Turkey's Twitter Ban and Why the Country's Still Tweeting
BY Carola Frediani | Tuesday, March 25 2014
When Turkish Prime Minister Recep Tayyip Erdogan decided on Thursday to “wipe out” Twitter, banning the microblogging website across the country, he made it more popular than ever. In a few hours after the ban, hashtags like #TurkeyblockedTwitter and #TwitterisblockedinTurkey became trending topics. Turkish netizens managed to post more than half a million tweets in the 10 hours following the ban with an average of about 1.8 million tweets per day, according to Al Jazeera. That figure quickly grew to the point of setting a new record for the country.
Activists online and offline, inside and outside Turkey began to spread information on how to circumvent censorship. The ban effectively introduced average users to new skills and tools. On social media a number of satirical memes were circulated, such as an altered Obama campaign poster that features Erdogan with a “Yes, We Ban!” slogan and another calling on citizens to “Keep calm and change your DNS.” There was also another variation: “Keep calm and 220.127.116.11/18.104.22.168," where the numbers refer to the IP addresses for the Google Public DNS. People also graffitied these tips on building walls and displayed them on posters.
— kaan sezyum (@kaansezyum) March 21, 2014
Erdogan began the Twitter block by implementing it at the DNS level. DNS, or the Domain Name System, is a service that translates domain names (i.e., www.techpresident.com) into IP addresses (22.214.171.124). By altering the DNS records, local Internet Service Providers can simply redirect users trying to access Twitter to other sites, like a website explaining the court orders that Twitter has ignored as a way for Erdodgan to justify the block. However, users could circumvent the ban by manually changing the DNS settings on their own computers and inserting other DNS server addresses.
Three cyber activist groups –- Telecomix, Anonymous and RedHack –- created an “emergency access center," a website for spreading information about circumventing censorship. It contains news and tips about software to download, DNS addresses to use, proxy sites, and everything you might need to access Twitter within Turkey.
“What we are doing is to show people how and through which doors they can access [Twitter],” an anonymous RedHack activist managing the website and various RedHack accounts, told techPresident. “They started with a DNS block, but they will probably move on to block some VPN [virtual private network] services. They just started by blocking the easiest ways of accessing the Internet, thinking it would work for most of the people." VPNs are circumvention tools that allow you to surf the web using a server located outside of the censoring country.
The emergency access center also warns against using some web proxies –- like Mviter.com, which became popular after the ban -- because even if it can help circumvent the block, it is not a secure site. “Although you might notice the SSL lock in your web browser [when using this type of website], this is insecure,” Frederic Jacobs, a security researcher and human rights advocate, explains to techPresident. “The operator of that website could record your password. Technically, this service is what we call a MITM or man-in-the-middle web proxy. This means that you will establish a secure connection with them, they will establish a secure connection with Twitter and then forward all the data between those two connections but the issue is that they have all the information, including your password and cookies, in plain text.”
A few days ago, the government started to block DNS options, including the ones operated by Google. Various researchers, such as Internet intelligence firm Renesys, reported that Turkey was also blocking Twitter at the IP level. According to network monitoring firm Bgpmon, Turkish Twitter censorship is now a combination of DNS filtering and IP filtering. This means that changing DNS settings is probably not going to work any more and that users need specific software to work around the ban.
Again, Internet activists tried to help. Among them was Telecomix, a group that operates worldwide to fight against Internet censorship. “We have no real organization,” Cameron Wiener, co-founder of the activist group, explains to techPresident. “The only principle seems to be that of spontaneous action. When Mubarak shut down the Egyptian Internet, we tried setting up modem lines. It worked, but only for a few connections. In Syria we have helped activists to upload videos on Youtube, without revealing their identities. In Turkey the situation is a bit easier, because the censorship is quite soft, at least on a surface level.”
Telecomix IRC (Internet Relay Chat) chat and the Telecomix Turkey Twitter account have been two of the main sites that provide real-time news on the technical implications of the ban. Telecomix's philosophy is about letting data flow and be shared. If someone tries to block them, they intervene. “We try to help Turkish people with some free tools such as VPNs and new DNS IP to bypass censorship,” another Telecomix member, that goes with the Twitter handle @fo0_ tells techPresident. “We have no specific websites for operations, we mainly use IRC and Twitter.”
