Circumvention problems in China-The Register

[FACT comments: We have long observed that the great majority of circumvention tools used in China were developed with funding from the banned religious group, Falun Dafa or Falun Gong. Was Falun Gong, in contracting for tool development, the victim of a sting which placed backdoors in such tools? Or did someone along the path not have a political agenda but just saw a way to make a little money? Furthermore, a lot of the funding to develop such tools comes from the US State Department. And who funds GILC. This is a very tangled web with Internet users mere fodder.]

China’s anti-censor software pimps user data
Dissident data for sale
John Leyden
The Register: January 21, 2009

http://www.theregister.co.uk/2009/01/21/china_censorship_tools_data_sale/print.html\

Harvard researchers have accused the developers of tools for dodging the Great Firewall of China of selling data harvested by the software, potentially giving the authorities in Beijing an easy way to identify dissidents.

As well as selling aggregate usage data, software developers were also offering to sell detailed surfing histories of individual surfers for a fee, something that poses an even greater privacy risk, according to an analysis (http://blogs.law.harvard.edu/hroberts/2009/01/09/popular-chinese-filtering-circumvention-tools-dynaweb-freegate-gpass-and-firephoenix-sell-user-data/) by Hal Roberts from The Berkman Center for Internet Society at Harvard University.

However, the developers of the circumvention tools deny this and say that a poorly-worded FAQ, which has since been amended, has been misinterpreted.

Representatives of the firms explain that all their services simply offer a means for webmasters to get a detailed breakdown on surfers visiting the site using anonymity tools. Contentious passages in the FAQ have been rewritten since the controversy blew up last week.

Harvard’s Roberts looked at three Great Firewall of China circumvention tools – DynaWeb FreeGate, GPass, and FirePhoenix – which together account for the majority of the market, with a combined user base running into millions.

Users of these packages have gone out of their way to obtain a way to get around the Chinese government internet controls. Time and again Chinese authorities have demonstrated their willingness to chase down, prosecute and imprison cyberdissidents. Even to collect surfing histories on those using censorship circumvention tools is misguided; to offer individually-identifiable clickstream data for sale to anyone prepared to pay who is able to pass a “screening test” (as implied by the original FAQ) is far worse.

But the developers of DynaWeb FreeGate, GPass, and FirePhoenix (all partners in the Global Internet Freedom Consortium (GIFC)) appeared to be offering just that from a beta site called edoors.com, maintained by an firm called World’s Gate, Inc, as an early version of a FAQ on the site explained (http://ranking.edoors.com/site/faq). GPass and FirePhoenix are maintained by World’s Gate, while DynaWeb FreeGate is published by an affiliated organisation.

Q: I am interested in more detailed and in-depth visit data. Are they available?

A: Yes, we can generate custom reports that cover different levels of details for your purposes, based on a fee. But data that can be used to identify a specific user are considered confidential and not shared with third parties unless you pass our strict screening test. Please contact us if you have such a need.

The origins of this data are openly explained:

Q: Where did you get the raw data for the analysis?

A: The raw data came from the server log of GIFC member companies. Right now, data from three of the five tools of GIFC (DynaWeb, GPass, and FirePhoenix) are included for analysis.

Even if we take the promises of screening tests at face value, the slightest risk that the Chinese authorities could get information on who’s been trying to bypass its controls to reach websites associated with dissident movements in Tibet, for example, makes for a frightening thought. Simply using the tools might be considered an offense in an authoritarian country like China and the authorities would surely be interesting in knowing who is using tools to bypass the Great Firewall.

None of the circumvention tools vendors is open about its business practices, according to Roberts.

“These projects are not only storing the data. They are actively offering to sell it,” he writes. “None of the projects has anything like a privacy policy that I can find, and none of them provides any notice anywhere on the site or during the installation process that the project will be tracking and selling user browsing activity. But all of the sites have deceptive language.”

We emailed the administrators of edoors.com and the firms involved with a list of questions, stemming from Roberts’ analysis. Bill Xia, a representative of Dynamic Internet Technology (DIT), the developer of DynaWeb FreeGate, apologised for concerns that the edoors FAQ has created, and said on Monday that it would shortly be publishing a new users’ agreement.

