Section 2- Country Cases

In this section, we spotlight several countries where we have evidence of public ISPs blocking websites using Netsweeper’s products. Each country has significant human rights, public policy, insecurity, or corruption challenges, and/or a history of using Internet censorship to prevent access to content that is protected under international human rights frameworks. We also provide a snapshot of the data we collected concerning Netsweeper installations in the country as of April 2018, as well as a selection of content that we determined was being filtered.

2.1 Summary

From our initial mapping efforts identifying Netsweeper installations in 30 countries (Section 1), we narrowed our focus to 10 countries characterized by significant human rights, public policy, insecurity, or corruption challenges, and/or a history of using Internet censorship to prevent access to content that is protected under international human rights frameworks. The broader political, security, and human rights context characterizing these countries is important to acknowledge in the context of Internet content filtering. These countries’ Internet censorship practices are a reflection of this broader context. In Section 3, we discuss how this context should be factored into decisions concerning the provision of Internet content filtering services, by both Netsweeper and the Government of Canada.

In what follows, we provide a snapshot of the broader human rights and information controls context for each country, summarize the results of our tests, and highlight some significant findings concerning Internet censorship in each country. Our results include both websites actually blocked, as well as websites that are not actually blocked, but which operators intend to block. For instance, our results showed that pages on twitter.com corresponding with certain Twitter accounts were blocked in several countries. However, users can actually access these pages because the full URL is very unlikely to be transmitted without HTTPS in practice, and the entire twitter.com site is not blocked.¹ (The full data set is available here).

The countries of interest

Afghanistan does not guarantee human rights, lacks democratic governance, and suffers from a perilous security situation. Unique among our dataset, certain blockpages returned in Afghanistan included reference to the ‘Matrimonial,’ ‘Match Making,’ and ‘Criminal Skills’ content categories, with LGBT content improperly categorized as ‘Match Making.’

Bahrain has drawn condemnation from human rights group for its ongoing human rights abuses and crackdowns on dissidents, which have included dissolving oppositional groups. The monarchy blocks access to political criticism and religious faith content.

In India, minority and other vulnerable groups suffer from human rights violations, including certain castes, religious minorities, Indigenous peoples, women, and LGBT groups. Indian censors have blocked hundreds of websites in various content categories, including websites covering the plight of refugees and religious minorities.

Kuwait bans religious and political criticism, especially if levelled at the head of state. Among the blocked websites in Kuwait were news websites, human rights groups, and secular discussion forums.

In Pakistan, security forces abduct and arrest citizens over their criticism of state authorities and religious expression is tightly controlled. In parallel, the censors have blocked content on political and religious grounds.

Qatar bans political parties, restricts workers’ associations, and does not grant women full rights. The country applies similar restrictions online and has blocked religious criticism and social content related to LGBT.

Sudan violates civil and political rights and restricts religious freedoms. The country’s security agency has detained student activists, human rights defenders, journalists, and opposition members. Moreover, Sudanese authorities restrict journalists from covering any issue the government deems to create a security threat and have confiscated copies of newspapers to prevent their distribution. Blocked content categories included ‘Occult,’ ‘Sex Education,’ and ‘Web Proxy.’

Somalia, Africa’s most-failed state, suffers from a human rights crisis. The government passed a repressive, vaguely worded law that prohibits media workers from publishing what it deems as false news. Citizen Lab has previously documented the use of Netsweeper in Somalia for Internet filtering. In 2016, ISPs blocked 29 websites with critical political content. Current testing confirmed the blocking of file-sharing, gambling, and circumvention tool websites.

The UAE restricts the rights to freedom of expression and association and detains and prosecutes government critics, opponents, and foreign nationals over their objectionable activities, online and off. Hence, the government censors block various websites run by political critics and human rights advocates, as well as religious and social content they deem objectionable.

Yemen is in the midst of a devastating civil war in which a rebel group is in charge of the sole national ISP. Yemen blocks access to many independent and opposition websites. Yemen’s key leaders are sanctioned by the United Nations Security Council for threatening peace and security.

2.2 Afghanistan

2.2.1 Background

Afghanistan’s 2004 constitution enshrines democratic processes and human rights protections alongside the country’s Islamic identity. However, successive disputed elections and weak state authority have prevented constitutional guarantees from being fulfilled in practice. International human rights groups have expressed concern about the government’s ability to guarantee human rights and maintain democratic governance due to the perilous security situation in the country. Weak political institutions have allowed for endemic corruption and ad hoc changes to the constitutional order, such as the power sharing deal following the most recent election, which created the new position of Chief Executive.

While the Afghanistan constitution includes broad and explicit protections for free expression, these rights are constrained in practice by a countervailing provision that enshrines deference to Islam in the legal order. The 2005 media law banned content deemed to be anti-religious, slanderous, contrary to the constitution, or which identified the victims of violence.

2.2.2 Information controls in Afghanistan

Free expression rights were constrained in 2010, when the government implemented nationwide Internet filtering. Authorities ordered the blocking of pornography, sites related to alcohol and gambling, dating sites, and social media. Later that year, the country blocked a news website. In 2017, the government’s attention turned to messaging apps, which have become increasingly popular across the country. The government ordered the blocking of Telegram and WhatsApp in November 2017.

2.2.3 Data analysis

2.2.3.1 Evidence of Netsweeper presence

We found 10 IP addresses in Afghanistan that were part of Netsweeper installations (shown in Table 2.2). Behavioral testing results are shown in Table 2.3.

The behavioural results (Table 2.3) are color coded. Green indicates a positive response (matching Netsweeper), red indicates a negative response.

All 10 installations matched our Boolean expression for Netsweeper installations (Section 1.1.2). The available SNMP sysdescr values include Netsweeper-related terms, such as “NS,” “WebAdmin,” “Reporter,” and “PS,” and list the locations where these devices are likely located (e.g., Kandahar, Kabul, etc.). The Netsweeper installation on the Etisalat Afghanistan network’s deny page title explicitly lists that it is a “Etisalat Afghanistan Web Filteration Voilation Alert” [sic].

Network measurements from both Afghantelecom and Etisalat Afghanistan appeared in OONI test results and showed that attempts to access blocked content received an injected blockpage. For example, OONI records the following response to an attempt to access the LGBT news site Gay Today (http://gaytoday.com/) on Afghantelecom on September 9, 2017:

A similarly formatted iframe was returned from a test on Etisalat Afghanistan.

