Mahsa: Mobile Censorship in Iran

As Internet users increasingly connect to the Internet through smartphones, this has transformed Iran’s Internet ecology towards an increasing reliance and production in apps. In Iran, a country that practises some of the most stringent censorship and surveillance techniques in the world has seen this transformation reshape the way the government implements information controls online. While applications with popular usage on browsers such as Facebook and Twitter remain blocked through their mobile applications, platforms that predominantly exist in app form such as WhatsApp, Viber, and Instagram remain unblocked in the country. This talk will look at how the government is counteracting these policies through various means, including local imitation apps, and new programs such as ‘intelligent filtering’, and the Revolutionary Guards' “Spider” program. Additionally, a discussion of how Iranian Internet users use these platforms, especially in reference to digital security awareness and practices will be included.

Mahsa

preroll music

Herald: Good evening, thank
you for joining us tonight,

here at the CCC in Hamburg.
And also thank you for everyone

tuning in around the
world via our livestream.

I'm very, very honored and excited
to introduce our new... next guest,

Mahsa Alimardani?
laughs

- it was my attempt to say the name Mahsa
Alimardani - she's an Iranian-Canadian

researcher and activist.

Mahsa is finishing her master's
degree and is a research assistant

at the Deja Active Lab, both at
the university of Amsterdam,

and her focus is on freedom of
expression and access to information

in Iran. She's also the editor
of the Global Voices Iran

and today she will be sharing some
of her research findings with us

about the censorship situation
in Iran on mobile platforms.

With that I would like to ask you to
help me welcome Mahsa Alimardani!

applause

Mahsa Alimardani: Thank you Sonia,
for the nice introduction,

and thank you all for
coming to this session,

I know there's a lot of awesome
computing sessions happening right now.

And, so, just to introduce you a little
bit to the Iranian internet ecosystem.

So, there are some realities,
you should know about it.

decent laughter

Yes, if you're thinking of traveling to
Iran I'd tell this to everyone: Do go!

It's awesome, it's amazing,
it's a beautiful country.

Although, take into consideration
the type of work that you do and

the type of public profile
you have when you do go.

If you do go do set up TOR relays
'cause that's really helpful to people

accessing the internet in Iran.

And one of the things you should
know that the Iranian internet,

it's often known as the Filter Net.

And Filter Net sort of has been the name
ascribed to the internet

because of the censorship
that happens in Iran.

I think out of the whole
world Iran would come

second after China in the terms
of the pervasiveness of censorship

and internet controls around the world.

Something that you might not know is
that it is also known as the "Kondnet"

and "kond" means "slow".

The fact that the internet
is often throttled in Iran,

and the speeds are very slow,

and the fact that it can be very
frustrating sometimes to upload a page

it also has the name of "Kondnet".

So, this talk will sort of describe this,
I'll talk on Mobile Censorship

and how they will focus on that.
I just wanna take a sort of broader view

and to look at more general
look at internet policy in Iran

and just before I sort of delve into it...

The reason why I really
wanted to get this talk at

a conference like the CCC is
because I know this is a community

full of lots of different
expertise in terms of

Digital Security,
in terms of Circumvention.

So, bringing awareness and sort
of knowledge in focus on Iran

I think is kind of exciting
in a community like this

'cause a lot of help and
a lot of aid can go towards

access to internet in Iran
from a group of people like you.

So: just a broad look at what the internet
infrastructure's like in Iran is.

The Ministry of Information,
Communication and Technology (ICT)

runs the Telecommunications
Company of Iran

and this company is also responsible

for the main ISP of Iran which is the
Data Communication Company of Iran.

So, in effect they control all
internet traffic that goes into Iran

and all ISP's both private and
government are controlled through

the Data Communication Company of Iran.

So this company in effect becomes
the point where filtering can occur

and the blocking of pages or
the blacklisting of keywords occurs.

Oftentimes the Telecommunications
Company uses proxy servers

for surveillance by logging all
unencrypted internet traffic that goes on

in Iran which is why it's really important
for pages that are being used

especially by Iranians if not
everywhere else in the world

to have https for all
Mobile Applications to be using

encryption technology
and things like that.

