Censored Planet: a Global Censorship Observatory
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Ensafi, Roya
Six years ago the idea behind CensoredPlanet started, that is now launched at censoredplanet.org. We had a simple (yet essential) guiding principle: measurements that may be politically sensitive should be done without volunteer participation. In this talk, besides a detailed scientific overview of the techniques and the current state of CensoredPlanet, I plan to talk about my experience in developing the project from the ground up. Despite the pervasive nature of Internet censorship and the continuous evolution of how and where censorship is applied, measurements of censorship remain comparatively sparse. Current censorship projects, including OONI, depend on participants within countries to help them collect measurements. While these projects are valuable, we have empirically seen that there are issues relating to continuity in terms of measurement, coverage of the geographical area, and ethical dilemmas when user participation is a requirement. Censored Planet use tens of thousands of *remote infrastructural and organizational vantage points* from over 170 countries to conduct it’s measurements, thereby removing the need for user participation. This allows us to regularly measure Internet disruptions over a longer period of time in significantly more countries in a safer way. The research we conduct at Censored Planet provides unique insights and data points on Internet disruptions. This information is extremely valuable to researchers in diverse fields from political science to computer science as well as to activists and journalists living and operating in countries where Internet disruptions are prevalent. By making our data easily accessible to the public, we aim to encourage future research in the field.
 Alright, it's my very big pleasure to introduce Roya and Safi to you. She's going to talk about the sensor planet, a global sensor ship observatory. I'm personally very interested in learning more about this project. Sounds like it's going to be very important. So please welcome Roya with a huge warm round of applause. Thank you. It's wonderful to finally make it to CCC. I've had joint talk with multiple of my friends over the past years and the visa stuff never worked out. This year I applied for a conference in August and the visa worked for coming to CCC. My name is Roya and Safi and I'm a professor at the University of Michigan. My research focuses on security and privacy with the goal of protecting users from adversarial network. So basically I investigate network interference. And somebody is interfering right now. In it. Cool. I'm good. Oh no, I'm not. Okay, in my lab we develop techniques and systems to be able to detect network interference often at a scale and apply these frameworks and tools to be able to understand the behaviors of these actors that do the interference and use this understanding to be able to come up with a defense. Today I'm going to talk about a project that is very dear to my heart, the one that I spent six years working on it. And in this talk I'm going to talk about censorship, inter-censorship and by that I mean any action that prevents users access to the requested content. We have heard an alarming level of censorship happening all around the world. And while it was previously multiple countries that were capable of using the packet inspections to tamper with user traffic, thanks to commercialization of these DPI's, now many countries are actually messing with users' data. For the first time that the users type CNN.com in their browsers, their traffic is subject to some level of interference by different actors. First for example, the DNS query where the mapping between the domain and the IP where the content is can be manipulated. For example, the DNS answers can be a dead IP where the content is not there. If the DNS succeeds, then the users and the servers are going to establish a connection, TCP handshake, and that can be easily blocked. If that succeeds, then users and servers start actually sending back and forth the actual data. And there are enough to clear text, be it the traffic encrypted or not, that the DPI can detect a sensitive keyboard and send a reset package to both basically shut down the connections. Before I forgot, let me tell you and emphasize that it's not just the governments and the policies that are imposed on the ISPs that lead to censorship. Actually server side, which provides the data, are also blocking users, especially if they are located in a region that they don't provide any revenue. We recently investigated this issue of dual blocking in DIP and provide more details about what role FDNs actually provide. Imagine now we have how many users, how many ISPs, how many transit networks, and how many websites, each of which are going to have their own policies of how to block users' access. More censorship changes from time to time, region to region, country to country. For that reason, many researchers, including me, have been interested in collecting data about censorship in a global way and continuously. Well, I grew up under civil censorship, be it the university, the government, more frustrating the server side. And I genuinely believe that censorship takes away opportunities and degrade human dignity. And it's not just China, Bahrain, Turkey that does internet censorship. Actually with the DPI, it's become cheaper and cheaper. Many governments are following their leads. As a result, internet is becoming more and more balcony-ized. And the users around the world are going to soon have very, very different pictures of what is internet is. And we need to be able to collect the data, to be able to know what is being censored, how it's being censored, where it's being censored, and for how long. This data can be used to bring transparency and accountability to governments or private companies that practice internet censorship. It can help us to know where the circumvention to where the defense needs to be deployed. It can help us to let the users around the world to know what their governments are up to. And more important, provide the valid and good data for the policymakers to come up with the good policies. Existing research already shows that if we can provide this data to users, they act by their own will to ensure internet freedom. For many years, my goal has been to come up with a better map, a censorship better map, where we can actually see changes in censorship over time, how some countries are different from others, and do that for a continuous duration of time and for all over the world. Creating such a map wasn't possible with the techniques, internet measurement methods that we had at the time. At the time, and even the common techniques we now use, the measurement methods to be able to use for measuring internet censorship is often by deploying a software or giving a customized Raspberry Pi to either a client or a server, and based on that, measure what's happening between client and servers. Well, this approach has a lot of limitation. For example, there are not that many volunteers around the world that are eager to download a software and run it. Second, the data collected from this approach are often not continuous, because the user's connection can die for a variety of reasons, or users might lose interest to keep running the software. And therefore, we end up with sparse data where we cannot have a good baseline for internet censorship studies. More measuring domains that are sensitive often create risks for the local collaborators and might end up with their government's retaliation. These risks are not hypothetical. When Arab Spring was happening, I was approached by many colleagues to recruit local friends and colleagues in Middle East to be able to collect measurement data at the time that was very interesting to capture the behavior of the network, and most dangerous for the locals, ambulanters, to collect that. My painting actually experts what I felt at the time. I can't just imagine asking people on the ground to help at these times of unrest. In my opinion, conspiring to collect the data against the government's interest can be seen as an act of treason, and these governments are unpredictable often. So it's exposed these volunteers to a severe risk. While no one has yet been arrested because of measuring interest in censorship, as far as we know, and I don't know how we can know that in a global scale, I think the clouds are on the horizon. I'm still at all how Turkish government used their surveillance data at a time of co-op and tracked down and detained hundreds of users because there was a traffic between them and by lock a messenger app that was used by co-op administrators. These things happen. Here I continue. If you know UNI, you might ask how UNI prevent risk? Well with a great level of efforts. And if you don't know UNI, UNI is a global community of volunteers that collected about censorship around the world. Well first and foremost, they provide their volunteers with a very honest consent, telling them that hey, if you run this software, anybody who is monitoring your traffic, know what you're up to. They also go out of their way to give freedom to these volunteers to choose what website they want to run, what data they want to push. They establish a great relationship with the local activist organization in the countries. Well now that I've proved to you guys that I am a supporter of UNI and I'm actually a friend with most of them, I want to emphasize that I still believe that consistent and continuous and global data about censorship requires a new approach that doesn't need volunteers help. I become obsessed with solving this problem. What if we could measure whether a client in anywhere around the world can talk to a server without being close to a client, somewhere from here, from University of Michigan, and see whether the two hosts can talk to each other globally and remotely off the path. When I talk to the people about this, honestly, everybody was like you don't know what you're talking about. It's really, really challenging. Well they were right, the challenge is there, and I'm going to walk you through it. We have at least 140 IP addresses that respond to the same packet. This means they speak to the world. And they follow blindly TCP IP protocol. So the question becomes how