Tor usage in Turkey spiked sharply during the initial days of the July 2016 coup—when ISPs were actively throttling Twitter—but declined steadily in subsequent months back toward pre-coup baselines, consistent with post-coup suppression being driven by chilling effects rather than sustained network-level blocking.

41% of users (139,042 of 342,650) in the post-coup dataset voluntarily removed 18% of all post-coup tweets by switching to protected mode, deleting accounts, or deleting individual tweets; the largest groups were active users who deleted some tweets (44% of affected accounts) and users who switched to protected mode (22%).

§4.1, Table 1 policy

Zero pro-Gülen topics appeared in the public tweet set post-coup, while 70% of unreachable (deleted/protected) Gülen-related tweets were pro-Gülen; the unreachable rate for Gülen-related tweets was twice the background rate, quantifying rapid directional self-censorship on politically targeted content within days of a government crackdown.

§4.2–§4.3, Table 2 policy

Comparing 5.6M pre-coup tweets (2015 Turkish general election) to 8.5M post-coup tweets (July–November 2016), the authors found 72% fewer government-censored tweets post-coup (142,492 vs. 513,719), with an estimated 43% of that decline attributable to reduced overall Twitter usage in Turkey and the remainder to user self-censorship.

§4.1 evaluation

Twitter's official Transparency Report for July–December 2016 reported 489 censored tweets in Turkey from non-withheld accounts; the authors identified 6,402 unique censored tweets from the same period—approximately 13× more than officially reported—replicating an earlier order-of-magnitude undercount finding by Tanash et al. (2015).

§5 evaluation

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Article 19 documents that Iran combines technical filtering with formal coercion of major foreign platforms (including Telegram, Instagram, and WhatsApp) to comply with content removal orders under threat of full blocking. The report notes that Iran's 2022 Women Life Freedom protests accelerated platform blocking when foreign operators refused compliance, demonstrating that the censorship system operates in two modes: coerce-and-allow for compliant platforms, block for non-compliant ones. Domain fronting via these platforms is therefore subject to sudden revocation if political conditions change.

2026-article19-tightening-the-net §6 ip-blockingdns-poisoningthrottling

The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.

2026-article19-tightening-the-net §4, §5 dpisni-blockingthrottling

The report documents that Myanmar's military has used its TSG-based infrastructure to execute targeted throttling and selective shutdowns of specific services and platforms, not only blanket internet shutdowns. This includes selective disruption of VPNs and circumvention tools during periods of civil unrest, demonstrating that Myanmar's censors have operationalized the granular per-service traffic control capabilities documented in the Geedge/MESA leak.

2025-jfm-silk-road-surveillance §5 throttlingip-blockingtraffic-shape

Active mid-connection bandwidth throttling (e.g., 100 Mbps → 50 Mbps) cleanly separates BBR from Hysteria and TCP-Brutal: BBR converges to the new rate within a few probing cycles, while Hysteria and Brutal interpret reduced bandwidth as increased packet loss and raise their sending rate further. This active probing technique resolves the BBR ambiguity that passive measurement alone cannot.

2025-wang-custom §4.4 throttlingtraffic-shape