While the traffic entries that I believe were DRTR calls may be K9, the logs are from machines that appeared to identify as ProxySG devices. However, my mistake may have been in being succinct. These logs contain several other types of calls to BC services during the collection period. At the moment the conversation has shifted to rebutting the response of BC (http://b.averysmallbird.com/entries/this-is-definitely-not-a-bluecoat-device-in-syria), but I will update this post with clarification and then follow up on the matter when possible.

I appreciate the critique :)

Don’t be so sure. This isn’t coming from Blue Coat hardware. This is a log from Blue Coat’s K9 offering… a free desktop content filtering application.

Syria’s blocking was politically motivated, targeting dissident sites, platforms for mobilizations, and terms like ‘proxy’ and ‘Israel.’

I would point out that Websense would also fall under sanctions and that Syria would be unlikely to turn to Israel. As for China, I cannot say that anyone stands to gain from American firms providing technology to repress online activity.

I look forward to your results, please do contact me when you have work to share.

If — and it’s a large if — the chart posted from this data elsewhere is accurately describing blocked traffic, as opposed to total traffic — even then, it’s possible the Bluecoats are mostly blocking garbage to keep bandwidth available. (The huge amount of web advertising, for instance, may be a bandwidth conservation measure.)

Unfortunately, no methodology for that chart is posted. I have a license for the reporter tool, so I’ll be doing my own analysis of the logs this week.

Now, the surveillance piece is problematic, of course – the bluecoat provides an easy-to-read log. But all ISPs maintain some level of connection logging. If Bluecoat pulls its hardware, and the Syrians go to Websense, or contract with Chinese or Israei firms for equivalent logging and visibility, is this in some way better?