2.2.3.2 Examples of blocked content

According to OONI data, blockpages were returned mentioning the following categories on Afghantelecom and Etisalat Afghanistan:

• Pornography
• Web Proxy (Etisalat Afghan only)
• Match Making (Etisalat Afghan only)
• Matrimonial (Etisalat Afghan only)
• Alcohol (Afghantelecom only)
• Criminal Skills (Afghantelecom only)
• Gambling (Afghantelecom only)

The Afghanistan case is the only instance in our dataset where we saw blockpages returned mentioning the ‘Matrimonial,’ ‘Match Making,’ and ‘Criminal Skills’ content categories.

We identified 19 blocked URLs. The list below indicates the URLs as well as the categories returned in the blockpages:

• 4Chan (http://www.4chan.org/) (Pornography)
• http://spys.ru/ (Web Proxy)
• http://translation.langenberg.com/ (Web Proxy)
• http://www.gay.com/ (Match Making)
• http://www.matrimony.org/ (Matrimonial)
• http://www.peacefire.org/circumventor/simple-circumventor-instructions.html (Web Proxy)
• http://www.youporn.com/ (Pornography)
• http://astalavista.box.sk/ (Criminal Skills)
• http://attrition.org/ (Criminal Skills)
• http://gaytoday.com/ (Pornography)
• http://www.4chan.org/ (Pornography)
• http://www.89.com/ (Pornography)
• http://www.drunkard.com/ (Alcohol)
• http://www.monacogoldcasino.com/ (Gambling)
• http://www.playboy.com/ (Pornography)
• http://www.royalvegas.com/ (Gambling)
• http://www.twistedInternet.com/ (Criminal Skills)
• http://www.usacasino.com/ (Gambling)
• http://www.wetplace.com/ (Pornography)

As we described in Section 1.3.5, http://www.gay.com/ is improperly categorized as ‘Match Making’; the website is actually the homepage of the Vanguard Blog that is run by the Los Angeles LGBT Center.

During Host Header testing, we saw blockpages returned from IP addresses in two Afghani ASNs: Etisalat Afghan and Asix.

2.3 Bahrain

2.3.1 Background

International human rights groups have expressed grave concern over a crackdown on dissent in the country. Bahrain’s largest political opposition group has been dissolved and its only independent newspaper shut down. Numerous opposition leaders have been jailed, including for critical speech on social media. In a 2017 report, Amnesty International called on “states supplying equipment to Bahrain that could be used for internal repression” to take immediate action.

2.3.2 Information controls in Bahrain

The Bahraini authorities use a variety of legal, physical, and digital tactics to prevent their citizens from accessing information deemed objectionable. The Bahraini authorities have repeatedly summoned outspoken critics of the monarchy for questioning, legal proceedings, or even to commit them to intermittent jail sentences in an apparent attempt to harass these critics into silence.

ISPs restrict Internet connectivity by throttling Internet speeds around the time of political protests. For example, the authorities have imposed Internet curfews in the town of Diraz by shutting down mobile data services and disrupting fixed-lined connections. Bahrain has also used spyware tools, including FinFisher, to spy on dissidents, political opposition, lawyers, and journalists.

Prior Citizen Lab research has documented the use of Netsweeper in Bahrain. A 2016 report documented the presence of Netsweeper installations on the networks of nine ISPs in Bahrain. We conducted the research after a January 2016 tender was published that indicated that Netsweeper was the sole bidder for a “National Website Filtering Solution.” The research utilized network measurement tests that were run on the Batelco ISP and identified that websites pertaining to local opposition political groups, human rights organizations, religious content, and critical independent media were filtered. Tests from two other Bahrain-based ISPs showed evidence that the Netsweeper installations in Bahrain were communicating with Netsweeper’s infrastructure, which we interpreted as suggesting that the installations were officially supported by the company.

2.3.3 Data analysis

2.3.3.1 Evidence of Netsweeper presence

We found 16 IP addresses in Bahrain that were part of Netsweeper installations (shown in Table 2.5). Behavioral validation results are shown in Table 2.6.

All but one of the IP addresses matched our Boolean expression for Netsweeper installations (Section 1.1.2). Of the 16 IP addresses, 14 returned SNMP sysdesc values that followed a relatively consistent naming scheme (e.g. viva-tubli-ps01, Northstar-PS01, etc.).

The blockpages in Bahrain all involve an iframe pointing to “http://www.anonymous.com.bh,” which we saw in prior research, e.g.:

This generates a blockpage similar to the one seen in Figure 2.2. As of April 8, 2018, we are not able to access this page from outside of Bahrain.

During Host Header testing, we saw blockpages returned from IP addresses in seven Bahraini ASNs: Bahrain Internet Exchange, Batelco, Infonas WLL, Kalaam Telecom, Mena Broadman, Nuetel Communications, and Rapid Telecommunications.

2.3.3.2 Examples of blocked content

According to OONI data, blockpages were returned mentioning the following categories on Afghantelecom and Etisalat Afghanistan:

• Custom
• Gambling
• Pornography
• Web Proxy

We identified 145 blocked URLs in Bahrain. Some of these URLs are listed in Table 2.7.

2.4 India

2.4.1 Background

Various social minorities and other vulnerable groups in India—including members of certain castes, religious minorities, indigenous people, women, and LGBT individuals—suffer from persistent human rights violations. Such violations include vigilante violence, discrimination, and demonization by dominant social groups. In some cases, security forces are responsible for committing these kinds of abuses. Indian security forces have used excessive force against protestors, prisoners, and others resulting in deaths.

2.4.2 Information controls in India

Indian citizens face notable challenges in the area of freedom of expression. Four journalists were killed in the country in 2017 and others were attacked, detained, or prosecuted, according to the Committee to Protect Journalists. India also maintains criminal defamation and sedition laws that have been used against journalists.

The same laws have also been used to punish free expression advocates, activists, protesters, and members of the public. In separate incidents in 2017: 30 people were arrested for organizing a press conference about caste-based violence; 20 people were arrested for allegedly celebrating Pakistan’s victory over India in a cricket match; eight university students were detained for almost a month for protesting against the state government; and four people were held for more than three months for attempting to commemorate Tamils killed in Sri Lanka.

