```

[Joint House and Senate Hearing, 107 Congress]
[From the U.S. Government Publishing Office]

 
           CHINA'S CYBER-WALL: CAN TECHNOLOGY BREAK THROUGH?
=======================================================================

                               ROUNDTABLE

                               before the

              CONGRESSIONAL-EXECUTIVE COMMISSION ON CHINA

                      ONE HUNDRED SEVENTH CONGRESS

                             SECOND SESSION

                               __________

                            NOVEMBER 4, 2002

                               __________

 Printed for the use of the Congressional-Executive Commission on China

         Available via the World Wide Web: http://www.cecc.gov

                           U.S. GOVERNMENT PRINTING OFFICE
83-512                          WASHINGTON : 2003
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

              CONGRESSIONAL-EXECUTIVE COMMISSION ON CHINA

                    LEGISLATIVE BRANCH COMMISSIONERS

Senate

                                     House

MAX BAUCUS, Montana, Chairman        DOUG BEREUTER, Nebraska, Co-
CARL LEVIN, Michigan                 Chairman
DIANNE FEINSTEIN, California         JIM LEACH, Iowa
BYRON DORGAN, North Dakota           DAVID DREIER, California
EVAN BAYH, Indiana                   FRANK WOLF, Virginia
CHUCK HAGEL, Nebraska                JOE PITTS, Pennsylvania
BOB SMITH, New Hampshire             SANDER LEVIN, Michigan
SAM BROWNBACK, Kansas                MARCY KAPTUR, Ohio
TIM HUTCHINSON, Arkansas             SHERROD BROWN, Ohio
                                     JIM DAVIS, Florida

                     EXECUTIVE BRANCH COMMISSIONERS

                 PAULA DOBRIANSKY, Department of State
                 GRANT ALDONAS, Department of Commerce
                D. CAMERON FINDLAY, Department of Labor
                   LORNE CRANER, Department of State
                    JAMES KELLY, Department of State

                        Ira Wolf, Staff Director
                   John Foarde, Deputy Staff Director

                                  (ii)

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

Rubin, Aviel, co-founder, Publius Web Publishing System, West 
  Caldwell, NJ...................................................     1
Xia, Bill, president, Dynamic Internet Technology, Inc., Cary, NC     5
Lin, Hai, computer scientist, Shanghai, China....................     7
Baranowski, Paul, chief architect, Peekabooty Project, Toronto, 
  ON, Canada.....................................................     9

                                APPENDIX
                          Prepared Statements

Rubin, Aviel.....................................................    28
Xia, Bill........................................................    29
Baranowski, Paul.................................................    31

           CHINA'S CYBER-WALL: CAN TECHNOLOGY BREAK THROUGH?

                              ----------                              

                        MONDAY, NOVEMBER 4, 2002

                            Congressional-Executive
                                       Commission on China,
                                                    Washington, DC.
    The roundtable was convened, pursuant to notice, at 2:30 
p.m. in room SD-215, Dirksen Senate Office Building, Ira Wolf 
(staff 
director) presiding.
    Also present: William Farris, senior specialist on Internet 
issues and commercial rule of law; Keith Hand, senior counsel; 
Holly Vineyard, U.S. Department of Commerce; and Dr. Jay 
Sailey, interpreter, Silver Spring, MD.
    Mr. Wolf. I would like to welcome everyone here to today's 
roundtable on China's Cyber-Wall: Can Technology Break Through?
    This is actually our second roundtable this year dealing 
with Internet issues in China. The first dealt more with policy 
issues, and today we are going to get more into the technology 
side.
    Next to me is William Farris, who is on the Commission 
staff and is in charge of Internet issues. Holly Vineyard works 
at the U.S. Department of Commerce for our Commissioner, Under 
Secretary of Commerce Grant Aldonas, and Keith Hand is one of 
our senior legal counsels on the Commission staff.
    I am Ira Wolf, staff director of the Commission. John 
Foarde, who is the deputy staff director and normally would be 
here, is in China.
    We have four panelists. Avi Rubin is co-founder of Publius; 
Bill Xia, president of Dynamic Internet Technology; Lin Hai, a 
computer scientist from Shanghai; and Paul Baranowski, chief 
architect for the Peekabooty project.
    We also have Jay Sailey, who will be helping with 
interpretation. Jay, it is good to always have you back again. 
Thanks.
    Avi, why do we not start with you?

 STATEMENT OF AVIEL RUBIN, CO-FOUNDER, PUBLIUS WEB PUBLISHING 
                   SYSTEM, WEST CALDWELL, NJ

    Mr. Rubin. Let me give a little more of an introduction of 
myself. I want to give you an idea of the kinds of questions I 
am hoping to get and the kinds that I will defer to my other 
panelists.
    I am a researcher at AT&T Labs, a computer science 
background. I am here explicitly not as a representative of 
AT&T, but as a computer scientist.
    In January, I will be starting to work in a faculty 
position as an associate professor at Johns Hopkins, and the 
technical director of their Information Security Institute.
    The reason that I am here is that some of my research in 
the past that focuses on computer security and networking has 
been on systems that resist censorship. One of them called 
``Crowds'' was designed for browsing the Web anonymously so 
that end users and other users of the system cannot tell who is 
accessing what.
    The other system, called ``Publius,'' which has won a 
censorship resistance award and is a little better known, was 
designed to publish information on a large network like the 
Internet in such a way that it is very difficult for anyone to 
forcibly remove the content.
    I am not an expert on China and I would rather answer 
general questions, such as, ``Is this possible? Is that 
possible? Why or why not? ''
    So let me talk a little bit about censorship. I think it is 
important to make a distinction between censorship within a 
network or within an organization or a country and censorship 
between users who are on the inside trying to access something 
that is on the outside where an adversary controls the 
interface between the inside and the outside, which is the kind 
of model that we are looking at here.
    The censor can prevent access to content on the outside 
through several means. One of them is simply by routing, 
looking at the Internet Protocol [IP] addresses of the 
destination of a request, and if it is on the outside, perhaps 
blocking that or filtering it some other way, or making a 
decision about how to treat that traffic 
differently.
    Another way would be through use of the domain name system. 
For those of you that do not know, the domain name system is 
the service that translates names like www.google.com into an 
IP address that networks need in order to get the packets where 
they need to go.
    So one thing that a censor could do, and I believe in a lot 
of cases this happens not only for censorship but for other 
purposes, is if the organization controls the domain name 
service [DNS]--and a powerful government can control the domain 
name service, or at least control those that control it--you 
can return false information, so when someone asks for 
google.com you can return an IP 
address. This will all be transparent to the users.
    That is an IP address to a computer under your own control, 
which could then simulate Google, giving the user the 
experience that they think they are at Google, but they are 
actually at some other, mirroring network. This would be a 
censorship technique that could be employed, or could simply 
drop the traffic or do whatever they want with it.
    Finally, you could do something called application level 
filtering. Instead of doing the censorship at the routing level 
or the domain name service level, what you could do is allow 
all traffic through. But, if it is destined for port 80, which 
is the World Wide Web port, then you could treat it 
differently.
    You could make filtering decisions and you could run it 
through software that looks for particular destinations, 
compare it to a blacklist and say, well, we are not going to 
allow that, or worse, we are going to substitute something for 
that in the reply, spoofing the reply.
    So, this has had to do with blocking the access of an 
individual within an organization to sites that are outside the 
organization.
    Another type of censorship is prohibiting the posting of 
content. I am an individual and I have something that I wish to 
have people access. Maybe I have some agenda that I want to 
publicize, or I want to be critical of the government, or 
whatever. A censor may wish to block the ability of somebody to 
post the content.
    One way to do that would be to monitor sites carefully 
using search engines or hot lists, and see if content that is 
objectionable is there, and then to go make the people remove 
it if the content is on the inside.
    Another, is through informants or spies who could 
infiltrate organizations that may wish to publish something 
that they would find offensive, and then finding out that it is 
there and doing the same thing.
    Again, if you control the connectivity, you can prevent 
someone inside your organization, your country, or China from 
being able to publish something that is in a site that is 
outside by simply blocking the connectivity or making the 
decision not to allow that.
    So what I have discussed up to this point is a one-to-many 
censorship. Somebody publishes something on the Web, say, and 
you either block their ability to publish that or you block 
people's ability to retrieve that information.
    Another type of censorship would be one-to-one 
communication. Someone may want to monitor e-mail messages that 
are going from one individual to another, and there are various 
ways of doing that.
    The FBI has a system called ``Carnivore'' that can be 
deployed at an Internet service provider [ISP]. What it does is 
it searches 
e-mails coming in and out for certain key words, looking 
perhaps for terrorist activity.
    The Chinese Government could deploy similar things at ISPs. 
In fact, they probably have more control over what the ISPs are 
doing, and look for whatever it is that they are interested in 
blocking. Then they can take whatever actions they want. They 
could block those e-mail messages. They could try to trace the 
owners of the accounts who sent or received those.
    Another thing that could happen to e-mail is, again, an 
application-level way of censoring. At the network level, what 
we call the IP layer, you could sniff. Network sniffers are 
programs that will look at packets coming in and out and make 
the same kind of decisions that were made at the application 
level about the e-mail by just looking at raw IP packets.
    It is a bit harder to do, but there are tools out there to 
do it. You take a bit of a performance hit when you do it that 
way, but the advantage for the censoring party in doing it that 
way is that it is completely passive. The ISP does not need to 
know that this kind of sniffing is taking place. Nobody can 
detect that it is happening.
    Another way to censor the one-to-one communication is to 
forbid encryption. If encryption is not allowed, then something 
like Carnivore or network sniffing is very effective.
    What sort of enforcement could take place if censorship 
were to detect that somebody had offensive content posted 
somewhere? When something is published, it resides in a 
physical place. It is on a computer. If that computer is under 
the domain of the censor, the censor can apply pressure to the 
administrator, or sanctions to the administrator of that 
computer and say, ``take that content down.''
    Finally, a way of censoring content might be to mandate a 
custom client. Instead of a Netscape or Internet Explorer 
browser, a government could say, ``We require you to use this 
program to browse the net,'' and that program could be some 
sort of scaled-down version that can only access certain 
approved sites.
    So up until now I have talked to you about ways of 
censoring. Let me speak, for my remaining time, about types of 
circumvention that you might have.
