Censorship of GitHub

GitHub has been the target of censorship from governments using methods ranging from local Internet service provider blocks, intermediary blocking using methods such as DNS hijacking and man-in-the-middle attacks, and denial-of-service attacks on GitHub's servers from countries including China, India, Russia, and Turkey. In all of these cases, GitHub has been eventually unblocked after backlash from users and technology businesses or compliance from GitHub.

Background

GitHub is a web-based Git repository hosting service and is primarily used to host the source code of software and facilitate project management. As of 2015, GitHub reports having over 10 million users and over 24.2 million repositories.[1] It offers free accounts, a pastebin service called Gist, and free website hosting under its github.io domain. The GitHub terms of service prohibits illegal use and it reserves the right to remove content at its discretion.[2] In addition, users can fork (copy and individually develop) other projects, which GitHub does not automatically take down when served DMCA takedown notices.[3] GitHub uses HTTPS for its connections making data much more secure against interception from third parties.

China

China heavily regulates Internet traffic and has blocked many international Internet companies including Facebook and Twitter.[4] In addition, Western businesses have said that these restrictions hurt their business by reducing access to information such as by search engines and using VPNs.[5]

GreatFire, a Chinese anti-censorship organization, has attempted to circumvent the Great Firewall of China using mirror websites. However, the links to these pages were posted using GitHub which brings the risk of the site being blocked along with the mirrors. In a previous incident, HSBC bank's Chinese operation was taken offline when the Akamai network was targeted for hosting GreatFire.org websites.[6]

DNS hijacking

Blockage

"No servers were able to reach your site."
Test results from viewDNS.info showing that GitHub was blocked from within China

On January 21, 2013, GitHub was blocked in China using DNS hijacking. Confirming the block, a spokesperson for GitHub said: "It does appear that we're at least being partly blocked by the Great Firewall of China".[lower-alpha 1][7] The block was lifted on January 23, 2013 after an online protest on Sina Weibo.[8]

Rationale

While there was no response from the Chinese government regarding the block, the Nandu Daily speculated that it was due to the hosting of plug-in software that allowed purchasing of train tickets before the Spring Festival rush in China, which was discouraged by the Ministry of Railways. However, the creator of the software denied this, saying that the software had been removed since January 16, 2013.[9]

Criticism

Kai-Fu Lee bought attention to the block after posting about it on Sina Weibo. He derided the block, saying: "Blocking GitHub is unjustifiable, and will only derail the nation's programmers from the world, while bringing about a loss in competitiveness and insight." Lee's post was shared over 80,000 times.[7]

The Next Web called the block unfortunate, saying that "Chinese developers will have to play around with workarounds or find an alternative service when they want to work with their peers around the world."[7]

MITM attack

Attack

"Safari can't verify the identity of the website github.com."
An example of the warning users in China received from browsers when trying to access GitHub with the self-signed certificate

On January 26, 2013, GitHub users in China experienced a man-in-the-middle attack in which attackers could have possibly intercepted traffic between the site and its users in China. The mechanism of the attack was through a fake SSL certificate.[10] Users attempting to access GitHub received a warning of an invalid SSL certificate, which due to being signed by an unknown authority was quickly detected.[11] A spokesperson for GitHub said "Early last week, it appeared that GitHub was being at least partially blocked by the Great Firewall of China... After a couple days, it appeared that GitHub was no longer being blocked."[10] NETRESEC performed forensics of the attack and determined that it was legitimate due to the large number of router hops (6) involved and because the user submitting the packet capture was from China.[12]

Rationale

GreatFire speculated that the attack was related to a popular White House petition calling for the denial of entry to the United States of the architects of the Great Firewall of China.[11] The petition linked to a Gist containing names of 3 of the architects and their contact information.[13] GreatFire also said that since GitHub is HTTPS only, Chinese authorities can't block individual pages and have to completely block the website, which helps explain why they would have to resort to the attack.[11] InformationWeek also noted the economic difficulty related to blocking GitHub: "What makes GitHub interesting from a censorship point of view is that it combines a critical business service—collaborative coding—with social interaction."[10]

