Resources for the global digital safety training community.
CreditsLast Updated 2014-03
Many tools and strategies to circumvent Internet restrictions are in existence today. However, some tools offer more security features than others, and may be better for your unique needs for security than others. Thus, it’s important to know the difference between the most common types of circumvention technologies.
Explain that you will begin by describing a typical Internet transaction or, if you’ve already offered a general session on how the internet works using the We Are The Internet, then a brief review should suffice. After that, you will address how requests for certain content can be blocked; then, you will explain how to bypass Internet censorship using proxies and other tools.
Explain that you will begin by describing a typical Internet transaction. We suggest using the whiteboard to draw out the process by which a browser requests a webpage; however, if you prefer, you can show a favorite video, discuss a pre-made diagram, etc. Regardless, it is not uncommon for participants to have questions about this introductory material.
The example below starts with a computer on a local area network (LAN), but applies equally well to any Internet-connected device. If your training is focused on mobiles, you should probably use a smartphone in your example - you can either explain that the device is connecting through WiFi, or modify a few of the terms below to account for the differences between mobile data services (3G, Edge, GPRS, etc.) and traditional ISP connections.
In this scenario, you are requesting a webpage with your browser. You click on a link and wait for the page to load. Meanwhile, your request is “routed” to the webserver that “hosts” the page you’ve requested. The server then sends you the content of that webpage, and your browser displays it for you.
Each Internet-connected device has a public IP address, assigned by its ISP, that it uses to send and receive data. This includes personal computers, Internet-connected smartphones, printers, game consoles, webpages and online services such as email providers and social networking sites.
That said, you will rarely request content using a server’s IP address directly. Instead, your Web browser will typically ask a domain name service (DNS) server to look up the domain name of the URL in the link you clicked (say, level-up.cc) and translate it into a public IP address (say, 188.8.131.52). Your browser will then request the specific content you want (say, “leading-training/training-curriculum/input/circumvention”) from the server at that public IP address.
Most of the devices you will use directly, such as laptops and smartphones, have local IP addresses that are unreachable from the public Internet. Devices on the same Local Area Network (LAN) frequently share the same public IP address.
Assuming you share a home with other people, however, your name becomes important once the envelope arrives at your door.
Depending on where you live and what type of Internet connection you have, both your request and the corresponding response will pass through a number of different computers along their respective “routes.”
Different packets may travel along different routes even if they are part of the same request, response or data submission (such as a when you submit a Web search or an email message).
These routes will vary depending on where you live and where the webpage you’re requesting is located, among other factors. Your request will typically pass through your local router, then on to your ISP. After that, things get a bit complicated.
When it arrives at your local router, it will be forwarded to your local IP address, then (finally) displayed in your Web browser.
Your access to information online may be blocked for a variety of reasons. Parents and school administrators frequently try to control the material to which children are exposed; companies have regulations about acceptable use of the Internet in the workplace; countries pass laws and establish policies that not only criminalize the publication of certain content within their jurisdiction, but that prohibit access to similar content published elsewhere.
Your employer might block requests to gaming sites and social media platforms from within the corporate firewall, and your government might require that your ISP return a “Page not Found Error” in place of an opposition website or a podcast produced by independent media. Because governments, ISPs, and administrators of public and private access points can monitor at least some aspects of your online activity, they can limit access to content they find objectionable.
Blocking and Filtering are the two terms most frequently used to describe the different mechanisms through which internet censorship takes place.
…refers to the banning or blacklisting of certain webpages, types of content, access channels, or protocols;
…refers to the process of analyzing traffic data in order to determine whether or not it is attempting to access anything that has been banned or blacklisted.
Internet filtering usually takes place at one of five locations:
A national censorship regime might have influence over any of these, though we typically focus on (3) and (4) when discussing state-level filtering.
Many comptuers in schools, libraries and Internet cafes (and even some in homes and businesses) contain software that directly prohibits requests for certain content. This sort of filtering is often associated with shared, publicly accessible devices or personal devices that are administered by someone in a position of authority (such as a parent or a corporate IT department).
There could be locally installed internet filtering software at your workplace, library, Internet cafe, etc. Technically, such software could be installed on any of the routers between you and the server you are trying to access, but we typically associate access point filtering with businesses, shared computers and publicly accessible (freely available or for-fee) Intenet connections.
Your ISP, which naturally has the ability to see any direct requests you make online, can implement filtering either by preventing your request from reaching its destination, or (less frequently) by preventing the response from reaching you.
