  Internet censorship is enforced by numerous governments worldwide, however,
due to the lack of publicly available information, as well as the inherent
risks of performing active measurements, it is often hard for the research
community to investigate censorship practices in the wild. Thus, the leak of
600GB worth of logs from 7 Blue Coat SG-9000 proxies, deployed in Syria to
filter Internet traffic at a country scale, represents a unique opportunity to
provide a detailed snapshot of a real-world censorship ecosystem. This paper
presents the methodology and the results of a measurement analysis of the
leaked Blue Coat logs, revealing a relatively stealthy, yet quite targeted,
censorship. We find that traffic is filtered in several ways: using IP
addresses and domain names to block subnets or websites, and keywords or
categories to target specific content. We show that keyword-based censorship
produces some collateral damage as many requests are blocked even if they do
not relate to sensitive content. We also discover that Instant Messaging is
heavily censored, while filtering of social media is limited to specific pages.
Finally, we show that Syrian users try to evade censorship by using web/socks
proxies, Tor, VPNs, and BitTorrent. To the best of our knowledge, our work
provides the first analytical look into Internet filtering in Syria.