DDoS attack

On March 26, 2015, GitHub was the target of a distributed denial-of-service (DDoS) attack originating from China. It targeted two anti-censorship projects: GreatFire and cn-nytimes, the latter including instructions on how to access the Chinese version of The New York Times.[14]

India

India selectively censors websites at the federal and state levels. This is enforced by the Information Technology Act, 2000 as well as licensing requirements for internet service providers (ISP). Critics such as Rajeev Chandrasekhar have noted the vagueness of these regulations and the Centre for Internet and Society found that ISPs tended to over-comply with takedown requests.[15]

ISP blockage

On December 17, 2014, the Indian Department of Telecom issued an order to ISPs to block 32 websites.[16] The notice was made public on December 31, 2014 and it included GitHub, GitHub's Gist, Vimeo, the Internet Archive, and various pastebin services.[17]

Direction to block Internet Website

To: All Internet Service Licensees
Under the powers conferred by Section 69A of the Information Technology Act, 2000 and under the Information Technology (Procedures and Safeguards for Blocking of Access of Information by Public) Rules, 2009, it has been decided to immediately block the access to the following 32 URLs:...

Department of Telecommunications[17]

The block order was confirmed on Twitter by Arvind Gupta, the national head of the ruling party BJP, and was attributed to a suggestion by India's Anti Terrorism Squad in response to content by the Islamic extremist group ISIS. Gupta also stated that websites that cooperated with the investigation were being unblocked.[18]

On January 2, 2015, the Ministry of Communications issued a statement that it will be unblocking 4 of the websites, including GitHub's Gist, and said that it will consider unblocking the remaining websites once they complied. Explaining its rationale, the ministry stated "Many of these websites do not require any authentication for pasting any material on them... These websites were being used frequently for pasting, communicating [jihadi] content..."[19] Gulshan Rai of the CERT-In agency of the ministry said that the order came from the Mumbai Additional Chief Metropolitan Magistrate following an interrogation of Arif Majeed, an ISIS recruit.[20]

On January 4, 2015, a GitHub spokesperson said that some users were still having trouble accessing the site and that GitHub has attempted to reach out to the Indian government, but is still unclear about the cause of the block. They said that restoring access to the developer community in India was their top priority and that they "would like to work with the Indian government to establish a transparent process for identifying unlawful content, restore access, and ensure that GitHub continues to remain available in the future without interruption."[21]

Impact

The Times of India reported blockage for Indian users by ISPs Vodafone, BSNL and Hathway, but still had access using Airtel.[16] Because the order only told ISPs what to block and not how, the effectiveness of blocking access varied. The blocking was unreliable and seemed to be occurring at multiple layers, even within the same ISP. Blocking methods included IP blocking, the use of a proxy server, and DNS blocking. Gaining access ranged from using an alternate DNS server to installing circumvention software.[22]

Criticism

Silhouettes of GitHub's octocat and the vimeo logo with the word "blocked" inside them, along with a description of the block
A poster by the Free Software Foundation Tamil Nadu protesting the blocks using the hashtag #GOIBlocks

In regards to the blocks, TechCrunch remarked that "[the] addition of GitHub... is one of the more head-scratching decisions" and anticipated an uproar considering its importance in the tech industry. They also called it embarrassing in the context of Prime Minister Narendra Modi's Make in India campaign to promote India as a destination for information technology.[23] Prasanth Sugathan of the Software Freedom and Law Center called the blocks short-sighted, saying that "If you block one website, terrorists can always use another one... Such a move only inconveniences the daily users..." Twitter users protested using the hashtag #GOIblocks and recirculated a hypocritical message by Modi from 2012 condemning blanket blocking of websites.[20] Anonymous of India also posted several threats against the government, but did not take any action.[19]

Russia

The Russian government blacklists websites that include child pornography, drug-related material, advocacy of suicide, extremist material, and other illegal content under the Russian Internet Restriction Bill to protect children. This list is maintained by Roscomnadzor, Russia's regulatory agency.[24]

ISP blockage

A screenshot of the Firefox browser and an error message in Russian
The block message Russian GitHub users saw when trying to access the website on December 2, 2014[lower-alpha 2]