The government has also acted to chill critical speech by using strict legal controls on foreign funding of civil society groups to punish groups that scrutinize official actions. The UN Special Rapporteurs on the situation of human rights defenders, on freedom of opinion and expression, and on the rights to freedom of peaceful assembly and of association have called on the Indian government to end this practice.

In 2017, the NGO SFLC.in filed a request under right to information laws to obtain details about the country’s website blocking regime. In response, the Ministry of Electronics and Information Technology stated that 23,090 websites/URLs were blocked in the country but withheld all other requested information under a legal provision that provides for “strict confidentiality…regarding all the blocking requests and complaints received and actions taken thereof.”

The NGO Access Now documented that authorities in India forced Internet and mobile providers to disable their networks 44 times in 2017 and 11 times in 2016.

2.4.3 Data analysis

2.4.3.1 Evidence of Netsweeper presence

We found 42 IP addresses in India that were part of Netsweeper installations (shown in Table 2.9). Behavioral validation results are shown in Table 2.10.

Thirty-three of the 42 identified devices returned a positive result for at least one of the behavioural tests. Of the remaining nine devices, seven returned SNMP sysdesc values which were consistent with other Netsweeper installations, such as “hyderabad-policy01” and “webadmin02.” The two devices that did not return sysdescr values did provide other indications they were Netsweeper installations. Censys results for 110.50.49.27 showed that it returned a page title of “Netsweeper Manager” on port 8080 and the second device returned a ‘Netsweeper Cloud Manager’ login page (http://115.248.224.97:8080/webadmin/start/).

During Host Header testing, we saw injected replies from three Indian ASNs: Spectranet, Hathway IP over Cable Internet, and Telstra Global.

An example of a blockpage in one case merits further discussion. An attempt to access the URL http://genderandaids.unwomen.org (the UN Women Gender Equality and HIV/AIDS Web Portal) returned the following blockpage on one occasion:

Interestingly, the URL parameter ‘&url=http%3a%2f%2f117%2e18%2e232%2e200%2f’, indicates that the Microsoft Azure IP address 117.18.232.200 is blocked, perhaps due to erroneous categorization by Netsweeper or erroneous operator intervention. Blocking an Azure IP address would inevitably cause significant collateral damage given the volume of content the service hosts.

2.4.3.2 Examples of blocked content

India was unique among the countries measured in that all blocked URLs appeared to belong to the ‘Custom’ category. In total, 1,158 unique URLs were found to be blocked.

Websites related to the Rohingya refugee issue, and the deaths of Muslims in Burma and India more generally, were blocked. Such websites included:

A series of Twitter accounts, Facebook groups, and YouTube channels were also blocked. Some of these pages contain information about religious minorities:

• http://twitter.com/tajinderbagga
• http://twitter.com/redditindia
• http://twitter.com/ekakizunj
• http://twitter.com/barbarindian
• http://twitter.com/anilkohli54
• http://twitter.com/i_panchajanya
• http://youtube.com/user/ajitkumar2350/
• http://youtube.com/user/aslam5535/
• http://youtube.com/user/cancerian809/
• http://youtube.com/user/glakoriz/
• http://youtube.com/user/iqbal1996ful/
• http://youtube.com/user/karsevakindia1/
• http://facebook.com/#!sonniyya/photos
• http://facebook.com/albaik1/
• http://facebook.com/amir.khan.18294053/
• http://facebook.com/amirkhan.bah/
• http://facebook.com/charitha.rathnasekara/posts/335064959919472/
• http://facebook.com/crisis.in.burma/
• http://facebook.com/events/334762509950039/
• http://facebook.com/groups/222847551172001/<
• http://facebook.com/groups/300203800077335/
• http://facebook.com/groups/326961567395994//
• http://facebook.com/groups/410690962321650/
• http://facebook.com/hindujagruti/
• http://facebook.com/ishfaqmatoo/
• http://facebook.com/media/set/?set=a.228899373874308.46433.100002627423113&type=3
• http://facebook.com/mujammil143143/
• http://facebook.com/mushahid.ali.566/
• http://facebook.com/realityofindia/
• http://facebook.com/savemuslimscommunityinburma/
• http://facebook.com/sonowal.niranjan1/
• http://facebook.com/tpsbagga/
• http://facebook.com/why.always.muslims/

Religious content:

• https://hinduexistence.org/
• http://www.formercatholic.com
• http://www.hindujagruti.org/news/14781.html

Other:

• The Wayback Machine from Archive.org, which allows users to search for archived versions of web content (http://wayback.archive.org/)
• A substantial number of file-sharing websites, particularly those sharing Bollywood music and movies

It is important to emphasize that for many of these blocked URLs, particularly those noted above that are hosted on Facebook, Twitter, YouTube, and Reddit, they would likely be accessible if the user attempted to access the HTTPS version. Since HTTPS obscures the specific path visited by a user, a censor would only be able to choose between blocking all of Facebook (to give one example) or none of it.

2.5 Kuwait

2.5.1 Background

Kuwait systemically ill-treats and discriminates against certain social groups. Thousands of stateless people, known as Bidun, continue to be excluded from full citizenship status despite their deep-seated roots in Kuwaiti territory. Human Rights Watch has expressed concern about the exploitation and abuse of migrant workers, who comprise more than two-thirds of the population. Under the official immigration sponsorship system, workers face restrictions on their ability to change jobs or leave the country without their employer’s permission.

Same-sex relations between men are punishable by up to seven years in prison in Kuwait. Human Rights Watch reported that authorities deported 76 men on suspicion of being gay in 2017. Transgender people can be arrested under a law that prohibits “imitating the opposite sex in any way.”

2.5.2 Information controls in Kuwait

While Kuwaiti law offers some meaningful protections to the media, it restricts freedom of speech through prohibitions on criticism of the Emir, the release of secret or private information, comments promoting overthrow of the regime, and criticism of Islam. A 2016 cybercrime law included broad prohibition of criticizing religion or the Emir online, with punishments ranging from fines to prison sentences.

In January 2016, the government revoked the publishing license of the newspaper Al-Watan. This action was condemned by international media watchdogs because it appeared that the Kuwaiti administration was punishing the newspaper for its critical coverage of the government.

