Chinese states with tight Internet control still ban VPN

Experts say reasons for crackdowns in Russia and China include advancements in VPN tech

The data security features of VPNs ensure anonymity, hide one's Internet history, and keep personal information safe. PHOTO: REUTERS

When freelance graphic designer Zhu Wen returned to China after completing her graduate studies in the United States, she experienced the "reverse culture shock" of not being able to access Google, Facebook, Twitter, and, later, Instagram.

Fortunately, a slew of virtual private network (VPN) services helped her to vault the Great Firewall, a combination of technological tools that Beijing uses to block access to content it deems undesirable or politically sensitive.

With the VPN services, she could mask her physical location and gain anonymous access to websites blocked in the mainland.

But for Ms Zhu and millions of other Chinese who rely on this tool to regain access to the wider Internet, VPNs have become increasingly unreliable in recent months, following a crackdown by Beijing.

"One of my Chinese VPN providers shut down without notice in June - the website went dark, there was no e-mail, no refund, everything just disappeared," said the 27-year-old, who pays about US$200 (S$272) a year for such services. "Fortunately, I'm still able to use providers that are not located in the mainland."

Since the beginning of this year, Beijing has leaned hard on a range of entities to plug the gaps in its Great Firewall. Last month, it shuttered dozens of domestic VPN services, following a January circular by the Ministry of Industry and Information Technology announcing a "cleanup" of the nation's Internet use.

Luxury hotels which used to discreetly offer VPNs for foreign guests have also quietly withdrawn these services.

  • How VPNs work

  • VPNs, short for virtual private networks, were originally created in the mid-1990s for businesses so that employees could securely access their company's intranet while outside the office.

    When switched on, the VPN service would contact the corporate server and, with the right credentials, a secure tunnel would be created over the Internet.

    An employee might be in a different country or continent, but would be able to access the company network as if he is sitting inside the company headquarters.

    As the public Internet is used to carry data and instructions meant to be contained within businesses' private networks, VPN technology also contains safeguards to ensure data is not compromised.

    Besides the secure tunnel, VPNs use encryption to ensure that eavesdroppers who may be watching or capturing the data would see only a garbled mess without the correct decryption key.

    Hence, the side effects of these technologies include masking the location of the VPN user, as well as preventing third parties from seeing what kind of content the VPN user was accessing.

    As Internet use evolved, VPNs were no longer the exclusive domain of businesses and governments. Consumer demand has increased, and commercial VPN services have proliferated greatly.

    Today, VPNs are mainly used by end-users to access geographically-restricted content, such as television series that may be available on Netflix in the United States but not in Singapore.

    With most commercial VPNs today offering a global list of servers, VPNs are also used to mask a user's true physical location, as it makes the user appear to be in the same location as the VPN server, allowing him to access websites that would otherwise be blocked, such as by China's Great Firewall.

    The data security features of VPNs are also used to ensure anonymity, hide one's Internet history, and keep personal information safe from prying eyes.

Last month, Apple took down over 60 VPN programs from its App Store, a fortnight after China ordered its three largest mobile carriers - China Mobile, China Unicom, and China Telecom - to completely block access by individuals to VPNs by next February.

These were significant moves for a country where 95 per cent of its users access the Internet on their mobiles. Experts noted that China does not intend to block all VPN services, but only "unauthorised" ones that fail to register with the government or are located overseas.

In a similar move, Russian President Vladimir Putin signed new laws banning VPNs and other technologies that help Internet users access blocked sites and mask their Internet histories. The legislation will take effect on Nov 1.

Other countries that have clamped down on VPNs include the United Arab Emirates, Turkey, Iran and Saudi Arabia.

But why do countries like China and Russia, which already have formidable Internet and information control regimes, want to clamp down on VPN use?

The Great Firewall, for instance, is highly effective in blocking access to unapproved websites through the use of keyword and Internet address blacklists, and by rerouting requests for blocked sites to incorrect or non-existent addresses.

Used together, these technologies "effectively seal off censored sites at all levels", said Tufts University cyber researcher Tommy Chao.

And while a majority of Chinese are aware of the Great Firewall, experts said few are actually interested in bypassing the censors, given the popularity of Chinese clones of Google and Twitter such as Baidu and Weibo.

But the experts who spoke to The Sunday Times identified three key reasons for the latest clampdowns by China and Russia.

The first is that VPN technology, the most effective way today of anonymising one's tracks online and circumventing blocks, has advanced enough to be able to defeat even sophisticated censorship mechanisms like the Great Firewall.

"There had been an ongoing arms race in China between censorship mechanisms and circumvention tools," said Mr Vincent Goh, vice- president for Asia-Pacific and Japan for IT security firm CyberArk.

"Each technological iteration or innovation on either side is effective until the other side creates another gateway."

Another reason for the crackdown is that while most Chinese and Russian netizens see no need to access blocked sites, the number who do are significant, and growing.

A 2014 report estimated that there are 90 million VPN users in China, while a report by market research firm Statista pegged the number at 29 per cent of netizens in China, or some 200 million users.

With this significant minority having access to unallowed websites, the authorities fear contamination of the wider Internet-using population in their respective countries through the sharing of prohibited content and ideas, said experts.

"These countries are usually ideologically locked down and control what information gets disseminated to their populace.

"When some users get their hands on undesirable content, they 'socially' share this behind the firewall, and therefore subvert the efforts to build the wall," said Mr Jerry Tng, Asia-Pacific vice-president of IT management software provider Ivanti. "VPN thus becomes a loophole in the whole cat-and-mouse game, even if most users did so without any malice or intention to subvert the state."

The third reason is that the possible political fallout from not clamping down on VPNs could be unacceptable.

Since it annexed Crimea in 2014, Russia has faced sustained criticism both in the international community and in the peninsula itself, and the state has responded with tougher laws against expression. The latest laws come ahead of the 2018 Russian presidential election, and can be seen as a pre-emptive tool to prevent the opposition from mobilising.

Likewise, China is headed for a major leadership reshuffle at a key party congress this autumn, and Beijing has traditionally clamped down on the Internet and dissidents in the months leading up to such pivotal political occasions.

The goal is therefore not to ban all VPN services, but to ensure that a number of major ones are inoperable during this time to prevent holes from being poked in the Great Firewall, said Mr Fazal Majid, chief technology officer of mobile analytics firm Apsalar.

"The Chinese authorities don't need to block 100 per cent of VPNs - just a high-enough proportion to keep the problem, from their point of view, of unfettered information flows manageable."

While major corporations and universities are likely to still have access to VPNs under the tougher regimes, Mr Tng said tighter laws could hit small and medium-sized enterprises in China which rely on consumer VPNs hard.

"It's business as usual for most MNCs as they would have tunnelling technologies or even hardware-based rerouting and dedicated trunks to overseas, while most universities in China would have dedicated terminals that are closely monitored that are exempt as well," he said. "But for SMEs who rely on Google Gmail for doing business, you are out of luck."

•Additional reporting by Lina Miao

Join ST's Telegram channel and get the latest breaking news delivered to you.

A version of this article appeared in the print edition of The Sunday Times on August 13, 2017, with the headline Chinese states with tight Internet control still ban VPN. Subscribe