can I leverage these subtle properties of TCP IP to be able to detect the two hosts can talk to each other? Well, a spooky scan is a technique that JetKorea and from University of New Mexico and I developed that uses TCP IP side channels to be able to detect whether the two remote hosts can establish a TCP handshake or not. And if not, in which direction the packets are being dropped off the path and remotely. And I'm going to start telling you how this works. First I have to cover some background. So any connection that is based on TCP, one of the basic communication protocol we have is it needs to establish a TCP handshake. So basically you send a sync and in the packet you send in the IP header you have a field called identification. And this field is used for fragmentation reason. And I'm going to use this field a lot in the rest of the talk. After the user received a scene, it's going to send a sync back. Have another IP ID in it. And then if I want to establish a connection, I send a reset. Most of the protocol says that if you send a sync packet to a machine with the port open or closed, it's going to send you a reset telling you what the heck you're sending me a sync. I didn't send you a sync. And another part is if you send a sync packet to a machine with the port open, it will send you a sync. If you don't do anything, because TCP IP is reliable, it's going to send you multiple sync. It depends on operating system 3, 5, you name it. As bookies can require some basic characteristics. For example, the client, the vantage points that we are interested should maintain a global variable for the IP ID. It means that when they receive a packet and they want to send a packet out, no matter who they are sending the packet to, this IP ID is going to be a shared resource. So by just watching the IP ID changes, you can see how much a machine is noisy, how much a machine is sending traffic out. A server should have a port open, let's say 80 for Fortary, and wants to establish a connection. And the measurement machine, me, should be able to spoof packets. It means sending packet with the source IP different from my own machine. To be able to do that, we need to talk to upstream network and ask them not to drop the packets. All of these requirements, I could easily satisfy with a little bit of efforts. As bookies can start, with measurement machine, send a sync packet to one of these clients with the global IP ID at a time, let's say the value is 7,000. The client is going to send back a reset following the protocol, revealing to me what's the value of IP ID. In the next step, I'm going to send a spoof sync packet to a server using a client IP as a result. The CNAQ is going to send to the client. Again, client is going to send a reset back. The IP ID is going to be increment by one. If I'm a query IP ID, I'm going to see a jump to. In a noiseless model, I know that this machine talked to the server. If I query it again, I won't see any jump. So delta 2, delta 1. Now imagine there is a firewall that blocked the CNAQs going from the server to the client. Well, it doesn't matter how much of the traffic I send. It's not going to get there. It's not going to get there. So the delta I see is 1-1. In the third case, when the packets are going to be dropped from the client to the server, well, my CNAQ gets there. The CNAQ gets to the client. The client is going to send a reset back, but it's not going to get to the server. So server thinks that the packet got dropped. So it's going to send multiple CNAQs, and as a result, the reset is going to be plus plus more. And so what jump I would see is, let's say, 2-2. Let me put them all together. So you have three cases blocking in this direction, no blocking and blocking in the other. And you see different jumps or different deltas. So it's detectable. Yes, yes, in a noiseless model. I know the clients talk to so many others, and the IPID is going to be changed because of a variety of reasons. I call all of those noise, and this is how we are going to deal with it. Well, in 2-2, we can amplify the signal. We can actually, instead of sending one spoofing packet, we can send n. And for a variety of reasons, packets can get dropped. So we need to repeat this measurement. So here is some data from a Spooky scan of where I used the following probing method. For 30 seconds, I send a query for IPID. And then for another 30 seconds, I send us five spoofing packets. This is machines or clients in Azerbaijan, China, and United States. And we wanted to check whether it's rich, tall relay that we had in Sweden. You can see there are different jump or different level shifts that you observe in a second phase. And just visually looking at it or using auto regressive moving average or ARMA, you can actually detect that. But there is an insight here, which is that not all the clients have the same level of noise, and for some of them, especially these guys, you could easily detect after five level of sending IPID query and then five seconds of spoofing. So in the follow-up work, we try to use this insight to be able to come up with a scalable and efficient technique to be able to use it in a global way. And that technique is called AUGAR. Well AUGAR adopts this probing method. First for four seconds, it queries IPID. Then in one second, send 10 spoofing packets. Then look at the IPID acceleration or second derivative and see whether we see a jump, a sudden jump, at the time of perturbation when we did the spoofing. How confident we are that that jump is the result of our own spoof packet. Well, I'm not confident. Run it again. I think so. Run it again until you have sufficient confidence. It turns out there is a statistical analysis called sequential hypothesis testing that can be used to be able to gradually improve our confidence about the case we are detecting. So I'm going to give you a very, very rough overview of how this works. But for sequential hypothesis testing, we need to define a random variable. And we use IPID acceleration at the time of perturbation being one or zero based on, you see, jump or not. We also need to calculate some empirical priors, known probabilities. If you look at everything, what would be the probability that you see a jump when there is actually no blocking and so on? After we've put all this together, then we can formalize an algorithm starting by run a trial, update the sequence of values for the random variables, then check whether the sequence of values belong to the distribution of where the blocking happens or not. What's the likelihood of that? If you're confident, if you reach to a level that you are satisfied, then we call it a case. So putting all this together, this is how other works. We scan the whole IPv4, find global IPID machines, and then we have some constraint that is it a stable machine? Is it a noisier or have a noise that we want to deal with? We also need to figure out what website are we interested to test reachability towards them. What countries we are. So after we decide all the input, then we run a scheduler, making sure that new client and server are under the measurement in the same time because they mess each other's detection. And then we actually use our analysis to be able to call the case and summarize the results. I started by saying that the common methods have this limitation, for example, coverage, continuity, and ethics. When it comes to coverage, there are more than 22 million global IPID machines. These are the nodes of pre-dississert, and previous these, for example. Similar to the previous board, one successful project is a right path less, and they have around 10,000 probes globally deployed. When it comes to continuity, we don't depend on end user, so it's much more reliable to use this. Well, by not asking volunteers to help, we were already reducing the risk because there is no users conspiring against their governments to collect this data. But our approach is not also zero risk. If you look, you have a different kind of risk here. The client and server is exchanging SINAC and reset without each of them giving a consent. And we don't want to ask for a consent because if you do, the dilemma exists. We have to go back and it's just the same that's asking volunteers. So to deal with that and copy that, to reduce the risk more, we don't use end IPs. We actually use two hop-back routers, which are infrastructure machines, and use those as a vantage point. Even with this harsh constraint, we still have 53,000 global IP ID routers. To see if it works, we chose 2,000 of these global IP ID machines, uniformly selected from all the countries we had vantage point. We selected websites from citizen lab test list. This is the research organization in Toronto universities where they crowd source a website that are potentially being blocked or potentially sensitive. And then we use thousands of the websites from Alexle, top 10k. And then we get the auger running for 17 days and collect this data. One of the challenges that we have to validate the auger was like, so what is the truth? What is the ground truth? What would we see that makes sense? This is the biggest and fundamental challenge for internet censorship anyway. But so the first approach is leaning on intuition, which is like no client should show blocking towards all the websites. No server should show blocking for bulk of our clients. And if anything happens like that, we just trash it. We should see more bias towards the sensitive domain versus the ones that are popular. And so on. And also, we hope to replicate the anecdotes, the reports out there. And we did all of those. And that's how we validate auger. So at the end, auger is a system that is scalable and efficient, ethical, and can be used to detect TCPIP blocking continuously. Yes, I know. That's just TCPIP. What about the other layers? Can we measure them remotely as well? Well, let me focus on the DNS. You might ask, is there a way that we can remotely detect DNS poisoning or manipulation? Well, let's think it out loud. From now on, I'm going to give just a highlight of the papers we work for the lack of the time. Well, if we scan the whole IPv4, we have a lot of open DNS resolvers, which means that they are open to anybody sending a query to them to resolve. And these open DNS resolvers can be used as a vantage point. We can use open DNS resolvers in different ISPs around the world to see whether that DNS