Project Bluesmote

tl;dr - analyze & visualize Blue Coat censorship logs from Syria

VIDEO (5 MiN)

A short video. This would be a good place to start.

About these logs...

This data was recovered from public FTP servers in Syria over a period of six weeks in late 2011. The logs are from Blue Coat SG-9000 filtering proxies (aka "deep packet inspection") installed by Syrian ISPs and used to censor and surveil the Internet. Individual log lines are data about HTTP request/response from web browsers.

The logs were eventually leaked, with client IP redacted. The data is now public domain.

The data set is ~55GB in total compressed, and almost 1/2 TB uncompressed. That's a whole lotta lines. They provide unique, first hand evidence of what censorship looks like from the censor's perspective.

Data Sets

Mirrored from http://sec.tl/syrian-censorship-logs/ at 2011-12-12 06:44 Two versions of the same data. Blocks are easier to work with.

Blocks: are a series of tab-separated lines, with several columns. Each file is gzipped & about ~10MB. They are numbered like block-0000.log.gz up to 5274. The fields are described here. Unparseable lines removed, etc..

Raw logs: are the original, unaltered mirror of the leaked logs.

no there are no versions with the client IP intact, please stop asking.