A state-controlled internet service provider in Kazakhstan is requiring at least some of its subscribers to submit to having their internet traffic intercepted when they use specific websites–including social media sites, email and messaging services, and Google News, according to research published this week by Censored Planet, a project at the University of Michigan.
A new opening for censorship and surveillance is cause for concern in Kazakhstan, where CPJ has documented the authoritarian government censoring the media and jailing journalists. And security experts are paying close attention because the interception undermines encryption, the essential layer of protection that stops other people from reading what you send online or changing the content on the websites you read before it reaches you. By utilizing its influence over local ISPs to degrade security online, Kazakhstan is provoking a global debate about the signals we rely on to assess whether websites can be trusted.
The interception “breaks the end-to-end encryption and enables the Kazakhstan government to have complete visibility [of] users’ traffic,” according to an email to CPJ from Roya Ensafi, an assistant professor of computer science and engineering at the University of Michigan, and one of the researchers behind the Censored Planet report. Kazakhstan’s Ministry of Digital Development, Innovation, and Aerospace Industry did not reply to CPJ’s emailed request for comment on July 22, or a subsequent follow-up.
The interception affected “a fraction” of the traffic passing through the country’s largest ISP, Kazakhtelecom, according to the research, which was carried out between July 17 and 20. But it targeted connections to 37 domains, the report found, including Facebook, Twitter, and YouTube as well as email and messaging tools and Google services including Docs, Hangouts, and News. “Users cannot access affected sites at all if they do not … allow interception,” the report said.
Kazakhstan’s journey to erode website security started in 2015, when the government amended the law on communication to involve a national security agency in the way telecommunication providers encrypt internet traffic. Local telecoms operators have only recently begun a pilot implementation of the law by distributing what is known as a root certificate to individual subscribers. “Users are asked to install a root certificate issued by the State Technical Service, subordinate to the National Security Committee, the main security service, on devices,” Adil Nurmakov, a Kazakhstani political scientist with a digital media focus, told CPJ by email. The pilot is mostly restricted to the capital, but involved all operators, he said.
Users “should not install” the root certificates, the Censored Planet report said, “because it opens them up to having their otherwise secure communication intercepted or modified without their knowledge.”
Installing the set of files known as a root essentially gives the internet provider permission to decrypt the individual’s internet traffic and pass it through another machine for inspection before re-encrypting it and forwarding it on to its destination, according to Nick Sullivan, head of cryptography at Cloudflare.
To exchange traffic securely using the protocol known as HTTPS, a browser and a website generate a shared encryption key known only to them, Sullivan explained in a phone conversation. Crucially, if an individual wants to know if their visit to a website is protected by this encryption or not, “it’s very easy to tell the difference, because of the lock icon in the browser.”
It’s certificates–data that is digitally signed by a certificate authority–that make this system work, according to Sullivan. If you want to have an encrypted website, you have to get one of the certificate authorities that browsers trust to issue a certificate that proves you run the website.
A spokesperson for Mozilla, which operates the Firefox browser, told CPJ by email that “the root certificate being used by the Kazakh government has not been submitted to Mozilla for a trust decision. That means our products do not trust the certificate by default, and will not do so in the foreseeable future as the inclusion process typically takes more than a year to complete.” In a decision documented in a bug report, Mozilla refused one request to trust a certificate authority in Kazakhstan in 2016 because it “lacked the required audits” and “because there was evidence that the certificate was used for MITM,” the spokesperson said, using the acronym for man-in-the-middle attack, another term for the method of interception documented by Censored Planet.
But, the spokesperson added, “end users of our products, and other browsers are able to override our decisions and import the certificate on their own.” The spokesperson declined to be identified by name because the comment was made on behalf of the company. Whether users should be able to bypass vetting this way, by installing root certificates themselves, “is still in debate,” censorship researcher Roya Ensafi told CPJ by email.
Once you install the root, Sullivan said, your browsing session will still look secure, even if your traffic is being inspected behind the scenes.
Why would anyone willingly break the lock icon? “There is no legal obligation” for individuals to install the certificate, according to Adil Nurmakov. “The idea is that users would do this voluntarily to avoid problems accessing various websites,” he said. “They claim now that it’s a measure to counter alleged personal data theft, hacking, and other malicious online activities.”
