China Security Memo: An Assault on the Great Firewall's Architect

Netizens and Censorship

On May 19 in Hubei province, a student identified only by his Twitter account snuck into a lecture hall at Wuhan University and threw eggs and shoes at computer scientist Fang Binxing, the architect of China's "Great Firewall." Other students claimed they also planned to attack Fang and had loosely organized themselves for that purpose over the Internet. The incident at Wuhan and the impromptu online movement highlight the growing conflict between Chinese Internet users and Beijing's sophisticated censorship regime. Currently the president of Beijing University of Posts and Communications, Fang studies Internet censorship and often writes in support of Beijing's tactics against Internet users. He previously served as deputy director and director of the China National Computer Network Emergency Response Technical Team/Coordination Center (CNERT/CC), a type of organization used in most countries to fight outbreaks of computer malware. Fang claims to have made major contributions to the design of China's Internet censorship system, known as the Great Firewall and operated by the Ministry of Public Security, during his tenure at CNERT/CC in the late 1990s and early 2000s. CNERT/CC played a major role in the system's design, but Fang has become the public face of Chinese Internet censorship. Internet users in China regularly criticize Fang, but this is the first time there has been a public protest made against him. In December 2010, Fang created a Sina Weibo page, the Chinese version of Twitter, which was summarily overridden with negative comments by Chinese "netizens." Internet users the world over are known for making provocative comments under the cloak of anonymity, but the May 19 egg and shoe assault in Hubei took that commentary to another level. Although it was an isolated incident, it showed the potential for grassroots Internet organization that Beijing works so hard to prevent. The incident began around 11 a.m. when a Hong Kong-based activist posted the whereabouts of Fang and suggested that the audience throw things at him, such as tomatoes and rotten eggs. The suspect in the case, whose Twitter identity "hanunyi" was confirmed by the local Public Security Bureau, posted on his Twitter account that four students discovered at about 12 p.m. that Fang was to give an afternoon speech in the lecture hall of the university and went to buy eggs for the occasion. They communicated online and did not know each other personally. In fact, hanunyi claims to be a student at Huazhong University of Science and Technology, rather than Wuhan University, where Fang was speaking. At some point during the speech, the student began throwing eggs, then he took off both of his shoes and threw those at Fang. One shoe was believed to have hit Fang, although all the eggs missed and the other shoe was knocked down by someone at the event. Some reports claimed that other students blocked security guards so the assailant could escape. But his story on hanunyi.com makes it sound as though there was no security around Fang, and campus security guards would likely have no reason to believe a shoeless student had just assaulted an important guest. Easily able to escape, the assailant was followed by two of the other conspirators, who bought him new slippers, and he jumped on a bus and left the area. The whereabouts of hanunyi are unclear, but he is still posting to his Twitter account and website. He said that a dean from his university talked to him about the incident, but he has not been punished. The online discussion of the event by Chinese netizens indicates universal support for hanunyi's actions, and he is even being offered gifts, everything from new shoes to free hotel stays to sexual favors (though nearly all of these postings have been deleted by censors). While the opinions of active Internet users do not necessarily reflect mainstream Chinese opinion, they do reveal the underlying discontent in China over Internet censorship. The facts of the incident do not bode well for Chinese Internet censors. The students involved were able to circumvent the censors, quickly obtain information on Fang's whereabouts and successfully stage a very public protest. And they are still communicating via Twitter, which is blocked in China (the students likely use virtual private networks, or VPNs, to access Twitter and other websites). It is no coincidence that the incident followed major blockages of foreign websites, even access to VPNs, throughout China since the beginning of May. Once sporadic, these problems have actually been increasing since the beginning of the year and include serious disruptions of Google services in China. There have been times when virtually all foreign-hosted websites have been inaccessible from China for 15 minutes to an hour. The Global Times, the English-language mouthpiece of the Communist Party of China aimed at foreign readers, published an article May 18 that was surprisingly candid about the possible causes. Fang was even quoted in the article, saying that it cost too much for Internet service providers (ISPs) to access foreign sites, so they periodically cut such access off. The most telling part of the article was an ISP spokesperson saying the government limited how many Internet Protocol addresses could access foreign sites during a given period; once that quota was reached, access was cut off. The government's limitations on foreign access could very well explain the blockages. Another theory not presented in the article is the possibility that Beijing is testing its ability to block communication networks, particularly VPNs, in case events like the Jasmine gatherings get out of hand. But STRATFOR sources with experience in Internet companies in China say the real problem is a lack of infrastructure for data flow, which could explain why websites are periodically unavailable, especially at universities or foreign companies that frequently access the sites.

