It is time to discuss how censorship resistant the Internet Computer really is. How hard is it to get an application removed from the Internet Computer? How hard is it to be censored by the community? If there are bad actors doing illegal things on the Internet Computer will we be able to remove them?
We’ll analyze censorship resistance right now (July 2021) as well as after a few additional Internet Computer features have come out.
Censorship Resistance Right Now
Scenario #1: The government of a country wants to take down an application on the Internet Computer.
If the replication factor is low (1-3 nodes), then it is easy because they only need to take down one node to compromise the application. The government locates one of the data centers where the node is being run. If under their jurisdiction they take control of the data center. If not, then they collaborate with other country government agencies. Then they look into each node to find the application they are seeking and they shut it down. This shows the lack of censorship resistance of low replication factor subnets, but even with a low replication factor, this scenario may require multiple countries to collaborate to remove an application on the Internet Computer.
If the replication factor of the subnet is high (or even just 7), it is much harder. Now the government has to take down 3 nodes of the 7 in the subnet to take the application down. In this case, they will have to coordinate with other governments around the world (or bribe data centers) to find data centers, take control, determine which nodes are running the application, and shut them down. This is harder than the first scenario because now at least three countries have to be involved (assuming appropriate geographic distribution of nodes in a subnet).
Finally (or as a last resort), the government could submit an NNS proposal and try to convince the Internet Computer community that we need to take down this site. The community could then vote to remove the site from the Internet Computer. Afterwards, the bad actors could be identified and watched/followed/banned in order to prevent them from continuing to be bad actors on the Internet Computer.
Scenario #2: The Internet Computer community wants to take down a website that is spreading misinformation about the Internet Computer.
In this case, the Internet Computer community has complete control over whether the application is taken down or not. Someone from the community can submit an NNS proposal requesting the removal of a particular application on the IC. If the majority of the community votes to remove it, then the application is removed. If the majority of the community does not vote to remove it, then it is not removed and the application cannot be forced out.
Scenario #3: Bad actors are spinning up applications that facilitate illegal activities and a government wants to take them down from the Internet Computer.
This scenario is almost identical to the first scenario. It would require multiple governments collaborating together to find data centers, identify nodes, and take them down, but this is very possible assuming they were motivated to do it.
Ideal Censorship Resistance on the Internet Computer
The difference between censorship resistance right now and the ideal censorship resistance on the IC is two new features called secure enclaves and node shuffling.
Secure Enclaves
Right now, code running on nodes is not encrypted so a motivated node provider could discover what they were running in their data center to try to hack the canisters. This is partially solved by secure enclaves. A secure enclave is basically when you encrypt data and code before it goes to a canister. This means that even if you saw the canister code, it would be encrypted and unreadable. The code would still run, but you have no way of knowing what it is. This makes it very very hard for node providers to know what is running on their machines.
Technically, it still might be possible to know the encryption scheme used to encrypt the code using special devices over months of effort. This seems unreasonable, until you think that one of your nodes might be worth billions of dollars, at which point even if it takes years it is still worth it. So the second feature that solves this side channel attack problem is node shuffling.
Node Shuffling
The main vulnerability of secure enclaves is it might take months or years to crack it. So to solve this problem we shuffle the nodes every week. This means that each canister will only be on the same node for a week, at which point it will get randomly shuffled somewhere else on the Internet Computer.
Node shuffling combined with secure enclaves makes canisters and nodes extremely secure. How secure you may wonder? Well, let’s go back through our scenarios from above but assuming we have secure enclaves and weekly node shuffling.
Scenarios #1, #2, and #3: It is no longer possible to determine where an application is running. Secure enclaves plus node shuffling mean that nobody knows where anything is running anymore. So you have three options, and these are literally your only three options:
1. Collaborate with governments across the world, identifying all data centers and indiscriminately shutting them all down. This would basically be a worldwide internet shutdown.
2. Spend $11.7 billion on ICP to own greater than 50% of the network (based on 469M ICP and $50/ICP price), stake it all in neurons with a dissolve delay of 6 months, and then submit a proposal to remove the application in question and vote to remove it. In this case, you don’t need anyone else’s votes because you have a majority.
3. Submit an NNS proposal and convince the Internet Computer community to vote to take down the application.
So we have mass internet shutdown, $12 billion, or NNS proposal vote. Those are the only ways to remove an application from the IC once we have the additional security features I discussed earlier. The other amazing thing is that over time, the mass internet shutdown has to account for many decentralized node providers (making it more difficult and maybe impossible for this strategy to work), and the $12 billion fee to gain control of half of the network is going to be much higher (making it more difficult and maybe impossible for this strategy to work).
Conclusion
The censorship resistance of the Internet Computer is already amazing, and it is only going to get better. Ultimately, only the community can determine what is censored on the Internet Computer, and the community can only do that through voting on NNS proposals.