2.5.3 Data analysis

2.5.3.1 Evidence of Netsweeper presence

We found five IP addresses in Kuwait that were part of Netsweeper installations (shown in Table 2.13). Behavioral validation results are shown in Table 2.14.

Notably, reverse DNS lookups of two of these five devices returned “blocked.fasttelco.net” and “restrict.kw.zain.com.” Fasttelco and Zain are the names of the two ISPs on whose network we found Netsweeper devices.

An attempt to access the World Health Organization’s HIV/AIDS site (http://www.who.int/topics/hiv_aids/) on the ISP Zain was categorized as Pornography and blocked using the following iframe:

Visiting the domain restrict.kw.zain.com from the iframe returns the blockpage in Figure 2.3.

An attempt to access LGBT news and opinion site Vanguard Blog (https://vanguardnow.org/) was blocked on Fasttelco as follows:

The blockpage in Figure 2.4 was displayed when accessing the domain seen in the iframe: http://blocked.fasttelco.net.

2.5.3.2 Examples of blocked content

Blockpages were returned mentioning the following categories in Kuwait:

• Abortions
• Alcohol
• Custom
• Gambling
• Hate Speech
• Multiple
• Nudity
• Phishing
• Pornography
• Sex Education
• Substance Abuse
• Viruses

Kuwait is the only country case in our data set where we found blockpages mentioning the ‘Abortions’ category.

In total, 437 URLs were found to be blocked at least once on a network in Kuwait. We observed a large number of obvious miscategorziations, particuarly in the ‘Pornography’ category. In many cases, these blocks were intermittent.

Miscategorizations

Four URLs on the World Health Organization’s website were blocked as a result of being categorized as ‘Pornography’:

• http://www.who.int
• http://www.who.int/influenza/human_animal_interface
• http://www.who.int/reproductivehealth
• http://www.who.int/topics/hiv_aids/

A number of other sites appear to have been miscategorized as ‘Pornography’:

The following Arabic websites were also miscategorized as ‘Pornography.’ Some of these websites have political content.

A series of blogspot URLs were categorized as ‘Viruses’ in some measurement tests and ‘Custom’ in others. It is unclear why such miscategorizations were observed. Kuwait results show that out of the total 437 URLs, there were 45 URLs (10 percent) where iframe injections had the same URL being categorized as more than one category. This high rate of categories per URL is unusual in our data and the only other country in which we observe a similar rate is the United Arab Emirates, where we see 12 percent of blocked URLs being associated with more than one category.

The website of Arabic Network for Human Rights Information website, which is a regional free speech advocacy group critical of human rights records in the Arab world, is blocked (http://www.hrinfo.net). The Kuwait page on the website is also blocked (http://www.hrinfo.net/kuwait/). Both of these URLs were categorized as ‘Nudity.’

The website of the LGBT personals application Scruff (http://www.scruff.com/) was blocked, categorized as ‘Phishing,’ ‘Pornography,’ and ‘Custom.’

Testing of a non-existant Tumblr page (http://thiswebsitedoesnotexistyet.tumblr.com) was found to be blocked in the ‘Custom’ category.

2.6 Pakistan

2.6.1 Background

The military continues to exercise undue influence over the civilian government of Pakistan, especially since the ouster of Prime Minister Nawaz Sharif on corruption charges in July 2017. In March 2017, the parliament reinstated secret military courts to try people accused of terrorism. These terrorism courts have been used to prosecute cases unrelated to terrorism, including that of a man who was sentenced to death for blasphemy after engaging in an online debate about Islam with an undercover counterterrorism agent.

Members of religious minorities face severe legal discrimination, including a ban on propagating their faith and building houses of worship. There have also been incidents of mob violence and other vigilante attacks against religious minorities.

Transgender women, especially those who advocate for their community, face a high risk of violence or murder. Homosexual sex remains criminal. The government took modest steps towards recognizing the existence of transgender people in 2017 by issuing the first ID with a transgender category.

2.6.2 Information controls in Pakistan

A 2016 law strengthened Pakistani authorities’ powers to detain and punish individuals for critical online speech. Since 2017, dozens of people have been interrogated, arrested, or abducted by security forces for posting critical comments about dominant religious groups or state authorities.

NGOs and independent news media are subject to violence and harassment by state and private actors, which prompts self-censorship. In July 2017, the UN Committee on Economic, Social, and Cultural Rights expressed deep concern over the treatment of human rights defenders in Pakistan; just a few months later in November 2017, the government expelled 29 international NGOs from the country.

Religious expression is severely constrained by criminal laws. Violation of such laws can result in a death penalty decision in some cases. Nineteen people were under death sentences for blasphemy in 2017 and hundreds more awaited trial. State authorities sent a mass text message to millions of citizens in May 2017 that warned them that uploading or sharing blasphemous content was a crime. In April 2017, a mob seized and murdered a 23-year-old university student, Mashal Khan, after rumours circulated that he had criticized Islam.

The NGO Access Now reported two national Internet shutdowns and four regional shutdowns in 2016 and three local or regional shutdowns in 2017. According to Access, shutdowns are most often justified on national security grounds and affect wireline Internet service in most cases—wireless data, SMS, and telephone services were sometimes interrupted.

Previous research has identified Netsweeper installations in Pakistan that were used to implement political and social Internet filtering, including blocking independent news websites, religious content, and human rights information.

2.6.3 Data analysis

2.6.3.1 Evidence of Netsweeper presence

We found 20 IP addresses in Pakistan that were part of Netsweeper installations (shown in Table 2.18). Behavioral validation results are shown in Table 2.19.

All 20 devices produced a positive result to at least one of the behavioural tests. Notably, the 19 devices on ASN9557 (PTCL) returned similar SNMP sysdesc values that contained text referring to Netsweeper (“netsw”); this indicated that each were part of a larger Netsweeper installation on that ISP.

2.6.3.2 Examples of blocked content

Network measurement data from Pakistan produced nine observed cases of filtering. Blockpages were returned mentioning the following categories:

• Pornography
• Custom

Our 2013 report on the use of Netsweeper in Pakistan found 123 URLs blocked, far more than those found in this most recent round of testing. A 2017 report published by OONI identified 210 websites blocked through methods including DNS tampering and transparent HTTP proxies. OONI’s report did not identify Netsweeper products or those of any other vendors as being used to implement censorship. Given that our Netsweeper signatures were limited to transparent blockpages and excluded DNS tampering, this could explain the lower number of URLs we found blocked. It is possible that censorship in Pakistan has shifted to a different method (i.e., DNS tampering) or is being implemented with alternative systems. Further research is required to identify any additional vendors responsible for censorship in Pakistan.

