Draft: draft-hall-censorship-tech-latest

Commentary: … nce . defines censorship . fixes definition of identification in intro . 
 First , one thing that is n’t clear immediately from the introduction is who / what is a “ censor ” . I find it a little strange , actually , to suggest that a censor performs " aggregation " . Is the censor an ISP ? A government ? Something else ? For example , a government may have loose policies about what kind of content to censor ( e.g. , " hate speech " ) . An ISP might in turn implement these loose policies in different ways . Policies can also differ across a country , etc . The other terms --- identification and prevention --- are similarly confusing , although I think the term " identification " is n't as problematic as its ( incorrect ? ) definition in the introduction . " Identification is the process by which censors determine whether content is blocked " - NO . I think it is the process by which a censor might classify traffic to determine whether to block a traffic flow or now . I would suggest something like : prescription , identification , and interference . 
 Wondering what you think about " design , identification , and interference " ? I think for the purposes of todays 20:00 ET IETF drafts deadline , I 'll change the terminology throughout to match prescription , identification , and interference and I 'll correct the other things mentioned here ( define censor , fix definition of identification in intro ) . 
 That seems a bit more clear , indeed ! Ah , I did n't realize there was a deadline of today 2000h . Not sure I can get you a pull request by then , but will try . 
 I 'll leave this open . You by no means need to get a pull request by 20:00 ! I just want to do my best to make changes responsive to your feedback . I 'll leave this open and you can see what I 've done ( I 'll be working on trying to clear out issues until then ) , and feel free to submit changes as you think are needed .
This document describes the technical mechanisms used by censorship
regimes around the world to block or degrade Internet traffic.  It
aims to make designers, implementers, and users of Internet protocols
aware of the properties being exploited and mechanisms used to censor
end-user access to information.  This document makes no suggestions
on individual protocol considerations, and is purely informational,
intended to be a reference.
This document describes the technical mechanisms used by censorship
regimes around the world to block or impair Internet traffic.  It
aims to make designers, implementers, and users of Internet protocols
aware of the properties being exploited and mechanisms used to censor
end-user access to information.  This document makes no suggestions
on individual protocol considerations, and is purely informational,
intended to be a reference.
This document describes the technical mechanisms used by censorship
regimes around the world to block or degrade Internet traffic (see
RFC7754 for a discussion of Internet blocking and filtering in terms
of Internet architecture).  To that end, we describe three elements
of Internet censorship: aggregation, identification, and prevention.
Aggregation is the process by which censors determine what they
should block, i.e. they decide to block a list of pornographic
websites.  Identification is the process by which censors determine
whether content is blocked, i.e. the censor blocks all webpages
containing "sex" in the title.  Prevention is the process by which
the censor intercedes in communication and prevents access to
censored materials.
This document describes the technical mechanisms used by censorship
regimes around the world to block or impair Internet traffic (see
RFC7754 for a discussion of Internet blocking and filtering in terms
of Internet architecture).  To that end, we describe three elements
of Internet censorship: prescription, identification, and
interference.  Prescription is the process by which censors determine
what types of material they should block, i.e. they decide to block a
list of pornographic websites.  Identification is the process by
which censors classify specific traffic to be blocked or impaird,
i.e. the censor blocks or impairs all webpages containing "sex" in
the title or traffic to sex.com.  Interference is the process by
which the censor intercedes in communication and prevents access to
censored materials by blocking access or impairing the connection.
At all levels of the network hierarchy, the filtration mechanisms
used to detect undesirable traffic are essentially the same: a censor
sniffs transmitting packets and identifies undesirable content, and
then uses a blocking or shaping mechanism to prevent or degrade
access.  Identification of undesirable traffic can occur at the
application, transport, or network layer of the IP stack.  Censors
are almost always concerned with web traffic, so the relevant
protocols tend to be filtered in predictable ways.  For example, a
subversive image would always make it past a keyword filter, but the
IP address of the site serving the image may be blacklisted when
identified as a provider of undesirable content.
At all levels of the network hierarchy, the filtration mechanisms
used to detect undesirable traffic are essentially the same: a censor
sniffs transmitting packets and identifies undesirable content, and
then uses a blocking or shaping mechanism to prevent or impair
access.  Identification of undesirable traffic can occur at the
application, transport, or network layer of the IP stack.  Censors
are almost always concerned with web traffic, so the relevant
protocols tend to be filtered in predictable ways.  For example, a
subversive image would always make it past a keyword filter, but the
IP address of the site serving the image may be blacklisted when
identified as a provider of undesirable content.
Censors sometimes identify entire protocols to be blocked using a
variety of traffic characteristics.  For example, Iran degrades the
performance of HTTPS traffic, a protocol that prevents further
analysis, to encourage users to switch to HTTP, a protocol that they
can analyze Aryan-2012.  A simple protocol identification would be to
recognize all TCP traffic over port 443 as HTTPS, but more
sophisticated analysis of the statistical properties of payload data
and flow behavior, would be more effective, even when port 443 is not
used Hjelmvik-2010 Sandvine-2014.
Censors sometimes identify entire protocols to be blocked using a
variety of traffic characteristics.  For example, Iran impairs the
performance of HTTPS traffic, a protocol that prevents further
analysis, to encourage users to switch to HTTP, a protocol that they
can analyze Aryan-2012.  A simple protocol identification would be to
recognize all TCP traffic over port 443 as HTTPS, but more
sophisticated analysis of the statistical properties of payload data
and flow behavior, would be more effective, even when port 443 is not
used Hjelmvik-2010 Sandvine-2014.
Empirical Examples: Packet Dropping is a very common form of
technical prevention and lends itself to accurate detection given the
unique nature of the time-out requests it leaves in its wake.  The
Great Firewall of China uses packet dropping as one of its primary
mechanisms of technical censorship Ensafi-2013.  Iran also uses
Packet Dropping as the mechanisms for throttling SSH Aryan-2012.
These are but two examples of a ubiquitous censorship practice.
Empirical Examples: Packet Dropping is a very common form of
technical interference and lends itself to accurate detection given
the unique nature of the time-out requests it leaves in its wake.
The Great Firewall of China uses packet dropping as one of its
primary mechanisms of technical censorship Ensafi-2013.  Iran also
uses Packet Dropping as the mechanisms for throttling SSH Aryan-2012.
These are but two examples of a ubiquitous censorship practice.
Empirical Examples: RST Packet Injection, as mentioned above, is most
often paired with identification techniques that require splitting,
such as DPI or Protocol Identification.  In 2007 Comcast was accused
of using RST Packet Injection to interrupt traffic it identified as
BitTorrent Schoen-2007, this later led to a US Federal Communications
Commission ruling against Comcast VonLohmann-2008.  China has also
been known to use RST Packet Injection for censorship purposes.  This
prevention is especially evident in the interruption of encrypted/
obfuscated protocols, such as those used by Tor Winter-2012.
Empirical Examples: RST Packet Injection, as mentioned above, is most
often paired with identification techniques that require splitting,
such as DPI or Protocol Identification.  In 2007 Comcast was accused
of using RST Packet Injection to interrupt traffic it identified as
BitTorrent Schoen-2007, this later led to a US Federal Communications
Commission ruling against Comcast VonLohmann-2008.  China has also
been known to use RST Packet Injection for censorship purposes.  This
interference is especially evident in the interruption of encrypted/
obfuscated protocols, such as those used by Tor Winter-2012.