Now, all of these things
are really concerning as it is

the fact that the government has so
much access to data over the internet.

What's even more concerning
is looking at this chart here.

So this is the overall view
of the institutions responsible

for internet policy in Iran.
And you see at the very top

there is the Supreme Leader. Although
Iran does have no active president,

ultimately, the Supreme Leader
has the Veto Power

and is in effect really
the official Head Of State.

And so while the ministry of ICT is part
of the elected administration

the Supreme Leader has ultimate power.
And what is particularly

concerning here is while we have
the ministry of ICT here on the right

and then you have the Telecommunications
Company. And then you have

the ISP provider in Iran. You then
have the Revolutionary Guards

which are a para-military
organization in Iran

who are not accountable
to the elected government.

They're ultimately only accountable
to the Supreme Leader.

They own the largest share of the
Telecommunications Company of Iran.

This is particularly concerning because
a group like the Revolutionary Guards

are the ones who are oftentimes
responsible for

various surveillance programs,
for arrests of dissidents.

One of their offshoots, the Basij
were the ones on the streets,

arresting and beating up protesters
during the 2009 Green Movement.

So the fact that they have access to
this kind of data it's very concerning

in why things like digital security are of
the upmost importance in Iran.

Just a little brief overview of why

this sort of history started in Iran.
It's not always been like this.

This started during the Reformer's era
in Iran which were the late 90ies.

This was a period where
relative to the Iranian context

which is a Islamic theocracy there was
more progressive politics

and the hardline elements which aren't
often accountable to the electorate

in Iran kind of clashed with the
Reformer's Government that was in power

and so the surge in Reformer's
jounalists that were

in traditional print media meant
that they could start migrating online

in the early 2000's, late 90ies, when
blogging was becoming really popular

and the technology to use Persian unicode
was becoming more pervasive.

During this time the government
sort of realized that there's

this space that's not
being controlled at all.

And so filtering of pages
started early on in 2001

but there was no real systematic
procedure for this filtering.

So they came up with the
Cybercrimes Law in 2006.

But that sort of lay
floating around until 2009

when the internet became
a really big deal because,

I'm sure some of you have
heard of the Twitter Revolution

which sort of came out after 2009
Green Movement. And it was at that point

- when Iranians were coming out en masse
onto the streets protesting

what they claimed to be a fraudulent
election - that the Iranian Government

shut down the internet. And so
after this period they codified

the Cybercrimes Law to sort of ensure
a more systematic way of filtering

various pages including Twitter
and Facebook, that came out of it.

And then following this you
had the Revolutionary Guard's

establishment of Gerdab which is
a Cyber Command Center

which is now responsible for
the arrest of many different bloggers

and activists in Iran. And then in 2011

because there wasn't enough
control over the internet

they set up the FATA, a police force,
from the police forces.

While they do sort of take care
of things like cybercrime

in terms of banking, in identity theft,
they also are responsible

for the arrests of various bloggers.
There was one popular case in 2012

of Sattar Beheshti, who had public
dissident posts against the government.

And then finally in 2012
the Supreme Leader who has

quite a grand name of its own decided
to setup a very Sci-fi-esque body

- at least in the English language -
called the Supreme Council of Cyberspace.

audience amused

This body basically would be responsible
for all of the Internet Policy

in Iran. And this really marked
a turning point in Iran where

cyberspace and internet became
a key issue of National Security;

not only were there concerns
of cyber attacks from the United States

and Israel, there was also
big concerns of dissidents

and various movements that could
sort of emerge through Social Media

and the blogs. And so all the
decision making would occur through

the members that they decided to appoint
to this council. And it's a mixed bag

of different ministers as well as
unelected officials and experts.

Over the years they've had various
different programs to try to control

the internet and most recently
in last March they came up with

another grand sounding
program called Spider.

Spider was a project of the Revolutionary
Guards where they sort of

talked about doing blanket surveillance
over all Social Media activities,

activities of Iranians which technically

- if any of you know anything about
how Facebook or how Twitter works -

it's quite hard. If posts are private
it's hard to delve into them.

Anyways, so what is key to understanding
about the internet climate right now

is that there is a moderate president
Rohani who came into power

on a platform of many
different progressive policies

one of which was Internet Freedom.

