How the Tor Project Measures Internet Censorship

The Tor Project actively tracks and analyzes global censorship events by combining real-time network telemetry, anomaly detection algorithms, and decentralized network measurement tools. By monitoring changes in user connection patterns, bridge utilization, and traffic routed through censorship-circumvention technologies, the organization detects when governments or internet service providers block access to the internet and privacy tools.

Tor Metrics and Directory Authorities

The primary method for measuring global censorship is Tor Metrics, a publicly accessible analytics platform that collects anonymized operational data from the Tor network. Directory authorities—the specialized servers that maintain the list of active relays—record connection requests from clients worldwide.

When an authoritarian regime implements a network-level block, Tor Metrics immediately registers a sharp decline in direct connections originating from that country’s IP ranges. Conversely, a simultaneous spike in connections via Tor Bridges (unlisted entry relays) indicates that users are actively switching to circumvention methods to bypass local restrictions.

Pluggable Transport Telemetry

When direct access to the Tor network is blocked, users rely on Pluggable Transports—technologies that disguise Tor traffic as ordinary web traffic. The Tor Project monitors aggregated usage statistics across specific circumvention tools:

• obfs4: Scrambles traffic to look like random noise, preventing deep packet inspection (DPI) from identifying the Tor protocol.
• Snowflake: Routes traffic through temporary WebRTC proxies run by volunteers worldwide, making it difficult for censors to block dynamic entry points.
• WebTunnel: Mimics standard HTTPS connections to specific web servers.

Sudden surges in Snowflake or obfs4 adoption from a specific geographic region provide direct, measurable evidence of an ongoing censorship event.

The Open Observatory of Network Interference (OONI)

Originally launched under the Tor Project, the Open Observatory of Network Interference (OONI) is a global observation network dedicated to detecting internet censorship. Volunteers run OONI Probe software on local networks to test for:

• DNS Tampering: Checking if DNS queries for specific websites resolve to incorrect IP addresses or block pages.
• TCP/IP Blocking: Identifying when connections to targeted servers are dropped or reset.
• HTTP/HTTPS Interference: Detecting transparent proxies, TLS handshake resets, or middlebox interference designed to intercept encrypted traffic.

OONI processes millions of network measurements daily, publishing the findings in real time to substantiate censorship events with granular, technical proof.

Automated Anomaly Detection and Verification

To identify events quickly, the Tor Project employs automated anomaly detection systems that flag statistical outliers in country-level traffic. When anomalous drops or spikes occur, network researchers correlate the data with known geopolitical developments, local news, and reports from digital rights advocates on the ground. This combination of automated metrics and human verification allows the Tor Project to document global censorship events accurately and deploy responsive circumvention updates.