Internet Filtering in Saudi Arabia in 2004

1. Introduction and Executive Summary

A. Summary
B. Our Research
C. Blocking Patterns In Saudi Arabia
D. Overblocking
E. Conclusion

2. Overview of the Internet and Filtering in Saudi Arabia

A. History
B. Control Infrastructure
C. Banned Content
D. Transparency in and Support for Filtering Internet Content

3. Research Goals and Methodology

A. Goals
B. Methodology
C. Caveats

4. Data and Analysis

A. Data on General Content Availability in Saudi Arabia
B. Analysis of Saudi Content Filtering
C. Analysis of Filtering Methods
D. Analysis of Filtering Choices

5. Conclusion

1. Introduction and Executive Summary

A. Summary

The Kingdom of Saudi Arabia controls the information its citizens can readily access on the World Wide Web through a sophisticated filtering system that draws upon commercial software from the United States (Secure Computing's SmartFilter) for technical implementation and site blocking suggestions, expert local staff for operations and additional site identification, and Saudi citizen input to suggest over- or under-blocking according to stated filtering criteria. The OpenNet Initiative (ONI) has tested filtering in Saudi Arabia over a three-year period. We found that the Kingdom's filtering focuses on a few types of content: pornography (98% of these sites tested blocked in our research), drugs (86%), gambling (93%), religious conversion, and sites with tools to circumvent filters (41%). In contrast, Saudi Arabia shows less interest in sites on gay and lesbian issues (11%), politics (3%), Israel (2%), religion (less than 1%), and alcohol (only 1 site). Unlike filtering in states such as China, the policies, procedures, and philosophy for Saudi Arabia's filtering system are relatively transparent and documented on the Web site of its Internet Services Unit (ISU). Users who try to access forbidden sites see a Web page informing them that the site is prohibited. Despite this openness about filtering, the system inevitably errs, resulting in overblocking of unrelated content.

B. Our Research

We selected roughly 60,000 Web addresses in 2002, 2003, and 2004 to discover what content Saudi Arabia blocks and attempted to access those Web addresses as if using the Internet within Saudi Arabia. In 2004, we also tested two different lists of Web pages: one list broadly covers sensitive material, and one list focuses on an index of prominent sites in important categories such as politics, religion, and human rights. Our tests in 2004 also recorded whether a site is apparently blocked because of its presence on SmartFilter's list or because the ISU itself added the page to the block list.

C. Blocking Patterns In Saudi Arabia

Our research found substantial blocking of provocative attire, Bahai faith, Holocaust, free Web hosting, opposition political groups, and Islamic extremist sites, but the lower filtering rate in this area indicates the ISU does not attempt to prevent access to all such content. Saudi Arabia passively blocks pages on gay / lesbian / bisexual issues, sexuality, women’s rights, Israel, politics, and the occult - the ISU responds to block requests, but devotes no special attention to this content. Surprisingly, the Kingdom blocks few sites related to alcohol, most religions (including Judaism), or media. This pattern demonstrates a filtering regime that is more limited - and more effective - than previously believed.

The most aggressive censorship focused on pornography, drug use, gambling, religious conversion of Muslims, and filtering circumvention tools. Our testing documented cases in which the ISU detected and blocked new pornographic content far faster than Secure Computing updated its own lists for SmartFilter.

In contrast, the low blocking rate of sites on gay and lesbian issues, women's rights, politics, extremist groups, most religions, alcohol, and Israel suggests that the Saudi filtering regime does not target this content. Indeed, we observed a slight decrease in blocking of human rights sites from 2002 to 2004. Saudi Arabia seems to filter these topics only when particular sites are brought to the government's attention rather than by taking active steps to find this material and to block access to it.

D. Overblocking

Despite the sophistication of its systems, the Kingdom's filtering regime does block sites that appear to fall outside stated prohibited topics. We found such sites blocked both because SmartFilter classified them erroneously - for example, categorizing a Hawaiian church site as pornography - and because filtering requires normative judgments to label content - for example, labeling a women's human rights site as nudity because of one image of a naked woman showing the marks of torture.

E. Conclusion

This study is part of ONI's ongoing initiative to improve understanding of international Internet filtering. Like most filtering regimes, Saudi Arabia's system blends technology, policy and personnel; and like most states, the Kingdom's decisions are shaped and limited by the U.S.-based filtering software it employs.

2. Overview of the Internet and Filtering in Saudi Arabia

A. History

Saudi Arabia only permitted its citizens public access to the Internet once the state felt confident it could control the content users could access. Strong Internet filtering was a prerequisite for Internet deployment in the Kingdom. Saudi Arabia established an Internet link for government use in 1994, but delayed wider availability for the next three years while the government debated the benefits, drawbacks, and logistical requirements of public access². Although worried about the "availability of pornographic material... [and] anti-government propaganda" and "the potential for proselytization of Saudi Muslims by foreign religions via the Web,"³ the Saudi government ultimately decided to allow public access, provided the country could create a state-wide firewall to "reduce the potential for [citizens] to access inappropriate information."⁴ Public access finally debuted in 1999 -- over three years later than in most Persian Gulf states.⁵ Saudi Arabia's Council of Ministers issued a decree in 2001 regulating Internet use that prohibits users from accessing or publishing certain forbidden content.⁶ As of the end of 2003, 1.6 million Saudis were counted as Internet users, out of a population of over 21 million.⁷

B. Control Infrastructure

Saudi Arabia has an effective and reasonably transparent Internet filtering regime. The Kingdom achieves its control over the content users can access by placing proxy servers between the state-owned Internet backbone and servers in the rest of the world. Requests from Saudi ISP users must travel through these proxies, where they can be filtered and blocked. The Internet Services Unit (ISU) of the King Abdulaziz City for Science and Technology (KACST) maintains the firewall and its content filters.⁸ Saudi Arabia is open about filtering Internet content, and provides relatively expansive details about the content it blocks and the methods it employs, although it does not offer a list of blocked Web sites. The ISU describes its filtering system explicitly on its public Web site:

KACST maintains a central log and specialized proxy equipment, which processes all page requests from within the country and compares them to a black list of banned sites. If the requested page is included in the black list then it is dropped, otherwise it is executed, then the request is archived. These black lists are purchased from commercial companies and renewed on a continuous basis throughout the year. This commercial list is then enhanced with various sites added locally by trained staff.⁹

If a Saudi Internet user tries to access a page blocked by the government, the requested page is "dropped"; instead of showing the page, the user's computer displays a "block page" stating that "[a]ccess to the requested URL is not allowed!". (See Appendix 1 for an example of a block page.) Previous research by ONI collaborators identified Secure Computing's SmartFilter software as the commercial filtering technology Saudi Arabia uses as a source of "black lists" and method of blocking access.¹⁰ The Saudi filtering system uses default rules for blocking access - if a specific URL is not listed in the black list, but its parent domain or directory is blocked, the filtering system will block that URL.¹¹

C. Banned Content

Saudi Arabia targets specific categories of content for blocking. Pursuant to the 2001 Council of Ministers decree, the ISU prohibits "pornographic web pages... [and] pages related to drugs, bombs, alcohol, gambling, and pages insulting to the Islamic religion or the Saudi laws and regulations."¹² The ISU identifies pornography as the "most noteworthy" topic, claiming that 95% of all blocked pages fall within this category.¹³ Under the heading "Usefulness of Filtering," the ISU justifies its blocking efforts by citing the Qur'an¹⁴ and invoking an American law review article correlating restrictions on pornography with reduced rates of murder and rape.¹⁵ However, the justifications do not extend to non-pornographic content; the ISU simply states that "non-pornographic sites are only blocked based upon direct requests from the security bodies within the government."¹⁶

D. Transparency in and Support for Filtering Internet Content

While the Saudi government (like most states that filter) does not reveal its list of blocked sites, the Saudi filtering process is openly described. First, the state expressly and publicly states it limits access to certain Internet materials, and reveals which types of content it tries to block. Second, the block page a user receives when attempting to access a forbidden site explains that the site is blocked and why it is filtered. Third, this block page contains links to a form for requesting that the site be unblocked and to a form for suggesting other sites for the government to block. Thus, Saudi Internet users are invited to participate in the blocking process to a limited degree.

How effective such user suggestions are is unknown independently, though Saudi officials have offered statistics on such requests to block and unblock Web sites to argue that filtering enjoys broad support. Earlier this year, the ISU's director reported the unit receives 200 requests each day to block currently accessible sites, but only a "trickle" of requests to restore access to blocked sites.¹⁷ In 2001, a Saudi official reported 500 block requests and 100 unblock requests daily,¹⁸ with 30% of the block requests and 3% of the unblock requests resulting in the addition or removal of a site from the list.¹⁹ The ISU director presented this ratio of block to unblock requests as demonstrating "wide public support" for filtering.²⁰

Of course, Saudi citizens might feel uncomfortable asking ISU to stop filtering a site. Users must include an e-mail address to submit such a request, which might dissuade Saudis from requesting that certain sites, especially political ones, be unblocked. In addition, several of ISU's studies indicate that the block and unblock request statistics may not accurately reflect public opinion. A 1999 ISU study found that 45% of users perceived the level of site blocking as "too much," although 14% sought more stringent restrictions and 41% found the filtering level acceptable: ²¹

Moreover, 16% of respondents in a 2002 study mentioned government filtering as a common problem they encountered while using the Internet.²² Saudi citizens also express dissatisfaction with filtering through their spending patterns. Demand for blocked content has created a new market; a Jedda Arab News report describes individuals "within every computer center in Riyadh" willing to provide access to blocked sites at rates of 100 to 250 Saudi Riyals per site ($26 - $67 US).²³ To complain about overblocking or to pay a computer expert to circumvent filtering, though, a Saudi user must know about desirable content that is blocked - they must have some intuition about the site that they cannot access.