And so they've had many
different progressive moments.

They shut down the hardline judiciary's
attempts to block Whatsapp e.g.

and they've promised not to really
shut down any other platform

or censor anything unless there is
a legitimate replacement for them

and this is a quote by
the minister of ICT.

But at the same time
they've been trying to cater to

some of the hardline elements
and try to sort of balance out

their Internet Freedom policies with
programs like intelligent filtering,

which would mean not blocking
entire platforms outright but

blocking individual pages.

This program... about 66 Mio. Dollars
has been spent on this program

from the ICT budget. And overall
it's been a bit of a failure.

I worked on a piece of research
with Frederic Jacobs that sort of

underlined how the intelligent filtering
on Instagram, which was

the most tangible,
resolved of this form of control.

was only occuring because
Instagram had failed to release

the https on the Mobile API.
So they were able to enable

intelligent filtering on the mobile
application but not on the browser.

Later on people found out that there was
still disruptions and images

weren't loading to Instagram even
after Instagram enabled https

over the Mobile API. And it turned out that
this was just collateral damage

from the fact that some of the
images on Instagram were also hosted

on Facebook which is
outright blocked in Iran.

So right now we're about to go
up to a election in Iran.

It's in February,
it's the Parliamentary Elections.

And typically during these
sensitive moments in Iran

they start playing around
with the internet and

this happened in 2013. There was

a significant throttling of the internet
leading up to the elections.

And right now there have been
some things spotted although

it's speculation whether or not
it's related to the elections at all.

Some websites with foreign
SSL certificates are being blocked.

There was one example of a
popular blogger based in Iran

named Jadi who has a
SSL certificate from Cloudflare

and his website was blocked.
And you'll notice that local certificates

won't be blocked because ultimately
they're controlled by the government.

This is a diagram formed by Smallmedia
that sort of explains how

the certificate authorities are ultimately
in the hands of the government

and data could potentially be shared.

There is also throttling of TLS in
November and the best example of this

was over TOR direct connections which,
you see, experienced a significant drop.

The shift towards mobile applications
and the fact that Iranians are

increasingly accessing the web through
their phones means that there's been

sort of a increased focus by
the government on mobile apps.

In order to sort of talk to this they've been
coming up with local alternatives

like WeChat has Dialog which sort of
you can see from the interface

that this local version is imitating that
application. Instagram had Lenzor.

But you kind of see that it's not
working as effectively because

if you look at the Cafe Bazaar Stats,
which is a platform where Iranians

download their apps, Lenzor
only has about 50000 users

while Instagram has
more than 9 Mio.

Viber had another imitation
out called Salam.

Salam was speculated to be
developed by the Basij.

So popular apps right now have...
there's Whatsapp and there's Viber

and Telegram in terms of
chats and communication.

Telegram is the most popular right now
and that's mainly because

Viber has been heavily
tampered with and

a lot of people don't trust Viber anymore
because the media has sort of

disparaged it in connection with Israel
and the Israeli Defense Forces (IDF).

And Whatsapp the second most
popular app has been experiencing

lots of network disruptions.
And so with this increasing shift

towards Telegram the media
has been focusing on also

highlighting that Telegram is
a place of moral corruption.

This is a picture from a semi-official
news source, FARS News,

sort of depicting how someone could be
dramming in Telegram.

So Telegram in Iran is really
controversial not only because

the government's really
concerned about it but

it had a really confusing
and weird relationship with Iran.

Starting in August, Bots and Stickers
started getting censored in Iran.

And the Bots and Stickers are one of the
reasons why Telegram is really popular

in Iran because the Bots allowed Iranians
to access content on the internet

without using a VPN
and the Stickers are oftentimes fun

and kind of rude and in Persian
which not a lot of apps have.

And so it's really popular.
But these got censored in August.

And the ministry announced that
the censorship was occuring

because of cooperation with Telegram,
but Telegram was very quick to deny this.

Pavel Durov came up and said that they
had not entered in to any agreements.

On top of that there's a respected community
of security experts have really

critizised the cryptography and
the security behind Telegram.