    One, is called steganography. The idea behind steganography 
is to hide content in other content. Briefly, imagine a 
photograph of your cat encoded as a JPEG image on a computer.
    There are tools out there for you to take a letter, an 
ASCII text letter, and encode the content of that letter in the 
picture of the cat, which still will look like a cat. And the 
only people that could extract that information, the letter 
from this picture, would be someone who knew the key, say, that 
you had shared with them.
    In fact, there are techniques where two photographs are 
indistinguishable relative to whether or not they contain 
content to anyone except the holder of the key. So, this might 
be a valuable technique to use if encryption is outlawed and 
you are worried about 
sanctions.
    On the other hand, if someone does discover the key through 
force or through some other means, then you could be in a lot 
of trouble, because once they extract the letter that could not 
have been coincidental.
    Another way is to disperse content widely. If you want to 
publish something and you have an automated way of publishing 
it in a thousand places, it becomes a lot harder for a censor 
to remove it, especially if these are under different 
administrative domains and countries.
    The Publius system that I designed and built uses the last 
two techniques in tandem, along with several others. I am happy 
to cover it more during questions and answers.
    Two other mechanisms for circumventing the censorship to 
post something are covert channels. A quick example of a covert 
channel might be, let us say that I was to communicate a 
message to you. So what I do is send you an e-mail message 
every second, or I do not send you an e-mail message every 
second, and whether or not I send you a message encodes a zero 
or a one.
    That is just a very lightweight example of how I could 
communicate information to you where I am actually using a 
covert 
channel. The fact that I sent something or did not send it is 
the information, and whatever it is that I sent could be just 
innocuous.
    Finally, there is a technique called a homomorphic 
encryption. That is a mechanism whereby you can encrypt 
something so that it can be decrypted two different ways. So I 
send you an encrypted document.
    Of course, only a regime that allows encryption would 
support something like this. You can decrypt it and it is a 
picture of your cat, and you can decrypt it and it is a call to 
arms. It depends on how you decrypt. So, that might be useful.
    For retrieval. I am running out of time, so I will just 
enumerate the things you could use. Special proxies, the Crowd 
system, which I can talk more about in the questions and 
answers, or an anonymous location, a library, a cafe, something 
like that if the country supports these kinds of things.
    Finally, let me just say that I believe there is an arms 
race between censorship and censorship circumvention, because 
if you tell me what you are using to censor I can tell you what 
to do to get around it. But, once I do that, then I could come 
back and tell you what you could do to get around that. I think 
we are in the midst of this arms race.
    I believe that any technology to circumvent censorship, 
having had the experience of developing such a thing, is going 
to lead to a double-edged sword where you could be accused of 
providing mechanisms whereby bad people can also do things.
    [The prepared statement of Mr. Rubin appears in the 
appendix.]
    Mr. Wolf. Thank you very much.
    Bill Xia.

STATEMENT OF BILL XIA, PRESIDENT, DYNAMIC INTERNET TECHNOLOGY, 
                         INC., CARY, NC

    Mr. Xia. Good afternoon, ladies and gentlemen. I would like 
to thank William Farris for inviting me to come here today.
    My name is Bill Xia. I am the president of Dynamic Internet 
Technology [DIT]. DIT conducts research regarding Internet 
censorship and provides service for anti-censorship 
technologies.
    Today I would like to share with you the experience of 
DynaWeb and ponder upon the role of technology in breaking 
through China's cyber-wall.
    DynaWeb was launched on March 12, 2002 as a proxy network 
that allows users to circumvent Internet censorship in China 
and to have secure and full access to the Internet.
    Users can use DynaWeb as an information Web or to go to 
other Web sites. Since the inception of DynaWeb, we have 
managed to stay ahead of the censorship by China most of the 
time. About 20,000 unique users gain regular, unblocked access 
to the Internet through us.
    DynaWeb has already played several rounds of the censorship 
and anti-censorship game in the past 8 months. Before I start, 
I would like to explain a few critical technical terms for 
understanding the DynaWeb experience.
    There are two ways to access a Web site through an Internet 
browser. One, is through typing the domain name, for example, 
google.com. The other way is through typing the IP address of 
the domain name. The IP address is the essential element from 
which the browser can fetch the Web site information for the 
user.
    However, a domain name is more user friendly. After a user 
types in a domain name, the Web browser will browse domain 
names to IP addresses and fetch the right information for the 
user. So this is essentially what Mr. Rubin explained about the 
DN 
system.
    The game started with an e-mail subscription service. At 
the 
beginning, DynaWeb e-mailed unblocked IP address updates to 
subscribers. After 2 weeks, the censor probably subscribed to 
our e-mail service as well because the very time window of 
DynaWeb IP addresses was reduced a range of a couple hours to a 
few days after release.
    Then our services expanded to the domain name with Dynamic 
IP addresses. However, censors started chasing the DynaWeb 
domain by automatically detecting the IP addresses that pointed 
to the domain name. This dramatically increased the need for 
back-up IP addresses, hence, increased costs of DynaWeb 
maintenance.
    Then DynaWeb adopted a new strategy so that censors had to 
manually verify the IP address before blocking it. Then 
automatic IP blockage stopped.
    Soon, in August, users started to have difficulty in 
accessing DynaWeb through https, even though the IP was not 
blocked. It was found out later on that the certificate DynaWeb 
used for secured access from the Internet browser was filtered. 
This can be achieved by package-level analysis of Internet 
traffic to find out the signature related to the certificate 
DynaWeb used.
    In response to this, DynaWeb started to change its 
certificates daily. No reports of certificate blocking have 
been found since then. Again, censors were frustrated with the 
resources required for daily updates of all related content 
filtering engines, and quit.
    At the end of September, DynaWeb domain names were hijacked 
to a fixed IP 64.33.88.161 in China, along with many other Web 
sites like www.voa.gov. DIT has published a detailed report 
about this hijacking and it can be independently verified from 
the United States. More study about this hijacking is still 
ongoing and will be released after we pass this stage.
    So what is next with the cyber-wall? As a first look, it is 
a technical question. If technology can break through China's 
cyber-wall, in fact, the process is a race of technology and 
time. As DynaWeb's experience has demonstrated, both parties 
can always implement new technologies to stay ahead and sustain 
the advantage.
    If the Internet breakthrough is defined as a pure technical 
issue, the future is brighter for censors because China 
purchases the most advanced censorship technologies from 
Western companies.
    China is also developing the ``Golden Shield'' project, a 
``database-driven remote surveillance system.'' When the whole 
Beijing city is wired with a biometric sensor and camera 
network, no Internet-based anti-censorship can get around the 
surveillance system.
    Even now, during the 8 months of the technical race with 
DynaWeb, China has developed the largest and most sophisticated 
IP blocking and content filtering system in the world.
    The more anti-censorship techniques are developed, the more 
comprehensive censorship technology has become. This leaves 
less and less technical room for anti-censorship. So, it is 
critical to take full use of technologies to benefit as many 
people as possible before the door is closed.
    Second, it is a matter of available resources. China has 
30,000 Internet police that specialize in Internet censorship, 
and ISPs are forced to perform self-censorship. The self-
censorship is even adopted by foreign ISPs such as Yahoo.
    China has purchased top technology from Western companies. 
These technologies have been modified for China's particular 
censorship needs. Nortel, Sun Microsystems, Cisco, and many 
smaller companies contributed to building China's cyber-wall.
    Compared to China's investment in censorship and the cyber-
wall, investment in breaking through this cyber-wall is next to 
nothing. There are very few groups developing technologies 
suitable for this wall. With more resources, DynaWeb can 
provide services to more people, develop better client 
software, and have closer monitoring of censors' new 
technologies, and respond faster.
    Third, people develop technology and technology serves 
people. The people factor is the most important factor, 
eventually. Recent increase of public awareness about China's 
Internet censorship both inside and outside of China is a great 
sign. We hope that this will help improve the current situation 
soon.
    Currently, companies contributing to China's cyber-wall 
bear little public pressure, not to mention any legislative 
limitation.
    Inside China, more and more harassment and arrests of 
dissidents and journalists are related to the Internet. Last 
year, there were more than 10 arrests in China for distributing 
forbidden information. This will create fear among the public. 
For the general public in China, they are now gradually 
realizing the existence of censorship consciously.
    More importantly, the government has adopted subtle mind 
control and propaganda to decrease the Chinese's interest in 
uncensored information. All major events outside of China are 
reported, with seemingly a variety of views, although all the 
different views are in fact the government's view. There is a 
fully developed online community inside China serviced by self-
censoring ISPs. This strategy is an extension of China's cyber-
wall, a wall in people's minds.
    The Internet, combined with TV, newspapers, and other 
information channels, now offer the Chinese people different 
types of information and different views on certain issues. It 
looks like full 
freedom of speech has been achieved.
    However, the government produces all the different views 
and types of information. The censors tried to use these to 
reduce 
people's interest in uncensored information.
    In summary, technology alone will not decide the future of 
China's cyber-wall, but people do. If all Chinese people would 
like to obtain uncensored information, the cyber-wall will be 
broken from the inside.
    Thank you.
    [The prepared statement of Mr. Xia appears in the 
appendix.]
    Mr. Wolf. Thank you very much.
    Lin Hai.

   STATEMENT OF LIN HAI, COMPUTER SCIENTIST, SHANGHAI, CHINA

    Mr. Lin. Ladies and gentlemen, good afternoon. My name is 
Lin Hai. I was born in Shanghai, China and graduated from 
Beijing's University of Aeronautics. I majored in computer 
science.
    After graduation, I worked as a software engineer, as well 
as sales marketing in some technology companies in Beijing for 
more than 5 years.
    At the end of 1995, I went back to my home town, Shanghai, 
and created a small Internet company with my partners. Our 
major business was to help other people to set up Web sites. 
Our major clients are joint ventures and foreign companies who 
are in 
business in Shanghai.
    As one of the first Internet users in China at that time, I 
was involved with the Internet Society, as well as technology 
because I, myself, was an Internet engineer.
    As was my interest, I did some technology research. For 
example, at that time I collected a lot of information on 
Chinese Internet users to see who was using the Internet, just 
for my own interest.
    Also, I was very excited about this new technology and 
expected some possible changes to the society by the new 
technology.
    I received a letter from a U.S.-based student's 
organization. The organization publishes newsletters that 
promote democracy, freedom of information, and independent 
opinions, as well as news into Mainland China. I was so excited 
because it was the first time that people could have a media 
that is not censored by the central 
government.
