A First glimpse at the Internet Filtering in Tunisia

We learned that the censorship imposed illegally on hundreds of Tunisian blogs and websites, both Tunisians and foreigners, was “shut off” temporarily for few hours on Monday, August 16, 2010. And although the information on this brief lifting of the censorship in the country is still contradictory – as some claimed they had no access to certain websites, while to others the same websites were accessible- it is still early to determine what really happened at the top level of Tunisian censorship, which is, remember, dark, top-secret, centralized at the highest level of the state and is never in the control of the several Tunisian ISPs, though, with an excess of zeal, they have the ability to add an extra layer of censorship to their customers.

Thus, we learned that access to Flickr, the photo sharing site (censored April 22, 2010) and video-sharing sites, blip.tv and wat.tv (respectively censored on the 22nd and 28th of April, 2010), has been restored. Ditto for many French and Arabic news websites. Curiously, during this same period, which lasted only a few hours, access to the two popular video-sharing websites, Dailymotion and Youtube (respectively censored September 3, 2007 and November 2, 2007) has not been restored. Something that raises some questions – but mostl importantly, provides some answers – about the nature of Tunisia’s secretive censorship infrastructure.

During this period, which lasted only a few hours, prompting hope amongst Internet users in Tunisia, many have raised the question of why YouTube and Dailymotion have remained inaccessible while other social websites like Flickr, became available from Tunisia. Why was the French Wikipedia page of Ben Ali inaccessible while the websites of Tunisian opposition parties, now censored, became available? Why was the blog Nawaat accessible while Nawaat’s Twitter page remained barred?

To understand what really happened, and then ascertain if any change in strategy at the organ level of censorship occurred, it is useful to clarify first the filtering techniques applied in Tunisia.

We will summarize the four Tunisian censorship processes. These four techniques have been adopted by the Tunisian censors at various times in the history of Tunisian Net, then gradually combined to form one of the most repressive online censorship machine.

1. Selective blocking by URL: such as is the case of Wikipedia. Indeed, rather than blocking the entire online encyclopedia, the censors selectively block the most “offensive” pages. This is why the French Wikipedia page on Ben Ali or the page relating to the practice of censorship in Tunisia remain inaccessible. Same for the Google video. If the majority of videos are still available, some, however, are blocked.
2. DNS Filtering: At the second stop, the Tunisian censors block the site by banning the domain and subdomain attached to it. This is the method most commonly used, especially to ban Tunisian bloggers emitting unpleasant opinions […] A situation that caused a cat-and-mouse game between bloggers and the censor through the successive creation of new sub-domains, which soon subsequently, are added the the block list.
3. IP Filtering: With the step above, the total blockage of the IP address of the site in question, whether or not the subdomain is used; this is the case of youtube.com, dailymotion.com and many others.
4. Keyword Filtering: Finally, we practice, for the most recalcitrant, a radical blocking through both, DNS and Keyword Filtering that block access to any URL path containing a specific keyword. This is the case with Tunisnews.net or Nawaat.org. With the latter procedure, any URL containing the string “Nawaat”, regardless of the domain, is systematically blocked. With this technique, the censors are trying to block every scrap of information on the keyword level that could appear on the screen of Tunisian Internet users.
   The Keyword Filtering when applied for example on the “Nawaat” string in any URLs results in a 404 page. Which practically means that @nawaat Twitter account is automatically blocked, as is the Nawaat Facebook account and all Google cache and search result pages that contain “nawaat” in their URL paths. […] In addition, the keyword in the URL blocks any image related to “Nawaat“, including those hosted on Google’s image search servers. Similarly, the string “Tunisnews” produces the same effects. Note that Keyword Filtering can be applied to block any content containing that specific string on any domain or subdomain.

So, in order to answer the questions raised above, let’s now recall the following facts that occurred during that brief lifting of the censorship in Tunisia, on monday, August 16th, 2010:

1. All sites censored by DNS filtering, including Flickr, were temporarily unblocked.
2. Both video-sharing websites, YouTube and Dailymotion, which are blocked in Tunisia by DNS and IP filtering, were not unblocked.
3. Ben Ali’s page on Wikipedia, which is censored by selective URL filtering, has not been unblocked.
4. Nawaat’s page on Twitter, which is subjected to a keyword Filtering, was also not available during the brief “lifting” of censorship.