Acid Attack

Six suspects were arrested May 19 in Wei county, Hebei province, for a sulfuric acid attack May 6 on a county official. Such attacks are common in China, and this case underscores the importance of maintaining situational awareness. The victim, surnamed Qi, is the director of the Wei County Planning Bureau and was probably targeted for his preventing a business deal. According to Chinese media, a construction project contractor, who was among the six arrested, believed Qi was responsible rejecting his project, seemingly because it violated planning regulations. The contractor then allegedly hired five others to attack Qi. All six reportedly surveilled Qi between May 3 and May 5, which would have given them time to get to know his usual activities and plan their attack. On May 6, someone deflated the tires on Qi's car while he was in a restaurant with his family, probably to prevent Qi from escaping the attack. When he left the restaurant and began inspecting his car, the attackers threw acid on his back and face and fled in a vehicle with no license plates. Qi was severely injured but is recovering, and a combination of what he remembers before the attack and CCTV footage may have been what led police to the suspects. Most victims notice their assailants prior to the attack, and the three days of surveillance would have exposed Qi's attackers to any interested observer. Revenge attacks are commonplace in China due to a lack of legal recourse, and planning officials are common targets, regardless of whether or not they are in the right on a given dispute. A local Hebei paper reported that locals were surprised that Qi would be targeted and thought that he must have offended someone in his role as a planning official. Although STRATFOR does not know of any such attacks on foreign businessmen, there is a potential for criminal reprisals in China, particularly in real estate disputes, and anyone involved in a business deal with high stakes should keep that potential in mind. (click here to view interactive map)

May 18

Jiao Dian Fang Tan, a Chinese investigative news program, reported that Nanjing police in Jiangsu province busted an Internet phishing ring that used a fake version of Taobao, a major Chinese auction website, in order to steal personal and bank-account information from shoppers.

May 19

The South China Morning Post reported that Hu Jun, a human rights activist with the Human Rights Campaign in China (HRCC), has been officially under investigation for inciting subversion since May 9 in Changji, Xinjiang Uighur Autonomous Region. Hu said he has been questioned by police five times since the Jasmine gatherings began, and more recently has been under home surveillance by Changji police. Many of the operators of the HRCC website have been detained, and Hu and Zhang Jianping, are the only two left to run it.
Local residents in Futian district of Shenzhen, Guangdong province, are preventing construction crews to reinforce a road near the newly constructed Guangzhou-Shenzhen-Hong Kong high-speed railway. They said the road has collapsed three times since the railway was built and that they are unhappy with the shoddy construction work. The accidents have yet to injure anyone, but residents are demanding inspections before construction continues.

May 20

The Jilin provincial Public Security Bureau arrested 89 suspects involved in drug trafficking between Sichuan province and northeastern China. During a raid, police confiscated 2 kilograms (4.4 pounds) of methamphetamine, two handguns, eight vehicles and 400,000 yuan (about $61,500).

May 22

The Guardian reported that four associates of Ai Weiwei, a well-known artist detained in April, are believed to have been arrested. Wen Tao, Zhang Jinsong, Hu Mingfen and Liu Zhenggang, Ai's friend, driver, accountant and designer, respectively, have all been missing for about seven weeks, since the time of Ai's disappearance. While Ai has recently been given the opportunity to speak to his wife, the other four are presumably being held to provide evidence against him. On May 20, police said Ai's company, Fake Design, had evaded taxes and destroyed accounting documents.
The India-based head of the Kirti Monastery in Aba, Sichuan province, told Reuters that 300 monks have been detained in the last month following unrest at the monastery. The protests began when a monk burned himself to death, leading to a crackdown in mid-April. Two exiled monks and a writer with sources in Aba said security forces put all 300 monks on trucks April 21, adding that it is unclear where they were taken.
One of the Jasmine movement blogs, molihuaxingdong.blogspot.com, posted a photographed letter calling for members of the People's Liberation Army to resist the Communist Party. The photograph was of a letter displayed at a bus stop in Beijing, and it is unclear if more such letters were posted around the city.

May 23

A spokesman for the Xinjiang Uighur Autonomous Region told reporters over 70 suspects had been apprehended for abducting Xinjiang children and selling them in other regions. Police fluent in both Mandarin and Uighur went to other provinces, including Anhui, Jilin, Hubei and Gaungdong, to find children taken by the suspects.