Change:
1. This document describes the technical mechanisms used by censorship <del> regimes around the world to block or degrade internet traffic.  To that end, we describe three elements of Internet censorship: aggregation, identification, and prevention.  Aggregation is the process by which censors determine what they should block, i.e. they decide to block a list of pornographic websites.  Identification is the process by which censors determine whether content is blocked, i.e. the censor blocks all webpages containing "sex" in the title. Prevention is the process by which the censor intercedes in communication and prevents access to censored materials. </del> <ins> regimes around the world to block or degrade internet traffic (see RFC7754 for a discussion of Internet blocking and filtering in terms of Internet architecture).  To that end, we describe three elements of Internet censorship: aggregation, identification, and prevention. Aggregation is the process by which censors determine what they should block, i.e. they decide to block a list of pornographic websites.  Identification is the process by which censors determine whether content is blocked, i.e. the censor blocks all webpages containing "sex" in the title.  Prevention is the process by which the censor intercedes in communication and prevents access to censored materials. </ins> 2.

Discussion:
Stephane Bortzmeyer provided great feedback on DNS aspects of this document, itemized in issues and . These commits should address those comments.
From Stephane: "Later in the document, there is again sloppy wording about the DNS. "As Domain Names are resolved recursively, if a TLD deregisters a domain all other DNS resolvers..." Which "other resolvers"? The TLD name servers are not resolvers. Also, the example "such as .ch or .ru" is poorly choosen since I am not aware of any case of censorship by the swiss TLD ("reference needed", as they say in Wikipedia). Better to use .com as an example (operation "In our sites" by the ICE)."
From Stephane: ""occasionally users outside of the censors region will be directed through a DNS server controlled by a censor, causing the request to fail" If you refer to the root-servers-in-China / Chile case, the requests never went "through a DNS server controlled by a censor". In China, this DNS mangling is done by network equipment, and does not require a DNS server."
From Stephane: "In the same section "the site is still technically unblocked if the user has another method to acquire the IP address of the desired site" is false for HTTP (unless the Web site is the only one listening at this IP address: otherwise, without a proper Host: field, using the IP address won't work)."
From Stephane: "Also, the section is self-contradictoy when it says "it is easily circumvented by a technical savvy user that opts to use alternative DNS resolvers" while mentioning later than Turkey solved the problem of circumvention by hijacking Google Public DNS' addresses. Unlike what you seem to imply, it was a success for the turkish government, very difficult to circumvent (Google does not use any authentication technique on Google Public DNS and, besides, there is little deployment of these techniques in the DNS.)"
From Stephane: ""DNS Cache Poisoning is one of the rarer forms of prevention" In France, it is the most common since it is mandated by law for at least two cases (illegal gambling and promotion of terrorism)."

from Stephane: "The first sentence is specially confusing: "DNS Cache Poisoning refers to a mechanism where a censor interferes with the response sent by a DNS resolver to the requesting device by injecting an alternative IP address on the return path." If it is done after the resolver, the cache will never see the alternative IP address and so won't be poisoned."
From Stephane: "the title "DNS Cache Poisoning" is very misleading since not all censorship-via-DNS target the cache. "DNS cache poisoning" describes a limited set of specific attacks and you should not use it to describe any DNS mangling. Otherwise, discussions about possible solutions would be impossible (for instance, DNSSEC fixes the problem of DNS cache poisoning but certainly not all the DNS censorship techniques)." Seems like the title needs to be fixed to "DNS Interference" or "DNS Censorship" and it be made broader to incorporate more features of DNS censorship.