queries are poisoned or not. Well, wait. We need to make sure that they don't belong to the end user. So we come up with a lot of checks to make sure that these open DNS resolvers are organizational, belong to the ISP or infrastructure. After we do that, then we start sending all our queries to these, let's say, open DNS resolvers in ISP in Bahrain for all the domain we are interested and capture what we receive, what IPs we receive. The challenge is then to detect what is the wrong answer. And so we have to come up with a lot of heuristics, a set of heuristics. For example, the response that we received, is that equal to a reply we got from our control measurements where we know the IP is not blocked or poisoned or something, the contents is there. Or we can actually look at the IP that we received and see whether it has a valid HTTP cert with or without SNI or server name identification or something. And so on so forth. So we come up with lots of heuristics to detect the wrong answers. The results of all these efforts ended up being a project called Satellite, which was started by Willa Scott, I'm sure he's in the audience somewhere, a great friend of mine, a very good supporter of sensor planet. He has been a miracle that I had an opportunity and fortunate to met him. We have satellite. And satellite automate the whole steps that I told you. For this work, we use science that developed in both of the work. We call it satellite because of seniority and it's sticking with the name. So how much coverage satellite has? If you scan the IP before you end up with 4.2 million of Pandianus resolvers in every country and their territories. We actually need to make sure there are ethical for that reason. If you put a harsh condition, we say that let's only use the ones that their valid PTR record follow this expression. Basically let's just use the open DNS resolvers that are name servers or at least their PTR record suggests that. This is really harsh constraint. Actually my students have been adding more and more regular expression for the ones that we are sure they are organizational. But for now, just being this harsh, we have 40K of NDS resolvers in almost 169 countries, I guess. So censorship happened in other layer as well. How do we deal with that remote channel? With the remote side channel? And especially what about HTTP traffic or disruption that can happen in the TLS center? I hate water. Oh, no. Okay. So it's well documented that many DPIs, especially in great furrows, China, monitor the traffic and then they see a key word, a sensitive key word like Falun Gong, the act and the drop traffic or send a reset. And as I mentioned earlier, there were enough clear text everywhere. And in TLS, I guess, and I is in clear text. And for a long time, I was trying to come up with the way of detecting application layer using this fancy side channel. Like how can I detect that when the client and server need to first establish a TCP handshake? How the side channel can jump in and then detect the rest? We were lucky enough that the end pointed to a protocol called ECHO. It's a protocol designed on 1983 and it's for testing reasons. For the debugging tool, basically. It's a predecessor to PING. And basically, after you establish a TCP handshake to port seven, whatever you send the ECHO servers on port seven, it's going to echo it back. Now think about it. How we can use ECHO servers to be able to detect application layer blocking? Well, when it's not, let's say I have an ECHO server in the US and measure my machine in the University of Michigan, I establish a TCP handshake and I send a GET request to using a sensor keyboard, for example. It's going to get back to me the same thing I sent. But now, let's put the DPI that is going to be triggered by it. Well, for sure, either I'm going to receive a reset first or something else. So we can actually come up with the algorithm to be able to use the ECHO servers to detect disruptions on application layer. Basically keyboard blocking, URL blocking. Results of this is a tool called Quack. And Quack actually use ECHO servers to be able to detect in a scalable way and safely better the keywords are being blocked around the world. So what did we do is first scan the whole IPv4. We find 47K ECHO servers running around the world. Then we need to be able to check whether they are not belong to the end users. And that was a very challenging part because there is not a clear signal. As it's, there are 90% of them are infrastructure, but there is still some portion of them that we don't know. So what we do is we look at the freedom of house reports and the countries that are partially open or not open. Not free or partially free, what they call. This is around 50 countries. And for those, we randomly select some that we want and we use OS detection of NMAP. And if you give us back, it's a server, it's a switch, and so on, we use those. So with the help of so many collaborators, after almost six years, we end up with three systems that can capture to CBI people locking, DNS, and application layer blocking using infrastructure and organizational machines. So while it was a dream or a vision that we can come up with a better map to collect this data in a continuous way, thanks to the help of a lot of people, especially my students, Will and other collaborators, we now have sensor planet. Sensor planet collects semi-weekly snapshots of internal censorship using advantage point in order to all the layers and provide this data in a raw format now in our website. We also provide some visualization way for people to be able to see how many advantage when we have in each country and so on. Of course, this is the beginning of sensor planet. We launched this at August and we have been collecting data for almost four months and we have a long way to go. We have users right now through organizations using our data and helping us debug by finding things that doesn't make sense pointing to us. And any of you that ended up using this data, please share your feedback with us and we are very responsive to be able to change it. Not as much as Zuni. We have a collective of very well-dedicated people participating. So now that we have the sensor planet, let me give you how it can help when there is a political situation going on. You all must remember around October, very jamal, Koshogi, Washington Post report there disappeared, killed at the Saudi Arabia embassy in Turkey. At the time of this happening, there was a lot of media attention and this news, especially two weeks in, become very internationally spread. Since the planet didn't know this event was going to happen, so we have been collecting this data semi-vehicle for 2000 domain or so. And so we went back and we checked the Saudi Arabia. Did we see anything interesting? And yes, we saw, for example, at two weeks in, around October 16, the domains that we were, that was reuse category and media category, the censorship related to those doubled. And let me emphasize. We didn't see like a block and not block over the whole country. Not all the countries have a homogeneous censorship happening. We saw it in multiple of the ISPs that we had vantage point. Actually I freaked out when one of the activists in Saudi Arabia told us that, I don't see this. And we said, what ISP, what ISP were in? And this wasn't the ISPs that we had vantage point in. So we were looking for hints that, is there anybody else seeing what we were seeing? And so we ended up seeing there is a command lab project that also saw around October 16, the number of malwares or whatever they're testing is also doubled or tripled. I don't know the other. So something was going on two weeks in when the news broke. Let me emphasize this news media that I'm talking about or the global news media that we checked like LA Times, Fox News and so on. But we also checked Arab news, which is, as the activists told us, is a Saudi Arabia's propaganda newspaper. That's in one of the ISPs was being poisoned. So again, censorship is a very complex problem. So where are we heading? Well, having said that about side channels and the techniques that help us to collect this data, I have to also say that the data we collect doesn't replicate the picture of the internet censorship. I mean, having a root access on a volunteer's machine to do a detailed test is powerful. So in the next step, in the next year, one of our goal is to join force with ONI to integrate the data from remote and basically local measurements to provide the best of the world's worlds. Also we have been thinking a lot about what would be a good visualization tools that doesn't end up to misrepresent internet censorship. I literally hate that one. Hate it. The number of vantage points in countries are not equal. We don't know whether all the vantage points that the data is resulted from it is from one ISP or all over the ISP. And then with test domains that are like benign, like I don't know, it defined based on some western values of the freedom of expression. I believe in all of them, but still, culture economy might play some things red. And then we put colors on the map, ranked the countries, called some countries awful and not giving a full attention to the others. So something needs to be changed. And it seems a horizon to think about it more deeper. We want to be able to have more statistic tools to be able to spot when the patterns are changed. We want to be able to compare the countries, then for example, telegram was being blocked at Russia, if you remember, millions of IPs being blocked. If you don't know, go to my friends, Lenny talk about Russia. You're going to learn a lot there. But anyway, so when the Russia was blocking telegram, I said to everyone, I bet in the following some other governments are going to jump to block telegram as well. And that's actually what we heard, rumors like that. So we need to be able to do that automatically. And overall, I want to be able to develop an empirical science of Internet censorship based on a rich data with the help of all of you. Sensor planet is now being maintained by a group of dedicated students, a great friend that I have, and needs engineers, political scientists to jump on our data and help us to bring meaning to what we are collecting. So if you are a good engineer or a political scientist or a dedicated person who wants to change the world, reach out to me. For those of you