Monday, February 18, 2008

How to choose a circumvention technology

Considerations For The Circumvention User

a) What, Where, How

Do you want to access or publish information on the Internet?

Although closely related, accessing banned content, as opposed to publishing it, can involve different risks, strategies and technologies for the user. We have created a separate guide for those who want to circumvent Internet censorship to publish information online.

Are you accessing the Internet from a private or public computer?

Accessing the Internet from either your home or a public computer at an Internet cafe or public library involves a different set of considerations, and presents a range of possibilities for circumvention. For example, users who access the Internet from public computers or Internet
cafés may not be able to install any software and will be restricted to web-based solutions.

Others may want to use applications besides Web browsing (HTTP), such as e-mail (SMTP) and file transfers (FTP), and thus may want to install software on their computer workstation and to 6tweak their computer’s settings. With your own private computer, you can install any software of your own choosing that you may not be able to install on a public Internet terminal. However doing so can impose additional risks, as there is now evidence on your computer of the use of circumvention technologies which, if seized by authorities, could lead to liabilities.

Public Internet access can offer anonymity that private computers cannot, although some require visitors to present personal identification and/or monitor visitors’ usage. Whether you circumvent censorship through your home or a public terminal, it is always important to understand as fully as possible the terms and conditions of the service that is being provided.

b) Who Do You Know?

Do you have any connections to or availability of trusted out-of-country contacts (e.g., friends, family members, colleagues)?

Since circumventing Internet censorship involves making connections to a computer outside of the jurisdiction in which the censorship takes place, an important factor for consideration is whether you know and trust someone or group outside of the country who is willing to provide circumvention services for you. Many users who circumvent censorship do so by connecting to open public proxy computers whose connection information is advertised in some manner.

Users should be aware that these are the least secure by definition, since a user can never be certain that an adversary has not set up a trap, or "honey pot", to entice dissidents. Having someone you know and trust set up a connection instead is a better option, but it is not without its own set of risks and considerations. Providers can monitor everything you do online, including all of the sites you visit. That is why it is essential that you fully trust the person or organization that is providing the circumvention service for you. Successful, long-term and stable circumvention is greatly enhanced by having a trusted contact in a non-filtered location.

Are you willing to pay and put your trust into a third party organization to access or publish information on the Internet?

If you do not have access to trusted friends and family members outside of your jurisdiction then you may have to put your trust into a third party. There are many commercial providers that offer circumvention services for a fee. If you are able to afford this option, be careful to explore the terms and conditions of the service and the privacy policy. Commercial services may offer anonymity to surf the Internet, but not anonymity from the commercial provider itself. If compelled by law, the commercial service may turn over all of their records, and your personal information.

c) What Do You Know?

What is your level of technical expertise? Do you consider yourself a beginner, intermediate, or expert computer user?

The greater your level of technical expertise the more your circumvention options increase. Some users may find the installation, set-up process, and use of circumvention technologies to be too onerous or beyond their level of expertise. Although it is always possible to invest time and learn how to use even the most seemingly complex software, be careful: the incorrect installation and use of circumvention technologies may put you at considerable risk.

What language of use is acceptable/preferable to you? Do you require technologies that operate other than English?

Most circumvention technologies are designed with user interfaces and instructions in English, although many also offer versions of their systems and user guides in other languages. If you are consulting a translated user’s manual, be sure that the translations you use match the version of the software you are employing as the two may not necessarily match.

d) Safety & Security

Are you accessing content that is highly critical of and is considered a security threat to the country in which you live?

Is there a precedent for arrests for the practice of circumventing Internet censorship in your country?

Do you have any affiliations with high profile groups that are known to be on your government’s watch list?

Accessing banned content can be a serious violation of the law, especially if the information you are visiting is considered a national security threat. If you are consistently accessing this type of content, you should choose circumvention technologies that offer the greatest anonymity and security. However, there is usually a trade-off between ease-of-use and security so be prepared to spend extra time and effort in order to minimize risks.