    So, I did something to help the organization, especially to 
help them in collecting information on Chinese Internet users 
so they could promote their newsletters to more receivers.
    For that activity, I was arrested by the Chinese 
Government. The date was March 25, 1998. As reported, I was the 
first victim of China's censorship of the Internet. So, I thank 
this Commission for letting me have a chance to speak here to 
all of you nice people.
    After I was arrested, my case was reported online. Finally, 
the government closed the trial and sentenced me to 2 years for 
some political crime. Thanks to the media reporters and many 
other supporters from outside organizations, especially human 
rights organizations, the Government of China released me 
early, with only 6 months to go. So, actually, I stayed in jail 
for a total of 18 months.
    After I was released, I stayed at home and tried to find 
some chance to re-start my business or career. I failed to do 
that because China is still a Communist country.
    So, for reasons you can probably understand, I found that I 
had to leave the country to seek my opportunities. So, I came 
to the United States. Right now, I am working in a small 
Internet company in New York City doing similar jobs as I did 
before as an Internet engineer. That is all of my story.
    Right now, we are doing a project named ``Secure Email 
Proxy,'' an Internet proxy project. The background is that 
people in China try to get free information. The Web sites on 
democracy are all blocked by the Chinese Government.
    E-mail seems to be an option for receiving information. E-
mail is a traditional application on the Internet, and they are 
still using it daily. It is proven to be easy to use and cost 
effective.
    People in China can receive information from those 
independent sources by subscribing to e-mail newsletters and 
some other organizations who send e-mails.
    It has worked in the past few years. Some months ago, 
something happened. As before, the Chinese Government has 
filters at almost all major IPs in China. Those filters check 
every e-mail that comes in to China, to check if there are any 
key words encoded in the e-mail. If they find more than, for 
example, 10 key words in an e-mail, they will block this e-mail 
and the people will not 
receive it. Furthermore, it may be dangerous to the receivers.
    So, clever Chinese people found that they can use free e-
mail boxes such as Hotmail and Yahoo Mail, which are based in 
the United States. It is out of the control of the Chinese 
Government. They can subscribe to those sources with their free 
e-mail account.
    It worked for years. But several months ago, the Chinese 
Government developed new technology that not only filtered the 
e-mails themselves, but also filtered the normal Web pages. If 
people in China accessed an e-mail box, say, Hotmail, it really 
works like a normal Web page on the Hotmail Web server.
    The Chinese filters--they installed filters on the gateway, 
I think--if people access a Web page that contains key words, 
the whole Web page will be fed back as a blank page. The people 
in China can access their e-mail box, but they cannot read the 
e-mail content if this e-mail is so-called ``sensitive.'' So, 
the people are waiting for some new technology to stop this 
kind of trouble.
    Our project, called ``Secure Email Proxy,'' is aimed for 
this purpose. Our mission is to provide a midway platform 
between the Chinese users within the firewall and the outside 
world.
    The traditional way of encrypting information is to use 
software such as the popular PGP software. But the PGP software 
requires that both senders and receivers use the same software, 
so it limits the usage of such kind of software. Most e-mail 
senders in the United States do not use it because they do not 
need it. So, that could be a problem.
    With our platform, we will forward all e-mail to Chinese e-
mail users who are interested in our system. Our function is to 
encrypt normal e-mail, then to send it back to Chinese users. 
It will help Chinese Internet users to have secure e-mail 
communication with outside people who do not use encryption 
software such as PGP.
    This will be very helpful. For example, in China, people 
subscribe to a mailing list from Voice of America, or Radio 
Free Asia. They can hardly receive the information, actually.
    We think, with our help, they can subscribe to the mailing 
list and the information can come to us at the e-mail proxy 
server, and we will encrypt it and send it back to the real 
receiver. So, this will help them to skip the firewalls of the 
Internet gateway. That is the solution, and we are doing it.
    That is all, thank you very much.
    Mr. Wolf. Thank you very much.
    Paul Baranowski.

   STATEMENT OF PAUL BARANOWSKI, CHIEF ARCHITECT, PEEKABOOTY 
                  PROJECT, TORONTO, ON, CANADA

    Mr. Baranowski. Good afternoon. I am the project leader for 
Peekabooty, a piece of software that is designed to get around 
state-sponsored Internet censorship at the national level.
    Peekabooty accomplishes this using peer-to-peer [PTP] 
technology. ``Peer-to-peer'' basically means that there is no 
central 
authority governing some part of the network system. The idea 
is that anyone using the peer-to-peer system also helps out 
other 
people in the system at the same time. Napster, Gnutella, and 
others are all examples of peer-to-peer networks.
    Peekabooty uses other nodes in the network to relay data 
around the firewall. It is kind of like a distributed proxy 
service.
    China has been working on its firewall since at least 1997, 
and we have seen its power growing over the years. Just about 
every other month we are seeing a new technology being deployed 
that makes it even more powerful.
    The Chinese authorities started blocking Web pages based on 
their Internet protocol addresses, which we have already talked 
about. People got around this initially by using open proxies, 
which are basically other computers that relay your requests 
for a Web page indirectly back to you.
    In early 2001, the Chinese Communist Party countered the 
use of open proxies by scanning the Internet for them and 
adding these proxies to the ban list. Another thing that some 
Web sites did--
apparently DynaWeb did as well--is that they changed their IP 
address every few days in order to try to prevent blocking of 
their Web site. But this is fairly ineffective.
    Safe Web and Voice of America set up a system that would 
send the IP addresses of available proxies to whoever requested 
them. Again, DynaWeb also tried this technique. However, it was 
not long before the Chinese authorities started requesting the 
proxy addresses and blocking them as well.
    There are two strategies that have not been effectively 
countered yet: bulk e-mail lists and freenet. Bulk e-mail still 
works because the origination of the e-mail is different every 
time. E-mail does, of course, has the drawback of being one-way 
communication, but at least that is something.
    Freenet is a peer-to-peer system that allows two-way 
communication. It still works because the only way to discover 
a new node in the Freenet system is through ``out-of-band'' 
means. This means you have to call up a friend, or your friend 
has to e-mail you an IP address of another domain network. You 
join the network and then you can get access to censored 
information.
    One of the main goals of Peekabooty is to eliminate this 
limitation, to create a method of discovery that automatically 
allows you to discover new nodes in the network without 
allowing you to discover all the nodes in the network, so that 
the Chinese authorities could not join the network and block 
everything.
    Some of the more recent developments of the Chinese 
firewall include selectively blocking out content within a Web 
site instead of blocking the entire site, denying Internet 
access for a certain amount of time to anyone searching for a 
band key word. So, for example, if you search for Falun Gong on 
Google, your Internet 
access would be denied.
    Suppressing dissident comments and chat rooms.--If you do 
type in some sort of dissident comments, a warning e-mail is 
sent to you telling you not to do that again.
    Finally, they are starting to log Google key word searches. 
So if you type in ``Falun Gong,'' they are going to remember 
who 
requested that.
    We can do something about all of this if we act now. The 
Chinese Government is already on its third generation of 
firewall technology, and we have not even started version one 
of a counter-strategy yet. If we do not do something soon, they 
may be able to close off the country completely and obtain 
absolute control of their net before we can do anything about 
it.
    A fair guess is that, by the Olympics in 2008, it will be 
much too late to act. Our window of opportunity is now, at this 
moment. The U.S. Government is the only organization that has 
the power to mount an effective counter against this type of 
censorship.
    Independent efforts, such as mine, by volunteer groups will 
be ad hoc and there will be no coordination between the 
releases of the various projects. A well-funded, centralized 
program could plan application releases so they occur at 
regular intervals in order to keep the Chinese authorities 
constantly scrambling to keep up.
    In other words, the U.S. agency in charge could coordinate 
and plan a global strategy that would be much more effective 
than the current ad hoc state of affairs. Centralizing this 
type of activity also allows for the possibility of inter-
operation between the projects and allowing more advanced 
features in these projects, eliminating redundancy.
    There are few, if any, commercial possibilities for this 
type of software, which is why the government is the only 
organization with the power to fund this type of activity on 
the scale that is 
required.
    The amount of money proposed in the Global Internet Freedom 
Act could fund dozens of projects. There are so many aspects to 
this problem and so many ways to solve it, that this is the 
kind of depth we need.
    Research is just beginning on this subject and we have a 
long way to go. This panel here represents a sample of what is 
out there. There are perhaps a dozen grassroots efforts 
attempting to do something about this on a shoestring budget. 
They all rely on volunteers.
    However, this many projects is not as many as we need. 
Right now, development on all of them is extremely slow, due to 
the fact that there is little funding and they all rely on 
volunteers.
    The first thing that is dealing with funding, is 
development speed. The second thing, is usability. The third 
thing, is translation into various languages. Finally, every 
project that is funded should have a budget for marketing so 
that each project can be promoted appropriately.
    If the government does fund projects such as these, it 
should be done through credible organizations that are 
committed to developing open-source solutions. Open-source 
software is crucial due to the fear of software back doors that 
would allow remote monitoring of or tampering with a user's 
computer.
    Open-source software relieves these fears because the code 
can be vetted by outside experts. One of the most important 
things with many of the current projects, is that they use 
peer-to-peer technology. This means, in terms of costs, there 
is little cash that is needed to keep them running.
    Funds are mainly needed for the maintenance of the code and 
the addition of new features. Each project could be initially 
funded by only a few hundred thousand dollars a year, and even 
less for maintenance once they have been deployed.
    The current crop of anti-censorship projects that show 
promise and should be considered for funding include the 
following: Peekabooty, the Freenet/Freenet-China project, the 
Invisible IRC project, which allows anonymous chat, CryptoMail, 
which is a Web-based e-mail system similar to Yahoo which 
provides encryption of e-mail, and finally, plug-ins to e-mail 
clients such as PGP and GPG to make encryption of e-mail 
easier.
    It should be noted that the National Science Foundation 
[NSF] has started funding anti-censorship research at the 
academic level. What we need, though, is a system to transfer 
the research into real-world applications.
    One of the areas of research that has not yet been 
exploited is in the field of wireless networking. This type of 
technology could allow individual devices to route information 
on their own. This would allow those devices to bypass the 
Internet infrastructure completely and create basically a new 
wireless Internet that could not be filtered.