interested, these are the publications that my talk was based on. And now I'm open to questions. All right, perfect. Thank you so much for your so far. We have some time for questions. So if you have a question in the room, please go to one of the room microphones, one, two, three, four, and five in the very back. And if you're watching the stream, you can ask questions to the Signal Angel via IRC or Twitter, and we'll also make sure to relay those to the speaker and make sure those get asked. So let's just go ahead and start with Mike too, please. Hey, great talk. Do you worry that by publishing your methods as well as your data that you're going to get a response from governments that are censoring things such that it makes it more difficult for you to monitor what's being censored or has that already happened? It hasn't happened. We have control measures to be able to detect that. But that has been, it's a really good question and often comes up after I present. I can tell you based on my experience, it's really hard to synchronize all the ISPs and all the countries to act to the CNAC and reset that I'm sending. Like, for example, for Augur, this is unsolicited packets and for the governments to block that, there are going to be a lot of collateral damage. You might say that, well, Roya, they are going to block the IP of University of Michigan, the spoofing machine. We have measure for that. We have multiple places that I am actually back, have a backup if that case happened. But overall, this is a global scale measurement and even in one city or multiple ISPs you know of, it's really hard to synchronize being like blocking something and maintaining that. So it is something that's in our mind thinking about, but as of now, it's not a worry. All right, then let's go over to Mike Wan. Thank you. I wondered, it's kind of similar to this question. What if you are measuring from a country that is blocking? Do you also distribute the measurements over several countries? Absolutely. Every snapshot that we collect is from all the vantage point we have in certain countries and portion of vantage point in China or US because they have millions of applications, so we don't have thousands of applications. So basically, at each snapshot, which takes us three days, we collect the data from all of the vantage point. And so let's say that somebody is reacting to us, we have a benign domain that we check as well, like for example, the domain example.com or random.com. So if we see something going on there, we actually double check. But good point, because now our efforts is very manual labor and we're trying to automate everything, so it's still a challenge. Thank you. All right, then let's go to Mike. Hi. Have you measured how much does IPID randomization break your probes? Oh, this is also really good. Let me give a shout out to Anteeris. He's the guy at 1998, discovered IPID or published something that I ended up reading. So like for example, what is this, Linux or Ubuntu in the newest version, they randomized it. But it's still the role of this legacy operating system, like Windows XP and Pre-DSS or Free BST that still have global IPID. So one argument that often come up is what if all this machine get updated to the new operating system where it doesn't have a maintained global IPID? And I can tell you that, well, we come up with another side channel. For now, that works. But my gut feeling is that if it didn't change from 1998 till now, with all the things that everybody says that global IPID variable is a horrible idea, it's not going to change in the coming five years. So we're good. Thank you. Okay, then let's just move on to Mike for. Thank you very much for the great talk. When you were introducing the blog, I was wondering does the detection of the blockage between the clans ever necessarily indicate censorship? So because you were talking about validating, I was wondering if it turns out that there is like a false alarm, what do you think could be the potential cause? You're absolutely right. And I tried to emphasize on that, that what we end up collecting can be seen as a disruption. Something didn't work. The SINAC or RISC got disrupted. Is that a censorship or it can be a random packet drop? And the way to be able to establish that confidence is to check whether aggregate the results. Do we see this blocking between multiple of the routers within that country or within that AES? Because if one of this is for accident that just didn't make sense or didn't get dropped, what about the others? So the whole idea, and this is another point that I'm so concerned about, most of these reports and anecdotes that we read is based on one VPN or one vantage point in the country. And then there are a lot of, lot of conclusion out of that. And you often can ask that, well, this vantage point might be subject to so many different things than a government censorship. Also, I emphasize that the censorship that I'm using in this talk is any action that stop users access to get to the requested content. I'm trying to get away from a semantic where the intention applied. But great question. All right. Then let's go back to Mike Onewright. Hi, you mentioned that you have a team of students working on all of these frameworks. I was wondering if your frameworks were open source or available online for collaboration and if so, where those resources would be? So the data is open. The code hasn't been. For one reason is I'm so low confident in sharing code. Like I'm friend with FiliBenter, they're 5L. These people are pro open source and they constantly blame me for that. But it really requires a confidence to share code. So we are working on that. At least for Quack, I think the code is very easily can be shared. For Auger, we spend a heck of amount of time to make a production ready code. And for Satellite, I think that is also ready. I can share them personally with you. But before sharing to the world, I want to actually give another person to audit and make sure we're not using a caseboard or something. I don't know. I just have completely my mind being a little bit conservative. But happy if you send me an email, I send you the code. Thank you. All right. Then move to Mac 2. Thanks again for sharing your great vision. I find it really fascinating, although I'm not really data scientist. My question is, did you find any usefulness in your approaches in the spreading of the Internet of Things? I understood that you used routers to make queries. But did you send and maybe receive back any data from washing machines, toasters? I mean, I know being ethical and trying to not use end user machine limits your access a lot. But that's our goal. We are going to stick with things that don't belong to the end users. And so it's all routers, organizational machines. So I want to make sure that whatever we are using belong to the identity that can protect themselves if something went wrong. They can just say, hey, this is a freaking router. It's receiving so many things. I mean, look, let me give you, show you a TCP for example. The volunteer might not be able to defend that because it's already conspiring and collecting the data. But good question. I wish I could, but I won't pass that line. All right. I don't see any more questions in the room right now, but we have one from the Internet. So please sing, Rachel. Yeah. Actually, a question from Kuldi5.5. I was in an African country where the internet has been completely shut down. How can I quickly and safely inform others about the shutdown? So while I think local users' values are highly, highly needed, they can use social media like Twitter to send and say whatever. There is a project called IOTA. It's a project at KDA, UCSD University in US. And Flip Winter, Alberto and Alistair are working on that. They basically, remotely, keep track of shutdowns and push them out. If you look at the IOTA on Twitter, you can see their live feed of how the shutdowns were, the shutdowns happen. So I haven't taught about how to reach to the users, telling them what we see or how we can incorporate the user's feedback. We are working with a group of researchers that already developed tools to receive the data from Twitter and basically use that as some level of ground truth. But only does it such a great job that I haven't felt the need. All right. Unless the signal angel has another question. Nope. Can I add one thing? So I was listening to a talk about how Iranian versus Arabs were sympathetic towards a Boston bombing in the United States and there were a lot of assumptions and a lot of conclusions were made that oh, I'm completely paraphrasing, I don't remember. But this Iranian doesn't care because they didn't tweet as much. So basically, their input data was a bunch of tweets around the time of Boston bombing. After the talk was over, I said, you know that, in this country, Twitter is being blocked and so many people couldn't tweet. All right. That concludes our Q&A. So thanks so much, Roya. Thank you. Thank you.