3. Research Goals and Methodology

This section describes the goals for our 2004 study of Saudi Arabia's Internet filtering and how we conducted our research.

A. Goals

This report seeks to build upon the 2002 report Documentation of Internet Filtering in Saudi Arabia²⁴ by documenting the types of Web sites unavailable to Saudi citizens, the extent of filtering within certain categories, and the changes in filtering observed over a two-year period. By assessing potential technical and philosophical reasons for filtering particular sites and categories, we hope to gain a preliminary understanding of what content the Saudi government considers to "violate the tenants [sic] of the Islamic religion or societal norms,"²⁵ and we seek to explore the apparently unintended consequences of large-scale Web filtering.

B. Methodology

The OpenNet Initiative (ONI) has conducted three rounds of testing of Saudi Arabia's Internet filtering system.²⁶ The first testing occurred in May 2002 with the permission and cooperation of ISU staff. We created a list of over 60,000 URLs (Uniform Resource Locators, such as cyber.law.harvard.edu) by targeting the most popular results from queries to the Google and Yahoo! search engines for sensitive content, including such topics as the Israel/Palestine conflict, human rights abuses within Saudi Arabia, the 1991 Iraq war, drugs, terrorism, Judaism, and higher education. (We refer to this list as the "wide list.") We attempted to access Web pages on the wide list from proxy servers located within Saudi Arabia and from a control location in Cambridge, Massachusetts, in the United States. Since all such requests from within the Kingdom pass through a central array of servers, our proxy server requests were subject to the government's filtering, allowing us to determine which pages were accessible and which were blocked.

In December 2003 and July 2004, we tested pages from the wide list using a similar methodology, but without explicit ISU permission.²⁷ We considered a page "blocked" in Saudi Arabia when the majority of our attempts to reach it returned a block page. (See Appendix 1 for an example of a block page.) We did not consider a page blocked if we received a non-block page response from the Saudi server, but that response differed from the one we received at our control location in Toronto, Canada.²⁸

In our 2004 testing, we captured new data from the block pages returned by the Saudi filtering system that allowed us to determine whether a Web site was blocked due to its classification by the SmartFilter software or due to independent action by ISU staff, who manually add certain sites to the country's black list. The block pages included an HTML tag, "ISUTag," that either had the value "sf" (meaning a block due to a SmartFilter category filtered by the ISU) or "local" (meaning a block due to ISU adding the site to the black list manually). We analyzed the relationship between the ISUTag value and the SmartFilter categorization for tested sites. Of the blocked sites where the ISUTag value was "local," only 7% were classified by SmartFilter in categories the Saudis choose to block. However, 60% of sites with an ISUTag value of "sf" fell in these categories. While our analysis does not unequivocally demonstrate that all "sf" blocks result from SmartFilter categorization, it strongly establishes that "local" blocks do not result from the SmartFilter software, but instead derive from independent ISU action.

In each test, we utilized multiple proxy servers in Saudi Arabia to gauge the filtering system's consistency.²⁹ The filtering system comprises at least 10 servers, and maintaining identical black lists on every computer can be challenging. While we found some discrepancies, blocking was generally consistent during our tests: the majority of blocked pages were always blocked, though a small percentage (5 - 10%) were occasionally accessible and occasionally blocked.³⁰

In addition to the wide list, we tested several smaller, more targeted lists. In 2002, we tested an additional 795 pornographic sites. In 2004, we tested an "index list" designed to provide an overview of a country's filtering efforts; it included 740 sites divided into 30 categories. These categories were developed by the ONI researchers rather than using the Open Directory Project (known as "dmoz") classification system. (Dmoz constructed a massive taxonomy of Internet content and utilizes volunteer editors to maintain lists of the most useful and content-rich sites within each category.³²) We also tested 21 Islamist sites compiled by the Middle East Media Research Institute (MEMRI) in 2004 to examine whether Saudi Arabia tries to block certain extremist groups. ³¹

To identify content-based filtering patterns, we attempted to collect category information for each URL through dmoz. Categorizing sites on our list helps us isolate topics and content areas that Saudi Arabia focuses on blocking, particularly since the SmartFilter software the ISU employs permits blocking based on its categorization of Web sites. For example, SmartFilter permits a state that uses the software to block all sites that it categorizes as "nudity." For our study, we accepted the dmoz categorizations as accurate depictions of a particular Web site's content. We compared the dmoz categorizations to the categorizations used by the SmartFilter software, which are available from a Secure Computing's Web site to allow one to check a page's current categorization in SmartFilter. ³³

C. Caveats

Testing Internet filtering is a "black box" enterprise. First, one cannot describe a filtering regime exactly since states do not reveal the black lists used. This makes it impossible to discover a list's precise content, particularly since lists are typically frequently adjusted.³⁴ Thus, results inevitably reflect the researcher's choice of Web sites to test and the time of testing.

Second, our lists had certain limitations. The majority of sites we tested were written in English, and certain subject areas had a relatively small number of sites tested. Categories with small numbers of sites include alcohol, gambling, and women's rights issues. This is mitigated by the fact that blocked sites represented on average fewer domains that the full list. Since dmoz does not categorize every site within a domain, testing multiple URLs results in a number being uncategorized.

Third, testing filtering with proxy servers has unavoidable limitations. We had no information about the proxy servers' configuration. For example, particular proxies may run additional filtering software or may not be filtered at all (such as proxies serving government entities). Testing each URL on multiple proxies is intended to mitigate these concerns. In addition, the centralized nature of the Saudi Internet filtering system (along with our repeated rounds of testing on multiple proxies) ensures that our results reflect not only the behavior that Saudi citizens have reported, but the environment that most Saudi users experience.³⁵

Third, the dmoz categories contain inherent limits. We downloaded category data from dmoz in August 2004, so certain pages' content may have changed sufficiently since then to affect their categorization. Dmoz listings contained only 39% of pages we tested, creating a lower block percentage for dmoz-listed sites than for sites overall. This low inclusion rate likely reflects lesser dmoz interest in classifying certain areas of interest to Saudi Arabia, such as pornography. ³⁶

Fourth, we base SmartFilter categorizations on tests run using the SmartFilterWhere tool³⁷ in early July 2004 and repeated in late August 2004. The SmartFilterWhere tool lets users check SmartFilter's current categorization of a URL in three versions (version 4, version 3.x Standard, and version 3.x Premium) of the software. The tool does not allow checking a URL's past categorization; thus, it can be difficult to determine whether a URL's classification has changed over time. SmartFilter categories change frequently; of the roughly 26,000 URLs we checked on both dates, 10% changed between dates through having at least one category added to or removed from the URL. Secure Computing, SmartFilter's developer, claims to update its list daily.³⁸ SmartFilter uses a "control list" that includes URLs and categories for as many sites as Secure Computing can analyze. SmartFilter customers create their black lists by choosing which categories, and sites, to block. SmartFilter makes updates to the control list available to customers. Since the ISU loads updates to the control list onto the Saudi servers regularly, we cannot determine how closely the SmartFilterWhere list and categorizations match those used by the Saudi filtering system. However, we assume that SmartFilter locates and corrects erroneously categorized pages as part of updating the control list;³⁹ this causes miscategorized Web pages to be underrepresented since our testing detects only categorization errors that have yet to be corrected.

While we describe the inherent limits to our methodology to allow readers to evaluate our results, we conclude that these issues have no important effect on our outcomes or analysis.

4. Data and Analysis

We present the data from our testing below. Our analysis first examines the types of content blocked by the Saudi filters, first by category and then by area of particular interest to the ISU. The second stage of our analysis seeks, where possible, to address why particular subject matter was filtered.

A. Data on General Content Availability in Saudi Arabia

Saudi Arabia blocks a small fraction of Internet sites overall, but prevents access to most pornographic and gambling sites, the majority of sex sites (non-pornographic), many sites related to converting Muslims to other religions, and a significant fraction of anonymizer and encryption sites. Somewhat surprisingly, our testing did not find major blocking of sites related to alcohol, Israel, Judaism (no sites blocked), religion (non-conversion), or women’s issues.

The first chart shows the total number of pages tested, and the corresponding number of pages blocked, each year. Only one-third of blocked sites were filtered in each year of our testing. However, our research found that changes in filtering were concentrated in a few categories - content categories with the greatest number of added blocked sites also had the greatest number of unblocked sites.

Next, we display all dmoz top-level categories, the total number of sites that we tested within each category, and the percentage of those sites blocked during each of the three tests.

Figure 4 contains the results of the 2004 "index list" test, including the number of sites in each category and the percentage blocked for that category. In the index list, categories were defined by the ONI researchers, not by the dmoz classification system.