2.7 Qatar

2.7.1 Background

Human rights groups have raised concerns around political rights and free expression in Qatar and over discrimination against certain social groups. Independent political parties are illegal in Qatar, as are most workers’ associations. Qatari nationals can form associations under certain conditions. Migrant workers, who do not have nationality, are prevented from organizing unions or other organizations to advocate for their rights. Partly as a result of their lack of representation, these workers have experienced abuse and exploitation — despite some steps in the direction of workers’ rights. The State of Qatar also discriminates against women and LGBTQ people. Women do not have equal rights regarding marriage, freedom of movement, and the ability to pass nationality on to their children. Qatar punishes sodomy with one to three years in prison.

2.7.2 Information controls in Qatar

The law in Qatar criminalizes expressions considered offensive to the Emir of the state. The censors ban citizens from accessing various web content categories that the government deems objectionable. In 2009, as part of our participation in the ONI project, Citizen Lab documented that the blocked content categories included political criticism, pornography, websites deemed offensive to Islam, LGBT, dating, escorting services, sex education, and online privacy and circumvention tools. In March 2011, we provided evidence that Netsweeper technology was used by the national ISP Qtel. In May 2011, we revealed more evidence that showed that the national ISP used Netsweeper technology and its URL database.

Reports of Internet blocking continue to emerge. In November 2016, the ISPs Vodafone and Ooredoo blocked the English news website Doha News (https://dohanews.co). Amnesty International officials described the blocking as “an alarming setback for freedom of expression in the country” and an “outright attack on media freedom.” Reporters Without Borders reports that journalists in Qatar practice self-censorship because of the “draconian system of censorship.” Criticism of the government, royal family, and Islam can lead to imprisonment. Moreover, a 2014 cybercrime law criminalizes posting “false news” online.

2.7.3 Data analysis

2.7.3.1 Evidence of Netsweeper presence

We found eight IP addresses in Qatar that were part of Netsweeper installations (shown in Table 2.21). Behavioral validation results are shown in Table 2.22.

As shown above, most of the non-blank SNMP sysdesc values followed a relatively consistent naming scheme which included a reference to Netsweeper (“ns”). The blocking behaviour further confirmed that these devices were in use on a consumer-facing ISP. Blocking was implemented through an iframe redirection, as shown in this example of an attempt to access circumvention tool Hotspot Shield:

This iframe would return the following blockpage from the URL http://www.censor.qa:

2.7.3.2 Examples of blocked content

Blockpages were returned mentioning the following categories in Qatar:

• Custom
• Pornography

The URLs added to the ‘Custom’ category included Hezbollah-affiliated satellite television station Al Manar (http://www.almanar.com.lb), circumvention tool Hotspot Shield (http://www.hotspotshield.com), and a site critical of Islam (http://www.prophetofdoom.net).

2.8 Somalia

2.8.1 Background

Somalia continues to suffer what the UN Office of the High Commissioner for Human Rights describes as a “human rights crisis.” This crisis is characterized by serious violations of human rights and humanitarian law. Millions of people in Somalia lack basic physical security, food, and access to humanitarian aid, in part because of ongoing armed conflict within the country.

Within this context, free expression and access to information are severely constrained, both by lack of resources and by the actions of the government and other groups. A 2017 Amnesty International report indicated that Al-Shabab has continued to prevent journalists from working in regions under its control through strategies of detaining, threatening, and harassing media workers throughout Somalia.

2.8.2 Information controls in Somalia

The government of Somalia passed a new law in 2017 that gave it broad and vague powers to prohibit “propaganda” and false news. The law has been used against critical journalists and as justification to arrest more than 30 journalists last year. In the autonomous region of Somaliland, the Somaliland Journalist Association stated that more than 30 journalists were arrested and detained by Somaliland authorities on charges of criticizing the government in 2017.

Authorities in Puntland have also arbitrarily detained journalists and other civilians for denouncing the region’s leadership and judicial decisions. In July 2017, journalist Ahmed Ali Kilwe was detained by counter-terrorism police and held for two weeks without charge, allegedly on the grounds of criticizing the president.

In 2016, Somali ISPs blocked 29 websites, most of which are owned by members of the Somali diaspora and had been critical of leaders of the Federal Government of Somalia and government practices. Prior Citizen Lab research in 2014 found Netsweeper installations on three Somali ISPs, and demonstrated that one of these installations was used to block pornography and anonymization and circumvention tools. Internet penetration in Somalia remains below 2 percent and has grown slowly over the last decade.

2.8.3 Data analysis

2.8.3.1 Evidence of Netsweeper presence

We found seven IP addresses in Somalia that were part of Netsweeper installations (shown in Table 2.24). Behavioral validation results are shown in Table 2.25.

All of the devices identified returned a true value for at least one of the behavioural tests. Five of the six SNMP sysdesc values referenced Netsweeper-related terms and the names of the affected ISPs.

Censorship was implemented through an iframe redirection, as shown in this example of a block delivered to a request for peer-to-peer file sharing site http://www.bittorrent.com:

During testing, we were unable to retrieve the injected blockpage, although we did see this same IP address in our 2014 report on Somali Netsweeper installations. The image presented to users in 2014 is shown in Figure 2.6.

2.8.3.2 Examples of blocked content

There were no category codes present in any blockpage collected. Only three URLs were identified as blocked in Somali measurement data: a file-sharing site (http://www.bittorrent.com), a gambling website (http://www.clubdicecasino.com), and a circumvention tool website (http://hidemyass.com).

2.9 Sudan

2.9.1. Background

The government of Sudan represses and violates basic civil and political rights and restricts religious freedoms.

The country’s security agency has detained student activists, human rights defenders, journalists, and opposition members, and prevented opposition political groups and civil society organizations from holding meetings and peaceful assemblies. The authorities restrict the construction of new churches and have closed one church over a dispute over administration of churches.

2.9.2. Information controls in Sudan

Sudanese authorities severely restrict journalists from covering any issue the government deems to create a security threat. On dozens of occasions in 2017, authorities confiscated copies of newspapers as they came off the presses in order to prevent their distribution.