 Alright, it's my very big pleasure to introduce Roya and Safi to you.  She's going to talk about the sensor planet, a global sensor ship observatory.  I'm personally very interested in learning more about this project.  Sounds like it's going to be very important.  So please welcome Roya with a huge warm round of applause.  Thank you.  It's wonderful to finally make it to CCC.  I've had joint talk with multiple of my friends over the past years and the visa stuff never  worked out.  This year I applied for a conference in August and the visa worked for coming to CCC.  My name is Roya and Safi and I'm a professor at the University of Michigan.  My research focuses on security and privacy with the goal of protecting users from adversarial  network.  So basically I investigate network interference.  And somebody is interfering right now.  In it.  Cool.  I'm good.  Oh no, I'm not.  Okay, in my lab we develop techniques and systems to be able to detect network interference  often at a scale and apply these frameworks and tools to be able to understand the behaviors  of these actors that do the interference and use this understanding to be able to come  up with a defense.  Today I'm going to talk about a project that is very dear to my heart, the one that I spent  six years working on it.  And in this talk I'm going to talk about censorship, inter-censorship and by that I mean any action  that prevents users access to the requested content.  We have heard an alarming level of censorship happening all around the world.  And while it was previously multiple countries that were capable of using the packet inspections  to tamper with user traffic, thanks to commercialization of these DPI's, now many countries are actually  messing with users' data.  For the first time that the users type CNN.com in their browsers, their traffic is subject  to some level of interference by different actors.  First for example, the DNS query where the mapping between the domain and the IP where  the content is can be manipulated.  For example, the DNS answers can be a dead IP where the content is not there.  If the DNS succeeds, then the users and the servers are going to establish a connection,  TCP handshake, and that can be easily blocked.  If that succeeds, then users and servers start actually sending back and forth the actual  data.  And there are enough to clear text, be it the traffic encrypted or not, that the DPI can  detect a sensitive keyboard and send a reset package to both basically shut down the connections.  Before I forgot, let me tell you and emphasize that it's not just the governments and the  policies that are imposed on the ISPs that lead to censorship.  Actually server side, which provides the data, are also blocking users, especially if they  are located in a region that they don't provide any revenue.  We recently investigated this issue of dual blocking in DIP and provide more details about  what role FDNs actually provide.  Imagine now we have how many users, how many ISPs, how many transit networks, and how many  websites, each of which are going to have their own policies of how to block users'  access.  More censorship changes from time to time, region to region, country to country.  For that reason, many researchers, including me, have been interested in collecting data  about censorship in a global way and continuously.  Well, I grew up under civil censorship, be it the university, the government, more frustrating  the server side.  And I genuinely believe that censorship takes away opportunities and degrade human dignity.  And it's not just China, Bahrain, Turkey that does internet censorship.  Actually with the DPI, it's become cheaper and cheaper.  Many governments are following their leads.  As a result, internet is becoming more and more balcony-ized.  And the users around the world are going to soon have very, very different pictures of  what is internet is.  And we need to be able to collect the data, to be able to know what is being censored,  how it's being censored, where it's being censored, and for how long.  This data can be used to bring transparency and accountability to governments or private  companies that practice internet censorship.  It can help us to know where the circumvention to where the defense needs to be deployed.  It can help us to let the users around the world to know what their governments are up  to.  And more important, provide the valid and good data for the policymakers to come up with  the good policies.  Existing research already shows that if we can provide this data to users, they act  by their own will to ensure internet freedom.  For many years, my goal has been to come up with a better map, a censorship better map,  where we can actually see changes in censorship over time, how some countries are different  from others, and do that for a continuous duration of time and for all over the world.  Creating such a map wasn't possible with the techniques, internet measurement methods  that we had at the time.  At the time, and even the common techniques we now use, the measurement methods to be  able to use for measuring internet censorship is often by deploying a software or giving  a customized Raspberry Pi to either a client or a server, and based on that, measure what's  happening between client and servers.  Well, this approach has a lot of limitation.  For example, there are not that many volunteers around the world that are eager to download  a software and run it.  Second, the data collected from this approach are often not continuous, because the user's  connection can die for a variety of reasons, or users might lose interest to keep running  the software.  And therefore, we end up with sparse data where we cannot have a good baseline for internet  censorship studies.  More measuring domains that are sensitive often create risks for the local collaborators  and might end up with their government's retaliation.  These risks are not hypothetical.  When Arab Spring was happening, I was approached by many colleagues to recruit local friends  and colleagues in Middle East to be able to collect measurement data at the time that  was very interesting to capture the behavior of the network, and most dangerous for the  locals, ambulanters, to collect that.  My painting actually experts what I felt at the time.  I can't just imagine asking people on the ground to help at these times of unrest.  In my opinion, conspiring to collect the data against the government's interest can be seen  as an act of treason, and these governments are unpredictable often.  So it's exposed these volunteers to a severe risk.  While no one has yet been arrested because of measuring interest in censorship, as far  as we know, and I don't know how we can know that in a global scale, I think the clouds  are on the horizon.  I'm still at all how Turkish government used their surveillance data at a time of co-op  and tracked down and detained hundreds of users because there was a traffic between them and  by lock a messenger app that was used by co-op administrators.  These things happen.  Here I continue.  If you know UNI, you might ask how UNI prevent risk?  Well with a great level of efforts.  And if you don't know UNI, UNI is a global community of volunteers that collected about  censorship around the world.  Well first and foremost, they provide their volunteers with a very honest consent, telling  them that hey, if you run this software, anybody who is monitoring your traffic, know what you're  up to.  They also go out of their way to give freedom to these volunteers to choose what website  they want to run, what data they want to push.  They establish a great relationship with the local activist organization in the countries.  Well now that I've proved to you guys that I am a supporter of UNI and I'm actually a  friend with most of them, I want to emphasize that I still believe that consistent and continuous  and global data about censorship requires a new approach that doesn't need volunteers  help.  I become obsessed with solving this problem.  What if we could measure whether a client in anywhere around the world can talk to a  server without being close to a client, somewhere from here, from University of Michigan, and  see whether the two hosts can talk to each other globally and remotely off the path.  When I talk to the people about this, honestly, everybody was like you don't know what you're  talking about.  It's really, really challenging.  Well they were right, the challenge is there, and I'm going to walk you through it.  We have at least 140 IP addresses that respond to the same packet.  This means they speak to the world.  And they follow blindly TCP IP protocol.  So the question becomes how can I leverage these subtle properties of TCP IP to be able  to detect the two hosts can talk to each other?  Well, a spooky scan is a technique that JetKorea and from University of New Mexico and I developed  that uses TCP IP side channels to be able to detect whether the two remote hosts can  establish a TCP handshake or not.  And if not, in which direction the packets are being dropped off the path and remotely.  And I'm going to start telling you how this works.  First I have to cover some background.  So any connection that is based on TCP, one of the basic communication protocol we have  is it needs to establish a TCP handshake.  So basically you send a sync and in the packet you send in the IP header you have a field  called identification.  And this field is used for fragmentation reason.  And I'm going to use this field a lot in the rest of the talk.  After the user received a scene, it's going to send a sync back.  Have another IP ID in it.  And then if I want to establish a connection, I send a reset.  Most of the protocol says that if you send a sync packet to a machine with the port open  or closed, it's going to send you a reset telling you what the heck you're sending me  a sync.  I didn't send you a sync.  And another part is if you send a sync packet to a machine with the port open, it will send  you a sync.  If you don't do anything, because TCP IP is reliable, it's going to send you multiple  sync.  It depends on operating system 3, 5, you name it.  As bookies can require some basic characteristics.  For example, the client, the vantage points that we are interested should maintain a global  variable for the IP ID.  It means that when they receive a packet and they want to send a packet out, no matter  who they are sending the packet to, this IP ID is going to be a shared resource.  So by just watching the IP ID changes, you can see how much a machine is noisy, how much  a machine is sending traffic out.  A server should have a port open, let's say 80 for Fortary, and wants to establish a connection.  And the measurement machine, me, should be able to spoof packets.  It means sending packet with the source IP different from my own machine.  To be able to do that, we need to talk to upstream network and ask them not to drop  the packets.  All of these requirements, I could easily satisfy with a little bit of efforts.  As bookies can start, with measurement machine, send a sync packet to one of these clients  with the global IP ID at a time, let's say the value is 7,000.  The client is going to send back a reset following the protocol, revealing to me what's the  value of IP ID.  In the next step, I'm going to send a spoof sync packet to a server using a client IP  as a result.  The CNAQ is going to send to the client.  Again, client is going to send a reset back.  The IP ID is going to be increment by one.  If I'm a query IP ID, I'm going to see a jump to.  In a noiseless model, I know that this machine talked to the server.  If I query it again, I won't see any jump.  So delta 2, delta 1.  Now imagine there is a firewall that blocked the CNAQs going from the server to the client.  