October 10, 2002
http://www.nytimes.com/2002/10/10/technology/circuits/10hack.html
Guerrilla Warfare, Waged With Code
By JENNIFER 8. LEE
HEN the reports started trickling out in early September, they were met with disbelief and then outrage among technophiles. The Chinese government had blocked its citizens from using the popular search engine Google by exercising its control over the nation's Internet service providers.
The aggressive move surprised Nart Villeneuve, a 28-year-old computer science student at the University of Toronto who has long been interested in Chinese technology issues. Blocking one of the most popular sites on the Internet was a far cry from Beijing's practice of restricting access to the Web sites of dissident groups or Western news organizations.
From his research, Mr. Villeneuve knew that the Chinese firewall was less a wall than a net. It was porous, and the holes could be exploited. So he sat down at his home computer and within three hours had created the basics of a program that would enable Chinese Internet users to get access to Google through an unblocked look-alike site.
"It's a very simple solution," Mr. Villeneuve said. "It's kind of crude, but it works."
Mr. Villeneuve considers himself a "hacktivist" - an activist who uses technology for political ends.
"I think of hacktivism as a philosophy: taking the hacker ethic of understanding things by reverse engineering and applying that same concept to traditional activism," he said.
He takes part in Hacktivismo, a two-year-old group of about 40 programmers and computer security professionals scattered across five continents. It is just one of a handful of grass-roots organizations and small companies that are uniting politically minded programmers and technologically asute dissidents to combat Internet surveillance and censorship by governments around the globe, including those of Saudi Arabia, Myanmar, Laos, Yemen and the United Arab Emirates as well as China.
Some protect the identities of computer users in countries where Internet use is monitored closely. Others are creating peer-to-peer networks that allow for anonymous file sharing. Some have taken established techniques for encrypting data and made them easier to use. Still others are adopting techniques used by commercial e-mail spammers to send political e-mail messages past restrictive filters.
"They are computer scientists who have principled causes," said Ronald J. Deibert, an associate professor of political science at the University of Toronto who has studied the activities of such groups and runs the Citizen Lab, a political science technology laboratory that supported Mr. Villeneuve's work. "They are developing technologies not for commercial purposes, but for political purposes."
One group, the Freenet Project, has built an anonymous file-sharing network from which Internet users can download anti-government documents without fear of reprisal. Dynamic Internet Technology, a small company in Asheville, N.C., provides technical services to efforts by the Voice of America to get e-mail newsletters into China, using spammers' techniques like altering subject lines or inserting odd characters in key terms (like "June{tilde}4,'' the date of the crackdown on protests in Tiananmen Square in 1989). Chinese Internet service providers use filters that scan e-mail for such politically sensitive terms.
SafeWeb, a maker of networking hardware in Emeryville, Calif., that has drawn some financing from the Central Intelligence Agency, recently provided free software called Triangle Boy that protected Internet users' identities by routing their browsing through SafeWeb's server. The service was popular in Saudi Arabia, the United Arab Emirates and China but has been suspended for lack of money.
Mr. Villeneuve's project, which he calls a "pseudoproxy,'' is fairly simple. A computer user in China who knows the right Web address - usually learned through word of mouth - can visit the Google look-alike site on unblocked computers that run Mr. Villeneuve's software. Those computers call upon Google's servers and return the search results to the user.
Other Hacktivismo members are taking Mr. Villeneuve's concept and applying it into a more secure and flexible program that can be distributed to computer users around the world to help Chinese users gain access to sites if and when they are blocked. (Google's main site is no longer blocked by China, although search requests are being filtered. The words "Falun Gong," for example, the name of a spiritual sect that has been outlawed by the Chinese government, do not return search results.)
Most groups are ad-hoc operations made up almost entirely of volunteers with shoestring budgets. The impact of their David-versus-Goliath struggles can be difficult to gauge. But lately these groups and companies have been receiving more attention from United States government officials. In August the House Policy Committee issued a policy statement that included a call for the United States to "aggressively defend global Internet freedom" by supporting nonprofit and commercial efforts.
Fighting restrictions on the use of the Internet can be difficult because the governments imposing the limits often control the technological infrastructure in their countries. The Saudi government, for example, filters all public Internet traffic. The Chinese government has public security bureaus across the county that monitor Internet use.
In its statement, the House Policy Committee noted that the Syrian government, for example, is able to monitor e-mail messages because it controls the single Internet service provider. Tunisia's five Internet service providers are also under direct government control, the statement said.