Journalists are regularly investigated and summoned for questioning by the country’s intelligence agency. Some have been convicted of covering topics that threaten security. In September 2017, the editor-in-chief of Akhbar Alwatan newspaper was arrested and beaten by intelligence forces after his paper reported on a land dispute.

In early 2018, 18 journalists were arrested while covering a protest and an independent radio station was forced to shut down. Sudanese journalists have turned to online publications and social media to avoid restrictions on print and broadcast media.

Sudan’s National Telecommunication Corporation (NTC) maintains and openly acknowledges a filtering process under which a special unit screens web content and handles blocking requests. In 2009, NTC stated that it blocks pornography and sites “related to narcotics, bombs, alcoholics, gambling, and blasphemous sites normally offensive to Islam.” Authorities have also pursued individuals who posted critical comments online.

2.9.3 Data analysis

2.9.3.1 Evidence of Netsweeper presence

We found four IP addresses in Sudan that were part of Netsweeper installations (shown in Table 2.27). Behavioral validation results are shown in Table 2.28.

All four of these devices returned true values for at least one of our behavioural tests and three of four had SNMP sysdesc values that referenced Netsweeper (e.g. “NSPS01” which could stand for Netsweeper Policy Server).

Blocking was implemented through an injected iframe on both ISPs, such as this example of a blockpage returned in response to an attempt to access a gambling website (http://www.monacogoldcasino.com):

Attempting to access the blocked page returned the blockpage seen in Figure 2.7.

On Sudatel, an injected iframe was also returned, such as this example of requesting the URL of a file sharing site http://thepiratebay.org:

Attempting to access the file sharing site delivered the blockpage in Figure 2.8.

2.9.3.2 Examples of blocked content

Blockpages were returned mentioning the following categories:

• Alcohol
• Gambling
• Pornography
• Web Proxy

In addition to the above categories, we also used Netsweeper’s Deny Page Test tool. This is a web application made for administrators of Netsweeper installations to verify which categories are being blocked. We accessed the web application on February 25, 2018 within Sudan and determined these additional categories as being blocked:

• Nudity
• Occult
• Profanity
• Sex Education

2.10 UAE

2.10.1 Background

The UAE is a member of the Saudi-led military coalition operating in Yemen, which has carried out attacks on civilians that Human Rights Watch  says likely amount to war crimes. The UAE also supports Yemeni counterterrorism operations, during which Yemeni forces have perpetrated human rights abuses against the civilian population. The UAE runs informal detention centres in Yemen, where suspects are arbitrarily detained. There have been reports of torture and extremely harsh treatment of prisoners in these detention centres and in the UAE’s domestic prisons.

Certain social groups in the UAE face similar conditions to those in other countries in the region. International watchdogs remain concerned about ongoing exploitation of migrant workers, although the government has implemented laws around working conditions. Workers are not permitted to organize for their rights or form unions.

Legal protections against violence against women in the UAE, especially abuse by family members, fall short of international standards. Women remain subject to legal discrimination in marriage, inheritance, and custody matters. Same-sex relations and extramarital sex carry prison terms under “indecency” laws.

2.10.2. Information controls in UAE

UAE authorities restrict the rights to freedom of expression and association, and detain and prosecute government critics, opponents, and foreign nationals under criminal defamation and anti-terrorism laws.

The UAE also prohibits a broad range of vaguely worded online activities that can fall within internationally-protected expression. For example, Federal Decree Law no. (5) of 2012 criminalizes the publication of “information, news, statements or rumors on a website or any computer network or information technology means with intent to make sarcasm or damage the reputation, prestige or stature of the State or any of its institutions or its president, vice-president, any of the rulers of the Emirates, their crown princes, or the deputy rulers of the Emirates, the State flag, the national peace, its logo, national anthem or any of its symbols.”

The same law also prohibits using the Internet to plan, organize, promote, or call for demonstrations or protests without license from the competent authority. The law also bans religious criticism such as insulting Islamic or other religious sanctities or rituals. In this restrictive context, the state censors in the UAE are believed to use Netsweeper Internet filtering technology to enable mass filtering of a broad range of content categories and prevent citizens from exercising their right to free access to information online. Among the content blocked using Netsweeper is political dissent, news websites, religious criticism, and tools that provide for anonymous browsing of the Internet. In addition, there are documented electronic spyware attacks against UAE dissidents, including the internationally-recognized human rights activist Ahmed Mansoor, who in April 2018 was brought to trial in the UAE after more than a year in prison.

2.10.3 Data analysis

2.10.3.1 Evidence of Netsweeper presence

We found three IP addresses in the UAE that were part of Netsweeper installations (shown in Table 2.30).

These three devices returned no results for a single behavioural validation test. However, all were observed in OONI measurement data sending blockpage responses.

Blocking was implemented through an HTTP 302 redirect. For example, an attempt to access LGBT civil rights organization the Human Rights Campaign (http://www.hrc.org) would result in a 302 redirect to the URL:

http://lighthouse.du.ae/?dpid=1&dpruleid=3&cat=41&dplanguage=-&url=http%3a%2f%2fwww%2ehrc%2eorg%2f

Accessing the URL contained displays the blockpage seen in Figure 2.9.

The blockpage contains du branding, contains a link to the UAE Telecommunications Regulatory Authority’s “Internet Access Management Regulatory Policy,” and links to a form that allows a user to flag a website believed to be blocked in error.

2.10.3.2 Examples of blocked content

In total, we found 548 unique URLs to be blocked with blockpages mentioning the following categories:

• Alternative Lifestyles
• Custom
• Pornography
• Web Proxy
• Multiple

In addition to looking at measurement data, we conducted user testing of certain URLs. The URLs that were determined to be verified blocked through this method are denoted with an asterisk (*).