B. Analysis of Saudi Content Filtering

Saudi Arabia concentrates its filtering efforts on a few distinct types of content, particularly that related to pornography, drugs, gambling, religious conversion, and open proxy servers and anonymizer tools. In these areas, the state's blocking is quite successful, though it does unintentionally block some unrelated material. Sites outside these proscribed categories are generally available. Thus, filtering by Saudi Arabia is relatively targeted and effective, and while overblocking is a problem, content not related to these sensitive categories is broadly available.

1. Pornography and Sexual Content

Saudi Arabia successfully blocks most sexually explicit material from its Internet users. Saudi filters are somewhat able to distinguish between pornography and sexually-related content, as shown by the difference in blocking rates between the "adult" and "society/sexuality" categories. Sites selling swimwear are filtered to a surprisingly high degree.⁴⁰

2. Drugs

Saudi Arabia filters the majority of Web sites positively portraying recreational drug use, especially those discussing marijuana. The ISU effectively distinguishes between these sites and those focused on substance abuse, as demonstrated by the sharp disparity in block rates between these categories.

3. Gambling

The ISU filters nearly all well-known gambling sites. In the 2004 index list test, we found 25 of 27 (93%) such sites blocked. Earlier tests, and the 2004 wide list test, did not include gambling sites.

4. Proxies and Anonymizers

Saudi Arabia generally blocks open proxy servers and anonymizer sites to prevent users from bypassing its filtering system. These Web sites allow users to circumvent filtering regimes by connecting to an intermediary, which requests the blocked site and passes the resulting page to the user. The government firewall only sees the user connect to the intermediary, but does not see the intermediary's request to retrieve the blocked page;⁴² thus, users can successfully evade filtering. To close this loophole, filtering countries generally add proxy and anonymizer sites to their black lists, and Saudi Arabia conforms to this pattern. Finding and blocking open proxy servers is a labor-intensive task since these servers change domain names and IP addresses frequently to evade such filtering.

5. Alcohol

The ISU does not filter sites related to alcohol. In the 2004 index list test, we found only 1 of 21 (5%) alcohol sites blocked. The wide list testing, and earlier tests, did not include alcohol-related sites.

6. Gay, Lesbian, and Bisexual

Saudi Arabia does not focus on blocking gay, lesbian, and bisexual sites. Our research indicates that while the Saudi filtering system blocks significantly more sites in this category than in most other categories tested, the overall percentage of gay, lesbian, and bisexual sites blocked is quite low.

7. Women's Rights/Feminism/Women in Religion

Saudi Arabia filters sites on women's rights and feminism only to a limited degree. Our wide list contained only a few sites in these categories. When we combine the wide list with the index list, we find that Saudi Arabia blocks such pages occasionally, but not comprehensively.

The 2002 ONI testing also found some blocking of women's sites, including two categorized as women's health, one classified as female sexuality, and one categorized as related to women as a cultural group.⁴³ Of the four sites blocked in 2002, three (women.eb.com, ivillage.com, and skirtmag.com) were not blocked in our testing. The fourth, teenwire.com, remains blocked, probably because it is categorized by SmartFilter as "mature" and containing "sexual materials."

8. Religion

Religious sites are rarely blocked in Saudi Arabia, based on our extensive testing of this category.

a. Apologetics⁴⁴

The pages Saudi Arabia blocks in this area were categorized as "Examining Other Beliefs," primarily Islam.

b. Islam

Our testing found the majority of blocked pages in this category involved either views opposed to Islam (especially Christian views) or non-Sunni Islamic sects (including Shia and Sufism).⁴⁵

c. Bahai

Saudi Arabia blocks a significant minority of Bahai sites. Our research found a consistent, and growing, level of filtering in this category.

d. Occult

The ISU blocks a small, but increasing, number of sites in this category.

9. Judaism

Saudi Arabia filters no sites related to the Jewish religion, and very few sites with Jewish or Hebrew content.

The country filters a significant fraction of sites related to the Holocaust against Jews during World War II, though this occurs primarily because SmartFilter categorizes many of these sites as having violent content.

10. Media

Saudi Arabia blocks small amounts of media-related content, concentrating on "zines" (including "e-zines").

11. Politics

Our testing indicates that Saudi Arabia blocks several sites opposing the current government along with a minority of sites discussing the state of Israel, or advocating violence against Israel and the West, and a small amount of material from Amnesty International and Amnesty USA (Figures 15 and 16).

12. Free Web Hosting

Saudi Arabia's filtering approach to sites that offer free Web hosting has shifted intriguingly over time. The ISU began by blocking these sites broadly but shifted to more targeted restrictions. States that filter the Internet often object to free Web hosting -- companies that provide the free space do little to monitor content, and the sites host widely varying content, making it difficult to adopt a single filtering approach for that domain. Our research uncovered significant changes by Saudi Arabia in the three years of our testing. The following chart (Figure 16) shows results for several free Web hosting domains, with the number of pages tested and the percentage blocked for each year's testing, thus indicating the percentage of pages tested that Saudi Arabia blocks within that domain. Figures in bold indicate that Saudi Arabia blocks the domain's home page -- for example, Saudi Arabia's ISU prevents access to the front page of Virgin's site at http://virgin.net.

Our data indicates that the Saudis originally attempted very broad blocking of several, but not all, free hosting domains. Saudi Arabia removed broad blocking for some sites in 2003 or 2004, shifting to filtering these domains on a page-by-page basis (an approach the ISU has used consistently for Geocities). This method comports with the ISU's stated policy of blocking "only the absolute minimum possible number of web pages possible to fulfill its duties."⁴⁷ Thus, while Saudi Arabia filters many free Web hosting sites, the granularity of its blocking has become more precise and targeted with time.

C. Analysis of Filtering Methods

Sections A and B describe our findings regarding types of content unavailable to Internet users within the Kingdom of Saudi Arabia. This section analyzes Saudi Arabia blocking of certain content categories. Our research reveals whether Saudi Arabia blocks a site because of how the filtering software used by the country classified it or because ISU staff specifically added it to the black list. This data demonstrates content areas where Saudi Arabia invests additional time, effort, and expense to monitor Web sites and to block access to them for the state's citizens.

The ISU documentation on filtering⁴⁸ explains that sites are added to the black list either by commercial filtering companies (such as Secure Computing) or locally-trained Saudi staff. The commercial list classifies sites by category, and Saudi Arabia chooses which categories to block. In addition to sites identified by the commercial software, the ISU selects additional sites to filter. Thus, the Saudi government filters on both an "outsourced" level (through selecting the commercial software's black list categories) and a "locally adjusted" level (through selecting particular URLs by ISU staff). While this distinction may be irrelevant to users who cannot access a desired site, it is vital to understanding how Saudi Arabia uses filtering to control the flow of information in the country. A site can be blocked in Saudi Arabia for one of three reasons:

1) SmartFilter classified the site as containing content in a category that Saudi Arabia chooses to block ("macro" level blocking);
2) SmartFilter incorrectly determined the site contains content in a category that Saudi Arabia chooses to block ("overblocking"); or
3) The ISU decided to filter the site even though SmartFilter did not classify it as containing content in a category that Saudi Arabia chooses to block ("micro" level blocking).

The commercial software categories that Saudi Arabia chooses to block (macro-level blocking and overblocking) indicate content topics that the country generally finds objectionable, while blocking by specific ISU-added URL (micro-level blocking) demonstrates specific concern about a given site or page. Our 2004 testing obtained data from the block pages generated by the Saudi filtering system that indicates whether a site was blocked due to its SmartFilter categorization or due to specific targeting by Saudi officials.⁴⁹

To explore macro and micro-level blocking, we evaluated 2004 testing data, since this is the only year for which we were able to obtain the necessary block page data and for which we have contemporaneous SmartFilter category data.⁵⁰

We find that Saudi Arabia filters sites in these SmartFilter categories: gambling, nudity, extreme⁵¹ , sex, pornography, drugs, obscene/extreme, tasteless/gross, and violence.

1. Outsourced Filtering - Commercial Software Blocks

Analyzing the filtering "outsourced" to the SmartFilter software shows what content Saudi Arabia seeks to block categorically - the state finds any site on this topic unacceptable. The ISU lists seven prohibited categories: pornography, drugs, bombs, alcohol, gambling, anti-government, and anti-Islamic material. The SmartFilter software the Saudis employ covers such typical filtering targets as the first five topics, but does not include "anti-Saudi government" as one of its categories. Using commercial filtering software is virtually required to limit access to content effectively as the Internet's size and architecture necessitate expending enormous resources to discover and classify sites. For example, a list on the URLBlacklist.com site contains over half a million Internet domains that contain pornographic sites.⁵² Thus, Saudi Arabia's decision to utilize a commercial service to block traditionally-censored categories is unsurprising. In effect, Saudi Arabia outsources the work required to find and classify sites in these content areas to Secure Computing, the software provider.

a. SmartFilter Categories Blocked

The SmartFilter software categorizes Web sites into either 30 or 62 categories (depending on the version of the software used).⁵³ Filtering entities, such as the ISU, can decide to block or permit access to each category independently. By reviewing whether pages within various SmartFilter categories were blocked, we created a list of filtered categories in Saudi Arabia -- gambling, nudity, extreme⁵⁴ , sex, pornography, drugs, obscene/extreme, tasteless/gross, and violence.⁵⁵ Saudi Arabia blocked 92% of the Web pages listed in one or more of these categories. In contrast, only 1% of the pages not included in one of these categories were blocked. We conclude these SmartFilter categories constitute the subjects about which Saudi Arabia is most concerned.

b. Overblocking Through SmartFilter Categorization Errors

Saudi Arabia blocks some Web sites unintentionally because SmartFilter categorizes them incorrectly. We found examples of Web pages classified as pornography by SmartFilter, but not classified as adult by dmoz, that Saudi Arabia blocked. Categorization errors are inevitable. Researchers question the accuracy of software classification of Web content.⁵⁶ SmartFilter's own marketing material quotes a study finding "94% of sites accurately blocked";⁵⁷ thus, the software errs at least 6% of the time. To place this error rate in context, the search engine Google currently searches over 4 billion Web pages;⁵⁸ were SmartFilter to categorize all these pages, it would make mistakes for over 240 million pages.