Well, it doesn't matter how much of the traffic I send.  It's not going to get there.  It's not going to get there.  So the delta I see is 1-1.  In the third case, when the packets are going to be dropped from the client to the server,  well, my CNAQ gets there.  The CNAQ gets to the client.  The client is going to send a reset back, but it's not going to get to the server.  So server thinks that the packet got dropped.  So it's going to send multiple CNAQs, and as a result, the reset is going to be plus  plus more.  And so what jump I would see is, let's say, 2-2.  Let me put them all together.  So you have three cases blocking in this direction, no blocking and blocking in the other.  And you see different jumps or different deltas.  So it's detectable.  Yes, yes, in a noiseless model.  I know the clients talk to so many others, and the IPID is going to be changed because  of a variety of reasons.  I call all of those noise, and this is how we are going to deal with it.  Well, in 2-2, we can amplify the signal.  We can actually, instead of sending one spoofing packet, we can send n.  And for a variety of reasons, packets can get dropped.  So we need to repeat this measurement.  So here is some data from a Spooky scan of where I used the following probing method.  For 30 seconds, I send a query for IPID.  And then for another 30 seconds, I send us five spoofing packets.  This is machines or clients in Azerbaijan, China, and United States.  And we wanted to check whether it's rich, tall relay that we had in Sweden.  You can see there are different jump or different level shifts that you observe in a second  phase.  And just visually looking at it or using auto regressive moving average or ARMA, you can  actually detect that.  But there is an insight here, which is that not all the clients have the same level of  noise, and for some of them, especially these guys, you could easily detect after five level  of sending IPID query and then five seconds of spoofing.  So in the follow-up work, we try to use this insight to be able to come up with a scalable  and efficient technique to be able to use it in a global way.  And that technique is called AUGAR.  Well AUGAR adopts this probing method.  First for four seconds, it queries IPID.  Then in one second, send 10 spoofing packets.  Then look at the IPID acceleration or second derivative and see whether we see a jump, a  sudden jump, at the time of perturbation when we did the spoofing.  How confident we are that that jump is the result of our own spoof packet.  Well, I'm not confident.  Run it again.  I think so.  Run it again until you have sufficient confidence.  It turns out there is a statistical analysis called sequential hypothesis testing that  can be used to be able to gradually improve our confidence about the case we are detecting.  So I'm going to give you a very, very rough overview of how this works.  But for sequential hypothesis testing, we need to define a random variable.  And we use IPID acceleration at the time of perturbation being one or zero based on, you  see, jump or not.  We also need to calculate some empirical priors, known probabilities.  If you look at everything, what would be the probability that you see a jump when there  is actually no blocking and so on?  After we've put all this together, then we can formalize an algorithm starting by run  a trial, update the sequence of values for the random variables, then check whether the  sequence of values belong to the distribution of where the blocking happens or not.  What's the likelihood of that?  If you're confident, if you reach to a level that you are satisfied, then we call it a  case.  So putting all this together, this is how other works.  We scan the whole IPv4, find global IPID machines, and then we have some constraint that is it  a stable machine?  Is it a noisier or have a noise that we want to deal with?  We also need to figure out what website are we interested to test reachability towards  them.  What countries we are.  So after we decide all the input, then we run a scheduler, making sure that new client  and server are under the measurement in the same time because they mess each other's detection.  And then we actually use our analysis to be able to call the case and summarize the results.  I started by saying that the common methods have this limitation, for example, coverage,  continuity, and ethics.  When it comes to coverage, there are more than 22 million global IPID machines.  These are the nodes of pre-dississert, and previous these, for example.  Similar to the previous board, one successful project is a right path less, and they have  around 10,000 probes globally deployed.  When it comes to continuity, we don't depend on end user, so it's much more reliable to  use this.  Well, by not asking volunteers to help, we were already reducing the risk because there  is no users conspiring against their governments to collect this data.  But our approach is not also zero risk.  If you look, you have a different kind of risk here.  The client and server is exchanging SINAC and reset without each of them giving a consent.  And we don't want to ask for a consent because if you do, the dilemma exists.  We have to go back and it's just the same that's asking volunteers.  So to deal with that and copy that, to reduce the risk more, we don't use end IPs.  We actually use two hop-back routers, which are infrastructure machines, and use those  as a vantage point.  Even with this harsh constraint, we still have 53,000 global IP ID routers.  To see if it works, we chose 2,000 of these global IP ID machines, uniformly selected  from all the countries we had vantage point.  We selected websites from citizen lab test list.  This is the research organization in Toronto universities where they crowd source a website  that are potentially being blocked or potentially sensitive.  And then we use thousands of the websites from Alexle, top 10k.  And then we get the auger running for 17 days and collect this data.  One of the challenges that we have to validate the auger was like, so what is the truth?  What is the ground truth?  What would we see that makes sense?  This is the biggest and fundamental challenge for internet censorship anyway.  But so the first approach is leaning on intuition, which is like no client should show blocking  towards all the websites.  No server should show blocking for bulk of our clients.  And if anything happens like that, we just trash it.  We should see more bias towards the sensitive domain versus the ones that are popular.  And so on.  And also, we hope to replicate the anecdotes, the reports out there.  And we did all of those.  And that's how we validate auger.  So at the end, auger is a system that is scalable and efficient, ethical, and can be used to  detect TCPIP blocking continuously.  Yes, I know.  That's just TCPIP.  What about the other layers?  Can we measure them remotely as well?  Well, let me focus on the DNS.  You might ask, is there a way that we can remotely detect DNS poisoning or manipulation?  Well, let's think it out loud.  From now on, I'm going to give just a highlight of the papers we work for the lack of the  time.  Well, if we scan the whole IPv4, we have a lot of open DNS resolvers, which means that  they are open to anybody sending a query to them to resolve.  And these open DNS resolvers can be used as a vantage point.  We can use open DNS resolvers in different ISPs around the world to see whether that  DNS queries are poisoned or not.  Well, wait.  We need to make sure that they don't belong to the end user.  So we come up with a lot of checks to make sure that these open DNS resolvers are organizational,  belong to the ISP or infrastructure.  After we do that, then we start sending all our queries to these, let's say, open DNS  resolvers in ISP in Bahrain for all the domain we are interested and capture what we receive,  what IPs we receive.  The challenge is then to detect what is the wrong answer.  And so we have to come up with a lot of heuristics, a set of heuristics.  For example, the response that we received, is that equal to a reply we got from our control  measurements where we know the IP is not blocked or poisoned or something, the contents is  there.  Or we can actually look at the IP that we received and see whether it has a valid HTTP  cert with or without SNI or server name identification or something.  And so on so forth.  So we come up with lots of heuristics to detect the wrong answers.  The results of all these efforts ended up being a project called Satellite, which was  started by Willa Scott, I'm sure he's in the audience somewhere, a great friend of mine,  a very good supporter of sensor planet.  He has been a miracle that I had an opportunity and fortunate to met him.  We have satellite.  And satellite automate the whole steps that I told you.  For this work, we use science that developed in both of the work.  We call it satellite because of seniority and it's sticking with the name.  So how much coverage satellite has?  If you scan the IP before you end up with 4.2 million of Pandianus resolvers in every  country and their territories.  We actually need to make sure there are ethical for that reason.  If you put a harsh condition, we say that let's only use the ones that their valid PTR  record follow this expression.  Basically let's just use the open DNS resolvers that are name servers or at least their PTR  record suggests that.  This is really harsh constraint.  Actually my students have been adding more and more regular expression for the ones that  we are sure they are organizational.  But for now, just being this harsh, we have 40K of NDS resolvers in almost 169 countries,  I guess.  So censorship happened in other layer as well.  How do we deal with that remote channel?  With the remote side channel?  And especially what about HTTP traffic or disruption that can happen in the TLS center?  I hate water.  Oh, no.  Okay.  So it's well documented that many DPIs, especially in great furrows, China, monitor the traffic  and then they see a key word, a sensitive key word like Falun Gong, the act and the drop  traffic or send a reset.  And as I mentioned earlier, there were enough clear text everywhere.  And in TLS, I guess, and I is in clear text.  And for a long time, I was trying to come up with the way of detecting application layer  using this fancy side channel.  