And this is especially worrysome
when you hear things like

30% of Telegram data is now being
stored in Iran which was a

announcement by the ministry of ICT
in Iran. But then again

Telegram was very quick to deny this,
again, saying that this is 100% bullshit.

laughter
And so the Telegram story continues.

I think it was in late November,

Pavel Durov made a announcement
saying that the ministry of ICT

had come to him demanding spying and
censorship capabilities from Telegram

which is really weird because
beforehand they thought they were

working together. And there's all sorts of
conspiracy theories about

how Pavel Durov got on a plane and went
to Tehran to meet with the minister Vaezi.

Noone really knows what happened,
all speculations and rumours.

Anyways, he comes out with this
announcement and then a few weeks later

it's like: "Oh, that was a fake email",
which is really odd and concerning

and no other internet company has ever
had anything happen like this.

He said that he received the fake email,
the ministry didn't actually contact him.

He never released the email.
It's all very strange and it led to

several advocacy organizations asking
for more transparency from Telegram.

But Telegram continues to be one of the
most popular apps in Iran.

What's notable about Telegram is that that
sort of sets a precedent for other

internet companies inside of Iran
especially as we move towards the removal

of sanctions. And companies like Facebook
and Twitter will be able to do business

with Iran potentially. And so noting these
kinds of behaviours and sort of holding

them to account is really important.

One last application that sort of
gaining ground in Iran and that

highlights one of the sort
of habits of Iranians is

Bisphone. Bisphone is this local app and
Security Researcher Kevin Miston

who I don't know if he's here [in the
hall] or not, but he's somewhere here

in the venue, has done some really cool
work into looking what exactly Bisphone is

'cause it's sort of this rising app
that's gaining a lot of popularity.

It apparently has connections, the
developers are loosely connected to

the government. It turns out that the
actual data collection over the ISPs is

connected to Iran's Telecommunications
Company. Which is very concerning but

Smallmedia recently did a report asking
Iranians what they thought about the

security of the apps that they use and the
tendency is that they either don't know

or it doesn't really
factor in as a big issue.

So security is a very low
priority for Iranians even though

it should be higher on their list.
They generally tend to go for

usability and fun features.
This kind of brings me

to the take aways of this talk which is:
Internet control in Iran is

quite pervasive, but it's not as
sophisticated as they would like.

It's especially important now
'cause there's been more arrests

of various bloggers, various people
who work in the Tech industry in Iran.

This might be particularly
problematic as we move towards

the Parliamentary Elections.

If you do particular research,
if you do any collection of data

and circumvention tools I think this is a
very exciting time to be looking at Iran's

internet ecosystem. Thank you!

applause

Herald: Thank you, we have 5
minutes now for question/answers.

So if you have questions for Mahsa
please go to one of the 4 microphones.

And I would like to ask you to
please say your question slowly

into the microphone because
it's being recorded.

audience mumbles amused

Question: Shall I start?
H: Ok we'll start with, yes, that microphone.

Q: So one thing first as a statement
not a question. If you are in Iran, do not

ever use your banking, whatever banking...
Mahsa: whispering Who's talking?

Q: ...without VPN. And then... because
they're gonna block it. You're gonna

have to go back to your bank and reopen
it. But the question is: Do you know...

how much do you know about the
relationships with other governments like

foreign governments or foreign companies
on the filters, there were... and like

further developments. Because I know from
Rohde&Schwarz like a year ago,

when I was there, they were talking about
the relationship with the filters in

I-don't-know Syria, maybe. And that they're
not officially related but they were used?

Mahsa: Yeah, I'm not a particular expert
on Syria but I do know that they have

exchanged technology and knowledge with
the Syrian Government 'cause they are

very close with the Assad Regime.

Q: I meant more specifically like
companies in Europe and in the US.

M: Yeah, so because of sanctions
I know the US don't really...

I do know Europe... is...
does work, but I know

the country that they turn to most for
censorship technology would be China.

And I know that in the past that they
heavily relied on Chinese technology

for censorship and surveillance material
but recently they've been shifting towards

local vendors and using more
locally grown technology.

Although it's hard to say. I don't have
direct insight into what technology

and where it's coming from. Maybe you
have more insight and can tell me.