It’s not wrong to conceive of the underlying process as a security strategy, according to Sullivan, because it was developed to help corporations or schools stop people on their networks from doing things the institution considers undesirable, whether that’s spending work hours on social media or visiting a website known to distribute malware.
But “it does break up the encryption,” Sullivan said. And from there, the security argument starts to break down. Even in a benign scenario, Sullivan’s research shows that the machines that conduct the inspection, called middleboxes, often lower the quality of encryption when they forward traffic, he said. The Hacker News separately pointed out that some users were apparently being prompted to download the certificates over an insecure connection, “which can easily allow hackers to replace certificate files.” And a hacker who accessed the interception machines could also inspect decrypted data.
Censored Planet’s report suggests that security is not the primary reason sites are being targeted for interception. “This list of domains suggests that the actual intention is instead to surveil users on social networking and communication sites,” the report said.
“Ideally, a security certificate is designed to protect users from security threats associated with information distributed online,” said a statement issued on Facebook by Kazakhstan’s Internet Freedom project. But in this case, the statement said, it “opens up the possibility of manipulation, censorship and abuse by the authorities,” according to a translation provided to CPJ by one of the project’s founders, Yelzhan Kabyshev. “All this leads us to the conclusion that the security certificate serves, first of all, the security interests of the authorities,” the statement concludes.
Kabyshev, a lawyer, described the Internet Freedom project to CPJ as a collaboration with Kazakhstan’s Legal Media Center, born out of concern over changes to the process of censorship. Websites could only be blocked by court order, he said, until a 2014 amendment to the communications law stipulated that the General Prosecutor’s Office or the Ministry of Digital Development, Innovation and Aerospace Industry could also block them without oversight. Over the next three years, more than 50,000 materials were restricted based on orders from the state body, compared with 8,240 blocked by court order between 2014 and 2018, according to Kabyshev, who has published research on website blocks in Kazakhstan.
“A lot of news sites are being blocked,” Kabyshev told CPJ. The Kyrgyz news website Kloop, for example, remains inaccessible since it was blocked in 2014, he said; RFE/RL reported at the time that Kazakh authorities were seeking to prevent distribution of a video the site had published allegedly showing Kazakh children being trained in Syria by the Islamic State militant group.
This year, further blocking of news websites and internet shutdowns have been reported amid a leadership transition that Human Rights Watch described as “carefully orchestrated and highly controlled.” In March, former President Nursultan Nazarbayev yielded his office of 30 years to interim leader Kassym-Jomart Tokayev, who became president in June following an election that OSCE observers said was “tarnished by clear violations of fundamental freedoms as well as pressure on critical voices.” RFE/RL’s Kazakh-language website was unavailable–apparently censored–for several weeks starting in April, according to Kabyshev and Reuters. Other news content was blocked, along with messaging and social media services, for several hours on May 9, according to the censorship monitoring group NetBlocks; protesters were expected to voice their opposition to the political handover that day, according to an analysis published by International Policy Digest. The state bodies and internet service providers alike denied responsibility for the disruption, according to Kabyshev. “It was a very odd situation,” he said. Internet service was blocked completely for most users on the morning of presidential elections in June, coinciding with reported detentions of journalists and activists in several cities, according to NetBlocks.
The leadership and the censorship process are not the only changes in Kazakhstan’s information environment since the encryption measure was first proposed. Two Scandinavian telecom firms are selling their stakes in local mobile brands to Kazakhtelecom, industry analyst TeleGeography reports. The firm is controlled by Kazakhstan’s sovereign wealth fund Samruk-Kazyna, according to an analysis published in The Diplomat, which said the move will “further concentrate the telecoms market into the hands of the government.” CPJ requested comment from Kazakhtelecom and Samruk-Kazyna via emails listed on their websites, but did not immediately receive a response.
Armed with this level of influence over the infrastructure, and under regulations based on national law, “it appears the government is both willing and potentially capable of widespread HTTPS interception in the near future,” according to Censored Planet, which urged the international community to play close attention. Roya Ensafi reiterated the stakes by email. “This is an alarming precedent, and might lead other authoritarian regimes to follow.”