The Architecture of RobustPublishing SystemsMARC WALDMANNew York UniversityAVIEL D. RUBINAT&T Labs—ResearchandLORRIE FAITH CRANORAT&T Labs—ResearchThe Internet in its present form does not protect content from censorship. It is straightforwardto trace any document back to a specific Web server, and usually directly to an individual. As wediscuss below, there are valid reasons for publishing a document in a censorship-resistant manner.Unfortunately, few tools exist that facilitate this form of publishing. We describe the architectureof robust systems for publishing content on the Web. The discussion is in the context of Publius, asthat system meets the most design goals of currently deployed systems. Publius has the propertythat it is very difficult for any adversary to censor or modify the content. In addition, the identityof the publisher is protected once the content is posted. The system differs from others in that toolsare provided for updating or deleting published content, and users can browse the content in thenormal point-and-click manner using a standard Web browser and a client-side proxy.Categories and Subject Descriptors: C.2.0 [Computer-Communications Networks]: General—Security and protection; K.4.4 [Computers and Society]: Electronic Commerce—SecurityGeneral Terms: SecurityAdditional Key Words and Phrases: Censorship resistance, Web publishing1. INTRODUCTIONThe publication of written words has long been a tool for spreading new (andsometimes controversial) ideas, often with the goal of bringing about socialchange. Thus the printing press and, more recently, the World Wide Webare powerful revolutionary tools. But those who seek to suppress revolutionsAuthor’s addresses: M. Waldman, Computer Science Department, New York University, NewYork, NY, email: [email protected]; A.D. Rubin, AT&T Labs, Research, email: [email protected]; L.F. Cranor, AT&T Labs, Research, email: [email protected] to make digital or hard copies of part or all of this work for personal or classroom use isgranted without fee provided that copies are not made or distributed for profit or direct commercialadvantage, and that copies show this notice on the first page or initial screen of a display alongwith the full citation. Copyrights for components of this work owned by others than ACM must behonored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers,to redistribute to lists, or to use any component of this work in other works, requires prior specificpermission and/or a fee. Permissions may be requested from Publications Dept, ACM Inc., 1515Broadway, New York, NY 10036 USA, fax +1 (212) 869-0481, or [email protected]°2001 ACM 1533-5399/01/1100–0199 $5.00ACM Transactions on Internet Technology, Vol. 1, No. 2, November 2001, Pages 199–230.200•M. Waldman et al.possess powerful tools of their own. These tools give them the ability to stoppublication, destroy published materials, or prevent the distribution of pub-lications. And even if they cannot successfully censor the publication, theymay intimidate and physically or financially harm the author or publisher inorder to send a message to other would-be-revolutionaries that they wouldbe well advised to consider an alternative occupation. Even without a threatof personal harm, authors may wish to publish their works anonymously orpseudonymously because they believe they will be more readily accepted ifnot associated with a person of their gender, race, ethnic background, or othercharacteristics.Anonymous publications have been used to help bring about change through-out history. Historians have often noted the role of anonymous publication inthe Colonies during the Revolutionary War period, when British law prohib-ited writings suggesting the overthrow of the government. Anonymous publi-cation itself was illegal, as British law required that books and pamphlets bearthe name of their authors and printers. After the United States governmentwas established the leaders of the former colonies enacted the First Amend-ment, which among other things, protects anonymous and pseudononymouspublication. Historians have identified over 75 public officials—including pres-idents, Cabinet members, and members of Congress—who published anony-mous or pseudononymous writings during the three decades following theRevolutionary War. It was also common for people to submit anonymous orpseudononymous letters to the editors of newspapers around that time. Insmall towns, people could often guess the identities of these letter writers,but usually could not prove that their guesses were correct. Thus even in smalltowns, anonymous publications afforded their writers a degree of deniability[Smith 2000].Quotations about the Internet’s ability to resist censorship and promoteanonymity have become nearly cliche. John Gillmore’s quote “The Net treatscensorship as damage and routes around it” has been interpreted as a statementthat the Internet cannot be censored. And Peter Steiner’s famous New Yorkercartoon captioned “On the Internet, nobody knows you’re a dog” has been usedto hype the Internet as a haven of anonymity. But, increasingly, people havecome to learn that unless they take extraordinary precautions, their onlinewritings can be censored and the true identity behind their online pseudonymsrevealed.Examples of the Internet’s limited ability to resist censorship can be foundin the Church of Scientology’s attempts to stop the online publication of docu-ments critical of the Church. Since 1994 the Church has combed the Internetfor documents that contain what they describe as Church secrets. Indivi-dual authors, Internet service providers, and major newspapers such as TheWashington Post, have had to defend their publication of excerpts from Churchdocuments (some of them fewer than 50 words) in court. The Church hasused copyright and trademark law in an attempt to suppress the publicationof Church documents [Grossman 1995]. In 1995, the Church convinced theFinnish police to force Julf Helsingius, the operator of anonymous remailerhanon.penet.fii, to reveal the true name of a user who had made anonymousACM Transactions on Internet Technology, Vol. 1, No. 2, November 2001.The Architecture of Robust Publishing Systems•201postings about the Church. When the Church tried to obtain the names oftwo more users, the following year, Helsingius decided to shut the remailerdown
View Full Document
Unlocking...