SmartFilter categorization mistakes can block content in unintended categories. We compared SmartFilter categorizations with those from dmoz and located pages likely blocked for this reason in Saudi Arabia. SmartFilter categorizes 77 pages as "Pornography" that dmoz also analyzes; however, only 25 received a dmoz classification of "Adult." Of the remaining 52 pages, 50 were blocked in Saudi Arabia. Dmoz categorized these pages as follows:

Classification errors by filtering software are inevitable. However, SmartFilter miscategorization leads Saudi Arabia to block more content than the state intends, preventing Saudi citizens from accessing information they otherwise would be permitted to view.

c. Qualitative Decisions in Software Filtering

Classifying a Web site's content requires difficult subjective decisions. By using the SmartFilter software, Saudi Arabia necessarily concedes many of these hard choices about what information its citizens can access to an American software company.

Even "correct" categorization of a site necessarily involves qualitative determinations that demonstrate the difficulties inherent in content filtering; the question for filtering regimes is who should make that decision. We found 10 sites blocked in Saudi Arabia with SmartFilter designations of "Nudity" that dmoz classified as "Art". Some of these sites undoubtedly contained nude photographs or drawings, and the question of whether to censor such content is an old one. What is new, however, is that the technology used in Saudi Arabia has an American company making such decisions for Saudi citizens. Though the Saudi government chooses to block a category such as pornography, SmartFilter makes the normative decision to include a site in that category based on its impression of the site's content.

Certain categorization issues are intensely complicated. We found two pages relating to the Holocaust against Jews during World War Two blocked in Saudi Arabia, likely because SmartFilter placed them in its "Violence" category. Clearly, much educational material on the Holocaust contains descriptions and depictions of violence. Whether some violent content merits blocking educational Web sites is a difficult decision, and an odd one for a foreign filtering company to make for a country's citizens.

Commercial software's filtering categorization inevitably simplifies a Web site's content. This reductionism makes analyzing the meaning of Saudi filtering more difficult. For example, we found that Saudi Arabia blocks an Iranian women's rights site, the Dr. Homa Darabi Foundation,⁵⁹ probably because SmartFilter classifies it as containing nudity. (In contrast, dmoz categorizes this site under "Women's Rights" and "Middle East/Society and Culture/Women".) Our researchers reviewed the site and found a picture of a naked woman displaying her injuries from the 50 lashes she received "for being present at a family gathering where men other than her father and brother were present."⁶⁰ After comparing the filtering rates of sites SmartFilter categorizes as "nudity" (high in Saudi Arabia) and those dmoz categorizes under "women's rights" (low), we conclude that the SmartFilter categorization causes the block. Technically, the SmartFilter categorization is correct - the page indeed contains an image of a naked woman. However, this classification reduces the site's complex content by focusing on a single, non-pornographic picture.

Because Saudi Arabia employs an American company to assist the state's Web filtering by classifying content, Saudi citizens are denied access to content beyond that which the government intends to prohibit. Overblocking is inevitable, and probably unwanted by Saudi Arabia. Theoretically, a Saudi user could submit a request to unblock a Web page through the link on the ISU block page. However, this user would have to know what content the blocked site offers and reveal his or her name as the requestor.

d. Conclusion

Saudi Arabia reveals certain normative judgments about content the state views as undesirable through the SmartFilter categories it chooses to block. Filtering this material, though, involves subjective decisions that can be difficult and that risk simplifying complex content and unintentionally blocking information. Furthermore, by using the SmartFilter software, Saudi Arabia allows an American company to make many of these judgments.

2. Locally Adjusted Filtering - Blocks by ISU

In addition to blocking sites through selecting SmartFilter categories, Saudi Arabia selects Internet content to filter on its own. At this local level, the ISU indicates two reasons why it adds sites to the black list: "direct requests from the security bodies within the government"⁶¹ or requests submitted from a Web form by "concerned citizens."⁶² ISU staff review the URLs requested to be blocked and decide which sites to add to the black list. Our research finds these locally-blocked sites generally fall into two categories: content in a category Saudi Arabia prohibits using the SmartFilter software, but that SmartFilter has not yet properly classified, and content viewed as "anti-Islam" and "anti-government" that cannot be blocked because SmartFilter does not include such categories. Since the ISU does not reveal its classifications, we cannot determine precisely how it categorizes a locally-filtered site on the black list.

3. Conclusion

Our data indicate that sites marked as SmartFilter blocks⁶³ were indeed blocked because of their SmartFilter classification, and that sites marked as local blocks⁶⁴ were blocked because the ISU decided independently to prohibit them. Sites marked as SmartFilter blocks, but not yet classified by the software, are filtered either because their SmartFilter categorization differs from that available from the public SmartFilterWhere tool or because the ISU blocks them but the block page does not mark them as "local". Based on these conclusions, we now sketch the contours of Internet filtering in Saudi Arabia.

D. Analysis of Filtering Choices
This section reviews and analyzes various categories of blocked content. The ISU Web site lists the types of content targeted for filtering: pornography, drugs, bombs, alcohol, gambling, and pages "insulting to the Islamic religion or the Saudi laws and regulations."⁶⁵ We explore our blocking data to reveal that Saudi Arabia actually concentrates its filtering efforts on Web sites related to pornography, drug use, gambling, open proxies and encryption tools, and religious conversion. Our research found substantial blocking of provocative attire, Bahai faith, Holocaust, free Web hosting, opposition political group, and Islamic extremist sites, but the lower filtering rate in this area indicates the ISU does not attempt to prevent access to all such content. Saudi Arabia passively blocks pages on gay / lesbian / bisexual issues, sexuality, women's rights, Israel, politics, and the occult - the ISU responds to block requests, but devotes no special attention to this content. Surprisingly, the Kingdom blocks few sites related to alcohol, most religions (including Judaism), or media. This pattern demonstrates a filtering regime that is more limited - and more effective - than previously believed.

1. Material Actively and Pervasively Blocked

Saudi Arabia focuses its filtering efforts on blocking access to material in these categories and topic areas.

a. Pornography

Our research indicates the Saudi government is extremely dedicated to filtering pornographic Web pages - in fact, the ISU is often faster to block porn than the SmartFilter software updates are. This commitment strengthened over the years of our testing; block rates for pornographic sites increased from 86% of URLs tested in 2002 to 98% in 2004. The intensity of the Saudi effort reveals itself in the speed at which ISU identifies and blocks new pornographic content. Frequently, the ISU outpaces SmartFilter's developer, Secure Computing, in identifying these sites, even though Secure Computing is a large public company whose success depends on keeping its black lists current. By contrast, the ISU had only 44 employees as of 2001 to manage all Internet connectivity within Saudi Arabia as well as the filtering system.⁶⁶

In 2004, 18 of 148 pages (12%) blocked locally by the ISU contained pornographic content. Of these pages, only 2 had been categorized by SmartFilter as pornography by August 2004. Reviewing these pages demonstrates the extraordinary difficulty facing any government or organization that wants to block pornography completely. Previous research⁶⁷ demonstrates that pornographic Web sites monitor domain name registries for expiring registrations; they purchase these domains once they expire and place pornographic content on their pages. Unlike the situation the prior research, where the co-opted domain redirected users to another pornographic site (which might already be included on a black list), the pages we investigated displayed the pornographic content at the new domain name - the owners had copied the material to the new domain.⁶⁸ Thus, blocking all Internet pornography requires constant surveillance of expiring and expired domains.

