Regional variation in Chinese internet filtering

Abstract

Internet filtering in China is a pervasive and well-reported phenomenon and, as arguably the most extensive filtering regime in the world today, has been studied by a number of authors. Existing studies, however, have considered both the filtering infrastructure and the nation itself as largely homogeneous in this respect. This article investigates variation in filtering across China through direct access to internet services across the country. This is achieved through use of the Domain Name Service (DNS), which provides a mapping between human-readable names and machine-routable internet addresses, and is thus a critical component of internet-based communications. Manipulation of DNS is a common mechanism used by states and institutions to hamper access to internet services that have been deemed undesirable. Our experiments support the hypothesis that, despite typically being considered a monolithic entity, the Chinese filtering approach is better understood as a decentralized and semi-privatized operation in which low-level filtering decisions are left to local authorities and organizations. This article provides a first step in understanding how filtering affects populations at a fine-grained level, and moves towards a more subtle understanding of internet filtering than those based on the broad criterion of nationality. The techniques employed in this work, while here applied to geographic criteria, provide an approach by which filtering can be analysed according to a range of social, economic and political factors in order to more fully understand the role that internet filtering plays in China, and around the world.

Keywords:

• surveillance/privacy
• censorship
• China

Notes on contriibutor

Joss Wright is a Research Fellow at the Oxford Internet Institute, University of Oxford, where his research focuses on the themes of privacy enhancing technologies and online censorship, both in the design and analysis of techniques and in their broader societal implications. He obtained his PhD in Computer Science from the University of York in 2008, where his work focused on the design and analysis of anonymous communication systems. [email: [email protected]]

Notes

1. The Herdict project does allow a user to express their opinion as to the cause of the blocking, but in the absence of direct experimentation this data has significant limitations.

2. Strictly speaking, DNS servers return the IP for a particular hostname, many of which may exist under a given domain name. For the purposes of this article, the two may be considered functionally equivalent as request were not made for multiple hosts within a single domain.

3. For completeness, it should be mentioned that DNS servers function in a hierarchy, and may request information for unknown domain names from more authoritative servers. This normal function of the service would not, however, implicate any third party, and would in fact be directly traceable to the computer used in our experiments.

4. In the case of the experiments detailed here, this was the UK. Whilst the UK certainly does engage in national-scale internet filtering, it does not, in general, involve this particular form of DNS manipulation, and care was taken that such filtering would not affect the results of these experiments.

5. Specifically, the first two-dotted quads of the IP addresses returned by the remote and the local DNS server were compared. If these differed, the response was marked as incorrect. Large internet services often make use of dedicated content distribution networks that employ a wider range of IP addresses. Experimental results were manually examined to detect any such networks, and any domains that resolved to these networks were assumed to be accurate responses. This automated approach does risk introducing both false positives and false negatives with respect to the existence of misleading DNS results, but this risk is relatively small and should not unduly skew the overall results.

6. DNS can, in fact, make use of TCP as a transport. The use of UDP, however, represents the overwhelming majority of DNS requests for reasons of speed and efficiency.