting on individual employee use in the United States, but Ashdown said a similar program called Visionnext has lately proved popular among Chinese language network managers. By relying on full cooperation from Internet service providers, the Chinese government can adapt such anti-porn filtering systems to inhibit information that the government does not want spread.

'Every Internet service provider in China must comply with a government-mandated filtering system in order to stay in business,' Ashdown said. 'The filtering is now getting more sophisticated, but, like all attempts to control the Internet, newer technologies will eventually defeat it.'

http://www.iht.com/cgi-bin/generic.cgi?template=articleprint.
tmplh&ArticleId=72279