The Twitter ban immediately brought about a spike in Tor downloads and usage, according to official statistics of the anonymizing network and software. Turkish users jumped from 25,000 per day pre-ban to over 50,000 post-ban, according to the latest numbers. The same holds true for VPN services, such as Hotspot Shield and Tunnelbear. Internet activists have applauded the sudden and widespread adoption of privacy and anonymity software like Tor. At the same time, there are worries that the government could try to block VPNs and Tor.
“We haven’t seen any measures against Tor in Turkey so far,” says Jacobs, explaining that there are two main possible approaches to blocking access to the Tor network. The first one would simply be blocking access to the Tor website so that people can’t download the software. This is why Telecomix has urged people to download the Tor software from the official website while they still can. Once the official website gets blocked it becomes way more difficult to distribute the software in a verifiable manner. In other countries, malicious users will try to distribute fake “Tor Browser Bundles” that are actually malware.
The other approach to blocking Twitter is not to block the distribution of Tor but lock the door on gaining access to the Tor network. First, they could block IPs. “Tor has a centralized list of relays, the entry points of the Tor network," says Jacobs. "They could decide to IP block all connections to those relays.” Or they could use DPI, Deep Packet Inspection. “They look into the IP packets that travel across the networks to look for distinctive properties that could identify a packet to belonging to a Tor connection. If the censor notices that a packet belongs to a Tor connection, it would just drop it so that the connection fails.”
Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges. If you suspect your access to the Tor network is being blocked, you may want to use the bridge feature of Tor.
But blocking Tor is not the only worry. The government may also try to spy on users circumventing its ban. Under Turkey's new controversial Internet law passed in February, ISPs can use “deep packet inspection” to filter specific web pages, monitoring users in real time. The law also requires ISPs to keep users' data for at least two years.
“Deep Packet Inspection is a very nasty form of surveillance and/or traffic control,” says Weiner. “It means that you take every IP-packet, analyze it, then decide what to do with it. For example, if you want to direct a request to Twitter.com, a DPI-computer may intercept that request, alter it or maybe redirect it to a fake site and modify the content, steal your password, etc. Deep Packet Inspection is becoming much cheaper every day, and it is used sometimes for very bad forms of repression. With enough DPI on the networks, you have the power to 'shape' traffic the way you want...unless the end user knows how to encrypt her traffic."
So far, however, it doesn't seem as if the government has been using this kind of technology. “It does not look like DPI is in motion in Turkey even if Erdogan has now the right to implement it," a cyber-activist who goes by his Twitter handle @ohkin explains to techPresident. “They passed a law that will grant them the right to deploy such infrastructure. But they didn't have the time to do it since it takes time and money."
But if blocking Twitter is expensive and time-consuming, if most users are still easily tweeting, and if censoring the Internet might stir up unwanted media attention, a kind of “Streisand effect," why is the Turkish government making such a draconian move? Sociology Professor Zeynep Tufekci, who studies social media movements, attempted to answer the question, explaining that Erdogan's intent is not really to censor but rather to antagonize social media as a whole. “The information isn’t censorable, and the ruling party in Turkey knows this. So what’s going on?” she wrote recently in Medium. “Erdogan also talked about the threat social media, including Facebook and YouTube, poses to family values. (…) In other words, Erdogan’s strategy is to demonize social media."
Even before blocking Twitter, Erdogan had made strong statements against social media. On June 2, 2013, he had said, "There is now a scourge called Twitter. The biggest lies can be found there. This thing called social media is currently the worst menace to society."
Tufekci explains in her article why this is: "It is a strategy of placing social media outside the sacred sphere, as a disruption of family, as a threat to unity, as an outside blade tearing at the fabric of society.(...) In Turkey, social media is already well established and beloved by the opposition as a tool to oppose censorship. Erdogan likely still has enough supporters to win elections, but to continue to win, he needs to keep them off social media."
As we have seen, over a million and a half tweets a day means that there's a fairly decent-sized community of committed people whose mission is to keep the from getting Internet turned off. And if censorship continues, that community might start expanding.
Carola Frediani is an Italian journalist and co-founder of the media agency, Effecinque.org. She writes on new technology, digital culture and hacking for a variety of Italian publications, including L’Espresso, Wired.it, Corriere della Sera, Sky.it. She is the author of Inside Anonymous: A Journey into the World of Cyberactivism.
Personal Democracy Media is grateful to the Omidyar Network and the UN Foundation for their generous support of techPresident's WeGov section.