Like how can I detect that when the client and server need to first establish a TCP handshake?  How the side channel can jump in and then detect the rest?  We were lucky enough that the end pointed to a protocol called ECHO.  It's a protocol designed on 1983 and it's for testing reasons.  For the debugging tool, basically.  It's a predecessor to PING.  And basically, after you establish a TCP handshake to port seven, whatever you send the ECHO  servers on port seven, it's going to echo it back.  Now think about it.  How we can use ECHO servers to be able to detect application layer blocking?  Well, when it's not, let's say I have an ECHO server in the US and measure my machine  in the University of Michigan, I establish a TCP handshake and I send a GET request to  using a sensor keyboard, for example.  It's going to get back to me the same thing I sent.  But now, let's put the DPI that is going to be triggered by it.  Well, for sure, either I'm going to receive a reset first or something else.  So we can actually come up with the algorithm to be able to use the ECHO servers to detect  disruptions on application layer.  Basically keyboard blocking, URL blocking.  Results of this is a tool called Quack.  And Quack actually use ECHO servers to be able to detect in a scalable way and safely  better the keywords are being blocked around the world.  So what did we do is first scan the whole IPv4.  We find 47K ECHO servers running around the world.  Then we need to be able to check whether they are not belong to the end users.  And that was a very challenging part because there is not a clear signal.  As it's, there are 90% of them are infrastructure, but there is still some portion of them that  we don't know.  So what we do is we look at the freedom of house reports and the countries that are partially  open or not open.  Not free or partially free, what they call.  This is around 50 countries.  And for those, we randomly select some that we want and we use OS detection of NMAP.  And if you give us back, it's a server, it's a switch, and so on, we use those.  So with the help of so many collaborators, after almost six years, we end up with three  systems that can capture to CBI people locking, DNS, and application layer blocking using  infrastructure and organizational machines.  So while it was a dream or a vision that we can come up with a better map to collect  this data in a continuous way, thanks to the help of a lot of people, especially my students,  Will and other collaborators, we now have sensor planet.  Sensor planet collects semi-weekly snapshots of internal censorship using advantage point  in order to all the layers and provide this data in a raw format now in our website.  We also provide some visualization way for people to be able to see how many advantage  when we have in each country and so on.  Of course, this is the beginning of sensor planet.  We launched this at August and we have been collecting data for almost four months and  we have a long way to go.  We have users right now through organizations using our data and helping us debug by finding  things that doesn't make sense pointing to us.  And any of you that ended up using this data, please share your feedback with us and we  are very responsive to be able to change it.  Not as much as Zuni.  We have a collective of very well-dedicated people participating.  So now that we have the sensor planet, let me give you how it can help when there is  a political situation going on.  You all must remember around October, very jamal, Koshogi, Washington Post report there  disappeared, killed at the Saudi Arabia embassy in Turkey.  At the time of this happening, there was a lot of media attention and this news, especially  two weeks in, become very internationally spread.  Since the planet didn't know this event was going to happen, so we have been collecting  this data semi-vehicle for 2000 domain or so.  And so we went back and we checked the Saudi Arabia.  Did we see anything interesting?  And yes, we saw, for example, at two weeks in, around October 16, the domains that we  were, that was reuse category and media category, the censorship related to those doubled.  And let me emphasize.  We didn't see like a block and not block over the whole country.  Not all the countries have a homogeneous censorship happening.  We saw it in multiple of the ISPs that we had vantage point.  Actually I freaked out when one of the activists in Saudi Arabia told us that, I don't see  this.  And we said, what ISP, what ISP were in?  And this wasn't the ISPs that we had vantage point in.  So we were looking for hints that, is there anybody else seeing what we were seeing?  And so we ended up seeing there is a command lab project that also saw around October 16,  the number of malwares or whatever they're testing is also doubled or tripled.  I don't know the other.  So something was going on two weeks in when the news broke.  Let me emphasize this news media that I'm talking about or the global news media that  we checked like LA Times, Fox News and so on.  But we also checked Arab news, which is, as the activists told us, is a Saudi Arabia's  propaganda newspaper.  That's in one of the ISPs was being poisoned.  So again, censorship is a very complex problem.  So where are we heading?  Well, having said that about side channels and the techniques that help us to collect  this data, I have to also say that the data we collect doesn't replicate the picture of  the internet censorship.  I mean, having a root access on a volunteer's machine to do a detailed test is powerful.  So in the next step, in the next year, one of our goal is to join force with ONI to integrate  the data from remote and basically local measurements to provide the best of the world's worlds.  Also we have been thinking a lot about what would be a good visualization tools that doesn't  end up to misrepresent internet censorship.  I literally hate that one.  Hate it.  The number of vantage points in countries are not equal.  We don't know whether all the vantage points that the data is resulted from it is from  one ISP or all over the ISP.  And then with test domains that are like benign, like I don't know, it defined based on some  western values of the freedom of expression.  I believe in all of them, but still, culture economy might play some things red.  And then we put colors on the map, ranked the countries, called some countries awful  and not giving a full attention to the others.  So something needs to be changed.  And it seems a horizon to think about it more deeper.  We want to be able to have more statistic tools to be able to spot when the patterns  are changed.  We want to be able to compare the countries, then for example, telegram was being blocked  at Russia, if you remember, millions of IPs being blocked.  If you don't know, go to my friends, Lenny talk about Russia.  You're going to learn a lot there.  But anyway, so when the Russia was blocking telegram, I said to everyone, I bet in the  following some other governments are going to jump to block telegram as well.  And that's actually what we heard, rumors like that.  So we need to be able to do that automatically.  And overall, I want to be able to develop an empirical science of Internet censorship  based on a rich data with the help of all of you.  Sensor planet is now being maintained by a group of dedicated students, a great friend  that I have, and needs engineers, political scientists to jump on our data and help us  to bring meaning to what we are collecting.  So if you are a good engineer or a political scientist or a dedicated person who wants  to change the world, reach out to me.  For those of you interested, these are the publications that my talk was based on.  And now I'm open to questions.  All right, perfect.  Thank you so much for your so far.  We have some time for questions.  So if you have a question in the room, please go to one of the room microphones, one, two,  three, four, and five in the very back.  And if you're watching the stream, you can ask questions to the Signal Angel via IRC  or Twitter, and we'll also make sure to relay those to the speaker and make sure those get  asked.  So let's just go ahead and start with Mike too, please.  Hey, great talk.  Do you worry that by publishing your methods as well as your data that you're going to  get a response from governments that are censoring things such that it makes it more  difficult for you to monitor what's being censored or has that already happened?  It hasn't happened.  We have control measures to be able to detect that.  But that has been, it's a really good question and often comes up after I present.  I can tell you based on my experience, it's really hard to synchronize all the ISPs and  all the countries to act to the CNAC and reset that I'm sending.  Like, for example, for Augur, this is unsolicited packets and for the governments to block that,  there are going to be a lot of collateral damage.  You might say that, well, Roya, they are going to block the IP of University of Michigan,  the spoofing machine.  We have measure for that.  We have multiple places that I am actually back, have a backup if that case happened.  But overall, this is a global scale measurement and even in one city or multiple ISPs you  know of, it's really hard to synchronize being like blocking something and maintaining  that.  So it is something that's in our mind thinking about, but as of now, it's not a worry.  All right, then let's go over to Mike Wan.  Thank you.  I wondered, it's kind of similar to this question.  What if you are measuring from a country that is blocking?  Do you also distribute the measurements over several countries?  Absolutely.  Every snapshot that we collect is from all the vantage point we have in certain countries  and portion of vantage point in China or US because they have millions of applications,  so we don't have thousands of applications.  So basically, at each snapshot, which takes us three days, we collect the data from all  of the vantage point.  And so let's say that somebody is reacting to us, we have a benign domain that we check  as well, like for example, the domain example.com or random.com.  So if we see something going on there, we actually double check.  But good point, because now our efforts is very manual labor and we're trying to automate  everything, so it's still a challenge.  Thank you.  All right, then let's go to Mike.  Hi.  