    Also, another area of research that should be considered is 
making e-mail encryption even easier to use and more 
transparent. Right now, it is a little bit too difficult for 
most people.
    Finally, to sum up, China's censorship technology is 
becoming more advanced every day. We can do something about it, 
but we must act now. The government should fund credible third 
party 
organizations to develop open-source anti-censorship 
technology.
    Multiple strategies should be developed and their release 
should be coordinated according to a centralized high-level 
strategy. If we do not act, there is no doubt the Chinese 
Communist Party will have more power over its populace than 
ever before in history 
instead of less.
    Thank you.
    [The prepared statement of Mr. Baranowski appears in the 
appendix.]
    Mr. Wolf. Thank you very much.
    Avi, you talked, first, about the arms race. You did not 
draw a conclusion. Is this arms race a winnable arms race on 
the circumvention side, or is it simply a continuing process of 
raising the costs at each level?
    Mr. Rubin. I, unfortunately, do not think there is a 
straightforward answer to that, because there are several 
different axes that I drew for censorship.
    If you are talking about the censorship between the inside 
of China to sites that are outside of China, it is pretty clear 
where the end of the arms race is, which is that they cutoff 
all connectivity. Then, short of going through a satellite, or 
phone lines, or some other way, there is really no way anyone 
could get out.
    However, there are a lot of other things. For example, if 
you look at people within China trying to communicate with 
other people within China, and maybe posting content where 
things are not going through the firewall, then I think there 
is an interesting arms race.
    It is not clear who the winner is, because I think the 
technology has only advanced so far at present. We need new 
research. I support the comments that were made about funding 
new research.
    You could imagine a technology developed whereby Internet 
traffic becomes untraceable, so the next thing that happens is 
that the government mandates router manufacturers to put 
something in each packet so that they can trace it. That is 
another step in the arms race. We have got to go back to the 
drawing table and figure out how to get around that, and I do 
not see where that kind of an arms race terminates.
    Mr. Wolf. Anyone else want to comment on that?
    Mr. Xia. I would.
    Mr. Wolf. Yes, please.
    Mr. Xia. I would like to make a little comment. 
Technically, you can comment on technology if it can be 
censored or it cannot, how hard it is.
    Another factor is if the user will use it. Like, for the 
Freenet China project, there are people sending e-mails and 
saying, I am a peasant, I only went to elementary school, so 
tell me how to use it in two sentences, something like this.
    So, even if technology works, there is the matter of, 
first, how can you overcome the first barrier, if you can 
convince the user to use the software and learn how to use it.
    Mr. Wolf. Thank you.
    Mr. Baranowski. I have a comment.
    Mr. Wolf. Go ahead.
    Mr. Baranowski. I think, if we do nothing, then eventually 
we will not be able to do anything. But if we do something 
soon, then the arms race will continue, and continue on 
indefinitely until whenever.
    But there is a point that, if we do nothing now, we will 
not be able to do anything eventually because they would have 
cracked down too much at that point and there would be no way 
to get 
anything in or out.
    Mr. Wolf. Is there a point in this arms race where the cost 
to China is too high, in the sense that the measures the 
government would have to take would so negatively impact on the 
use of the Internet, and on Chinese businesses' ability to use 
the Internet to be internationally competitive?
    Mr. Rubin. I think you have put your finger on it right 
there. If China were willing to isolate themselves from the 
rest of the world, then they could censor in a way that we 
probably could not overcome.
    But as long as there are forces within China that want to 
have, for the sake of their own businesses, like you said, 
connectivity, then I think that there is something we can do.
    I also see the door closing if nothing is done, but maybe 
not as fast. The thing that will push them to the next level in 
censoring is when circumvention technologies start to move. If 
they stagnate, then I do not see them having a need to respond.
    Mr. Xia. I am also thinking of another possibility, that 
Western companies collaborate in doing censorship even outside 
of China. Then they can collaborate with censorship technology 
so it will not affect, like e-commerce communication, inside 
and outside of China. One technical example I can think of, is 
content filtering of any Web site--for example, Google--so if 
you are searching for key words, you are kicked out.
    However, it is actually easy to resolve this. Google can 
just implement https so your requests will be encrypted. I am 
not sure if Google is willing to do that. It is obvious that 
Google will be confronting China's content filtering engine.
    Mr. Lin. I might comment. I think those who do censorship 
and who did anti-censorship, they actually use similar 
technologies. The result is people or companies do something 
for profit. So that is why we see that the Chinese Government 
can create a firewall.
    I think some U.S. companies are heavily involved with it, 
say, especially some companies in California. The backbone, the 
technology, and the core equipment are developed and 
manufactured by the United States, especially California 
companies.
    So we do not have exact evidence, but we can reasonably 
conclude that the American companies are helping the Chinese 
Government to build the censorship firewalls. So that is why 
the same technology can result very differently for different 
sides. For people who are doing anti-censorship, like Paul, he 
is just doing it for the ideals, not for profit.
    I think the two sides are not even. So, the result is, we 
can expect who will win the war. I do not think, in any small 
part, that we will win the war. That is the reality, so I am 
worried about it. So, I think it is my duty to speak here to 
help many people to 
understand the situation.
    Mr. Baranowski. Can I answer that as well?
    Mr. Wolf. Sure.
    Mr. Baranowski. You raised a good point about the commerce 
and tying this anti-censorship technology to commerce. This is 
the only way I think that these technologies will work.
    For example, using SSL [Secure Sockets Layer] encryption 
for secure communication. SSL is also used in e-commerce to buy 
things over the Web, so they cannot outlaw, for example, that 
type of encryption. So, this opens a whole lot of China which 
they cannot really block unless they want to block all of e-
commerce.
    The second thing I want to talk about is the stagnation of 
censorship technology that Avi mentioned. I do not think this 
would 
happen at all, because they are plowing forward as fast as they 
can to implement more and more technology. For example, the 
Golden Shield project. They are trying to use as much 
technology as possible to control their population. I do not 
think it is going to 
stagnate anytime soon.
    Mr. Wolf. All right. Thanks.
    Holly.
    Ms. Vineyard. I would like to follow up on Ira's point 
there. I would first direct this toward Paul. It is open for 
anyone else who would like to answer. As technologists, how 
would you characterize the economic cost of censorship?
    I am interested in this as an approach for, how do we 
engage the Chinese to see the true economic potential of the 
Internet if it is left unfettered?
    Mr. Baranowski. Obviously it is costing them a lot of money 
to employ this many people to constantly be looking at Web 
sites and trying to filter them. So that's the obvious, up-
front cost, as well as buying the right type of hardware 
equipment that they need.
    Another economic cost that might be borne by them is the 
fact that they might be blocking sites that are not supposed to 
be blocked which are e-commerce sites, so if people cannot get 
to those sites, they will not be able to buy goods and services 
through those sites. That is just off the top of my head. Maybe 
someone else can answer that as well.
    Mr. Rubin. Well, I am not certain how much commerce there 
is from China to e-commerce sites in the United States, and I 
think that is something that should be looked at to figure out. 
That was used as a motivation for why they are not likely to 
block SSL, but blocking SSL is trivial. It is 443.
    They just turn it off and say, we do not have SSL through 
our firewall. If it is not the case that people in China can 
purchase things on e-commerce sites in the United States, then 
that point is pretty meaningless. I do not know. Maybe somebody 
knows about that.
    Ms. Vineyard. Does anyone know if there is much in the way 
of e-commerce going the other way?
    Mr. Rubin. People in the United States purchasing things in 
China? I do not know, either. I would be surprised.
    Mr. Xia. I do not think many people are buying things 
outside of China from inside China.
    Mr. Baranowski. Maybe not consumers, but maybe businesses. 
Of course, I do not think any of us have any data on this 
whatsoever. We are just making the best guesses that we can.
    Mr. Xia. When China blocked Google, there was a big cry 
inside China and more people are complaining. They want to do 
research or just common activity and they are blocked.
    Mr. Baranowski. That is a good point. I believe it was 
businesses eventually that complained so much that Google was 
blocked that they had to unblock it.
    Mr. Wolf. Let me just jump in here. Rather than e-commerce 
and individual e-commerce, as Chinese industry continues to 
develop and become more sophisticated, they are going to have 
global sourcing strategies that require fairly sophisticated 
use of the Internet, whether it is sourcing, inventory 
controls, and so on.
    That is what I was getting at. Not so much individual e-
commerce so much as, does additional effort by China to 
monitor, block, and control the Internet raise the costs, 
ultimately, of a joint venture auto manufacturer that is 
involved in global logistics?
    Mr. Rubin. Definitely. I mean, the way that I would 
envision that this would happen would be if they do not want to 
allow unfettered access to the SSL port, which someone serious 
about 
censoring would not because a lot of circumvention technologies 
could be built on it.
    They could perhaps require any company or any entity that 
wants to do that to clear it with them, and then they would 
provide a special port and maybe some encryption keys that they 
know that they allow them to use, and then they could monitor 
it carefully. That would all be very expensive.
    It would require a lot of databases to keep track of which 
keys are used for which communications, and then all of the 
monitoring equipment. So, they are raising the bar on 
themselves to some 
extent by making it more expensive to allow those business-type 
communications that they want to allow while preventing general 
use.
    Mr. Xia. I think this is true right now for e-mail service. 
If you are running e-mail service in China, you have to put in 
all the 
filtering software. For the Chinese ISPs, many of them have 
very 
sophisticated e-mail filtering software which will delay users 
receiving e-mails.
    Also, many people will lose their e-mails. It is quite 
different from here. I can call you and say I just sent you an 
e-mail, but in China you cannot rely on this.
    Ms. Vineyard. Thank you.
    Mr. Farris. I am wondering if any of you could speculate on 
what sort of attributes any anti-censorship or censorship 
circumvention software or project would have to have in order 
to be successful.
    For example, I think issues like deniability on the user 
end, the receiver end, would be important. But perhaps Bill or 
Lin Hai can speak to whether or not they think that is really 
an important issue in China.
    Other issues like user interface, I think you mentioned, or 
translations into Chinese. How important is it to the Chinese 
people at the user end that this be in the Chinese language, or 
does the average Internet user have an English level sufficient 
to use these 
programs? If any of you have any speculation on what a good 
censorship circumvention program would possess.
    Mr. Rubin. I can tell you what we did with Publius and some 
of the lessons that we learned in that regard. In terms of user 
interface, I think the best way to distribute client software 
is as a 
plug-in to a browser.