H: Thank you, next question, please.

Q: Thank you to bring us the awareness
that we have to fight for our freedom

in internet or also to fight
leaders which try to...

H: Could you get a little closer to
the microphone, please!

Q: My question was: When you go back to
Iran, do you have any repression or

problems?
M: Do I personally?

Q: Yes. personally.
M: I haven't gone back to Iran since 2010

because I do things like come and
talk here on a recorded video

audience amused
I generally don...

applause

Q: It was my question exactly, and you
should be aware that it's no democratic

there so if they catch you they do
whatever they want with you.

It's not, like, we control the police...
M: Yeah, I mean that's also another point

I wanna make: There's a lot of
awesome unknown people doing work

and doing research and activism on the
Iranian internet that remain anonymous

and use pseudonyms and can't do
things like come here and talk, so

that's a decision I've made. There's other
people doing really amazing work that you

probably will never see
on a platform like this.

applause

H: Okay, may I ask on the next
question, please. Thank you.

Q: Yeah, thanks for the great talk! I have
a question about the certificate authorities

there in the Iranian State. You said that
foreign certificate authorities are

blocked by the governmental filters.
With your demonstration of one site...

of this blogger. Are there any certificate
authorities in Iran not connected to

the government, or not... are forced to
giving the private key to the government,

so that maybe foreign sites could just
adjust their certificate to an Iranian

free or libre CA and so could do an
access for the people there?

M: That's a really good question. I don't
think I have the knowledge or expertise

to fully answer it. But I will point you
towards the Smallmedia report that

really delved into this. They did like
months of research. I think the person

you would probably wanna talk to
would be Amin Sabeti. I could only

sort of guess and I'm not sure if
it's broadly done on every website,

'cause there's obviously a lot of websites
using foreign SSL certificates that

are not blocked, but if it's sensitive
it's more likely to get blocked in Iran.

Q: Thank you very much.
H: Thank you, are there any questions

from the internet?
looking out for Signal Angel

Yes? Aah, ok. The internet, please!
Signal Angel: So, question.

Since there seems to be a lot
of trouble politically-wise,

is there a hacker scene in Iran? Like
there is in Europe or in the USA?

M: Yeah, yeah there is a hacker scene
and there's a, like an emerging

open source community doing a lot of
cool work. Yeah, totally the scene exists.

I'm sure a lot of them would
have loved to have been here.

H: And the internet, again!
S: A lot of people in Iran, I know,

use VPNs. Have you heard of VPN providers
cooperating with the government?

M: Yeah, that's another big security
concern that I didn't cover in this talk,

w hich is like using VPNs is ubiquitous,
basically, in Iran. Even

members of the government use it.
I think there was even a photo of...

someone in one of the ministries, they
had Psiphon on their desktop and

it was pictured on a famous photo that
went viral. But one of the concerns is

like, the government is actually providing
their own VPN so they can access data

and what people are connecting to
through their own backdoored VPNs.

H: We have one more question, and that's
here in the back, please. You, yeah.

Q: Hi, so I have... I was wondering
if you have concrete cases

about government monitoring data or

using that as evidence in court cases.

Because we have always been
speculating that these guys

will go through the messages that we send
and then they're gonna use it against us.

But we have never been able
to prove it. Do you have

any kind of cases study on that?
M: There is the one really famous one that

I'm sure you've heard of,
the Sony-Ericsson case

- I think I'm getting the company right -
back in 2009 where they tracked

through the cell phone company.
So that's the most concrete case.

But I suppose there aren't
that many known,

and that's one of the problems with
installing sort of a culture of digital

security in Iran. Because most people
are afraid of physical surveillance,

this thing that if they're arrested and
they take their computers physically

- that's the actual concern, not so much
using encrypted email or encrypted chat.

So that might be part of it.
I'm sure there are. I couldn't

name them to you right now but the most
famous would be from 2009 when they were

working with Ericsson.
Q: Thank you.

H: Ok, thank you!
applause

H: And with that one more warm applause
for Mahsa. Thank you so much for

coming today, Mahsa, thank you!

postroll music

created by c3subtitles.de in 2016