Fighting the “blackheart airports”: Internal policing in the Chinese censorship circumvention ecosystem

The “Great Firewall of China” (GFW) has become a familiar trope in information security circles. China is compar- atively shut off from the rest of the Internet, with extensive censorship and blocking of websites, especially those hosted outside China. The Chinese public use a variety of methods to circumvent the extensive online censorship practised by the Chinese state. In scaling the “Great Firewall”, these ordinary users of the Internet now make use of so-called “airport services” which allow tunnelling through to censored websites. This has resulted in the emergence of both an illicit ecosystem of censorship circumvention providers and a population of scammers who set up fake or unreliable services to con these would-be everyday Internet freedom enthusiasts. We have discovered, through scraping the public chat channels used by “airport” providers, that this anti-censorship ecosystem is beginning to develop highly organised methods of self-policing, making co-ordinated use of techniques associated with malicious cybercrime to force these scammers offline and promote a healthy market. While so-called “booter” services - websites where users can purchase Denial of Service attacks for a small fee - have generally been used for malicious purposes, amusement, protest, or extortion, our research suggests that in the Chinese censorship circumvention market they are being used for internal policing.