GFW BLOG（功夫网与翻墙）

政府如何监控我们的电子网络通讯?----中国网络监控报告之二

2008-03-25T19:52:00.000-07:00

作者：于声雷来源：维权网

全文：http://crd-net.org/Article/Class1/200803/20080324093843_8168.html

目录：

导言

一、现代电讯工具在中国的开发及其对传统信息垄断的挑战

二、中国官方对现代电讯工具的管制、审查、和监控

1.对手机短信的监控

1.1.手机短信监控流程

1.2.手机短信监控措施

2.对电子邮件的监控

2.1.服务商自律安装过滤

2.2.“国家防火墙”

2.3.监控涉外电邮机制剖析

3.对QQ的监控

3.1.腾讯公司自律，QQ设有后门检测程序

3.2. QQ如何监视用户的聊天记录

4.对SKYPE、MSN的监控

4.1.对skype的监控

4.2.对MSN的监控

三、关于安全使用电讯工具的建议

1.一般性安全措施

2.电邮安全措施

3. QQ安全措施

4. SKYPE安全措施

5. MSN安全措施

四、保障公民言论自由和通信自由

附件一：中国网监目前使用的关键字基本过滤词表[相关部分]

附件二：QQ是如何监视你的聊天记录？

中国移动网络，“老大哥”的监视工具？

2008-02-03T04:00:00.000-08:00

作者：AFP 翻译：weigod 转自：译言

瑞士，达沃斯（法新社）——上个星期在达沃斯，中国政府能够监视国内5亿移动电话用户的能力引起严重的担扰。

中国最大的移动电话公司有超过3亿的用户。这个公司的领导透露说，他们公司可以自由地获取客户的个人资料，当被要求时，会把这些资料提交给中国的安全官员。他令与会代表震惊不已。

这种直白的供认，被美国国会议员艾德·马肯（Ed Markey）形容为"脊梁骨发凉"。它使世界经济论坛上的电信专家听众打冷颤。这些专家立即看到滥用和监视的潜在可能。

中国移动通信集团公司总裁王建宙说："我们知道你是谁，并且你在那里。"他的公司每月增长六百万新用户，是世界上用户人数最多的移动通信集团。他解释在获知客户在那里和正在做什么的基础上，公司是如何利用客户的个人资料去销售广告和服务。当被追问到这样做对私隐和安全的影响时，他补充说："我们可以获取这些信息，并且看到某个人在那里，但我们从不泄露这些信息……除非安全部门提出要求。"

移动电话用户的活动能够被追踪到，是因为他们连接到当地的基站留下了踪迹。这些信息，在大多数民主国家，只有安全部门的官员在遵守严格的条件下才能获取。

移动电话也很容易被窃听。

麦肯是美国众议院电信小组委员会主席。他把这种情况与美国所使用的检查和控制相对比。在美国，政府查看电话记录是需要法院的许可令。“我非常非常之惊讶，他们正在冲击底线。”听到王的发言后，他告诉法新社，“对于与政府是什么关系，还有的是，公司怎样能够使用那些资料，我有更多的疑问。”

（译：此处删去三段有关雅虎的案例）

英国牛津大学互联网管理与法规教授乔纳森·齐特林（Jonathan Zittrain）强调，在所有的国家，移动电话是怎样变成私隐的严重威胁。“很惊讶看到，这样一个广泛的监视网络是怎样通过消费需求的市场力量而建立起来。”他告诉法新社，“对于闭路电视，政府把它安装起来，人们对它没什么可说的。对于这个（移动电话），人们正为自己的监视设备埋单。”他说，民主国家的政府“刚刚意识到立法的需要”。

王的这些评论是在论讨移动电话运营商如何增加目标广告和其它服务以获取附加收入时说出的。广告商利用移动电话用户所处的地理位置去投放目标广告。这种基于地理位置的广告理念也获得谷歌（Google）主席埃里克·施密特（Eric Schmidt）的支持。他用快餐广告商是如何能够把广告锁定一个正位于餐厅附件的用户作为例子。

王说，在去年上海的F1赛事，他的公司能够通过计算那个地区的用户数估算出现场的人数。他说，当在中国有足够多的人拥有电话时，数据就能够用来估算在特定时间马路上的人数，从而间接知道堵塞的情况。

根据官方的数据，九月底中国移动电话用户数是5亿2330万，比2006年底增长了13.5%。

这场讨论是发生在一个名为“移动技术的未来”的会议上。

Broad-based U.S. push to tighten Internet monitoring

2008-01-29T01:43:00.000-08:00

作者：David Montero 来源：csmonitor.com

The White House has moved this month to beef up its capacity to tap phones and police the Internet. But those expanded powers are heating up a long-running debate on security versus privacy.

The Washington Post reported on Saturday:

"President Bush signed a directive this month that expands the intelligence community's role in monitoring Internet traffic to protect against a rising number of attacks on federal agencies' computer systems.

The directive, whose content is classified, authorizes the intelligence agencies, in particular the National Security Agency, to monitor the computer networks of all federal agencies -- including ones they have not previously monitored.

Until now, the government's efforts to protect itself from cyber-attacks -- which run the gamut from hackers to organized crime to foreign governments trying to steal sensitive data -- have been piecemeal. Under the new initiative, a task force headed by the Office of the Director of National Intelligence (ODNI) will coordinate efforts to identify the source of cyber-attacks against government computer systems."

The new directive is part of a wider push by the US intelligence community to monitor the Internet, says Wired Magazine's blog "Threat Level," which follows security and privacy issues.

"The nation's top spy, Michael McConnell, thinks the threat of cyberarmageddon ... is so great that the U.S. government should have unfettered and warrantless access to U.S. citizens' Google search histories, private e-mails and file transfers, in order to spot the cyberterrorists in our midst.