Many national filtering policies are implemented at the ISP level - in fact, many ISPs are government-owned and operated.
Online services are sometimes “defaced,” in order to prevent them from responding to requests for content, regardless of where those requests might be coming from.
Finally, while we don’t usually think of it as a “blocking” or “filtering,” a service can prevent you from accessing its own content based on any number of things: your IP address, the country from which your request was sent, the preferred language specified by your browser, etc.
Besides using legal or socio-cultural means to curtail access to particular types of information online, the following are common technical methods used to prevent access to online content.
Access to a particular IP address is denied. When information is sent over the Internet, it is broken up into a number of packets. In addition to the actual data being sent, each packet contains information about how to route the packet itself.
If the target is on a “shared hosting” server (one of the more affordable ways to put up a website), then all sites on that server will be blocked. Similarly, IP blocking cannot be used to filter a particular video or Facebook profile.
If a DNS server is configured to filter content, it consults a “blacklist” of blocked domain names. When you enter a URL in a Web browser, the first thing the Web browser does is ask a DNS server to look up the domain name referenced in the URL and supply the corresponding IP address.
DNS filtering has limitations similar to those of IP filtering, and also tends toward unintentional over-blocking.
When requesting content over HTTP (versus encrypted HTTPS) the entire URL can be scanned for banned keywords. Regardless of the actual domain name or IP address you are trying to reach, filtering software can prevent access based on the presence of these keywords.
This process is often called “deep packet inspection” and refers to the process of monitoring traffic and censoring requests for banned content by performing a “deep inspection” of the content of individual data packets sent as part of a request.
Servers listen on different numbered ports in order to provide different services. Ports are infrastructure within the larger communication framework of the internet, that serve as channels for different protocols or traffic types - each is referred to by a number.
These ports are generally consistent, so blacklisting a given port number will block a particular type of traffic, regardless of the actual server to which a request is being sent.
Major international Web platforms that serve content to people all over the world—such as Google’s search engine, YouTube, Twitter and Facebook—have at times complied with requests from governments to remove certain content from their portals. This renders content invisible to people who do not know where else to find it. Unfortunately, censorship circumvention tools are generally unable to get around this sort of blocking.
In extreme cases, such as during a popular uprising, some governments have been known to disable their citizens’ access to the Internet entirely. Once again, there is little that traditional circumvention solutions can do to address this form of censorship. Fortunately, such blockades tend to be extremely unpopular, and are rarely left in place for long.
To get around technical website filters, most circumvention tools simply ask a server in some other country to fetch blocked websites for them. This server is known as a proxy.
As long as the censorship software you are trying to bypass has not added your proxy to its blacklist, in addition to the blocked content itself, this technique works quite well.
Before choosing a proxy, it is important make sure that it meets the following critieria:
While the ISP may not be able to see the full scope of your internet activity when you use a proxy, whoever is running the proxy server can.
When you use a tool to proxy your Internet traffic, it is important that your connection to the proxy server be encrypted. In addition, you must ensure that the connection between your proxy server and the destination site is also encrypted.
This assumes that you are requesting content from a secure server, such as an HTTPS website; not all website-based proxies provide this level of security.
Furthermore, even a website-based proxy that does encrypt both ends of the proxied connection may itself be able to access your sensitive content, including your passwords.
This generally presents an unacceptable risk, so you are almost certainly better off using a technology that is known to provide a single, encrypted tunnel all the way from your device, through one or more proxies, to the content you are trying to access. Examples include VPNs and Tor, as discussed below.
VPN software, which you may have to install on your PC or mobile device, provides a secure tunnel between you and a VPN server on the Internet. All of your Internet traffic will be sent through that tunnel before being routed to its destination.
As long as your VPN server is located somewhere that is not subject to filtering, this will allow you to access blocked content. Trust is still important, as your VPN provider could easily maintain a list of the websites you visit, but at least they will not be able to access the traffic send to (or receive from) encrypted services like HTTPS websites.
Anonymity networks typically “bounce” your Internet traffic between various secure proxies in order to disguise where you are coming from and what you are trying to access.
Tor is the most well tested and widely used anonymizing proxy network. By tunneling your traffic through a randomly selected series of encrypted relays, Tor offers a secure, reliable, publicly accessible means of circumvention that saves you from having to worry quite so much about the extent to which you trust your ISP, the organization that runs your proxy servers, or the the filtered websites themselves.