Saudi Arabia devotes significant effort to this task and does it quite well. The majority of this type of site we tested had been re-registered between November 2003 and February 2004; all were accessible in either 2002 or 2003, but blocked in July 2004. These sites' previous content included information from record labels, local churches, a "guide to Jewish people worldwide," ethnic newspapers, and the Portugese consulate in Toronto.⁶⁹ This diverse content was replaced by pornography within 7 months of the domain names' re-registration; this rapid change indicates that pornographic content distributors pursue attractive, expiring domains with dedication and alacrity. Saudi Arabia's efforts to block these sites are consistent with an April 2001 report indicating ISU was "looking for a mechanism to get immediate information on all sites as soon as they open to screen them for immoral content."⁷⁰ ISU's mechanism may not be immediate, but it is remarkably fast at detecting and filtering new pornographic content. Overall, Saudi Arabia successfully blocks most pornographic Web content, and its rapid detection of new porn demonstrates the Kingdom's commitment to filtering this material.

b. Drugs

The Saudi government actively seeks to block drug-related sites, especially those promoting illegal drug use. In 2004, 86% of the drug sites we tested were blocked. As with pornography, the Saudi ISU staff manually added a number of these sites (25 URLs, representing 17% of locally-blocked pages) to the black list before SmartFilter detected them. Saudi Arabia distinguishes between pro-drug and drug abuse sites fairly well, blocking only 5% of substance abuse sites we tested. We conclude that ISU aggressively seeks to block drug pages, making it difficult to access pro-drug use sites in Saudi Arabia.

c. Gambling

Saudi Arabia heavily blocks gambling sites and relies on SmartFilter to do so. We tested a short list of gambling sites in 2004 and found 93% of these pages blocked, all by SmartFilter. We did not find local blocking of gambling sites, indicating satisfaction with SmartFilter's success rate or a slightly lower degree of concern with gambling than with drugs or pornography.

d. Circumvention Tools: Proxies and Encryption Sites

Saudi Arabia protects its Internet filtering by blocking access to tools that provide users with prohibited content. Filtering regimes must disable access to circumvention methods, such as alternative Web proxy servers, to succeed. The ISU understands this potential weakness, as internal presentations from 2001 demonstrate: "Once KACST knows the address of [public] proxies they get added to the black list."⁷¹ We found 21 blocked anonymizer and encryptions sites; all were added to the black list locally by the ISU.⁷² Saudi Arabia clearly understands the risk circumvention tools pose to filtering and acts to prevent it.

e. Religious Conversion

Saudi Arabia also concentrates on blocking sites that attempt to convert its citizens or to introduce them to other faiths, as demonstrated by significant local blocking by the ISU. We found 148 such sites locally blocked. This filtering echoes the Kingdom's earliest concerns about the Internet as a tool to proselytize Saudi citizens. The largest locally blocked group of these sites (22%) concerned relationships between Christians and Muslims. Blocked sites in this area are frequently available in Arabic, and also include sites ostensibly encouraging dialogue between the Christian and Islamic religions. We believe this concern also explains blocking of Apologetics sites that focus on "explaining Islam." Some noteworthy blocked sites include:⁷³

The ISU devotes attention to finding and blocking locally sites that seek to convert Saudi citizens to non-Islamic faiths, or to introduce them to other religions from an evangelical perspective.

2. Material Widely But Not Actively Blocked

Saudi Arabia blocks a substantial number of sites in these areas, but does not try to prevent access to all material in these categories and topic areas.

a. Bahai

Saudi Arabia frequently blocks Bahai sites, and at a far greater rate than other religious sites, but its filtering concentrates only on two domains, indicating the ISU does not focus on this area. 12% of the 50 Bahai sites we tested were filtered. These sites were blocked during each year of our tests. There is no evidence SmartFilter erroneously classified these sites, eliminating overblocking as an explanation. However, all blocks are on the domains bahai.org and bahai.com and pages hosted on them, while other Bahai domains remain unblocked. For example, the sites bahai-library.org, www.bahai-faith.org, and www.bahaiworldnews.org are not blocked. We believe the ISU blocks sites on these two domains intentionally, but that Saudi Arabia does not make a concerted effort to prevent all access to Bahai content.

b. Non-Sunni Islam

Saudi Arabia locally blocks some Web sites related to non-Sunni sects of Islam such as Salafism, Shia, and Sufism. We found several sites blocked locally in this category, including several Shia sites:

c. Political Opposition

Saudi Arabia blocks some Web sites of organizations that oppose the country's government. The ISU selects these sites to block locally since there is no applicable SmartFilter category. Blocked sites include:

d. Extremist Groups

Saudi Arabia blocks some Web sites of extremist groups such as terrorist organizations. Some of this filtering likely results from overblocking. Our testing found two sites in the dmoz "terrorism" category blocked, apparently because SmartFilter classified them as either "nudity" or "violence" and "extreme." We also found five sites on the MEMRI list blocked locally. Saudi Arabia faces pressure from states such as the United States to prevent access to this type of content. Our results indicate that Saudi Arabia filters some of these Web sites, but does not focus its attention on this type of content.⁷⁵

e. Free Web Hosting

Saudi Arabia blocks locally most sites in two free hosting domains, virgin.net and erols.com. (See Figure 16.) However, it does not block extensively many other free Web sites such as Geocities. Saudi Arabia's blocking in this area shifts drastically over time - in 2002, the ISU blocked 92% of mindspring.com sites and 90% of compuserve.com sites, but in 2004, none of the pages in these domains were filtered. Some sites we found blocked locally did not meet known ISU blocking criteria -- for example, one site was entitled "Jefferson Airplane Loves You," and another allowed users to search popular quotes. Some domains, such as members.aol.com and geocities.com, are blocked only on a page-by-page basis. This arbitrary approach may indicate the ISU blocks currently popular free Web hosts - or hosts to which forbidden content has migrated - but normally permits access to most pages on these sites. We believe further research is needed to explain this filtering pattern for free Web hosting domains.

f. Other Sexual Content

Saudi Arabia widely blocks sites containing sexual, but not pornographic, content. However, the Kingdom does not seek to block sex education sites. 7 of 166 locally blocked sites in our testing related to sexual material, ranging from a blog with some sexual discussion (www.links.net) to a site dmoz categorized as "cyberculture" that contained a variety of sexual (and other potentially offensive) content (www.newgrounds.com) to a sexual health and instruction site (www.sexuality.org). Overall, the ISU blocked 50% of sites dmoz categorized as "sexuality."

In contrast, we tested 29 sexual education sites on our index list and found only 1 locally blocked (in addition to 1 blocked site mistakenly categorized as pornography by SmartFilter). The locally-blocked site (www.sxetc.org) discusses teen sexual issues. Many sites with similar content and traffic levels are accessible.

The ISU blocks a wide range of sexual content. However, we believe this is part of Saudi Arabia's focus on prohibiting pornography, since sexual education sites are not blocked, despite evidence of ISU attention to sites in this area.

3. Material Passively Blocked

Saudi Arabia does not block most sites on gay / lesbian / bisexual issues, provocative attire, women's rights, politics, Judaism, and the occult. It filters access to some Web pages, but makes little effort to prevent most access through local blocking or use of SmartFilter categories. We conclude Saudi Arabia responds to specific blocking requests for such sites, but does not generally seek to prevent access to material in these categories and topic areas.

a. Gay/Lesbian/Bisexual Sites

While Saudi Arabia filters gay, lesbian, and bisexual material sites at an above-average rate, the ISU does not focus on blocking this content: most blocks result from SmartFilter classification errors, and there is no local blocking in this area. We found 11% of gay-themed content blocked. However, SmartFilter classifications account for 7% of the total blocking percentage, since the software categorized these sites as pornography, sex, or nudity. We controlled for sites blocked due to their SmartFilter category (see final column of Figure 22). This left a 4% block rate for this type of content, compared to a 0.6% block rate for all dmoz-listed sites lacking a SmartFilter category. None of the blocked sites in this topic were tagged as "local," so there is no evidence of direct ISU action to block this category.

In addition, we tested 30 gay-themed sites on our index list and found 3 blocked, all of which SmartFilter categorized as pornographic. However, none of the 5 sites classified by SmartFilter as "Lifestyle," a euphemism for gay / lesbian / bisexual sites, were blocked. SmartFilter describes the Lifestyle category as follows:

URLs in this category may contain discussions or material relevant to an individual's personal life, whether it be unique characteristics or orientation. The sites may include such things as straight men's groups, gay and lesbian discussions, senior citizen clubs, transgender issues, vegetarianism, naturism, and more. Some examples include:

World Guide to Vegetarianism
The Naturist Society - Promotion of clothes-free lifestyle
Gay Universe - Guide to alternative lifestyle⁷⁸

We conclude Saudi Arabia does not block this SmartFilter category. While the Kingdom may want to avoid blocking sites on vegetarianism and nudists, we believe instead that the ISU does not seek to filter all of these sites. Our analysis is supported by a Reporters Without Borders report describing how the ISU granted their request to unblock two gay sites, which stated "The head of the ISU... replied on 29 March : 'After receiving your letter, a re-examination of these sites was carried out. As no pornographic content was found, the blocking was lifted.'"⁷⁹ Saudi Arabia's above-average rate of blocking gay, lesbian, and bisexual sites may indicate some interest in filtering such content, or at least less vigilance in correcting overblocking in this area.

The greater filtering rate for gay, lesbian, and bisexual sites in Saudi Arabia (compared to the background blocking rate for uncategorized sites) could indicate previous SmartFilter errors, ISU methods that do not tag blocks as local, or at least less vigilance in correcting overblocking in this area. However, the lack of tagged local blocks, and the general availability of this content, indicates that Saudi Arabia does not focus on blocking gay, lesbian, and bisexual sites.

b. Provocative Attire

Saudi Arabia filters some sites with provocative attire (such as women's lingerie and swimwear), including employing local blocking, but does not prevent access to most such sites. "Provocative attire" comprises a separate SmartFilter category from pornography and denotes sites containing images of scantily-clad women that sell lingerie and women's swimsuits. Our results indicate that while the ISU does not block all these sites by adding the SmartFilter category to the black list, it does add provocative attire sites to the list intermittently on its own. We tested 22 provocative attire sites with our index list; 4 (18%) were blocked, with 3 tagged as local blocks and 1 incorrectly categorized as pornography by SmartFilter.

While the ISU blocks locally some provocative attire sites, its selection seems arbitrary -- less-known lingerie and swimwear sites are filtered (for example, www.bodylingerie.com, the 77,341st most-popular site on the Web according to Alexa), but more popular ones (such as www.victoriassecret.com, which Alexa ranks 971st) are not.⁸⁰ Thus, we conclude that the ISU passively blocks this category - when government ministries or users object to specific provocative attire sites, ISU blocks them, but the agency makes no effort to seek out this content. This inactivity contrasts sharply with Saudi Arabia's vigilance regarding Internet pornography.

c. Women's Rights

Saudi Arabia does not actively filter content on women's rights. While we tested relatively few women's rights sites, we found no evidence of concerted blocking efforts. There were no local blocks of these sites. While there was blocking of women's rights sites, we believe virtually all this filtering results from SmartFilter classification of the pages (compare the block rates including and excluding SmartFilter-categorized sites in Figure 24). Saudi Arabia may be ambivalent about this content; a Reporters Without Borders report documents a women's rights site blocked after it "posted articles on the violence undergone by women in Saudi society,"⁸¹ but notes the ISU removed the block shortly thereafter. We conclude Saudi Arabia filters these sites passively - it makes no effort to block access to them, but does not appear concerned about overblocking.

d. Politics

Saudi Arabia blocks a small fraction of political Web sites, but does not generally filter this topic. Blocking rates in this area are low, and SmartFilter classification errors do not explain most blocks.

We also found some politically-oriented Web sites blocked locally:

Thus, we conclude Saudi Arabia targets a limited number of sites to which it objects, but does not block access to political content generally.

e. State of Israel and the Holocaust

Saudi Arabia blocks content related to Israel only sporadically. We found three pages on the Israeli Defense Forces site (www.idf.il) blocked in 2002 and 2003, but the block had been lifted in 2004. The Kingdom blocks a significant minority of Holocaust sites, but this occurs primarily due to SmartFilter errors. The majority of blocked Holocaust-related content resulted from SmartFilter categorizing it as ?violence,? or even "pornography."⁸² ISU blocked only one site locally: a travel site with information on the Anne Frank House. However, www.annefrank.com is accessible. The low blocking rates and lack of local blocking demonstrated that while Saudi Arabia may occasionally block content related to the Holocaust, the Kingdom makes no serious attempt at filtering sites on the state of Israel.

f. Occult / Paganism

Saudi Arabia passively blocks sites related to the occult, paganism, and similar beliefs. Many blocks in this category result from erroneous SmartFilter categorization :
⁸³

ISU created a small number of local blocks in this area, including 13 pages on a Chinese astrology site (www.asiaflash.com/rao), a British astrology site (www.shininglight.org.uk), and 4 pages on Satanism sites (www.the600club.net and www.the600club.com). The low blocking rate and the availability of more well-known and popular pages (for example, Alexa rates www.churchofsatan.com as the 181,207th most-trafficked site on the Web, while www.the600club.com is 1,549,887th) indicates a passive approach to filtering this type of content: pages called to ISU's attention may be blocked, but Saudi Arabia makes no effort to block access comprehensively.

g. Conclusion

Our results show Saudi Arabia filters material on gay / lesbian / bisexual issues, provocative attire, women's rights, politics, and occult beliefs only passively. This undercuts previous research on Internet blocking in Saudi Arabia.⁸⁴ We conclude that these areas are not the focus of the ISU's efforts to control Internet materials.

4. Material Saudi Arabia Does Not Block

Saudi Arabia does not filter all content one might predict it would block. Our testing included several categories of content previously suggested as targets of the Saudi filtering regime where we found no evidence of intentional blocking.⁸⁵ These topics include alcohol and most religions.

a. Determining Intentional Blocking

We distinguished categorization errors by SmartFilter from intentional Saudi Arabian filtering by analyzing blocking rates in particular dmoz categories after removing all sites classified by SmartFilter in categories blocked by the ISU.⁸⁶ This analysis includes local blocks.

Figure 29 compares blocking rate for the top-level dmoz categories after removing sites blocked based on their SmartFilter category with the blocking rate with all sites included:

Most blocks in some content categories - for example, pages in Health and Arts -- result from SmartFilter's classifications and not the sites' content . Understanding overblocking helps us discern content that Saudi Arabia focuses on controlling while distinguishing filtering that occurs due to classification errors by Secure Computing.

We next explore content categories where Saudi Arabia expends little effort to prevent access.

b. Alcohol

Despite the ISU's claim, we found no evidence that Saudi Arabia attempts to block sites related to alcohol.⁸⁷ Only 1 of 21 alcohol sites on our index list was blocked, and that site (www.skyy.com, the site for Skyy Vodka) was incorrectly categorized by SmartFilter under drugs, not alcohol. Many highly visible, well-known sites are available, such as www.budweiser.com, www.jackdaniels.com, and www.beer.com. Thus, we conclude that the Saudis have not made even a cursory effort in this area.

c. Religion

Saudi Arabia does not filter religious sites extensively. As noted in Section 4.D.2, the ISU blocks sites on Bahai and certain Islam sects at an above-average rate. The Kingdom does not block sites on the Jewish religion (no sites filtered in our testing). Overall, the aggregate filtering rate for religion is low. Though SmartFilter incorrectly classifies a number of religious pages as pornography, removing these sites from our analysis produced little change in the results.

5. Material Saudi Arabia Blocks For Unexplained Reasons

Our testing uncovered a number of locally blocked sites with no apparent thematic consistency or clearly objectionable content, including a Swedish newspaper,⁸⁸ the site of the German Green Party,⁸⁹ a page with information about advertising on AskJeeves.com,⁹⁰ a scholarship for black business school students in Florida,⁹¹ and the local paper for Navasota and Grimes County, Texas.⁹² These blocks may demonstrate ISU mistakes in selecting sites to filter, or these pages may meet filtering criteria we have yet to discover.

5. Conclusion

Our testing located over 2,000 sites blocked at least once during our research. These blocks range from the seemingly random - Swedish newspapers -- to the highly targeted - pornography. Blocked sites primarily included content related to perceived vices (drugs, pornography, gambling), religious conversion, and tools to circumvent filtering. Our testing and our analysis create the following picture of filtering in Saudi Arabia.

Saudi Arabia operates a sophisticated Internet filtering system that focuses on blocking material on pornography, drugs, gambling, circumvention tools, and religious conversion. The filtering regime excels at preventing access to pornography; it blocks 98% of these sites that we tested, and detects new content even before its commercial software provider does. The Kingdom prevents access to significant amounts of content related to the Bahai faith, non-Sunni Islamic sects, opposition political groups, extremist groups, free Web hosting sites, and non-pornographic sexual content. However, information on gay / lesbian / bisexual issues, provocative attire, women's rights, politics, Judaism, and the occult is filtered only passively, with little effort to control access, and material on alcohol and most religions is freely available.

Importantly, some seemingly plausible assertions about Saudi Arabia's priorities and sensitivities fail under empirical scrutiny. Previous reports indicated that gay sites, women's rights sites, and Judaism sites were completely unavailable on the Saudi Internet.⁹³ Our research casts doubt on these statements.

Our study should also inspire caution regarding Internet filtering itself. Given the miscategorization and qualitative decisions used by filtering software to build any comprehensive block list, overblocking errors are inevitable -- there will always be material blocked for reasons other than its subject matter. While further study is needed to understand the relationship between SmartFilter classification errors and particular content categories (for instance, gay sites that are labeled "pornography"), we found incorrectly categorized pages in every area we tested extensively. Internet filtering is inherently error-prone. Saudi Arabia may demonstrate the inevitable difficulties in such a massive filtering apparatus. The government can shut off particular sites, or even huge portions of the Internet, almost instantly. Yet even Saudi Arabia's relatively transparent and professional filtering unit makes errors - compounded by the country's decision to outsource much of its normative decision-making to an American software company. While the ISU makes available means to request the unblocking of a site, this requires affirmative effort by users, who draw Saudi government attention to themselves and their Internet habits. It may also be difficult for a user to identify which sites are "mistakenly" blocked, versus those that represent a deliberate policy on the part of the government.

Overall, the Internet filtering regime in Saudi Arabia concentrates on a few things - pornography, drugs, gambling, circumvention tools, and religious conversion - and blocks them relatively successfully in the absence of active circumvention measures taken by users. The ISU, which implements blocking and manages the Kingdom's Internet, provides relatively comprehensive, transparent information about its blocking practices, and offers users some (albeit limited) means to participate in decision-making - rare steps in a filtering regime. However, Saudi Internet filtering also demonstrates the risks inherent even in a technologically adept blocking regime: overblocking, inconsistency, and loss of control over decisions. While Saudi Arabia's implementation of filtering is relatively transparent and limited, it also highlights the serious questions posed when a state seeks to prevent its citizens from accessing the information they seek.

Appendix 1

Example of Block Page in Saudi Arabia

Appendix 2

List of Locally Blocked Pages in Saudi Arabia

Footnotes

1 The OpenNet Initiative is a collaborative partnership among the Citizen Lab at the Munk Centre for International Studies, University of Toronto; the Berkman Center for Internet & Society at Harvard Law School, Harvard University; and the Advanced Network Research Group at the Cambridge Security Programme, University of Cambridge.