…[I]n May 2007 McConnell convinced President Bush that a massive cyber-attack on a [single] U.S. bank would be worse for the economy than the deadly terrorist attacks of September 11, [a Jan. 21 article in The New Yorker] reports."

Meanwhile, The New York Times reports that the administration has advanced its efforts to boost its wiretapping abilities.

"[The] White House plan to broaden the National Security Agency's wiretapping powers won a key procedural victory in the Senate on Thursday, as backers defeated a more restrictive plan by Senate Democrats that would have imposed more court oversight on government spying.

The vote moves the Bush administration a step closer toward the twin goals it has pursued for months: strengthening the N.S.A.'s ability to eavesdrop without court approval, while securing legal immunity for the phone companies that have helped the agency in its wiretapping operations."

Those efforts may violate, however, an earlier law governing wiretapping, The Washington Post reports.

"At the heart of the controversy is whether the government's wireless surveillance program violated provisions of the original FISA [Foreign Intelligence Security Act] law that requires warrants for wiretaps whenever one of the parties involved in the communication resides in the United States....

The original FISA law requires the government to get permission from a special court to listen in on the phone calls and e-mails of people in the United States. Changes in communications technology mean many purely foreign to foreign communications now pass through the United States and therefore require the government to get court orders to intercept them."

Both the wiretapping and Internet proposals have met stiff public resistance from privacy advocates and Democratic senators, and the debate is likely to balloon, reports The Wall Street Journal's "Washington Wire" blog.

"Congressional aides tell The Journal that they, too, are also anticipating a fight over civil liberties that will rival the battles over the Foreign Intelligence Surveillance Act."

Bruce Schneier writes in Wired Magazine's "Security Matters" blog.

"Security and privacy are not opposite ends of a seesaw; you don't have to accept less of one to get more of the other. Think of a door lock, a burglar alarm and a tall fence. Think of guns, anti-counterfeiting measures on currency and that dumb liquid ban at airports. Security affects privacy only when it's based on identity, and there are limitations to that sort of approach."

Mr. Schneier's blog links to a recent poll by Rasmussen Reports, an electronic publishing firm specializing in the collection, publication, and distribution of public opinion polling information, indicating that Americans think security is more important than privacy.

"Fifty-one percent (51%) of Americans say that Security is more important than privacy. A Rasmussen Reports national telephone survey found that 29% disagree and say privacy is more important. Twenty percent (20%) are not sure."

DRI condemns backdoor implementation of surveillance laws

2008-01-20T23:05:00.000-08:00

来源：Digital Rights Ireland

Government proposals to introduce surveillance of all internet users are unacceptable. The proposed law will require Internet Service Providers (ISPs) to log details of every email, every instant message or chat message, and every time users log on or log off, and to store that information for up to 18 months. This information will then be available without any court order or warrant. These proposals, implementing European law, are being drafted without public consultation and would be implemented by a statutory instrument. There will be no scrutiny by the Oireachtas.

It is incredible that the Government proposes to introduce a law which would require every Internet user to be monitored without any warrant or prior judicial approval, without any public consultation and without any debate or vote in the Oireachtas. A law of this gravity should not be made by stealth.

The Department of Justice appears to be relying on the “urgency” of the matter to justify bypassing the Dail and Seanad. But the European law being implemented was passed in February 2006. The Department has had two years to introduce a Bill and it cannot rely on its own delay to justify sidelining democratic scrutiny.

In any case, it is inappropriate to implement this law whilst it is under court challenge. The Irish government itself has challenged the validity of the law before the European Court of Justice. Digital Rights Ireland has also brought a High Court action challenging the European law. These proposals will effectively pre-empt the judgment of the courts.

E-mail and chat data to be stored 'within a month'

2008-01-20T22:59:00.000-08:00

作者：Karlin Lillington 来源： The Irish Times

Records of e-mails and internet chat messages sent and received by Irish residents - and the times they log on and off the internet - will have to be stored for three years. The scheme will be implemented within a month.

The Irish Times has learned the Department of Justice intends to effect a controversial EU data retention directive affecting e-mail and web usage "within a month", according to a department spokeswoman.

Due to the short timescale, the department will need to use a statutory instrument rather than use primary legislation.

The content of messages will not be retained, but information specifying who sent and received all e-mail and chat messages, the date and time, and the size of the message would have to be retained.

Internet protocol addresses, which define individual users or computers on the net, will also be retained. The directive would likely affect individuals and small to medium businesses, and not private business networks used by large multinationals.

Industry observers and privacy advocates have argued the new EU directive is so vague that internet service providers remain uncertain of what information they need to retain, or how they are to retain and manage it.

Despite the short timetable for implementation, industry bodies had not been told yet that the Government planned to bring forward the statutory instrument.

Ireland received warning letters from the EU last month because it is now three months overdue to implement the directive.

Paul Durrant, director of the Internet Service Providers Association of Ireland (ISPAI), said: "The ISPAI is disappointed that such an all pervasive measure . . . should be enacted without being subjected to the full rigours of Dáil debate and the public exposure that brings."

Ireland will be among the first to bring the directive into force in Europe, despite the fact that it has also challenged it in the European Court of Justice.

The challenge does not relate to the substance of the directive, which the Government has championed in the EU, but the fact that it was introduced by vote of the larger EU members, a precedent that worries the State.

Privacy advocacy group Digital Rights Ireland (DRI) is challenging the existing call data laws in the High Court in a case that is expected to be referred to the European courts.

Edward McGarr, principal of McGarr Solicitors, who are representing DRI said: "At the very least the transposition of the directive should be by primary legislation and following a debate in the Oireachtas."