    We experimented with client-side proxies. Those require 
someone who knows how to run a compiler in order to get them 
running, unless you want to write something native, but then 
people use many different operating systems.
    The one common denominator seems to be a browser. So, a 
client-side plug-in would have the advantage of being able to 
have general-purpose functionality.
    You could build your whole protocol into it, whatever that 
might be. Users would be able to not know necessarily exactly 
what it is doing and just have content displayed for them. So, 
as far as user interface goes, I think that is the way to do 
it.
    That will not work in a cyber cafe, for example, where you 
do not have access to installing a plug-in. In that case, you 
need to go with raw html, and it is a lot harder because if you 
need to do any decryption or decoding or anything like that in 
the software, then the only way you might do that would be via 
a Java applet.
    The Java applet would come from some well-known site, and 
that could easily be blocked. So, after looking at all the 
different alternatives, I think a browser plug-in is the way to 
go.
    You mentioned deniability. In the Publius project, what we 
did was take the content that somebody wanted to publish and 
break it up into many, many little pieces. Those things had 
transformations performed on them so that you needed some 
subset of them to reconstruct the content.
    So, here's an example. Take a piece of Web content, whether 
it is an image or a document, and break it up into 100 pieces 
such that any 4 of them can reconstruct it, but any fewer than 
4 is meaningless and more than that is redundant. The idea 
here, is then you store those pieces on 100 different servers 
all over the world. We had a bunch of servers up and running in 
seven countries. This was a research prototype.
    The sites that would host the content, they see this 1 
piece out of 100 and they do not know what it is. So, there is 
deniability from the host server. Without three other pieces 
they do not know what it is and they do not necessarily have 
that information on where the other pieces are.
    So it was a system for publishing something. It got 
dispersed throughout the Net. Nobody knew exactly what the 
individual pieces meant. Then somebody to retrieve it would get 
a special URL, or they could get a link through something, and 
by running a proxy on their machine that their browser talked 
to, could go out and get four pieces, do a cryptographic check-
sum on them, verify that they had not changed, and then load 
the image into the browser or the document without the user 
having to be aware that all this happened behind closed doors.
    Mr. Baranowski. May I answer that as well?
    Mr. Wolf. Please.
    Mr. Baranowski. As far as user interface, I think a variety 
of methods should be used depending on the individual user. 
Something different should be in an Internet cafe versus 
someone from a home computer, versus someone at a business, 
which is what I was getting at before in my speech. I was 
saying we should have multiple projects going on at once using 
a variety of methods.
    As far as deniability, the only thing I can say is that 
this does exist in Peekabooty. The connections to the Web 
server are anonymous. No one can tell who is fetching which Web 
page.
    As far as English level proficiency, I just read a report 
last week that said 20 percent of Web pages viewed from China 
are in English. So, definitely the minority. That is all.
    Mr. Lin. May I comment? There are some informal 
technologies used by the Chinese Internet guys. They can always 
find some secret way to access the outside world. But the 
problem is, it is not public technology. So, the public needs 
to use most widely used technologies, say, for Web access.
    I think if we can offset technology to let people use a 
normal browser to access the outside world, the effect or the 
result will be very limited. So, that is a problem. Not all 
people are educated in technology. They are just normal users.
    Mr. Xia. I think the answer, a lot, depends on how many 
users you are targeting. For the most computer-capable people, 
many of them can read English. They will find ways themselves. 
They do not quite need your help. Like, DynaWeb has reached the 
level of tens of thousands. So at this level, you need 
something really easy. We got complaints, in the beginning, 
about DynaWeb using the 
domain name, or just visiting a Web site.
    I cannot say anything easier than that. But, still, some 
people do not like the pop-up windows, https, because it is not 
certified, or something like that. Or we do some technology 
that makes the 
domain name look weird, and then some users say, should I click 
it, or something like this.
    So, even at this level of users there are lots of questions 
that arise. But if you are working on something like a plug-in 
or a 
program, people need to download a Chinese interface. That is 
important. Like for the Freenet China project, it has software 
and it reaches a user level of 10,000. So at this level of user 
base, you do need the Chinese interface, and a very easy-to-
understand 
interface.
    Another factor we tried to compile, is we want to put the 
program below 1.44 megabytes so people can carry it around with 
a floppy. Then people do not have to leave that program on 
their computer's hard drive, they can, every time, download it 
and delete it.
    But this is getting harder because in the Internet cafe 
situation, it is really bad. In many of those registered 
Internet cafes, you cannot download and there is no floppy 
drive.
    I think for some software, the administrator can remotely 
look at your screen at any moment. I think for this specific 
environment, it is almost like the door is closed. There is 
hardly anything to do with it.
    Mr. Rubin. Just one other point. In a country where it is 
illegal to do certain activity, you could conceive that if 
there were such a plug-in or proxy program, the fact that that 
thing is on your 
machine could be a liability.
    Mr. Farris. So just a follow-up. In terms of the state-of-
the-art right now, is it possible for there to be a system that 
has complete deniability, something that would not have to be 
downloaded, that would not involve any obvious encryption that 
would tip off the 
authorities?
    Mr. Rubin. It depends on your threat model. If you have a 
threat model that the authorities are sniffing your line, then 
the answer is, without encryption, no. If they do not allow 
encryption, then there is nothing you can do.
    If you have authorities that are, with some probability, 
sniffing your line, then maybe you can play some games and 
adjust or tune your risk factor and say, I will get caught with 
this probability, and that may be able to be small enough that 
it would be worth it for people. But if the adversary can view 
the line going into your house and you do not allow encryption, 
then I do not see how there is anything you could do.
    Mr. Baranowski. Since China still does allow encryption, 
what you could do is if you are in China and you have a friend 
in the United States, you could download a program such as PGP 
Net, I believe, and encrypt all your data between the two 
computers, he sets it up on his computer and his computer is on 
all the time, and you just route everything through him.
    So, it has to be more of a personal connection to someone 
who is going to help you out in another country, and then you 
could quite easily get around it. As far as an automatic 
system, there is no way right now to--sorry.
    Could you repeat the question real quick?
    Mr. Farris. I guess I am trying to see if it is possible to 
have complete deniability.
    Mr. Baranowski. Oh, complete deniability.
    Mr. Farris. So nothing needs to be installed in the 
computer.
    Mr. Baranowski. Nothing that is automatic. Right.
    Mr. Farris. Yes.
    Mr. Xia. Technically, I think it is probably impossible to 
achieve that. But right now, I think the closest is DynaWeb. 
You only need a domain name to visit a Web site, and then you 
can clean your history with your Internet browser. But still, 
if someone is looking through your computer, still you can be 
caught.
    Here, just now what Paul mentioned, I think, we can put in 
a social background.
    Right now, downloading and using PTP will not get you into 
prison. But there are people arrested, and PTP is used as site 
evidence. So, just using PTP is fine, but if you are doing 
something else along with PTP then it is something else. I 
think this is an important point. In the last 20 years, China 
has changed a lot.
    During the Cultural Revolution, all the requirements were 
really harsh. If you were listening to the VOA radio at 
midnight, you could be caught and sent to prison. But now the 
government, instead of arresting you, is only trying to jam VOA 
radio.
    Mr. Wolf. Thanks.
    Keith.
    Mr. Hand. I wanted to get back to this arms race issue for 
a minute. I was curious what the typical timeframe is in terms 
of the cycle of technology and counter technology.
    Then maybe you could follow it up with another point. There 
has been some concern expressed that, as these new technologies 
are developed, there could be a false sense of security among 
users in China as to the degree of protection that they have.
    I was wondering if you could comment on that risk and 
whether, in your experience, people understand it or whether 
they feel like they are completely protected from monitoring 
when a new technology is introduced.
    Mr. Xia. From my experience, they correct that mistake 
pretty quickly, like 1 day after. If they mistakenly block 
their own sites or something like that, they will correct that 
pretty quickly since they only need to release what they did 
with that technology. But to develop brand-new technology, from 
our recent experience, it is more like months. But for security 
concerns, I think you have to foresee it to be compromised.
    Mr. Rubin. To answer the other part of your question, it is 
interesting. When we came out with Publius, I got approached by 
somebody who wanted to use it for very sensitive--they did not 
tell me what--activities and they said they were really 
worried, and how much would I vouch for the software.
    It is interesting, because normally if there is a bug in a 
program that I write, something crashes. But the responsibility 
of potentially putting someone in harm's way by a bug in the 
software was too much. So we disclaimed it and said, this is a 
research 
prototype. We did open-source it. I agree that open-source is 
an 
important component of anything like this.
    If you are going to use a program that could get you thrown 
in jail if it does not behave properly, that is a pretty scary 
notion. I mean, the way they measure the number of bugs in a 
program, the metric in software engineering, is by the number 
of lines of code.
    You ask a software engineer, how many bugs does a program 
have, they say, well, how many lines of code? And then you know 
how many bugs it has, or a minimum, anyway.
    So for something to be that reliable that you are going to 
risk your freedom to use it, I think it is tough and I am not 
sure that I would want to take that chance, myself.
    Mr. Hand. Thank you.
    Mr. Wolf. Paul, if you had a different hat, let us say as a 
representative of a U.S. intelligence agency, and you were 
sitting here as the fifth person on this panel, and you heard 
Paul Baranowski talk about the need to develop open-source 
software for countermeasures, what would you say to us in 
response?
    Mr. Baranowski. In response to what?
    Mr. Wolf. Regarding the technology required for 
countermeasures, what concern would the intelligence community 
have that obviously bad people would put this to bad use?
    Mr. Rubin. The double-edged sword.
    Mr. Baranowski. Oh, yes. All right. I have been asked this 
question before. Yes, I would have concerns about whether bad 
people could use this technology for bad things. My response to 
that is I have tried to think of ways that, especially 
Peekabooty, could be used to do bad things and I am hard 
pressed to come up with something that is not already done 
better using the different programs specifically designed to do 
bad things.
    There are plenty of programs out there in the Internet area 
that do bad things, like denial of service attacks, viruses. 
All this, you can get easily. So, something that simply makes 
your Web browsing anonymous, it is somewhat difficult to think 
of scenarios that you could use it to do evil with.
    Mr. Lin. I might comment. I think no one can prevent some 
people from doing bad things with some technologies. So, based 
on this theory, to make any policy to limit people using 
technology, you will not really reach your goal.
    For example, the PGP software. To my understanding, it is 
still banned for people outside of the United States to 
download the PGP software from U.S. Web sites. It is the United 
States law. So how do they do it? They just publish the PGP 
software, soft code, and carry it to Norway, and then retype it 
into the computer at the Web site in Norway at PGPI.com, or 
something like that.
    So that other part of the world--outside of the United 
States--can download the same program. That is just an example. 
The United States making some kind of policy to try to limit 
the people using technology, it does not work. That is my 
opinion.
    Mr. Rubin. Getting back to your question for a minute, when 
Publius came out we took a lot of criticism from people who 
came up with the example, imagine somebody came up with child 
pornography or some other kind of offense-to-pretty-much-
everybody image and posted it to a system where it was 
published where it could not easily be removed. That is 
something that was not possible before. Or instructions on how 
to make a bomb, or something like that.
    You sort of take a step back when you suddenly think about 
uses of your technologies. There are several different ways to 
look at it. One is an example I go back to. When the automobile 
was first introduced, law enforcement was afraid to allow these 
things to be mass produced because they were worried bad guys 
would be able to get away more easily. Yet, we see all the good 
that has come out of the automobile. The same thing could be 
said for the Internet.
    A more constructive answer, though, is to say that you can 
build censorship-resisting technologies with dials in them and 
let society set the dial. So in the United States, for example, 
we all believe pretty much--we should believe--in freedom of 
speech and the right to do certain things.
    Then there are certain acts which pretty much are the norm 
in society that that is unacceptable, certain things like child 
pornography that there is just no debate about. So, perhaps we 
can build a censorship system so that if almost all the users 
in the system do not want something, then that thing can be 
censored, but it requires a communal effort of almost 
everybody. That is just some thoughts on how to do it. You have 
got to be very careful that you do not enable, accidentally, 
ways of censoring that are more easy than before.
    Mr. Wolf. Let me turn to United States suppliers of 
technology, equipment and software for China's backbone. Lin 
Hai was talking about California companies. Others have talked 
about the need to license or restrict United States export of 
technology to China that can be used for censorship and 
control.
    I wonder if you could comment on what you think should or 
could be done regarding control of United States exports of 
Internet technology to China, or whether it is something you 
believe is a road that we should not go down.
    Mr. Lin. I think that it is not easy to make any kind of 
policy like that because people can find some ways, any ways, 
for profit. So my suggestion is, do some reverse policies to 
encourage companies, and individuals, and organizations to 
develop any other technologies against censorship. This is the 
way to work, I think. For example, set up some funds to sponsor 
people like Paul, to develop anti-censorship technologies. That 
is the right way.
    Mr. Baranowski. I would say to ask the companies themselves 
to have them issue a statement saying we do not support 
censorship and surveillance. We do not take part in it. For 
them to come out and publicly say that, I think, would be a 
very good first step in that process.
    There is a precedent for regulating this type of 
technology, and that is with encryption. Just a few years ago, 
you had to first submit any encryption product to some agency 
to have it checked out before it was exported, so you could not 
export anything that encrypted above a certain level. This 
could also be done with censorship technology. That would be a 
more extreme thing to do, but there is precedent for it.
    Mr. Rubin. Yes. I pretty much would oppose any idea of 
regulating what Internet companies can and cannot sell abroad. 
While I agree with the goal, I think that such export 
restriction attempts have fallen flat on their face before, as 
we have seen with the encryption.
    Mr. Wolf. Bill, do you have a comment on this?
    Mr. Xia. I think it is kind of analogous to export arms so 
that arms can be used for good things or bad things. So, there 
can be restrictions on what kind of technology you can export 
and where you can export. They cannot just say, I am sending 
the technology, I do not know or I do not care what they are 
doing with it.
    Especially for China, in the past years, it has been 
demonstrated, what are they going to do with content filtering 
technologies. So, I think there can be regulations on some 
specific cases.
    Mr. Rubin. I would worry that China would start buying 
their backbone technologies from other countries that have 
equally 
developed products, and that we would be hurting our business 
without actually helping fight censorship.
    Mr. Wolf. Holly.
    Ms. Vineyard. If China has such effective cyber-walls, in 
your opinion, why is it these cyber-walls are not being used to 
stop 
piracy as well?
    In the recent regulations, copyright piracy was not 
identified specifically as an illegal purpose. How do you 
recommend we go about raising this?
    I mean, we would be asking the Chinese to provide 
additional policing to a medium that we essentially want to be 
free, but we still want to protect the rights of copyright 
holders.
    Mr. Xia. I think Internet censorship has become a very 
essential policy of the Chinese Government. This year, the head 
of the Public Bureau of Security commented that there is a 
conspiracy about anti-China forces trying to distribute 
subversive information through the Internet.
    I think for the Chinese Government, the Internet Freedom 
Act can potentially endanger their current authority, so it is 
a pretty high priority, not just economics.
    Ms. Vineyard. But my question was really trying to get at 
the protection of intellectual property rights, especially 
copyrighted 
material. If any of you have any experience with how that is 
being protected or not protected on the Chinese Internet, I 
would appreciate your views.
    Mr. Rubin. I think that it is really a different security 
technology that protects or prevents traffic from flowing 
freely and that guards intellectual property. It is almost like 
guarding the information in the other direction.
    So, if something that is a particularly valuable 
intellectual property gets inside China and can get replicated 
very easily, the fact that it went through a firewall when it 
got through is meaningless at that point.
    Intellectual property protection technologies are somewhat 
limited in their capabilities. If there is something that you 
have in software, you can replicate it. Hardware assistance is 
expensive. It is difficult to distribute things when you 
require people to have a particular kind of player.
    Intel and Microsoft are taking steps to provide 
intellectual property protection in the platform that people 
have in their homes. At that point, if that works, it will be 
successful in China as well. But I do not think that the 
censorship technologies are designed, nor can they very easily 
protect, intellectual property of something once it has gone 
through the firewall.
    Mr. Lin. To my understanding, this is more consistent with 
the law. In China and in the United States, they seem to have 
similar copyright laws, but they actually deal with them very 
differently.
    In China, on the big Web sites, they understand the 
copyright law, but individual users do not care. The government 
also does not care about the individuals who use free copies of 
copyrighted 
materials.
    So, the censorship through technology will not help to 
protect the copyright, but it should be done by something like 
how to develop the law and how to actually do something under 
the law.
    Mr. Baranowski. Actually, one of the scary things is that 
if China does get this DRM technology, which is Digital Rights 
Management, which allows you to protect your intellectual 
property, if that goes to China, it actually gives China more 
power to censor their people because you could use that same 
technology to say, you can only run this program on your 
computer, or this set of programs on your computer, and nothing 
else that is not approved by the Chinese Government. Thus, no 
program that we could write, any anti-censorship program we 
could write, could ever bypass that sort of control.
    Mr. Rubin. And that is not limited to China. A lot of 
people worry that DRM technology in the United States could 
greatly 
restrict fair use of all kinds of things.
    Ms. Vineyard. Thank you.
    Mr. Farris. I would like to stay on that point for a 
moment. I think at least Publius, and maybe also Peekabooty, 
were not specifically designed with China in mind, and there 
may be a concern about other countries as well.
    Do any of you have a view on where China fits in the 
spectrum of censorship compared with, say, even the United 
States or other countries? Is China the worst offender? Do you 
see the United States moving in a similar direction?
    Mr. Baranowski. China is the worst offender, possibly tied 
with Saudi Arabia. The other countries that are censored are 
Burma, Cuba, and even Australia.
    There are about 20 or 21 countries that censor their 
Internet the last time I checked.
    You are right that this type of technology could work in 
any country. It is not just limited to China, which is, in my 
opinion, a good thing.
    Mr. Farris. Thank you.
    Mr. Wolf. Keith.
    Mr. Hand. I wanted to get at Ira's question from a slightly 
different angle. There was a lot of controversy over the Yahoo 
China pledge earlier this year. Some argued that even operating 
under some restrictions, there is still an advantage to having 
a company like Yahoo operating in China, delivering information 
and pushing the limits of the controls there where they can.
    I was wondering if you could comment on that and give us 
your sense of where you think the line should be drawn between 
working within the system and struggling within it for change, 
and where you end up colluding with the government on these 
censorship issues.
    Mr. Rubin. I think that anything that encourages the 
openness, the connectivity between China and the rest of the 
world, opens up avenues for other censorship-defeating 
technologies to piggy-back on the existence of that network. 
So, from that sense I think it is a good thing.
    Mr. Baranowski. It seems to me that companies going into 
China are playing right into their hands. China basically stops 
any company from coming in unless they obey their rules.
    So, basically it does not seem like any Western thought is 
getting into China through these corporations. For example, the 
Norton Antivirus software. They gave China virus software 
before they could get into China. Cisco built special routers 
for them.
    All these companies are playing right into their hands and 
basically doing whatever the Chinese Government says so they 
can get into this imaginary market, in my opinion, that is not 
quite as big as they made it out to be.
    Mr. Xia. I agree with what Paul said, especially in the 
case of Yahoo. They have openly signed a self-censorship 
agreement. In the case of Yahoo, it actually helped China to 
create a kind of Chinese Internet and make it look like people 
can stay there and get everything.
    Mr. Wolf. Paul, you just said Cisco provided special 
routers. Are you saying that the Chinese Internet censors 
provided specifications to Cisco to provide some unique 
equipment, or are we talking about equipment that they provided 
that have multiple uses?
    Mr. Baranowski. The reports are that they asked for 
specific features in these routers, and Cisco made it for them.
    Mr. Wolf. Is it your assumption that those features are 
unique?
    Mr. Baranowski. Unique to China.
    Mr. Wolf. Unique to censorship functionality as compared to 
some other functionality?
    Mr. Baranowski. To censorship technology.
    Mr. Wolf. But that is a guess, right?
    Mr. Baranowski. These are reports from interviews of people 
that worked on the project, so I do not have direct experience 
with that.
    Mr. Wolf. As you develop circumvention technologies, is the 
target user the average Internet user in China, or is the 
target someone who has a fair amount of sophisticated 
knowledge? In other words, is the beneficiary someone who has a 
PC at home, does not know much about the technology but knows 
how to sign onto his ISP?
    Mr. Baranowski. Are you saying, for Peekabooty, is that the 
main target market?
    Mr. Wolf. Yes.
