How Yang Was Caught "Crossing the Wall" by the Hanbin Public Security

This article contains my personal speculation and reasoning; there is no proof, so please take it as reference only.

A few days ago, on May 17, 2020, the Hanbin District Branch of the Ankang City Public Security Bureau in Shaanxi Province posted on Weibo that Yang downloaded two apps, Laowang VPN and Ant VPN, on his phone in September 2019, installed them for free use, and used these two apps to establish an illegal channel for international networking. Under Articles 6 and 14 of the “Interim Provisions of the People’s Republic of China on the Administration of International Networking of Computer Information Networks”, the Hanbin Branch gave Yang an administrative warning and a 500 yuan fine.

Five days earlier I had just written “Is “Crossing the Wall” Illegal or a Crime”, and was immediately slapped in the face — but why did nothing happen to others? I’ll “speculate” on the reason he was caught.

Focus: the Wall-Crossing Tool

The wall-crossing tools Yang used were Laowang VPN and Ant VPN, used for free on his phone. The problem is that he downloaded and used free software from domestic app markets. As everyone knows, private use of VPN is no longer allowed in China; all VPNs must be reported. Yet some VPN apps still survive in domestic app markets, and they’re free — think carefully about who built these free VPNs.

The Difficulty of Detecting Wall-Crossing from a Technical Angle

Let’s talk about the difficulty of detecting your wall-crossing from a technical angle. If the “ladder” you use is a neutral third party, the traffic is first encrypted into unrecognizable data streams, then wrapped in another layer of HTTPS. The link node captures your packet and finds it’s HTTPS web traffic whose content can’t be recognized. You might think this determines you’re “crossing the wall,” but think about how huge the country’s network traffic is — it’s impossible to open and analyze every HTTPS packet. So your “unrecognizable” traffic gets mixed into the massive normal traffic; this massive volume of requests can’t be stored, and certainly can’t all be unpacked and analyzed, so it’s hard to detect.

Other Detection Methods

Traffic can’t be decrypted, but wall-crossing can be detected through other means. I speculate there may be the following:

1. Analyze the proportion of undecryptable unknown traffic in your outbound IP. For example, if 90% of your home’s traffic is unknown traffic, guess whether they can infer what you’re doing.
2. During the time of unknown traffic, you suddenly search Baidu for some sensitive keywords. Guess whether they can estimate what you’re looking at.
3. Your home’s traffic has large amounts of traffic with a few overseas IPs fixed. Normally overseas traffic should be minimal, so put a CDN in front to hide the server’s IP.

Hu Xijin Weighed In

During the pandemic Hu Xijin became popular and also commented on this incident. Hu Xijin posted on Weibo that he opposes this penalty and also opposes characterizing “crossing the wall” to access information as “illegal.” The firewall has its real necessity, but people “crossing the wall” for various reasons should also be seen as reasonable. This is a rather fuzzy area; the hat of illegal shouldn’t be slapped around randomly. China is in a special period, and he opposes taking a measure to an extreme. Our society needs management, but also elasticity and vitality.

Interim Provisions of the People’s Republic of China on the Administration of International Networking of Computer Information Networks

The “Interim Provisions of the People’s Republic of China on the Administration of International Networking of Computer Information Networks” was promulgated in 1996. The relevant Articles 6 and 14 are as follows:

Article 6: International networking directly through a computer information network must use the international exit channel provided by the state public telecommunications network of the Ministry of Posts and Telecommunications. No unit or individual may establish or use another channel for international networking on their own.

Article 14: Whoever violates the provisions of Articles 6, 8, and 10 of these Provisions shall be ordered by the public security organ to stop networking, given a warning, and may be fined up to 15,000 yuan; where there are unlawful gains, the unlawful gains shall be confiscated.