Have you measured how much does IPID randomization break your probes?  Oh, this is also really good.  Let me give a shout out to Anteeris.  He's the guy at 1998, discovered IPID or published something that I ended up reading.  So like for example, what is this, Linux or Ubuntu in the newest version, they randomized  it.  But it's still the role of this legacy operating system, like Windows XP and Pre-DSS or Free  BST that still have global IPID.  So one argument that often come up is what if all this machine get updated to the new  operating system where it doesn't have a maintained global IPID?  And I can tell you that, well, we come up with another side channel.  For now, that works.  But my gut feeling is that if it didn't change from 1998 till now, with all the things that  everybody says that global IPID variable is a horrible idea, it's not going to change  in the coming five years.  So we're good.  Thank you.  Okay, then let's just move on to Mike for.  Thank you very much for the great talk.  When you were introducing the blog, I was wondering does the detection of the blockage  between the clans ever necessarily indicate censorship?  So because you were talking about validating, I was wondering if it turns out that there  is like a false alarm, what do you think could be the potential cause?  You're absolutely right.  And I tried to emphasize on that, that what we end up collecting can be seen as a disruption.  Something didn't work.  The SINAC or RISC got disrupted.  Is that a censorship or it can be a random packet drop?  And the way to be able to establish that confidence is to check whether aggregate the results.  Do we see this blocking between multiple of the routers within that country or within that  AES?  Because if one of this is for accident that just didn't make sense or didn't get dropped,  what about the others?  So the whole idea, and this is another point that I'm so concerned about, most of these  reports and anecdotes that we read is based on one VPN or one vantage point in the country.  And then there are a lot of, lot of conclusion out of that.  And you often can ask that, well, this vantage point might be subject to so many different  things than a government censorship.  Also, I emphasize that the censorship that I'm using in this talk is any action that  stop users access to get to the requested content.  I'm trying to get away from a semantic where the intention applied.  But great question.  All right.  Then let's go back to Mike Onewright.  Hi, you mentioned that you have a team of students working on all of these frameworks.  I was wondering if your frameworks were open source or available online for collaboration  and if so, where those resources would be?  So the data is open.  The code hasn't been.  For one reason is I'm so low confident in sharing code.  Like I'm friend with FiliBenter, they're 5L.  These people are pro open source and they constantly blame me for that.  But it really requires a confidence to share code.  So we are working on that.  At least for Quack, I think the code is very easily can be shared.  For Auger, we spend a heck of amount of time to make a production ready code.  And for Satellite, I think that is also ready.  I can share them personally with you.  But before sharing to the world, I want to actually give another person to audit and  make sure we're not using a caseboard or something.  I don't know.  I just have completely my mind being a little bit conservative.  But happy if you send me an email, I send you the code.  Thank you.  All right.  Then move to Mac 2.  Thanks again for sharing your great vision.  I find it really fascinating, although I'm not really data scientist.  My question is, did you find any usefulness in your approaches in the spreading of the  Internet of Things?  I understood that you used routers to make queries.  But did you send and maybe receive back any data from washing machines, toasters?  I mean, I know being ethical and trying to not use end user machine limits your access  a lot.  But that's our goal.  We are going to stick with things that don't belong to the end users.  And so it's all routers, organizational machines.  So I want to make sure that whatever we are using belong to the identity that can protect  themselves if something went wrong.  They can just say, hey, this is a freaking router.  It's receiving so many things.  I mean, look, let me give you, show you a TCP for example.  The volunteer might not be able to defend that because it's already conspiring and collecting  the data.  But good question.  I wish I could, but I won't pass that line.  All right.  I don't see any more questions in the room right now, but we have one from the Internet.  So please sing, Rachel.  Yeah.  Actually, a question from Kuldi5.5.  I was in an African country where the internet has been completely shut down.  How can I quickly and safely inform others about the shutdown?  So while I think local users' values are highly, highly needed, they can use social  media like Twitter to send and say whatever.  There is a project called IOTA.  It's a project at KDA, UCSD University in US.  And Flip Winter, Alberto and Alistair are working on that.  They basically, remotely, keep track of shutdowns and push them out.  If you look at the IOTA on Twitter, you can see their live feed of how the shutdowns were,  the shutdowns happen.  So I haven't taught about how to reach to the users, telling them what we see or how  we can incorporate the user's feedback.  We are working with a group of researchers that already developed tools to receive the  data from Twitter and basically use that as some level of ground truth.  But only does it such a great job that I haven't felt the need.  All right.  Unless the signal angel has another question.  Nope.  Can I add one thing?  So I was listening to a talk about how Iranian versus Arabs were sympathetic towards a Boston  bombing in the United States and there were a lot of assumptions and a lot of conclusions  were made that oh, I'm completely paraphrasing, I don't remember.  But this Iranian doesn't care because they didn't tweet as much.  So basically, their input data was a bunch of tweets around the time of Boston bombing.  After the talk was over, I said, you know that, in this country, Twitter is being blocked  and so many people couldn't tweet.  All right.  That concludes our Q&A.  So thanks so much, Roya.  Thank you.  Thank you.
35c3-9877-censored_planet_a_global_censorship_observatory_0_59.png 35c3-9877-censored_planet_a_global_censorship_observatory_60_719.png 35c3-9877-censored_planet_a_global_censorship_observatory_720_1079.png 35c3-9877-censored_planet_a_global_censorship_observatory_1080_9599.png 35c3-9877-censored_planet_a_global_censorship_observatory_9600_9755.png 35c3-9877-censored_planet_a_global_censorship_observatory_9756_19283.png 35c3-9877-censored_planet_a_global_censorship_observatory_19284_24971.png 35c3-9877-censored_planet_a_global_censorship_observatory_24972_31535.png 35c3-9877-censored_planet_a_global_censorship_observatory_31536_31595.png 35c3-9877-censored_planet_a_global_censorship_observatory_31596_31703.png 35c3-9877-censored_planet_a_global_censorship_observatory_31704_33131.png 35c3-9877-censored_planet_a_global_censorship_observatory_33132_35267.png 35c3-9877-censored_planet_a_global_censorship_observatory_35268_36899.png 35c3-9877-censored_planet_a_global_censorship_observatory_36900_40679.png 35c3-9877-censored_planet_a_global_censorship_observatory_40680_41039.png 35c3-9877-censored_planet_a_global_censorship_observatory_41040_47783.png 35c3-9877-censored_planet_a_global_censorship_observatory_47784_50483.png 35c3-9877-censored_planet_a_global_censorship_observatory_50484_50639.png 35c3-9877-censored_planet_a_global_censorship_observatory_50640_54335.png 35c3-9877-censored_planet_a_global_censorship_observatory_54336_65831.png 35c3-9877-censored_planet_a_global_censorship_observatory_65832_66395.png 35c3-9877-censored_planet_a_global_censorship_observatory_66396_67739.png 35c3-9877-censored_planet_a_global_censorship_observatory_67740_69119.png 35c3-9877-censored_planet_a_global_censorship_observatory_69120_69287.png 35c3-9877-censored_planet_a_global_censorship_observatory_69288_69719.png 35c3-9877-censored_planet_a_global_censorship_observatory_69720_71735.png 35c3-9877-censored_planet_a_global_censorship_observatory_71736_71819.png 35c3-9877-censored_planet_a_global_censorship_observatory_71820_71927.png 35c3-9877-censored_planet_a_global_censorship_observatory_71928_72095.png 35c3-9877-censored_planet_a_global_censorship_observatory_72096_72395.png 35c3-9877-censored_planet_a_global_censorship_observatory_72396_72527.png 35c3-9877-censored_planet_a_global_censorship_observatory_72528_72839.png 35c3-9877-censored_planet_a_global_censorship_observatory_72840_73847.png 35c3-9877-censored_planet_a_global_censorship_observatory_73848_74015.png 35c3-9877-censored_planet_a_global_censorship_observatory_74016_74831.png 35c3-9877-censored_planet_a_global_censorship_observatory_74832_75251.png 35c3-9877-censored_planet_a_global_censorship_observatory_75252_75995.png 35c3-9877-censored_planet_a_global_censorship_observatory_75996_76175.png 35c3-9877-censored_planet_a_global_censorship_observatory_76176_76451.png 35c3-9877-censored_planet_a_global_censorship_observatory_76452_77063.png 35c3-9877-censored_planet_a_global_censorship_observatory_77064_77243.png 35c3-9877-censored_planet_a_global_censorship_observatory_77244_78695.png 35c3-9877-censored_planet_a_global_censorship_observatory_78696_79067.png 35c3-9877-censored_planet_a_global_censorship_observatory_79068_79139.png 35c3-9877-censored_planet_a_global_censorship_observatory_79140_79331.png 35c3-9877-censored_planet_a_global_censorship_observatory_79332_79895.png 35c3-9877-censored_planet_a_global_censorship_observatory_79896_79979.png 35c3-9877-censored_planet_a_global_censorship_observatory_79980_81035.png 35c3-9877-censored_planet_a_global_censorship_observatory_81036_81287.png 35c3-9877-censored_planet_a_global_censorship_observatory_81288_81419.png 35c3-9877-censored_planet_a_global_censorship_observatory_81420_81863.png 35c3-9877-censored_planet_a_global_censorship_observatory_81864_82583.png 35c3-9877-censored_planet_a_global_censorship_observatory_82584_83147.png 35c3-9877-censored_planet_a_global_censorship_observatory_83148_83543.png 35c3-9877-censored_planet_a_global_censorship_observatory_83544_84094.png