Censors' Delay in Blocking Circumvention Proxies
This research addresses the challenge of understanding censor behavior for internet freedom advocates, though it is incremental in nature.
The study measured the delay between when circumvention proxies become discoverable and when they are blocked by censors, finding that China's firewall blocked new Tor bridges after 2 to 36 days, with blocking only occurring after end-user software releases.
Censors of the Internet must continually discover and block new circumvention proxy servers. We seek to understand this process; specifically, the length of the delay between when a proxy first becomes discoverable and when it is actually blocked. We measure this delay in the case of obfuscated Tor bridges, by testing their reachability before and after their introduction into Tor Browser. We test from sites in the U.S., China, and Iran, over a period of five months. China's national firewall blocked new bridges after a varying delay of between 2 and 36 days. Blocking occurred only after end-user software releases, despite bridges being potentially discoverable earlier through other channels. While the firewall eventually discovered the bridges of Tor Browser, those that appeared only in Orbot, a version of Tor for mobile devices, remained unblocked. Our findings highlight the fact that censors can behave in ways that defy intuition, presenting difficulties for threat modeling but also opportunities for evasion.