[tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   |   Keywords:  censorship
 |  block
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 Direct users in Iran dropped from 8,000 to 2,000 between 2016-08-20 and
 2016-08-23. The numbers recovered to 4,000, then crashed to 400 on
 2016-09-03 and 2016-09-04.
   [[Image(userstats-relay-country-ir-2016-06-24-2016-09-22-off.png)]]
 [https://metrics.torproject.org/userstats-relay-
 country.html?start=2016-06-24&end=2016-09-22&country=ir&events=off link]

 Looking at bridge users, there is an increase right around 2016-08-20, the
 time of the first blocking, then an abrupt return to previous levels
 around 2016-09-03, the time of the second blocking.
   [[Image(userstats-bridge-combined-ir-2016-06-24-2016-09-22.png)]]
 [https://metrics.torproject.org/userstats-bridge-
 country.html?start=2016-06-24&end=2016-09-22&country=ir link]

 Looking at the graph of bridge users by transport, obfs4 continued working
 while obfs3 and vanilla were blocked.
   [[Image(userstats-bridge-country-ir-2016-06-24-2016-09-22.png)]]
 [https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=ir link]

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mrphs):

 Looking at a couple of other countries, it seems obfs3 has been dropped
 for everyone at the same rate. Here's Germany for instance:
 https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=ru

 So perhaps it's not about obfs3 being blocked.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 The change in direct users was noticed by the Filterprints detector. Iran
 went to the top of the "most anomalous in the last day" list on
 2016-08-30:
 http://lists.infolabe.net/archives/infolabe-
 anomalies/2016-September/37.html
 {{{
 Last day:
 =
 Iran, Islamic Republic of (IR)
 Kazakhstan (KZ)
 China (CN)
 Georgia (GE)
 Uzbekistan (UZ)
 Bulgaria (BG)
 Ethiopia (ET)
 Ghana (GH)
 Turkmenistan (TM)
 Oman (OM)
 }}}

 Here's the 01day graph from that report (originally at
 http://lists.infolabe.net/archives/infolabe-
 anomalies/attachments/20160909/135fb600/attachment-0003.pdf).
 [[Image(2016-09-06-01day.png)]]

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 Replying to [ticket:20216 dcf]:
 > Looking at bridge users, there is an increase right around 2016-08-20,
 the time of the first blocking, then an abrupt return to previous levels
 around 2016-09-03, the time of the second blocking.
 >
 > Looking at the graph of bridge users by transport, obfs4 continued
 working while obfs3 and vanilla were blocked.

 I accidentally swapped the images for these two paragraphs.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 Replying to [comment:1 mrphs]:
 > Looking at a couple of other countries, it seems obfs3 has been dropped
 for everyone at the same rate. Here's Germany and Russia for instance:
 >
 > DE: https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=de
 >
 > RU: https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=ru
 >
 > So perhaps it's not about obfs3 being blocked.

 You're right. Here's the graph of the most popular transports across all
 countries.
   [[Image(userstats-bridge-
 transport-2016-06-24-2016-09-22-obfs3-obfs4-meek-.png)]]
 [https://metrics.torproject.org/userstats-bridge-
 
transport.html?start=2016-06-24&end=2016-09-22&transport=obfs3&transport=obfs4&transport=meek&transport=%3COR%3E
 link]
 obfs4 took a hit at the same time too, but didn't go to zero.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by joss):

 Hi All,

 Just for a little extra context, we also have code to run the anomaly
 detection system on both normal and bridge usage, and only report a period
 as anomalous when there is an anomalous drop in normal usage and a
 corresponding anomalous rise in bridge usage. (Or vice versa, actually.)

 The nice thing about the system we're working with here is that it's
 designed to exclude anomalies that are seen over a reasonable number of
 other countries, so it should only highlight per-country anomalies in
 usage.

 As noted, Iran did experience this combined bridge/normal anomalous
 period, but there's been a quick drop back to non-anomalous behaviour for
 combined bridge usage. I really should be running this on the per-
 transport graphs...

 For isolating events like this in the future, I'd be happy to work at
 getting this code running with regular outputs like the infolabe-anomalies
 mailing list  that  David mentioned. I'm wary of flooding too much data
 out there, though. Do let me know if there's something that would be of
 particular interest.

 I could just output a list and output graph every day for any country that
 experiences these 'combined' anomalies. Over the five years of data we
 have, and 102 countries that meet our data criteria, we've spotted about
 480 events where there are both types of anomaly simultaneously, so these
 events are relatively rare.

 I'll attach a recent combined anomaly Iran graph for reference.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20216 [Metrics/Censorship analysis]: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09

[Tor Bug Tracker & Wiki]

#20216: Iran blocking of vanilla and obfs3, 2016-08 and 2016-09
-+-
 Reporter:  dcf  |  Owner:
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Metrics/Censorship analysis  |Version:
 Severity:  Normal   | Resolution:
 Keywords:  censorship block |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by dcf):

 Replying to [comment:4 dcf]:
 > Replying to [comment:1 mrphs]:
 > > Looking at a couple of other countries, it seems obfs3 has been
 dropped for everyone at the same rate. Here's Germany and Russia for
 instance:
 > >
 > > DE: https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=de
 > >
 > > RU: https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2016-06-24&end=2016-09-22&country=ru
 > >
 > > So perhaps it's not about obfs3 being blocked.
 >
 > You're right. Here's the graph of the most popular transports across all
 countries.

 [https://lists.torproject.org/pipermail/metrics-
 team/2016-September/000216.html Karsten writes] that 2016-09-02 was the
 date that [https://blog.torproject.org/blog/new-bridge-authority the new
 bridge authority Bifroest took over from Tonga], causing
 
[https://metrics.torproject.org/networksize.html?start=2016-08-01&end=2016-09-22
 about 40%] of public bridges to stop reporting. If that 40% was
 disproportionately obfs3, that might help explain what we're seeing.

 I don't see how the changed bridge authority could have an effect on the
 number of ''direct'' users, so the fact that direct and obfs3 users both
 decreased on 2016-09-02 could be a coincidence. I just took "obfs3" out of
 the ticket title.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs