“Tor metrics are the ammunition that lets Tor and other security advocates argue for a more private and secure Internet from a position of data, rather than just dogma or perspective.”
— Bruce Schneier (June 1, 2016)
You're a journalist or more generally a person who wants to know what's going on in the Tor network? We're collecting unusual events in the Tor network together with any insights we have into what we think has happened.
Ukraine blocks Russian-operated web services. Relay and bridge users increase over 5×. May be partly attributable to the FreeU Browser, a browser produced and advertised by Mail.ru that includes a tor client.
Drop in direct users from Egypt.
Sudden temporary peak of 3k direct users in Macau.
AssumeReachable 1 on the Snowflake bridge 2B280B23E1107BB62ABFC40DDCC8824814F80A72 in an attempt to make it start publishing statistics.
Direct users fluctuate widely in Taiwan after a 3× sudden increase.
Another sudden increase of direct users in Israel. Bridge users not affected.
Directory authority maatuska's bwscanner stops operating, leading to a drop in traffic on some relays.
Sudden increase of direct users in Israel. Bridge users not affected.
Orbot 15.4.0 beta-2 multi is released, containing the new meek-azure CDN configuration.
Tor Browser 6.5.1 is released, containing the new meek-azure CDN configuration.
meek-azure is shut down pending migration to a new CDN configuration.
Measurement error from bandwidth authority causes decrease in measured bandwidth in Europe.
Increase in obfs3 users from the UAE, from 5K to 75K. Other transports and countries not affected.
Huge increase in relay users (200k+).
Drop in relay users.
The Democratic Republic of the Congo orders a block of social media services.
Turkey blocks direct Tor connections. The order to block had come on 2016-11-04.
Belarus blocks the addresses of public Tor relays, apparently by RST injection. Bridges work, even unobfuscated ones.
Decrease in direct users in Saudi Arabia.
Default obfs4 bridge Lisbeth turns on timing obfuscation (
Tor Browser 6.0.6 is released, unbreaking meek on macOS 10.12 (Sierra). (See 2016-09-20 breaking event.)
Default obfs4 bridges ndnop3 and ndnop5 turn on timing obfuscation (
Turkey orders a block on VPN services and Tor
Turkey blocks Facebook, Twitter, YouTube, WhatsApp
Egypt blocks Tor directory authorities and public relays by TCP RST. Bridges work.
Large decrease in meek users, perhaps caused by problems in Orbot 15.0.2 BETA 1 that were fixed in Orbot 15.2.0 RC8.
Direct users fluctuate wildly in Israel. Bridge users not affected.
Ethiopia declares a state of emergency and implements network blocks.
Turkey blocks storage services including Dropbox, Google Drive, OneDrive, and GitHub. Most (all?) of the blocks were rescinded the next day.
Reports that direct connections from Egypt are blocked; bridges are required. Maybe be the same as the block beginning 2016-10-25.
Default obfs3 bridge LeifEricson upgrades and begins reporting statistics to the new bridge authority Bifroest. This is the last obfs3 bridge that hadn't upgraded.
Default obfs4 bridge LeifEricson upgrades and begins reporting statistics to the new bridge authority Bifroest. This is the last obfs4 bridge that hadn't upgraded.
Default obfs3 bridges ndnop0 and ndnop2 upgrade and begin reporting statistics to the new bridge authority Bifroest.
Default obfs3 bridges ndnop3 and ndnop5 upgrade and begin reporting statistics to the new bridge authority Bifroest.
Default obfs3 bridges "Unnamed" and "Unnamed" (fingerprint AF9F66B7B04F8FF6F32D455F05135250A16543C9) upgrade and begin reporting statistics to the new bridge authority Bifroest.
Outage of default obfs3 bridges "Unnamed" and "Unnamed" (fingerprint AF9F66B7B04F8FF6F32D455F05135250A16543C9). (Start date not known for sure, though it must have been after 2016-09-23; discussed in non-archived tor-team email.)
macOS 10.12 (Sierra) is released, breaking some programs that are built with Go <1.7, including the meek-client that comes with Tor Browser. (See 2016-11-15 unbreaking event.)
Iran intensifies the blocking begun on 2016-08-20, getting most of the remaining direct users. There is interference in the graphs from the bridge authority changeover on 2016-09-02, but because the changeover would not have affected counts of ''direct'' users, it may be a coincidence.
The former bridge authority Tonga shuts down. Bridges that have not updated to tor 0.2.8.7 or 0.2.9.2-alpha (which include all 5 default obfs3 bridges and 3/16 default obfs4 bridges) stop reporting statistics.
CollecTor begins publishing bridge stats from the new bridge authority Bifroest.
tor 0.2.8.7 and 0.2.9.2-alpha are released, changing the bridge authority from Tonga to Bifroest.
Large decrease in users in China.
Iran somehow blocks most direct Tor connections. May also affect bridge users, but it's hard to tell because there were few vanilla bridge users anyway.
Sustained increase in meek users in Brazil. Locals believe that they are not actual users, rather bots or something like that. End date coincides with shutdown of meek-azure before migration.
Kazakhstan blocks vanilla Tor TLS. Users mostly switch to obfs4.
Tor Browser 6.0 released, which lacks the fte pluggable transport on Mac.
WhatsApp block in Brazil
Tor Browser 6.0a5 and 6.0a5-hardened released, which lack the fte pluggable transport on Mac.
Large drop in direct users in Turkmenistan.
This material is supported in part by the National Science Foundation under Grant No. CNS-0959138. Any opinions, finding, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation. "Tor" and the "Onion Logo" are registered trademarks of The Tor Project, Inc.. Data on this site is freely available under a CC0 no copyright declaration: To the extent possible under law, the Tor Project has waived all copyright and related or neighboring rights in the data. Graphs are licensed under a Creative Commons Attribution 3.0 United States License.