So the technology activists sometimes have to get creative to get around the restrictions. The activists include computer industry professionals as well as teenage geeks. (Hacktivismo's youngest member lives in India and says he is 15 years old.) Most are in their 20's and early 30's.
"There is a lot of apathy among my generation with political processes," said Ian Clarke, the 25-year-old founder of the Freenet Project. "The nice things about writing code to address the political issues is that we are playing the game on our own turf."
Some of the groups are careful to distance themselves from protest-oriented forms of hacking that attack or deface computer systems. Hacktivismo members, for example, say they are trying to be constructive rather than destructive.
"Hackers like to see stuff built up, not torn down or defaced," said the group's 51-year-old founder, who identified himself only as Oxblood Ruffin. "You don't want to attack the infrastructure."
So far many of the groups have focused on China, which with some 46 million users has the third-largest online population in the world (after the United States and Japan) and some of the most sophisticated controls over service providers (along with Saudi Arabia's).
Among Hacktivismo's current projects is an encrypted file-sharing technology called Six/Four, a name derived from the date of the Tiananmen Square crackdown. This technology would provide a layer of encryption that would allow computers to request and pass information without leaving an easily traceable trail.
Six/Four makes it difficult to determine whether a computer is requesting information or simply relaying a request on behalf of another computer, making it harder to trace the path that information is traveling.
The Freenet China project uses the publishing technology of a broader organization, the Free Internet Project, known as Freenet, to disseminate information about China on the Web. People who install Freenet software on their computers can anonymously place information in a global information library shared by the network of Freenet users. While users of the World Wide Web ordinarily make direct connections with Web sites to obtain information, Freenet users make indirect requests to other Freenet computers, which in turn send the request onward if they do not have the requested document.
Among the documents that have been released through Freenet China are the Tiananmen Papers, a compilation of transcripts of 1989 meetings among Chinese leaders about the protests.
Siuling Zhang, a Long Island-based developer of the project, said that it had received 10,000 requests for the Freenet China software. Since the program is small enough to fit on a floppy disk, she said, it has undoubtedly been copied many times over.
Because any computer can communicate with any other computer on the Freenet network, the Chinese government would need access to each individual machine to censor the entire Freenet library. "So far we haven't heard anything about Freenet being blocked," Ms. Zhang said.
Groups are also trying to create user-friendly versions of encryption technology. Digital steganography, the art of hiding one piece of information within another, has drawn more attention over the last year because of concern that terrorists could communicate by embedding text messages in graphics on the Internet. Until recently most security researchers have agreed that steganography is more glamorous in theory than in practice because it is hard to use.
But in July Hacktivismo released a program called Camera/Shy that makes steganography more accessible to ordinary users. The program rides atop Internet Explorer, automatically scanning images for hidden messages as the user browses through Web pages. The user needs to know the decryption key required to unravel the messages. It does not help users encrypt data, though tools for doing so are available for downloading on the Internet.
Hacktivismo members say that Camera/Shy has been downloaded an average of 300 times a day from the release site, sourceforge.net/projects/camerashy.
A shortage of funds prevents some promising technologies from being widely promoted. Dynaweb, an "anonymizing'' service that makes it hard for Chinese servers to identify users, was introduced six months ago by Dynamic Internet Technology and is available at dwang.orgdns.org. That site is more difficult for China to block because while its Web address remains the same, its numerical Internet Protocol address (which the government often uses to identify sites to block) changes regularly.
Dynaweb is seeking money from foundations to promote its service. "We actually hope we can have one full-time programmer to maintain it," said the 29-year-old Chinese immigrant who runs Dynamic Internet Technology and goes by the name Bill Dong.
If some members of Congress have their way, more money may soon be available for efforts to circumvent Internet censorship. Representative Christopher Cox, a California Republican and chairman of the House Policy Committee, has introduced legislation that would create a sister agency to the Voice of America called the Office of Global Internet Freedom. It would receive $50 million a year over the next two years.
"We want to organize and support our government-directed effort to defeat state-sponsored jamming of the Internet," Mr. Cox said.
Some remain wary of any alliance with the United States government. "The most effective strategies are always done on a grass-roots level," said Professor Deibert of the University of Toronto. "Anything that emanates from large bureaucratic organizations tends to be heavy-handed, misconceived and ill-planned."
But many politically minded technology specialists welcome the institutional support and money. "The government has lots of manpower and resources to put in," said Mr. Dong, the Dynaweb manager. "If you have two companies, it's nothing compared to resources the government has."