2 Seymour E. Goodman et al., The Global Diffusion of the Internet Project: An Initial Inductive Study 210-11 (Mar. 1998), The Mosaic Group, at http://mosaic.unomaha.edu/GDI1998/7HSAUDI.PDF.

3 Id. at 216.

4 Id.

5 The Mosaic Group, Up-date: The Internet in the Kingdom of Saudi Arabia 1 (Feb. 1999) at http://mosaic.unomaha.edu/SaudiArabia_1999.pdf.

6 Arab Media, Saudi Internet Rules (Aug. 1, 2003), at http://www.al-bab.com/media/docs/saudi.htm (reproducing the Council of Ministers Resolution of Feb. 12, 2001).

7 Reporters Without Borders, The Internet Under Surveillance 99 (2003), at http://www.rsf.fr/IMG/pdf/doc-2236.pdf. The ISU states that at the end of 2003, the country had 1,462,000 Internet subscribers. Internet Services Unit, Frequently Asked Questions, at http://www.isu.net.sa/faqs/faqs.htm (last visited Sept. 7, 2004).

8 KACST describes itself as "an independent scientific organization of the Saudi Arabian Government, established in 1977." King Abdulaziz City for Science & Technology, About KACST, at http://www.kacst.edu.sa/en/about.asp. The ISU believes "Filtering is too complex to be left for ISPs." Internet Services Unit, Internet Future (Oct. 18, 2000), at http://www.isu.net.sa/library/internet_future.PDF.

9 Internet Services Unit, Introduction to Content Filtering, at http://www.isu.net.sa/saudi-internet/contenet-filtring/filtring.htm (last visited Sept. 7, 2004).

10 Jonathan Zittrain & Benjamin Edelman, Documentation of Internet Filtering in Saudi Arabia (Sept. 12, 2002), at http://cyber.law.harvard.edu/filtering/saudiarabia/. "Black lists" are lists of sites blocked or filtered by a state, corporation, or other entity.

11 The filtering system uses this approach both for URLs blocked by the SmartFilter software and for URLs blocked locally by ISU staff. For example, if a user requests the URL http://opennetinitiative.net/bulletins/002/, and the filtering system does not block that URL specifically, but does block the path http://opennetinitiative.net/bulletins/, the user will not be permitted to access the URL.

12 Internet Services Unit, Introduction to Content Filtering.

13 Id.

14 Id. (stating that "God Almighty directed humanity in the Nobel Qur'an in the words of His prophet Joseph: 'He said: My Lord, prison is more beloved to me than that to which they entice me, and were you not to divert their plot away from me I will be drawn towards them and be of the ignorant. So his Lord answered him and diverted their plot away from him, truly, He is the All-Hearer, the All-Knower' Yusuf(12):33-34" (emphasis in original)).

15 Id. The cited article is apparently Cass Sunstein, Pornography & the First Amendment, 1986 Duke L. J. 589 (1986).

16 Internet Services Unit, Local Content Filtering policy, at http://www.isu.net.sa/saudi-internet/contenet-filtring/filtring-policy.htm (last visited Sept. 7, 2004).

17 Robin Miller, Meet Saudi Arabia's most famous computer expert, Newsforge, Jan. 14, 2004, at http://internet.newsforge.com/article.pl?sid=04/01/12/2147220.

18 Mirza Al-Khuwailadi, Saudi Internet Official Notes 500 Requests Made Daily to Block Sites, Jedda Arab News, Mar. 30, 2001.

19 Abdulaziz Hamad Al-Zoman, The Internet in Saudi Arabia (Technical View) (Apr. 30, 2001), at http://www.isu.net.sa/library/CETEM2001-Zoman.pdf.

20 Miller, Meet Saudi Arabia's most famous computer expert.

21 Internet Services Unit, The Old User Survey results, at http://www.isu.net.sa/surveys-&-statistics/user-survey.htm (last visited Sept. 7, 2004) (reporting an on-line survey of 260 users from July through September 1999).

22 Internet Services Unit, User's [sic] survey Internet performance, at http://www.isu.net.sa/surveys-&-statistics/new-user-survey-results-4.htm (last visited Sept. 7, 2004). Results translated by authors.

23 Jameel Al-Balawi, Hackers in Riyadh Reportedly Offer Access to Government Blocked Sites, E-Mail, Jedda Arab News, Nov. 3, 2001. While the article does not indicate how these individuals access filtered material, they likely employ open proxy servers. An open proxy server is "a server outside the kingdom [of Saudi Arabia] that users in the kingdom can use to reach blocked sites." Al-Zoman, The Internet in Saudi Arabia (Technical View) 26.The use of open proxies is no surprise to the ISU, whose director "knows that anyone with much knowledge of the Internet and computers can blow right by the Saudi content filters" and who "sees the filtering as a way to protect children and other innocents from Internet evils, and not much more than that." Miller, Meet Saudi Arabia's most famous computer expert.

24 Zittrain & Edelman, Documentation of Internet Filtering in Saudi Arabia.

25 Internet Services Unit, Introduction to Content Filtering.

26 The ONI research concentrates on Web-based content available over the HTTP protocol. We did not test whether Saudi Arabia filters other types of Web traffic, such as that available over the FTP (file transfer), SMTP (e-mail), or various P2P (peer-to-peer, such as BitTorrent) protocols.

27 ONI staff contacted the Internet Services Unit by e-mail on two occasions seeking comment on our results and on ISU filtering practices and procedures. We did not receive a response.

28 We successfully accessed the majority of the pages (93% in 2003 and 91% in 2004) from our control location (the server returned the HTTP response code 200). In some cases, the response from the control and Saudi locations differed. For example, if we requested a file that no longer existed on a blocked site, the control location received an HTTP error code such as "404 - file not found". Since the Saudi filters block requests on their black list without attempting to access the prohibited page, the Saudi proxy server would in this case return a block page rather than an error. For example, if Saudi Arabia blocked any page in the domain "http://cyber.law.harvard.edu," a request for a Web page in this domain that did not exist, such as http://cyber.law.harvard.edu/NONEXISTENTPAGE, would return an HTTP 404 error code from the control location, but a block page from the Saudi proxy server. Thus, counting this type of response as a block is not accurate, since Saudi Arabia blocks the domain regardless of how many Web pages are contained within in, and counting a non-existent page would overstate the true extent of filtering.

29 In 2002, we tested sites between 1 and 10 times; 84% of blocked URLs were tested either 5 or 6 times. In 2003, we tested each URL using 11 different proxies. In 2004, we tested each URL using between 8 and 14 proxies.

30 These results include sites blocked in more then 50%, but less than 90%, of our tests. Sites that were occasionally blocked and occasionally accessible formed 7% of our results in 2002, 5% in 2003, and 10% in 2004.

31 Marie-Helene Boccara, Islamist Websites and Their Hosts Part I: Islamist Terror Organizations, Middle East Media Research Institute, at http://www.memri.org/bin/articles.cgi?Page=archives&Area=sr&ID=SR3104 (July 16, 2004).

32 One can download data from Open Directory Project's database at http://rdf.dmoz.org/. At last count, the dmoz database includes over 4 million sites in more than 590,000 categories. We downloaded the cited data cited at the beginning of August 2004.

33 Secure Computing implements this feature through its SmartFilterWhere tool, which is available at http://www.securecomputing.com/sfwhere/index.cfm.

34 Saudi Arabian officials say that they update the list of blocked sites daily. Internet Services Unit, Local content Filtering Procedure, at http://www.isu.net.sa/saudi-internet/contenet-filtring/filtring-mechanism.htm (last visited Sept. 9, 2004).

35 The proxy servers we tested connect to Saudi Arabia's Internet backbone through KACST through an ISP in the same way that Saudi users connect to and access content from this network. In our testing, we received block pages from the ISU cache servers, confirming that our results were not affected by additional proxy filtering. Thus, our results likely duplicate those that most Saudi users experience.

36 For example, dmoz lists relatively few sites devoted to converting Muslims to Catholicism or to pro-drug viewpoints.

37 Secure Computer, SmartFilterWhere, at http://www.securecomputing.com/sfwhere/index.cfm (last visited Sept. 9, 2004).

38 Secure Computing, Product Overview, at http://www.securecomputing.com/index.cfm?skey=274 (last visited Sept. 9, 2004).

39 See Seth Finkelstein, SmartFilter stupidity - Christian sites as SEX, at http://sethf.com/anticensorware/smartfilter/damage3.php (last visited Sept. 9, 2004). Finkelstein provides examples of 6 Christian sites categorized as "sex" by SmartFilter on July 17, 2002, and notes that all 6 were corrected in September 2002.

40 This finding accords with the 2002 ONI testing results. See Zittrain & Edelman, Documentation of Internet Filtering in Saudi Arabia (noting that "Pages were blocked from Yahoo categories that suggest the display of images of people wearing less clothes than is typical in Saudi Arabia," including "28 pages... from Yahoo's Swimming & Diving category").

