Rerouting traffic through proxies or virtual private networks, known as VPNs, often helps access websites that have been blocked by authoritarian governments. But tech-savvy system administrators in countries like China, Russia, Belarus and Iran have long since recognized and sought to plug these loopholes.

That's why these administrators have begun building their own segregated internet ecosystems complete with online banking, trading and social media platforms. These splinternets, as they're known, are detached from the global internet system.

Users who want to connect to such splinternets must disclose their true identity by providing telephone numbers, IP addresses and copies of personal documents. In addition, some providers also require live selfie videos and precise GPS location data. The aim is to prevent anyone from using such networks anonymously, and to block access from abroad.

"The message is clear: If you're not identifiable to the state, you don't get to participate in the information space it controls," wrote journalist and anti-censorship expert Patrick Böhler. "Autocrats have learned they don't need the same communication channels as everyone else. They can build their own and decide who gets in." 

The consequences became apparent as early as 2022, during the Iran uprising following the death of 22-year-old Kurdish woman Jina Mahsa Amini. When protesters created social media accounts, Iranian authorities were able to identify them within just a few hours.

Something similar happened that same year in China amid protests over the Communist leadership's strict COVID-19 policy. Thanks to registered SIM cards, device IDs and the requirement for individuals to use their real names online, Chinese authorities swiftly identified and arrested government critics.

Exploiting authoritarian mistrust

Activists and journalists reporting from within authoritarian countries face a dilemma: either they reveal their identity on splinternets and put themselves and their sources in danger, or they risk losing access to these important communication channels. One activist puts it succinctly: anonymity saves lives.

Böhler and fellow activists have, however, worked out a way to navigate around this system of total surveillance. Their approach is based on the fact that different authorities within authoritarian states do not trust each other enough to coordinate effectively.

In other words, the mistrust that gives rise to authoritarian rule helps opponents of this very system.

If a platform needs to confirm the authenticity of a person, it will also accept foreign passports, ID cards or telephone numbers. Every system has its own way of working and this inevitably creates loopholes. Shell companies and dubious offshore firms exploit similar loopholes, which are also known as system arbitrage.

For example, if you can obtain a passport from a country that an authoritarian state considers friendly, then this will cause less mistrust in the verification process than if you register using a US or British ID card, for instance.

It's fairly easy to obtain such a passport on the darknet. And once the verification proceeds, the system does not question whether the person registering really is the rightful passport holder.

The first two steps of the verification process can be made using a SIM card and such a passport.

Cracking adaptive verification systems

Many platforms use adaptive verification systems, which assess a user's risk potential.

The "verification ladder" starts with requesting a person's telephone number and SMS code (level 1), progresses to ID documents (level 2), facial recognition (level 3), live videos with specific movement prompts (level 4) and finally requests a verified user to vouch for the new person (level 5).

While levels 1 and 2 can be completed as described above, further verification steps prove more challenging.

This is because apps that handle the verification procedure for platforms check a phone's settings and immediately notice if a video is not recorded via the phone's own built-in camera, but played through a third-party source as a kind of bypass.

Working around this verification hurdle requires a sophisticated strategy known as identity simulation, combining cloud services and virtual camera software.

Cloud services allow individuals to use services on remote servers anywhere in the world, rather than use their own personal device. This makes it very easy to spoof metadata, such as geographical information, making it hard to trace phones.

Biometric checks, meanwhile, are completed using a software solution favored by many streamers. It creates a virtual camera driver at the operating system level. This way, a live video can be created using a static, AI-generated photo.

Rather than deploying software like Photoshop, which leaves digital traces, common AI tools are more useful for creating fake identities.

Researchers like Böhler and others deliberately use prompts that create imperfections in AI-generated images, leading to visible pores, skin blemishes and so forth — precisely the characteristics human viewers would expect from real selfies.

This method can be used to bypass even the most advanced facial recognition systems deployed by the Chinese Ministry of Public Security — at least for the time being. After all, authoritarian governments are constantly looking for ways to close existing loopholes in their systems.

Future of digital authentication

These developments raise fundamental questions about the future of digital verification. If a perfectly AI-generated fake identity is practically indistinguishable from a real one, what does this mean for our understanding of digital authenticity?

Moreover, these elaborate methods to bypass censors can also be used to cause harm. "The same security gaps that give researchers access to confidential information allow criminals to launder money," wrote Böhler.

Nevertheless, Böhler advocates using these techniques as we find ourselves in world where anonymity is increasingly criminalized. He said we must uphold key values like a commitment to the free flow of information, the importance of journalism and the rights of citizens to learn about their government's actions.

Note: DW has performed the exact steps required to log into Chinese, Iranian and Russian accounts anonymously from abroad. To protect the people who rely on these workarounds, we cannot share any detailed information on these steps.

This article was originally written in German.