On December 2, 2014, Roscomnadzor blocked GitHub because it was hosting various copies of a suicide manual. Because GitHub uses HTTPS, which encrypts data between a user's computer and GitHub, internet service providers (ISP) were forced to block the whole website instead of the pages in question. Complying ISPs included: Beeline, MTS, MGTS and Megafon. Maxim Ksenzov, the Deputy Head of the Roscomnadzor, said in a statement that the block was due to GitHub not complying with earlier takedown requests for the manual on October 10, 2014.[25] GitHub was also momentarily blocked on October 2, 2014 until the original copy of the manual was deleted.[26]

Banned content

The manual in question was posted on March 23, 2014, and details 31 methods of suicide in Russia. It was created in a repository for a software library for working with Windows filesystems and was forked by several users.[27] The original copy was deleted by the owner on October 2, 2014 after numerous complaints by GitHub users following a block of GitHub by Roscomnadzor.[lower-alpha 3][27][28]

TechCrunch remarked that the manual seemed to be written as satire and includes methods such as "biting your tongue", "joining the military" or "getting a good gun" from a policeman.[29] The takedown targeted the manual and its copies, as well as a reposted blog entry about suicide.[30]

Response

GitHub complied and blocked access to the content within Russia saying that they were working to get reinstated. Citing its terms of service, GitHub elaborated that "you must not, in the use of the Service, violate any laws in your jurisdiction (including but not limited to copyright or trademark laws)."[29] GitHub also created an official repository titled "roskomnadzor" for the purpose of posting takedown notices from the regulator. (It was later moved to "gov-takedowns" after a request from China on June 9, 2016[31]) In the readme of the repository, GitHub states that they are concerned about Internet censorship and believe in transparency to document the potential for chilling effects. They also warn that the presence of a notice is only for documentation and that GitHub does not pass any judgement on their validity.[32]

Turkey

Network measurements by Turkey Blocks confirming the time at which GitHub was blocked

On October 8, 2016, following the leak of emails by RedHack of Minister Berat Albayrak, the Information and Communication Technologies Authority (BTK) ordered ISPs to block several file sharing websites including Dropbox, Microsoft OneDrive, and Google Drive.[33] The censorship monitoring watchdog Turkey Blocks observed that GitHub was blocked the following morning, and associated administrative orders were subsequently posted by the BTK stating that access had been officially restricted.[34] Software that depended on GitHub reported errors, such as Font Awesome and Homebrew. Participants in Startup Istanbul week also complained about the availability of infrastructure. The #GitHub hashtag became one of Twitter's top trends in Turkey. According to The Daily Dot, RedHack purposefully spread the emails using multiple services, expecting Turkey to block them so that the Streisand effect could be utilized. GitHub was unblocked 18 hours later.[35]

Notes

  1. ↑ The Next Web and GreatFire both claim that it was fully blocked however.[7]
  2. ↑ The content of the page consists of 4 reasons why the website breaks laws under the Russian Federation, and why therefore, the contents of the website are blocked.
  3. ↑ However, because the original was forked, and Git keeps a history of changes, the file was still accessible on GitHub.

