Censorship in the Wild: Analyzing Internet Filtering in Syria

Select |




Print


Chaabane, Abdelberi; Chen, Terence; Cunche, Mathieu; DeCristofaro, Emiliano; Friedman, Arik; Kaafar, Dali


2014-11-05


Conference Material


The 2014 Internet Measurement Conference (IMC)


Vancouver, BC, Canada


285-298


Over the past few years, several governments worldwide have put in place Internet censorship programs. Due to the lack of publicly available information, as well as the inherent risks of performing active measurements, it is often hard for the research community to analyze censorship practices. Therefore, the leak of 600GB worth of logs from 7 Blue Coat SG-9000 proxies deployed by Syrian authorities to monitor, filter, and cache Internet traffic, at a country scale represents a unique opportunity to provide a detailed snapshot of a real-world censorship ecosystem. This paper presents the methodology and the results of a measurement-based analysis of the Blue Coat logs. Our study uncovers a relatively stealthy, yet quite targeted, censorship. Traffic is filtered in several ways: using IP addresses and domain names to block subnets or websites, and keywords or categories to target specific content. We show that keyword-based censorship (e.g., denying all requests containing the word ‘proxy’) produces some collateral damage as many requests are blocked even if they do not relate to sensitive content. We also find out that Instant Messaging is heavily censored, while filtering of social media is limited to specific pages. Finally, we show that Syrian users try to evade censorship by using web/socks proxies, Tor, VPNs, and BitTorrent. To the best of our knowledge, our work provides the first analytical look into Internet filtering in Syria.


censorship, measurement


http://conferences2.sigcomm.org/imc/2014/


nicta:8086


Chaabane, Abdelberi; Chen, Terence; Cunche, Mathieu; DeCristofaro, Emiliano; Friedman, Arik; Kaafar, Dali. Censorship in the Wild: Analyzing Internet Filtering in Syria.[Conference Material]. 2014-11-05. <a href="http://hdl.handle.net/102.100.100/93784?index=1" target="_blank">http://hdl.handle.net/102.100.100/93784?index=1</a>



Loading citation data...

Citation counts
(Requires subscription to view)