DIT will release an End User License Agreement soon. DIT cut off service to non-China IPs since 1/1/2009. DIT will release fee based software to non-China user and will need an EULA anyway. Those will happen in this week. I will keep you updated on those.

DIT feels sorry about the concerns this has caused. We will allocate more resources to address those concerns.

In a response to Roberts’ initial analysis, GIFC claimed that their offer has been misunderstood. It is offering visitor breakdowns for web masters, not surfing histories on what would normally be understood to be its users.
Peter Li of the Global Internet Freedom Consortium explains:

We apologize for the confusion here. The anti-censorship ranking service is provided by one of the GIFC partners. It only publishes the popularity ranks of destination websites users visit through our anti-censorship tools. It is similar to alexa.com but is only limited to anti-censorship web traffic.

The ranking service is not authorized to access, nor can it access, the data users transmit on the wire. It is not authorized to release logs containing information on the websites any individual user visits either.

The FAQ for the ranking service was not written properly, as originally “user” there meant website owners who may be interested in getting detailed statistics on how their websites are visited through our anti-censorship tools. We apologize that we have overlooked the wording.

The edoors FAQ has now been rewritten, but the implications of the original wording – in particular the claim that “data that can be used to identify a specific user are considered confidential and not shared with third parties unless you pass our strict screening test” – has sparked a lively debate.

Roberts is unconvinced by the explanation from the circumvention tools suppliers. Even if the apparent sale of clickstream data were a simple misunderstanding, then the issue of user-identifiable data retention still stands.

“I don’t understand how a website could be considered confidential,” Roberts told El Reg. “I think it more likely that the confusion falls somewhere between the partners sharing the data.”

“But in any case, the important finding that they are storing the data at all remains.”
Roberts has published a more detailed response to the reactions of the circumvention tools firms here (http://blogs.law.harvard.edu/hroberts/2009/01/20/update-on-chinese-circumvention-circumvention-tool-snooping/).

I’m happy that the data is no longer for sale on the website, but given all of these factors, I’m still concerned with the amount and sensitivity of the data being stored, the lack of disclosure to users about what data is being stored and how it is being used, and the care with which the data is being protected.

Roberts adds that he is not questioning the motives of those developing the tools, seeking to accuse them of making a quick buck, but rather criticising their lack of openness and privacy policies.

Who else is eavesdropping?

Roberts notes that any security shortcomings in circumvention tools leaves Chinese users with few alternatives. Technologies such as Psiphon and Tor offer anonymous surfing but have themselves been subject to problems, he writes.

“Lots of folks rely on personal VPNs to circumvent or otherwise secure their connections, but those VPNs are not inherently any safer that the local ISPs through which they are tunneling,” Roberts adds, noting recent laws from the Swedish government giving it the ability to eavesdrop on VPN connections maintained by local ISP Relakks.

Similar issues involving the use of communication technology in China have cropped up before. Last October, Skype admitted that text messages sent through a Chinese version of the service were open to surveillance, blaming local partner TOM Online for allowing the eavesdropping.

The issue emerged after researchers from Citizen Lab, which is based at the University of Toronto, established that TOM-Skype was “censoring and logging” text chat messages containing certain keywords. The researchers were able to prove the breach because the surreptitiously logged data was kept on an open server.

We asked Ronald Deibert, director of the Lab, to comment on Roberts’ analysis. He said that he was closely monitoring the debate (http://rconversation.blogs.com/rconversation/2009/01/circumventing-c.html) about Global Internet Freedom Consortium tools stirred up by Roberts’ recent post.

He added that trusting a commercial virtual ISP or circumvention tools provider was an inherently risky proposition.

“The original notion of Psiphon (our circumvention tool) was to depend on personal social networks of trust as node operators, rather than other providers, precisely to avoid this problem,” Deibert told us.

“We took some flack on this at the outset, and it was widely misunderstood, but it seems apropos now to reiterate it.”