2010 Circumvention Tool Usage Report Hal Roberts, Ethan Zuckerman, Jillian York, Robert Faris, and John Palfrey † The Berkman Center for Internet & Society October 2010 † Each co-author is affiliated with The Berkman Center for Internet & Society at Harvard University. Hal Roberts is a fellow; Ethan Zuckerman is a senior researcher; Jillian York is a staff member; Robert Faris is the director of research; and John Palfrey is a faculty co-director of the Berkman Center. We gratefully acknowledge support for this research from the U.S. Department of State via a subgrant through Internews Network (USA). The Berkman Center shares funders with some of the makers of circumvention tools such as Tor, Psiphon, Freegate and Ultrasurf. Neither the Berkman Center nor the authors of this paper have any involvement in any of the technologies or entities described in this report, including but not limited to Tor, Freegate, or Ultrasurf. Neither the Berkman Center nor the authors stand to profit in any way financially from the success of any general technology or specific tool described in this report. 1 Circumvention Tool Usage Report Hal Roberts, Ethan Zuckerman, Rob Faris, John Palfrey Berkman Center for Internet and Society at Harvard University Introduction Circumvention tools allow users to bypass Internet filtering to access content otherwise blocked by governments, workplaces, schools, or even the blocked sites themselves. There are a number of different types of these tools: blocking-resistant tools, simple web proxies, virtual private network (VPN) services, and open HTTP/SOCKS proxies. But every type of circumvention tool provides the same basic functionality – proxying user connections to provide access to otherwise blocked sites. In the following report, we use a variety of methods to evaluate the usage of the first three of these four types of tools to test two hypotheses. First, even though much of the media attention on circumvention tools has been given to a handful of tools – notably Freegate, Ultrasurf, Tor, and Hotspot Shield – we find that these tools represent only a small portion of overall circumvention usage and that the attention paid to these tools has been disproportionate to their usage, especially when compared to the more widely used simple web proxies. 1 Second, even when including the more widely-used simple web proxies, we find that overall usage of circumvention tools is still very small in proportion to the number of Internet users in countries with substantial national Internet filtering. Key Findings • We estimate that no more than 3% of Internet users in countries that engage in substantial filtering use circumvention tools. The actual number is likely considerably less. • Many more users use simple web proxies than use either blocking-resistant tools or VPN services. Of the 11 tools with at least 250,000 unique monthly monthly users, 3 are blocking- resistant tools, 1 is a VPN service, and 7 are simple web proxies. • When users search for proxy and circumvention related terms in filtering countries, they overwhelmingly search for generic proxy terms like “proxy,” and those terms overwhelmingly return either simple web proxies or sites that list simple web proxies and HTTP/SOCKS proxies, not more sophisticated tools. Circumvention Tool Types The OpenNet Initiative has documented network filtering of the Internet by national governments in over forty countries worldwide. 2 Countries use this network filtering as one of many methods to 1 We used google to search nytimes.com (eg. [site:nytimes.com freegate]) for mentions of the ten most popular circumvention tools (as documented in the body of this paper) and found the following number of mentions for the following terms: Freegate: 17, Ultrasurf: 3, Global Internet Freedom Consortium (which includes both Freegate and Ultrasurf): 15, Tor project: 8, Hotspot Shield: 7. The other six tools in the set of ten most used circumvention tools are all simple web proxies – the six combined received only one mention on nytimes.com.. 2 See the country reports, available for free online, at http://opennet.net. For a book-length treatment of this topic, see 2 control the flow of online content that is objectionable to the filtering governments for social, political, and security reasons. Filtering is particularly appealing to governments as it allows them to control content not published within their national borders. In addition to national Internet filtering by governments, many schools and businesses filter their local connections to the Internet. Many web sites even filter their own content by the geographic location their users – for example, television streaming site hulu.com blocks all users outside of the U.S. from accessing its content. All circumvention tools use the same basic method to bypass this sort of network filtering: they proxy connections through third party sites that are not filtered themselves. By using this method, a user in China who cannot reach http://falundafa.org directly can instead access a proxy machine like http://superproxy.com/, which can fetch http://falundafa.org for the user. The network filter only sees a connection to the proxy machine (superproxy.com), and so as long as the proxy itself remains unfiltered, the user can visit sites through the proxy that are otherwise blocked by the network filter. Some, but not all, tools also encrypt traffic between the user and proxy, both so that the traffic between the user and proxy is much more difficult to monitor and so, that filtering triggered by the content of the traffic (instead of merely the destination of the traffic) will not work. Despite this core similarity, circumvention tools differ significantly in many implementation details. We break circumvention tools into four large categories based on their proxy implementations. Each category of tool is distinguished from one another also by virtue of each being closely associated with a single model of financial support. The four categories of tools are: • blocking-resistant tools • simple web proxies • VPN services • HTTP/SOCKS proxies The defining characteristic of blocking-resistant tools is that they implement sophisticated methods for evading blocking by filters. A core problem for all circumvention tools is that proxy sites can be blocked just as content and other sites. China can block superproxy.com as well as falundafa.org, and then proxy requests through superproxy.com will cease working. Some tools in each of the above categories use simple forms of blocking resistance to avoid this sort of filtering—for example, a simple web proxy might maintain a list of alternative domain names to send to users in the case that one or more of its existing domain names is blocked. The tools we classify as blocking-resistant tools distinguish themselves from the other categories of tools by implementing much more sophisticated technical means of blocking resistance. 3 Ronald Deibert, John Palfrey, Rafal Rohozinski, and Jonathan Zittrain, eds., Access Controlled: The Shaping of Power, Rights, and Rule in Cyberspace (MIT Press, 2010). 3 All of these tools use the same basic method for remaining unblocked. In addition to a core of powerful proxy machines that transit and accelerate proxy traffic, these tools maintain a large pool of “disposable” front end proxies whose only job is to proxy traffic back to the core proxies. These blocking-resistant tools are able to cycle quickly through large numbers of these front end proxies as they are blocked by filtering countries, so that the user is ideally always able to 3 All of the tools in this category also require installation of a downloaded, client-side application but use the native interface of the browser for web access, unlike the simple web proxies described below. We include only a handful of tools in this category: Freegate, Ultrasurf, and Tor. All of the tools in this category are supported primarily by governmental or charitable funding. Freegate and Ultrasurf are part of the Global Internet Freedom Consortium (GIFC), a Falun Gong-associated group, and are expressly aimed at allowing Chinese people to bypass Chinese government filtering to access political content (though users in other countries use the GIFC tools as well). Tor was initially developed as an anonymity tool but is also effective as a circumvention tool. Simple web proxies are server-side applications accessed through web page forms. To use one of these tools, the user simply visits a web page that includes a form with a url input box. Instead of entering a web page url into the browser address bar, the user enters the address into the web page form. By submitting this web page form, the user sends the url request to the proxy web server, and the web server returns the page via the proxy. Simple web proxies do not require the user to download or install any client-side application. To use the tool the user needs only visit the web page hosting the proxying web application (for instance http://superproxy.com). Simple web proxies do require, however, that the user navigate the separate, form based browsing interface. Almost all of these tools support themselves by hosting ads, on either or both of the initial landing page and the banners inserted onto the top of proxied web pages. Some tools go a step further and attempt to replace ads on the requested page with their own ads. Simple web proxies were initially targeted at students in the U.S. and other countries to bypass school filtering systems, but they use the same basic proxying methods as the blocking-resistant tools and so also serve to bypass national filters as long as a given proxy is not specifically blocked by a given country. Some simple proxies have been optimized for usage in countries where the Internet is filtered by the government.