    Mr. Baranowski. Yes. Yes. For my project, Peekabooty, that 
is the target market, the personal home computer or any 
computer you can actually install software on.
    Mr. Wolf. And a user who is not particularly sophisticated.
    Mr. Baranowski. Yes, and a user that has no special 
knowledge of Internet technology.
    Mr. Wolf. Avi.
    Mr. Rubin. Since it was a research prototype, we never got 
it to that phase. But the design was made with that as one of 
the original main constraints, is that it should be usable by 
anyone.
    Mr. Wolf. Bill.
    Mr. Xia. From the response I got, there are people who 
really have little computer technology. They ask me, you gave 
me the URL. What should I do? So I have to tell them, please 
copy the URL to the address of your Internet browser and 
return. You will see the Web interface, blah, blah, blah.
    Mr. Wolf. All right.
    Mr. Lin. I think nobody can get benefits from a virus. If 
the government, for some purpose, makes some special virus that 
is very dangerous and powerful, you can understand because most 
of the users are uneducated in special technology. They will 
not find 
anything special.
    All information can be collected by the central government. 
It is very easy and effective and could happen. We have not had 
any 
reports that it has already happened, but it is just a 
technical 
possibility.
    Mr. Rubin. It is actually pretty bad. There is a program 
out there for Windows, which is the most popular platform, 
called Back Orifice. It is a spoof on the name Back Office.
    What this program does, is it can be installed on a 
computer in stealth mode, meaning that you cannot really tell 
that it is running on your computer, and it provides a remote 
terminal to whoever installed it there where they would have a 
window on their screen that was exactly your desktop, whatever 
you saw there.
    They could control it with mouse clicks and keyboard events 
that would be sent from their computer to the target computer, 
and anything that was done on that target computer would be 
visible, and any keystroke, any password that was typed in, 
would be 
visible.
    So in the extreme where the government wishes to install 
this kind of a virus, or even to require vendors to install 
this on the computer when they sell them, they could pretty 
much see exactly what was going on on every single computer any 
time they wanted. Big brother. Turn the switch on this house 
and watch what is going on on that computer. That is not just 
technically feasible, that has already been done. That software 
is out there.
    Mr. Wolf. I have one last question. Bill, the figure of 
30,000 Internet police. Where does that come from?
    Mr. Xia. I think it is originally from some report from 
China, and then everybody is quoting it.
    Mr. Lin. There is a specific Web site. They publish a lot 
of information related to the Web site, at dfn.org, Digital 
Freedom Network. That is my recommendation. You can find some 
information related to it.
    Mr. Wolf. All right. Well, I would like to thank you all 
very much for coming today. This has been helpful in our 
understanding of the Internet technology issues. I appreciate 
the fact that, although you are all technologists, you talk 
about it in a way that non-technologists can understand.
    So, thank you all very much for spending the time, and 
thank you all for your commitment to this.
    [Whereupon, at 4:13 p.m. the roundtable was concluded.]
                            A P P E N D I X

=======================================================================

                          Prepared Statements

                                ------                                

                    Prepared Statement of Avi Rubin

                            november 4, 2002
    While I am a researcher at AT&T Labs, I am participating in this 
round table as an individual, representing only my personal beliefs and 
opinions. I have been researching computer security issues since 1991. 
Much of my work has focused on privacy, anonymity, and censorship 
resistance.
    The purpose of my statement is to discuss technical issues related 
to censorship. I will discuss the techniques that a network 
administrator, including a large company or a country, could use to 
censor access and content to and from its network, and I will discuss 
techniques that could be used to circumvent this censorship. For the 
remainder of this paper, I will refer to the party controlling the 
network as the Censor, and to the party wishing to circumvent 
censorship as the User.
    Censorship is somewhat of a broad term. It can refer to the 
blocking of access to web sites. It can refer to blocking all 
connectivity outside of the domain of the Censor, and censorship can 
refer to the limitation of access to certain content. Censorship can 
also involve forceful removal of content from the Web, by applying 
pressure to the publisher and/or the web hosting party. The latter is 
the type of censorship that the Publius system was designed to 
circumvent. In this statement, I do not discuss censorship within the 
domain of the Censor, but rather, the censorship of content available 
from outside of the domain for people whose network is under the 
control of the Censor. I also focus on the User as the receiving party 
of information and not the publishing party. I will be happy to discuss 
issues related to the latter in the question and answer period.
    There are three principle techniques that can be employed by the 
Censor.

    1. Routing filters: The Censor is in a position to control how 
traffic from the User reaches the rest of the Internet. The Censor can 
refuse to route Internet packets from the User that are destined for 
particular locations. Thus, the Censor can use the destination address 
of the packets to make a censorship decision. In the extreme, the 
Censor can prevent all traffic from all of its users from reaching any 
network outside of its control. This is easy to do, and any Censor can 
accomplish this without the need to purchase any new hardware or 
software. The functionality is built into all off the shelf routing 
equipment that sites use to connect to the Internet.
    2. DNS tricks: The Censor can exert some control on which external 
sites users can communicate with by virtue of its control over the 
Domain Name Servers (DNS) within its administrative boundary. The DNS 
is the service that maps computer addresses (IP addresses) to names. 
For example, wow.avirubin.com has the address 207.140.168.155. 
Computers communicate using such numerical address, but people enter 
readable names into web browsers. The DNS translates these names into 
numbers. Since the Censor controls its own DNS service, it can 
translate requests from the User to addresses under its own control. 
For example, if the User attempts to connect to www.avirubin.com, the 
Censor can program its DNS to return 10.10.32.1 when the User's machine 
tries to figure out the IP address of the machine, and this address can 
be that of a machine controlled by the Censor. Thus, DNS provides the 
Censor with the ability to control which computers the User can connect 
to.
    3. Application level filtering: The previous censorship techniques 
dealt specifically with connectivity issues. Application level 
filtering, on the other hand, is a mechanism for controlling the 
content, even if the User can connect to a server. The most likely type 
of application level filter that the Censor would use is an HTTP proxy. 
This is a program that intercepts requests sent to Web servers and the 
responses returned to the User. The Censor can inspect the content, and 
a decision can be made, as to whether or not to block the information 
from reaching the User. A Censor using an HTTP proxy might focus its 
attention on popular search engines.

    The first type of censorship, based on routing filters, is 
difficult to circumvent. If the routers do not allow packets in and out 
of the network, then there is no way to get around that. The best one 
could do is to dial up to an external ISP. Of course, this could get 
expensive if the Censor is a country. Also, a very strict and powerful 
censor could monitor the phone network for data dial-up connections and 
disconnect them, as well as sanction the User.
    The second type of censorship, based on DNS spoofing, can be 
circumvented by users who know the IP address of the server with which 
they wish to communicate. Instead of referring to the server by name, 
they could connect using the IP address directly. However, IP addresses 
change frequently, and it may not always be possible for users under 
the control of the Censor to know the IP address of a server. In 
general, this is not a very effective technique.
    The third type of censorship, based on application level filtering, 
is perhaps the easiest to circumvent. Encrypted content is difficult to 
censor, but a very strict Censor can maintain a policy of blocking all 
content that it cannot interpret for the purposes of filtering. Perhaps 
the easiest way to bypass HTTP proxies is to proxy web content over a 
different port. Port numbers are used on the Internet to identify the 
type of service for packets between hosts. For example, Web traffic 
uses port 80. HTTP proxies process packets that are marked with port 
80. A User wishing to circumvent this monitoring could cooperate with 
someone on the outside of the Censor's administrative control. They 
could set up two proxies. The inside one would translate port 80 
packets into ones that use, say, port 14500. The outside one would 
translate port 14500 back to port 80 and send them to the server. Thus, 
the User could browse the Web without the Censor detecting it. However, 
a strict censor could block all ports except 80, and then filter on 
port 80. There is little that could be done by the User in that case. 
It should be noted that researchers have succeeded in identifying 
services by their traffic patterns, independent of port numbers.
    The bottom line is that there is an arms race in censorship. An 
extreme Censor can win every time, but at the expense of completely 
disconnecting all users. The more tolerant a Censor, the more avenues 
there will be for circumvention of the censorship that is in place.
                                 ______
                                 

                     Prepared Statement of Bill Xia

                            november 4, 2002
    DynaWeb was launched on March 12, 2002. It is a proxy network that 
allows users to circumvent the Internet censorship in China and to have 
secure and full access to the Internet. Users use DynaWeb as an 
information web portal to all other web sites. Since the inception of 
DynaWeb, we have managed to stay ahead of the censorship by China most 
of the time. 20,000 unique users gained regular unblocked access to the 
Internet through us.
    DynaWeb has already played several rounds of the censorship and 
anti-censorship game in the past 8 months.
    Before I start, I would like to explain a few critical technical 
terms for understanding DynaWeb experience. There are two ways to 
access a web site through an Internet browser. One is to type in the 
domain name, for example, www.google.com. The other way is to type in 
the IP address of the domain name. The IP address is the essential 
place the browser will fetch the web site information for the user. 
However, domain name is more user-friendly. After a user types in a 
domain name, web browser will resolve domain names to IP addresses and 
fetch the right information for the user.
    The game started with e-mail subscription service. DynaWeb e-mailed 
unblocked IP address updates to subscribers. After 2 weeks, the censors 
probably subscribed to our e-mail service too because the valid time 
window of DynaWeb IP addresses reduced to a range from a couple of 
hours to a few days after release.
    Then our services expanded to domain names with dynamic IP 
addresses. However, censors started chasing DynaWeb domain by 
automatically detecting the IP addresses that pointed to the domain 
name. This dramatically increased the needs for back-up IP addresses, 
hence increased the cost of DynaWeb maintenance. DynaWeb adopted new 
strategy so that censors had to manually verify the IP addresses before 
blocking it. Then automatic IP blockage stopped.
    Soon in August, users started to have difficulty of accessing 
DynaWeb through https even the IP was not blocked. It was found out 
later on that the certificate DynaWeb used for secured access from the 
Internet browser was filtered. This can be achieved by package level 
analysis of Internet traffic to find out signature related to the 
certificate DynaWeb used. In response to this, DynaWeb started to 
change its certificate daily. No reports of certificate blocking have 
been found since then. Again, censors were frustrated with the resource 
required for daily updates of all related content filtering engine, and 
quit.