Local and UAE-focused websites

The UAE’s government censors block websites that have critical political content and websites run by local activists. Some of these activists conduct campaigns to free people who they describe as political prisoners or advocates for political reform.²

Local political websites with critical content include:

• EMASC (*http://www.emasc-uae.com/)
• Al-Islaah (*http://alislaah.net/site/)
• Emirati Affairs (*http://emirati-affairs.com/)

Campaign websites, which demand the release of political prisoners, include:

• The Seven Emiraties (*http://sevenuae.blogspot.com/)
• UAE71 (*http://www.emirates71.org/)

Websites that discuss human rights practices in UAE prisons include:

• UAEDetainees (http://www.uaedetainees.com)
• UAEPrison (*http://www.uaeprison.com)
• UAETorture (http://www.uaetorture.com)

Regional news websites include:

• NoonPost (*http://www.noonpost.net/)
• SasaPost (*http://www.sasapost.com/)
• Watan (*http://www.watan.com)
• Arab Times (*http://www.arabtimes.com/)
• Arabi 21 (*http://arabi21.com/)
• Asrar Arabiya (*http://asrararabiya.com/)
• The New Khalij (*http://www.thenewkhalij.net/)
• Al Araby (*http://www.alaraby.co.uk/)

Religious criticism, conversion, and atheism

The censors also block Arabic websites that are critical of Islam and websites that discuss other religious issues, including atheism. Among the religious criticism and conversion websites³ are:

• The Good Way (*http://www.the-good-way.com)
• The Koran (*http://www.thekoran.com)<
• The Religion of Peace (*http://www.thereligionofpeace.com)

Arabic atheist websites include:

• Arab Atheist Broadcasting (*http://arabatheistbroadcasting.com)
• Ladeeni (*http://www.ladeeni.net)

Other sites in this category include:

• The Debate (http://www.debate.org.uk)
• St Columba’s Parish Church (http://www.stcolumbas.org)
• Submission (http://www.submission.org)
• Trinity Lutheran.org (http://www.trinity-lutheran.org)

Alternative Lifestyles

The Netsweeper device installations we found in UAE were the only installations identified that blocked the ‘Alternative Lifestyles’ category. This content category is described by Netsweeper as follows:

“This includes …sites that reference topics on habits or behaviors related to social relations, dress, expressions, or recreation that are important enough to significantly influence the lives of a sector of the population. It can include the full range of non-traditional sexual practices, interests and orientations. Some sites may contain graphic images or sexual material with no pornographic intent.”

As discussed in subsection 1.2, Netsweeper’s decision to include this as a category in their system has facilitated the wholesale blocking of non-pornographic LGBT content. In testing on the ISP du, we saw the following websites blocked as a result of their categorization as “Alternative Lifestyles” content:

• Gay & Lesbian Alliance Against Defamation (http://www.glaad.org/)
• Human Rights Campaign (http://www.hrc.org/)
• The International Lesbian, Gay, Bisexual, Trans and Intersex Association (http://ilga.org/)
• The Los Angeles LGBT Center (http://www.gay.com)
• Gay Men’s Health Centre (http://www.gmhc.org)
• The International Foundation for Gender Education (http://www.ifge.org)
• Kwir Media, an LGBT news and culture site (*https://www.kwirmedia.com/)
• Queerty, an LGBT online magazine (http://www.queerty.com)

A number of other websites were blocked as a result of their categorization as ‘Alternative Lifestyles,’ although they do not appear to contain content that matched the category description:

• Caritas International, a Catholic relief, social services, and development organization (http://www.caritas.org)
• Freeservers web-hosting (http://www.freeservers.com/)

The ‘Custom’ list

The category most observed in the data for UAE was ‘Custom’ (44 percent). Within this category, a number of sites offering VoIP services were found to be blocked, including:

• Vonage (http://www.vonage.com)
• VoicePulse (http://www.voicepulse.com)
• MyWebCalls (http://www.mywebcalls.com)
• fring (http://www.fring.com/)
• Efonica (http://www.efonica.com)

The blocking of VoIP services in the country has been widely reported dating back to 2007.

In addition, websites that offer censorship circumvention or anonymization were also blocked, including:

• IPVanish (https://www.ipvanish.com/)
• Hotspot Shield (https://www.hotspotshield.com/)
• HTTP Tunnel (*http://www.httptunnelclient.com/html/)
• Anonymizer (https://www.anonymizer.com/)
• Ultrasurf (http://ultrasurf.us)
• Freegate (http://download.cnet.com/freegate/3000-2085_4-10415391.html)
• BTGuard (https://btguard.com/)

Three URLs of dictionary and translation sites were also blocked. The translation features of such sites have been used as a form of censorship circumvention. Those URLs are:

• Dictionary.com (http://dictionary.reference.com)
• Reference.com (http://translate.reference.com)
• Dictionary.com (http://www.dictionary.com/)

Miscellaneous

The following URLs were included in the ‘Custom’ category and thus access to them was blocked:

• Greenpeace (http://www.greenpeace.org; http://www.greenpeace.org/international/)
• Square Enix, a video game developer (http://www.square-enix.com)
• Equal Marriage for Same-Sex Couples (http://www.samesexmarriage.ca)
• Cocaine.org, a drug rehabilitation service (http://cocaine.org/)

Intermittent blocking

Some websites were found as being blocked during some test runs but were accessible during later tests. Examples include the website of The Telegraph (https://www.telegraph.co.uk/), which was found blocked in October 2017, but was later found to be accessible. It is not clear why the blocking occurred and why it ceased.

Miscategorization

Among the blocked websites are some that appear to be blocked as a result of miscategorization by the Netsweeper categorization services. Notable examples include the website of the World Health Organization (http://www.who.int), which was found blocked during a November 2017 test. The test showed that it was miscategorized as ‘Pornography’ at the time. Later test runs showed that the website has been made accessible.

The reasons behind these miscategorizations are unclear. Within the data, we see 68 out of 548 URLs (12 percent) where a given URL is assigned to more than one category. This is a high percentage of cases, which is similar only to the Kuwaiti installation results (10 percent). Among all the injections we have seen, the who.int URLs were only seen blocked in both Kuwait and UAE.

2.11 Yemen

2.11.1 Background

Since 2015, Yemen has been engaged in a civil war during which more than 15,000 civilians have been killed or wounded causing a grave humanitarian disaster. On one side of the conflict are the Houthi rebels and forces loyal to former president Ali Abdullah Saleh, with the other consisting of forces loyal to the internationally-recognized president Abd-Rabbu Mansour Hadi, who is supported by a Saudi-ledmultinationalmilitary coalition. Amnesty International reported that all parties have committed war crimes and other serious violations of international laws. The Houthi-Saleh Forces have bombed civilian residential areas indiscriminately, which has led to deaths and injuries among civilians. The Yemeni government, Yemeni forces aligned with the UAE, and Houthi-Saleh forces are all engaged in illegal detention practices, enforced disappearance, and torture.