This very revealing incident of the brief lifting of censorship has offered us, and for the first time, some insights about the extraordinary sophistication of the technical infrastructure of filtering in Tunisia. Thus, if the temporary “lifting” was a matter of a maintenance procedure, this leads us to note that there are at least two independent sub-facilities: one dedicated to DNS level filtering, and the second dedicated to keywords and IP filtering (and perhaps there is a third layer specially dedicated to the IP filtering). Thus, if a layer of these filters fails or is deactivated for some reason, such as maintenance or a server update, the independent secon–and possibly third–layers continue to operate.

Consequently, we can assume that this latest incident, the temporary “lifting” of censorship, has affected only one layer of the Tunisian censorship machine, the one responsible for the DNS filtering. This is what was observed on Monday. If we take the example of Nawaat (one of the few Tunisian sites censored by DNS and keyword filtering), we discovered that the DNS filtering was not working during that period, but during the same time, the keyword filtering within the URL was functioning efficiently. Thus, during this brief “lifting” of censorship, nawaat.org was accessible at the domain name level, but any URLs carrying the string “nawaat” were blocked (see below screenshots of the test on nawaat.org from Tunisia):

Now the other question that may arise, and that is important, is to know why the DNS filtering system stopped working for several hours while the other one or two layer(s) continued to ban “normally” all sites covered by IP, URL and keywords filtering?

It is possible that the Tunisian censors are currently improving their control over the network infrastructure for a better monitoring of “sensitive” topics, or even a more rigorous analysis of data packets traveling between the Tunisian network and the international one. A sophistication of the infrastructure could be very useful for mass logging and control of the online activities of users in Tunisia. With over one million and a half Tunisians on Facebook, hundreds of blogs (which are increasingly critical), more than a hundred of which are already censored, and a rather politicized stream of Tunisians on Twitter and other social web sites, the Tunisian regime has no choice but to increase its control over the network through a sophistication à la chinoise of its filtering and tracing infrastructure. Still, if there was an update of the infrastructure, such as another notch of sophistication, do not hesitate to all be vigilant and attentive to the processes used.

It is also probable that this was a “simple” update server; and rather than unblocking all of the traffic, the censor has maintained a layer or layers of URL, keywords and IP filtering while unblocking the other layer, that of DNS blocking. Once the update or change to the server made, everything was back to “normal”.

Other extrapolations, such as the Forum on Democracy and Trade Union Policy, could explain the temporary lifting of censorship:

It seems that international delegation is visiting our country to discuss freedom of the press and the veracity of allegations of civil society activists on Internet censorship …. we therefore expect that the lifting of censorship is temporary just long enough to fool the delegation mentioned above.

It is indeed possible, but unlikely for the following reason: in some circumstances, the Tunisian censors have unblocked sites to fool the international community. This happened during the WSIS and in certain international events in Tunisia. But each time, this was limited to certain sites such as those of political parties currently censored. Thus, the temporary lifting has never been as systematic as we experienced on monday, but rather on a site by site basis. In any event, during the interlude of “freedom”, neither the blog Nawaat nor Tunisnews have escaped the vile censorship filters.

Obviously all of these assumptions are mere speculations. This is an effort on our part to try to better understand one of the most secretive system of repression in Tunisia and to help demystify its processes. And obviously, we invite anyone with further information to make them public, and a fortiori, it may be that former collaborators of this repressive system finally reveal what can help Tunisia to get rid of this evil.

It is only a matter of time and, sooner or later, revelations, from those who are now involved in the censorship taking place, will occur. Also, remember our email Nawaat [@] gmail [dot] com. Our site is always open to any collaborator. It goes without saying that these collaborators have the absolute assurance about the confidentiality of their identity.

Written jointly by Sami Ben Gharbia and Astrubal. Translated from french by Jillian C. York .