    At the end of September, DynaWeb domain names were hijacked to a 
fixed IP 64.33.88.161 in China, along with many other web sites like 
www.voa.gov. DIT has published a detailed report about this hijacking 
(http://www.dit-inc.us/report/hj.htm), and it can be independently 
verified from the U.S. More study about this hijacking is still 
undergoing and will be released after we pass this stage.
    So, what is next with the Cyber-wall?
    At the first look, it is a technical question if technology can 
break through China's Cyber-wall. In fact it is not. This process is a 
race of technology and time. As DynaWeb's experience has demonstrated, 
both parties can always implement new technologies to stay ahead and 
sustain the advantage. If Internet breakthrough is defined as a pure 
technical issue, the future is brighter for censors because China 
purchases the most advanced censorship technology from western 
companies.
    China is also developing the Golden Shield project, a ``data base-
driven remote surveillance system.'' When the whole Beijing city is 
wired with biometric sensor and camera network, no Internet based anti-
censorship can get around the surveillance system.
    Even now, during the 8 months of technical race with DynaWeb, China 
has developed the largest and most sophisticated IP blocking and 
content filtering system in the world. The more anti-censorship 
technique is deployed, the more comprehensive censorship technology has 
become. This leaves less and less technical room for anti-censorship. 
It is critical to take full use of technologies to benefit as many 
people as possible before the door is closed.
    Second, it is a matter of available resources. China has 30,000 
Internet police specialized on Internet censorship, and ISPs are forced 
to perform self-censorship. The self-censorship is even adopted by 
foreign ISPs such as Yahoo. China has purchased top technology from 
western companies. These technologies have even been modified for 
China's particular censorship needs. Nortel, Sun Microsystems, Cisco 
and many smaller companies contributed to building China's Cyber-
wall.\1\
---------------------------------------------------------------------------
    \1\ China's Golden Shield: Corporations and the Development of 
Surveillance Technology in 
the People's Republic of China, by Greg Walton, International Centre 
for Human Rights and Democratic Development http://www.ichrdd.ca/
english/commdoc/publications/globalization/goldenShieldEng.html
---------------------------------------------------------------------------
    Comparing to China's investment in censorship and cyber wall, 
investment in breaking through this Cyber-wall is next to nothing. 
There are very few groups developing technologies suitable for this 
Wall. With more resources, DynaWeb can provide services to more people, 
develop better client software, have closer monitoring of censors' new 
technologies and respond faster.
    Third, people develop technology and technology serves people. 
People factor is the most important factor eventually. Recent increase 
of public awareness about China's Internet censorship both inside and 
outside of China is a great sign. We hope that this will help improve 
the current situation soon. Currently companies contributing to China's 
Cyber-wall bear little public pressure, not mention any legislative 
limitation.
    Inside China, more and more harassment and arrests of dissidents 
and journalists are related to the Internet. Last year, there are more 
than ten arrests in China for distributing forbidden information. This 
will create fear among the public. For the general public in China, 
they are now gradually realizing the existence of censorship 
consciously.
    More importantly, government has adopted subtler mind control and 
propaganda to decrease Chinese's interests in uncensored information. 
All major events outside of China are reported, with seemingly a 
variety of views, although all the different views are in fact the 
government's view. There is a fully developed online community inside 
China serviced by self-censoring ISPs. This strategy is an extension of 
China's Cyber-wall, a wall in people's mind. Internet, combined with 
TV, newspaper and other information channels now offers Chinese people 
different types of information and different views on certain issues. 
It looks like that full freedom of speech has been achieved. However, 
the government produces all the different views and types of 
information. The censors try to use this to reduce people's interest in 
uncensored information.
    In summary, technology along won't decide the future of China's 
Cyber-wall. But people do. If all Chinese people would like to obtain 
uncensored information, the Cyber-wall will be broken, from the inside.

                 Prepared Statement of Paul Baranowski

                            november 4, 2002
    I am the project leader of Peekabooty, a piece of software that is 
designed to get around state-sponsored Internet censorship at the 
national level. Peekabooty accomplishes this using peer-to-peer 
technology. Peer-to-peer (P2P) basically means that there is no central 
authority governing some part of a networked system. The idea is that 
anyone that uses a P2P system also helps out others. Napster, Gnutella, 
Morpheus, and Kazaa are all examples of peer-to-peer networks. 
Peekabooty uses other nodes in the network to relay data around the 
firewall, kind of like a distributed proxy service.
    China has been working on its firewall since before 1997, and we 
have seen its power growing over the years. Just about every other 
month now we see another story of a new technology being implemented in 
order to more effectively filter information.
    The Chinese authorities started by blocking web pages based on 
their Internet Protocol (IP) address. Citizens of China initially 
worked around this by using ``open proxies''--that is, other computers 
on the Internet that indirectly fetch web pages for the user. In early 
2001, the Chinese Communist Party countered the use of open proxies by 
scanning the Internet for them, and adding the proxies to their banned 
list. Web sites have also responded by changing their IP addresses. 
However, they can only change their IP addresses every few days and 
this costs money, so this is fairly ineffective.
    SafeWeb and Voice of America (VOA) set up a system that would send 
the IP addresses of available proxies to whoever requested them. 
However, it wasn't long until the Computer Monitoring and Supervision 
Bureau of the Ministry of Public Security started requesting the proxy 
addresses and simply banned any IP addresses it received.
    There are two strategies that have not been effectively countered 
yet: bulk email lists (where email is sent out to an enormous number of 
people) and Freenet. Bulk email still works because the origination of 
the email is different every time. However, email has the drawback of 
being one-way communication. Freenet is a peer-to-peer system that 
allows two-way communication, and it still works because the only way 
to find another Freenet node is through ``out-of-band'' means. This 
means there is no automatic way to discover all the nodes in the 
network. The only way to find another node is, for example, by calling 
up a friend of yours that is running Freenet and getting his IP address 
or having an IP address personally sent to you in an email.
    One of the main goals of Peekabooty is to overcome this limitation: 
to create a method of discovery that is automatic yet never allows 
anyone to discover all the nodes in the network. I am currently 
developing a simulation of a system that shows great promise in this 
regard.
    More recent developments of the Chinese firewall include:

     Selectively blocking out content within a web site instead 
of blocking the entire     site
     Denying Internet access for a certain amount of time to 
anyone searching for     a banned keyword
     Suppressing dissident comments in chat rooms, followed by 
a warning email to     the user who made the comments
     Logging Google keyword searches

    We can do something about this if we act now. The Chinese 
Government is already on its third generation of firewall technology, 
and we haven't even started version one of our counter-strategy yet. If 
we do not do something soon, they may be able to close off the country 
completely and obtain absolute monitoring and control of their net 
before we can do anything about it. A fair guess is that by 2008, when 
the Olympics go to Beijing, it will be much too late to act. Our window 
of opportunity is now, at this moment.
    The U.S. Government is the only organization that has the power to 
mount an effective counter against this type of censorship. Independent 
efforts by volunteer groups will be ad-hoc, and there will be no 
coordination between the releases of the various projects. A well-
funded, centralized program could plan application releases so that 
they occur at regular intervals in order to keep the Chinese 
authorities constantly scrambling to keep up. In other words, the U.S. 
agency in charge could coordinate and plan a global strategy that would 
be much more effective than the current ad-hoc state of affairs. 
Centralizing this type of activity also allows for the possibility of 
interoperation between the projects, allowing more advanced features in 
each product and eliminating redundancy.
    There are few, if any, commercial possibilities for this type of 
software, which is why the government is the only organization with the 
power to fund this kind of activity on the scale that is required. The 
amount of money proposed in the Global Internet Freedom Act has the 
possibility to fund dozens of projects. There are so many aspects to 
this problem and so many ways to solve it that this is the kind of 
depth we need. Research is just beginning on this subject and we have a 
long way to go. This panel represents a sample of what is out there--
there are, perhaps, on the high end, a dozen grass-roots efforts 
attempting to do something about this on a shoestring budget. However, 
this is not as many as we need. Right now development on all of them is 
extremely slow due to the fact that they all rely on volunteers, 
usually only one or two per project. The first thing that is gained 
with funding is development speed. With a full-time staff working on 
each project we would see rapid improvements in the technology. The 
second thing that we gain is usability. For your average consumer, the 
user interface is everything. For developers, this usually comes last. 
With appropriate funding, experts can be hired to solve the usability 
problem. Third, the interface for each program must be translated into 
various languages, most importantly Chinese. With funding this becomes 
possible. Finally, marketing the applications to their intended 
audience is critical. Some part of the funding for each project should 
be spent on promotion.
    If the U.S. Government does fund projects such as these, it should 
be done through credible organizations that are committed to developing 
open-source solutions. Open-source software is crucial, due to fear of 
software backdoors that would allow remote monitoring or tampering of a 
user's computer. Open-source software relieves these fears because the 
code can be vetted by outside experts.
    One of the important things about many of the current projects is 
that they use peer-to-peer technology. In terms of cost, this means 
that they do not need large amounts of cash to keep them running. Funds 
are mainly needed for maintenance of the code and the addition of 
features. Each project could be initially funded by only a few hundred 
thousand dollars a year, and even less for maintenance once they have 
been deployed.
    The current crop of anti-censorship projects that show promise and 
should be considered for funding include the following: Peekabooty, 
Freenet/Freenet-China; the Invisible IRC project (IIRC) which allows 
anonymous chat; CryptoMail, a web-based email system like Yahoo that 
provides automatic encryption of email; and Pretty Good Privacy(PGP) 
and Gnu Privacy Guard(GPG) plug-ins to email clients (examples of such 
plug-ins are enigmail and Kmail).
    It should be noted that the National Science Foundation (NSF) has 
started funding anti-censorship research at the academic level. What we 
need is a system to transfer the research into real world applications. 
One of the areas of research that has not yet been exploited is in the 
field of wireless networking. This technology would allow wireless 
devices to route information on their own. If there was an application 
that did this, and enough wireless devices, it would create a new 
Internet infrastructure which could not be filtered. I also think there 
should be work done to make email encryption easier to use and more 
transparent.
    China's censorship technology is becoming more advanced every day. 
We can do something about it, but we must act now. The government 
should fund credible third-party organizations to develop open-source 
anti-censorship technology. Multiple strategies should be developed and 
their release should be coordinated according to a centralized high-
level strategy. If we do not act, there is no doubt the Chinese 
Communist Party will have more power over its populace than ever before 
in history.

                                   - 

```