2.11.2 Information controls in Yemen

Citizens’ access to information, online and off, has been significantly disrupted since the beginning of the war. A 2015 Citizen Lab report found that Netsweeper filtering technology was being used by the national ISP, Yemennet, to filter critical political content, independent media websites, and all URLs belonging to the Israel (.il) top-level domain. Following the Houthis’ capture of the capital Sana’a, Yemennet has been under their control, with the Houthis acting as the de facto government of Yemen. Citizen Lab has monitored Internet censorship in Yemen since the publication of the 2015 report and has found that the Houthis have expanded Internet filtering by adding a number of local and regional news websites.

Yemeni media organization and news portal Sahafa.net has complained about Internet censorship, raised the issue of the use of Netsweeper technology to filter political content, and demanded that the Hadi government communicate with Netsweeper, Inc. about the use of its products in Yemen and request that the company discontinue its filtering services. The demand came in a December 2017 press release in which Sahafa.net condemned the significant increase in blocking of websites by the Houthis during their armed clashes with forces loyal to their former ally president, Saleh. Sahafa.net wrote in their press release: “We call on Netsweeper, the company which provides Internet blocking technology, to discontinue its services in Yemen because its product is being used by the armed militia to block social media websites, to violate human rights, and to oppress freedom of opinion and expression and exploit the technology for military purposes.”

In December 2017, the New York Times reported that “[t]o keep their enemies from conspiring against them, the Houthis have used their control of Yemen’s communications infrastructure to shut off access to the Internet for days and to block social media sites like Facebook.” The New York Times described an admission by a Houthi commander that his group controls the Internet and manipulates it for military purposes. The commander was quoted as saying, “It is not hard … We have telecommunication companies in Sana full of people who have been educated abroad. We had to stop our enemies from communicating with each other.”

The use of Netsweeper for military-aligned censorship by the Houthis is supplemented by oppressive legal regulations. The Houthi-controlled Ministry of Information in Sana’a introduced legal restrictions on electronic journalism in October 2017. The act bans operating a news website without a prior license from the ministry and states that websites that publish objectionable content will be banned.

The deployment of Netsweeper technology on Yemen’s national Internet network precedes the war and we have previously documented that the company’s devices and technologies have been used for political and social filtering and to block Internet privacy and circumvention tools. The use of Netsweeper products during the war has taken a significant turn: it has been used where warring parties have been accused of violating human rights and blacklisted by the UN for committing war crimes against children. Some of the actors have been sanctioned by the United Nations Security Council, including the Houthi rebel group leader whose group controls the Internet and enforces media and Internet censorship in Yemen. Moreover, results from continued network measurements indicate the use of Netsweeper technology in war propaganda. Specifically, Netsweeper enables Internet censorship that prevents citizens from accessing information related to the war from multiple sources. The websites that remain accessible are those affiliated with the Houthis themselves or those editorially aligned with their political stance on the war.

2.11.3. Data analysis

2.11.3.1 Evidence of Netsweeper presence

We found six IP addresses in Yemen that were part of Netsweeper installations (shown in Table 2.32). Behavioral validation results are shown in Table 2.33.

All devices that match at least one behaviour test are on the same ASN “Public Telecommunications Corporation.” Among these, three IPs match more than a single behaviour. Throughout our testing period, the IP 82.114.160.94 displayed a blockpage that contained a link to email address “[email protected].” The domain name on this address is the official website of Yemennet and the domain deny.yemen.net.ye resolves to this same IP address.

Within measurement data, attempts to access censored content receive an injected response with an iframe. For example, an attempt to access the website of the circumvention tool Psiphon (http://psiphon.ca) would return the following iframe:

Visiting the IP from this injected iframe returns the blockpage seen in Figure 2.10.

Using in-country tests, volunteers tested the websites from different locations, including areas under the control of the Houthis and others under the control of the government of president Hadi. The results from both regions were identical because all connections go through the same national ISP.

Determination of inaccessibility was straightforward because the national ISP YemenNet serves an explicit blockage for social content and some political websites, and a 404 Not Found page for most political websites. The explicit blockpage is the same that was identified earlier in Figure 2.10 while the 404 page can be seen in Figure 2.11. Previous Citizen Lab research has shown that the device(s) serving the explicit blockpage and this 404 Not Found page were likely the same device due to anomalies identified in the IPID and TTL values observed.

During Host Header testing, we saw blockpages returned from IP addresses in one Yemeni ASN: the Public Telecommunication Corporation.

2.11.3.2 Examples of blocked content

The majority of test results from Yemen did not include a categorization. However, among those cases where categories were included, those that were returned included:

• Custom
• Multiple
• Pornography
• Web Proxy

In addition to looking at public measurement data, we did in-country testing of URLs to determine which websites were blocked in August 2017. URLs that were determined as being blocked solely through this method are denoted with an asterisk. Among all our data, the blocked websites fall into the following categories:

Local news and political opinion websites that report on the ongoing armed conflict and provide opinions different from those provided by the Houthis. The websites in this category report on political and military developments contrary to the ones provided by the Houthi-controlled media. Examples include:

• Barakish (*http://www.barakish.net/)
• al-Hekmah (*https://www.al-hekmah.net/)
• Moragboon Press (*https://www.moragboonpress.net)

Websites of Yemeni political parties, including:

• General People’s Congress (*http://almotamar.net/)
• Yemen’s Social Party (*http://aleshteraky.com/)
• al-Islah Party (*http://www.al-islah.net)
• Nasserist Unionist People’s Organisation (*http://www.alwahdawi.net/)

Regional websites that provide pan-Arab news coverage, including that of Yemen political and military conflicts. Examples include:

• al-Araby al-Jadeed (*https://www.alaraby.co.uk/portal)
• Arabi 21 (*https://arabi21.com/)
• US government-funded Radio Sawa website (*https://www.radiosawa.com/)
• al-Hurra TV (*https://www.alhurra.com/)

Websites of Internet privacy and circumvention tools used by citizens, and especially by journalists, and activities to anonymize their communication. Examples include:

• Hide My Ass (*https://www.hidemyass.com)
• Tor Project (*https://www.torproject.org)
• Psiphon (https://psiphon.ca)