If you are associated with a high profile rights organization or dissident group, then you may be on
your government’s watch list and you should take extra precautions in carefully choosing your circumvention technologies. You may want to assume that you are being monitored and that your computer could be seized at any time. Avoid circumvention technologies that require installation on your computer. If possible, access the Internet from a range of different anonymous public terminals instead.

e) Identity

Is protecting your identity online of paramount importance to you?

Do you want to surf and/or publish anonymously?

Circumvention and anonymity are different. Anonymous systems protect your identity from the website you are connecting to and from the anonymity system itself. They can be used for circumvention, but are not designed for this purpose and thus can easily be blocked. Circumvention systems are designed to get around blocking but do not protect your identity from the circumvention provider.

Do not mistake open public proxies for anonymous systems - they are not. Although they may not ask for personal information, they can view and record the location of the computer from which you are connecting and all of the websites you visit through them. Commercial services which advertize anonymous surfing may still record your connection information and the web sites you visit. Make sure you fully understand the terms and conditions of their use.

There are a number of strategies that you can follow if you want to publish online anonymously. The Citizen Lab has created a separate guide on circumvention for publishing online that includes a section on anonymous publishing.

Consideration For The Circumvention Provider

a) Safety First

Setting up a circumvention technology for someone is a great way to give a helping hand to others to exercise their basic human rights of access to information and freedom of speech. However, it is a choice that carries with it a heavy responsibility and several considerations. Above all else, the safety of your users must be your primary concern.

What is your level of technical expertise?

Do you consider yourself a beginner, intermediate, or expert computer user?

Setting up and hosting a circumvention technology server can be a time-consuming and complex task depending on the circumvention system. Some require the download and installation of several different pieces of software. Almost all of them will entail some configuration to accommodate your own particular network environment. If you are running your Internet connection through a home router or firewall, for example, there may be some customization of your circumvention system.

Some circumvention technologies have very clear and helpful documentation and user guides while others do not. Be sure that you choose a technology that matches your skill level and abilities, as setting up a system improperly could jeopardize the security of your user(s). Make sure that you are also comfortable maintaining your system, as an outdated or constantly interrupted technology can frustrate and needlessly endanger users in censored locations.

b) Your Users

What is the number of users you expect or want to accommodate and what is your available bandwidth?

The number of users you allow to surf through your computer will affect your computer’s processing capabilities and your connection speeds, affecting not only what you do but what circumvention users can do. The more users you have, the more complicated it will be to monitor their usage (if necessary) and manage their accounts. Make sure that you offer circumvention services only to the number of users you and your computer can comfortably handle.

What will you allow your users to do through your connection?

Would you want to know what information they are accessing or publishing?

What are you going to do with their surfing records?

Setting up a circumvention service means that you will be able to monitor all of the usage that runs through it. Having this capability means that you can decide what information you will allow users to retrieve or publish. Some circumvention systems make this feature easier to employ than others, but even those that do not still leave traces on your computer of the user’s activity.

You must decide for yourself what information you will choose to view, archive, and/or discard. If you choose to discard this information, make sure that you do it properly as even deleted information can leave traces. Above all, make sure that you let your users know what your standard operating procedure will be concerning the information they leave on your computer and what they can do through your circumvention system. Communicate a clear policy to your users.

c) Risks

What are your potential security and legal risks of hosting circumvention technologies?

Does your ISP or government restrict this type of service?

The risks of hosting circumvention technologies are not as great as they are for users of circumvention technologies, but they are not zero. You are almost certainly responsible for everything that is done through your computer using your Internet connection. If someone visits websites or posts information through your circumvention service that is illegal you may be held liable. A less likely but nonetheless significant risk concerns the possibility of you becoming a target of foreign agents of the country in which your service is offered. Make sure that you understand the potential security and legal risks of hosting circumvention technologies from the perspective of both your ISP and your own government.