References

  1. ↑ "GitHub Press Info". github.com. Github. Retrieved 27 June 2015.
  2. ↑ "GitHub Terms of Service". GitHub. Retrieved 27 June 2015. (Specifically terms A8 and G7)
  3. ↑ "DMCA Takedown Policy". GitHub. Retrieved 27 June 2015.
  4. ↑ Wei, Sisi. "Inside the Firewall: Tracking the News That China Blocks". ProPublica. Retrieved 27 June 2015.
  5. ↑ Chin, Josh. "China Internet Restrictions Hurting Business, Western Companies Say". Wall Street Journal Blogs. Retrieved 27 June 2015.
  6. ↑ Silbert, Sean. "Routing around the Great Firewall of China". LA Times. Retrieved 27 June 2015.
  7. 1 2 3 4 Protalinski, Emil. "The Chinese government appears to be blocking GitHub via DNS (Update: Investigation underway)". The Next Web. Retrieved 9 April 2015.
  8. ↑ Kan, Michael. "GitHub unblocked in China after former Google head slams its censorship". Computer World. Retrieved 9 April 2015.
  9. ↑ Tiantian, Bai. "US tech website back online". Global Times. Retrieved 9 April 2015.
  10. 1 2 3 Claburn, Thomas. "China's GitHub Censorship Dilemma". InformationWeek. Retrieved 27 June 2015.
  11. 1 2 3 "China, GitHub and the man-in-the-middle". GreatFire. Retrieved 27 June 2015.
  12. ↑ Hjelmvik, Erik. "Forensics of Chinese MITM on GitHub". NETRESEC Blog. Retrieved 27 June 2015.
  13. ↑ Muncaster, Phil. "Great Firewall architects fingered for GitHub attack". The Register. Retrieved 27 June 2015.
  14. ↑ Anthony, Sebastian. "GitHub battles "largest DDoS" in site's history, targeted at anti-censorship tools". ars technica. Retrieved 9 October 2016.
  15. ↑ Patry, Melody. "India: Digital freedom under threat? Online censorship". index. Retrieved 2 April 2015.
  16. 1 2 Saxena, Anupam. "Pastebin, Dailymotion, Github blocked after DoT order: Report". The Times of India. Retrieved 1 April 2015.
  17. 1 2 Blue, Violet. "India blocks 32 websites, including GitHub, Internet Archive, Pastebin, Vimeo". ZDNet. Retrieved 1 April 2015.
  18. ↑ Ghoshal, Abhimanyu. "GitHub, Vimeo and 30 more sites blocked in India over content from ISIS". The Next Web. Retrieved 1 April 2015.
  19. 1 2 Sharma, Ravi. "Indian government unblocks Vimeo, Dailymotion, 2 other websites". The Times of India. Retrieved 1 April 2015.
  20. 1 2 Arora, Kim. "Government blocks 32 websites to check ISIS propaganda". The Times of India - Tech. Retrieved 1 April 2015.
  21. ↑ Orsini, Lauren. "India Unblocks GitHub, Three Other Websites". readwrite. Retrieved 1 April 2015.
  22. ↑ Srikanth, Kaustubh. "Technical Observations About Recent Internet Censorship In India". The Huffington Post. Retrieved 1 April 2015.
  23. ↑ Russell, Jon. "India's Government Asks ISPs To Block GitHub, Vimeo And 30 Other Websites (Updated)". TechCrunch. Retrieved 1 April 2015.
  24. ↑ Khazan, Olga. "Russia's secret new Internet blacklist". The Washington Post. Retrieved 2 April 2015.
  25. ↑ Lunden, Ingrid. "Russia Blacklists, Blocks GitHub Over Pages That Refer To Suicide". TechCrunch. Retrieved 1 April 2015.
  26. ↑ Лихачёв, Никита. "AliExpress, 2ch и GitHub попали в реестр запрещённых сайтов" [AliExpress, 2ch and GitHub put on the register of banned sites]. TJournal (in Russian). Retrieved 9 April 2015.
  27. 1 2 "Create suicide.txt". GitHub - amdf/objidlib. Archived from the original on 27 June 2015. Retrieved 8 April 2015.
  28. ↑ "Delete suicide.txt". GitHub - amdf/objidlib. Archived from the original on 27 June 2015. Retrieved 9 April 2015.
  29. 1 2 Lunden, Ingrid. "To Get Off Russia's Blacklist, GitHub Has Blocked Access To Pages That Highlight Suicide". TechCrunch. Retrieved 1 April 2015.
  30. ↑ "roskomnadzor/2014-10-21-roskomnadzor.md". GitHub. Retrieved 1 April 2015.
  31. ↑ Geraci, Jesse. "github/roskomnadzor - README.md". GitHub. Retrieved 9 October 2016.
  32. ↑ Geraci, Jesse. "github/roskomnadzor - README.md". GitHub. Retrieved 9 October 2016.
  33. ↑ "Turkey blocks Google, Microsoft and Dropbox services to 'suppress' mass email leaks". International Business Times. 10 October 2016. Retrieved 10 October 2016.
  34. ↑ "Dropbox, Google Drive and Microsoft OneDrive cloud services blocked in Turkey following leaks". Turkey Blocks. Retrieved 9 October 2016.
  35. ↑ Sozeri, Efe Kerem. "How hacktivist group RedHack gamed Turkey's censorship regime". Daily Dot. Retrieved 12 October 2016.

External links

This article is issued from Wikipedia - version of the 11/6/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.