41 Dmoz categorizes sites using a deep taxonomy (we found over 19,000 distinct categories for the 70,000 sites we tested) -- for example, rather than classifying a site as "Drugs," dmoz may categorize it as "Society/Issues/Health/Drugs/Illegal/Pro-Legalization/Marijuana/Medical_Purposes". To increase the clarity of our results, we aggregated categories based on the presence of particular words within the dmoz categorization. For example, we would include two sites with the dmoz categories "Recreation/Drugs/Cannabis" and "Shopping/Recreation/Drugs/Cannabis" in our "cannabis" and "drugs" categories. In table captions, the term "category" refers either to a formal dmoz category or to our aggregate category. Dmoz categories begin with the word "Top," and may include the notation ".." to indicate we omitted intermediate categories to improve display (for example, "Top/../Shopping/../Swimwear" includes "Top/Regional/Europe/United_Kingdom/Business_and_Economy/Shopping/Clothing/Swimwear").

42 Technically, the government can determine what site the user asks the intermediary to retrieve if the request is not encrypted. However, we have no evidence Saudi Arabia does this; instead, the state focuses on blocking access to intermediaries themselves.

43 See Zittrain & Edelman, Documentation of Internet Filtering in Saudi Arabia: Blocked Pages by Yahoo Category - Grouping by Level 3, at http://cyber.law.harvard.edu/filtering/saudiarabia/sa-yahoo-3.html.

44 Apologetics is "the branch of theology that is deals with the defense and proof of Christianity." The American Heritage Dictionary 119 (2d ed. 1991).

45 Saudi Arabia is primarily a Sunni country. See Library of Congress, Saudi Arabia - A Country Study, at http://lcweb2.loc.gov/frd/cs/satoc.html (last visited Sept. 9, 2004). The United States Department of State notes that the Saudi "Government enforces a strictly conservative version of Sunni Islam." U.S. Department of State, International Religious Freedom Report 2004: Saudi Arabia (Sept. 15, 2004), at http://www.state.gov/g/drl/rls/irf/2004/35507.htm.

46 "MEMRI" is the Middle East Media Research Institute.

47 Internet Services Unit, Introduction to Content Filtering.

48 Id.

49 Our 2004 testing retrieved information from the block page indicating whether the HTML tag "ISUTag" in the page had the value "sf" (meaning a block due to a SmartFilter category filtered by the ISU) or "local" (meaning a block due to ISU adding the site to the black list manually).

50 SmartFilter makes several versions of its black lists available through the SmartFilterWhere tool. However, Secure Computing updates these lists constantly, making it impossible to verify a site's categorization retroactively. In addition, the targeted sites themselves change over time.

51 The "extreme" designation is used for sites that are "extremely violent, gory, or horrific in nature." Secure Computing, 3.2 Control List, at http://www.securecomputing.com/index.cfm?skey=1317#ex (last visited Sept. 10, 2004).

52 See URLBlacklist.com, at http://urlblacklist.com/ (last visited Sept. 10, 2004).

53 SmartFilter may include a site in more than one category - for example, the software could categorize a site based on both sexual content and drugs content.

54 The "extreme" designation is used for sites that are "extremely violent, gory, or horrific in nature." Secure Computing, 3.2 Control List, at http://www.securecomputing.com/index.cfm?skey=1317#ex (last visited Sept. 10, 2004).

55 These categories are a mix of those available in versions 3 and 4 of SmartFilter. Saudi Arabia likely standardizes on one of these software versions. It is possible that not all of these categories are blocked; rather, our data may reflect the frequency with which a site appears in two or more categories.

56 See, e.g., Seth Finkelstein, SmartFilter - I've Got A Little List (Dec. 7, 2000), at http://www.sethf.com/anticensorware/smartfilter/gotalist.php; Ben Edelman, Sites Blocked by Internet Filtering Programs (Feb. 12, 2003), at http://cyber.law.harvard.edu/people/edelman/mul-v-us/.

57 Secure Computing, Cisco Content Engine Running ACNS Software, at http://www.securecomputing.com/index.cfm?skey=976 (last visited Sept. 10, 2004).

58 On Sept. 10, 2004, Google stated on its home page, http://www.google.com, that the engine searched 4,285,199,774 Web pages.

59 Dr. Homa Darabi Foundation, available at http://www.homa.org (last visited Sept. 10, 2004).

60 Id. at http://www.homa.org/Details.asp?ContentID=2137352747&TOCID=2083225413 (last visited Sept. 10, 2004).

61 Internet Services Unit, Local Content Filtering policy.

62 Internet Services Unit, Introduction to Content Filtering.

63 These sites have a block page where the ISUTag value is "sf".

64 These sites have a block page where the ISUTag value is "local".

65 Internet Services Unit, Introduction to Content Filtering.

66 Abdullah Ahmed Al-Rasheed, The Internet in Saudi Arabia (Management View) (Apr. 30, 2001), at http://www.isu.net.sa/library/CETEM2001-AlRasheed.pdf.

67 Ben Edelman, Domains Reregistered for Distribution of Unrelated Content: A Case Study of "Tina's Free Live Webcam" (Feb. 18, 2003), at http://cyber.law.harvard.edu/people/edelman/renewals/.

68 Some pages we tested loaded content via an "IFRAME" from other pornographic domains. Cf. W3C, Frames in HTML Documents, at http://www.w3.org/TR/REC-html40/present/frames.html#h-16.5 (last visited Sept. 10, 2004). In this case, if the black list contains the domain from which the content is loaded, the filtering system will block the IFRAME site from displaying the content. We believe Saudi Arabia blocked these domains, in addition to the source domains for the pornographic content, to provide redundancy in their filtering.

69 We verified the sites' previous content using the Internet Archive, available at http://www.archive.org/. The content of these sites was in English.

70 Muhammad Al-Saed, Arab News Reports Saudi Government to Block 200,000 New Internet Sites, Jedda Arab News, Apr. 29, 2001.

71 Al-Zoman, The Internet in Saudi Arabia (Technical View).
72 It is not clear why the ISU blocks these sites locally rather than using the relevant SmartFilter category, since SmartFilter accurately classifies the majority of these sites. Saudi Arabia may use an older version of SmartFilter that requires blocking (or permitting access to) anonymizers and translation sites together, since the software includes them in a single category; if so, the Saudis might block circumvention sites locally to preserve access to translation sites.

73 See Section 4.B.8.a.
74 This site currently contains no content; we verified its content at the time of testing through the Internet Archive.

75 We note, however, that many other countries do not block the sites on the MEMRI list. ONI attempted to access these sites through servers in Canada, France, Germany, Israel, Japan, and the United States on November 16, 2004. In each case, we were able to access all of the MEMRI sites. Thus, we conclude that none of these countries filtered the MEMRI sites during this testing.

76 This block rate controls for possible SmartFilter classification errors by analyzing only blocked sites in SmartFilter categories not blocked by Saudi Arabia.

77 We obtained this list of extremist Islamist Web sites from Boccara, Islamist Websites and Their Hosts Part I: Islamist Terror Organizations.

78 Secure Computing, 3.2 Control List, at http://www.securecomputing.com/index.cfm?skey=1317#lf (last visited Sept. 14, 2004).

79 Reporters Without Borders, Internet Under Surveillance 2004: Saudi Arabia, at http://www.rsf.fr/article.php3?id_article=10766 (last visited Sept. 14, 2004). Reporters Without Borders requested that the ISU unblock the sites 365gay.com and gaymiddleeast.com.

80 We collected data on the sites' popularity from Alexa in September 2004. See http://www.alexa.com/data/details/main?url=http://www.victoriassecret.com/ and http://www.alexa.com/data/details/main?url=www.bodylingerie.com.

81 Reporters Without Borders, Internet Under Surveillance 2004: Saudi Arabia. The blocked site was that of the Arab Region Resource Center on Violence Against Women, at www.amanjordan.org. We did not test this site and cannot independently verify whether it was blocked.

82 The site categorized as pornography, http://members.aol.com/dalembert/lgbt_history/nazi_biblio.html, concerns gays and lesbians killed in the Holocaust.

83 For example, SmartFilter categorizes the occult sites http://www.astroguru.net, http://www.astrologyhoroscopes.com, and http://www.erotiscopes.com as pornography. None of these sites contains pornographic images or content.

84 For example, Reporters Without Borders states "Homosexuality and women's rights are completely absent from the Saudi Internet." Reporters Without Borders, Internet Under Surveillance 2004: Saudi Arabia.

85 For example, some articles conclude that "just about any site that portrays Judaism or Israel in a positive light isn't allowed." Miller, Meet Saudi Arabia's most famous computer expert.

86 We conclude these SmartFilter categories are gambling, nudity, extreme, sex, pornography, drugs, obscene/extreme, tasteless/gross, or violence-related content. See Section 4.C.1.a.

87 See Internet Services Unit, Introduction to Content Filtering.

88 http://www.expressen.se

89 http://www.gruene-saar.de

90 http://static.wc.ask.com/docs/advertise/advertising.html

91 http://www.jackituckfield.org
92 http://www.navasotaexaminer.com

93 See, e.g., Reporters Without Borders, Internet Under Surveillance 2004: Saudi Arabia, at http://www.rsf.org/article.php3?id_article=10766 (stating that "Homosexuality and women's rights are completely absent from the Saudi Internet"); Marni Soupcoff, Keep the U.N. away from the Internet, The American Enterprise Online, at http://www.taemag.com/issues/articleID.17976/article_detail.asp (stating that "Sites that show Judaism or Israel in a good light are also out of the question").