Re: [tor-talk] Many more Tor users in the past week?

["Asa Rossoff" <asa@xxxxxxxxxxxxx>]

From mirimir:
> On 09/04/2013 02:09 AM, Collin Anderson wrote:
>
>> On Tue, Sep 3, 2013 at 9:39 PM, mirimir <mirimir@xxxxxxxxxx> wrote:
>> 
>>> I wonder what it might mean.
>>>
>> 
>> I don't believe much, Syria's increase was relatively marginal and
>> potentially related to normal trends of weekly or holiday use. For the
most
>> party, suspect countries have increased orders of magnitude in users --
>> Syria is only a few percent and it's decreased since.
>
> Huh? Syria went from ca. 1e+3 in late June 2013 to over 4e+3, initially
> a spike in early July, and then plateauing in early August.
> 
> That's hardly a few percent. It's a factor of four. And that's plainly
> obvious from the Tor metrics site:
...

I agree there is an anomoly in Syrian usage, but it appears independent of
the overall anomoly.

Since it occurred first, it's conceivable that Syria was a testing ground
for a botnet or that events in Syria indepently created either an increase
in local Tor demand or accessibility.

Reviewing known Syrian political and war events occurring, as well as the
Muslim and Syrian holiday and festival calendars, as well as reviewing Tor
usage data worldwide, and a sampling of major news stories related to
privacy and encryption, I came up with something of a timeline, although I
draw no conclusions from it.

Timeline through August 31
==========================
* February, a dramatic, roughly ten-fold decrease in Syrian directly
connnecting Tor users.
* July 9-14, spike in Syria directly connecting users from est. ~ 1,000
users, peaking at just over 4,000 users on July 12, and returning to ~ 1,000
users by July 15.  Approximately four-fold increase at peak on July 12.
Syrian Usage in the near term both before and after fluctuates up to ~50%
and 1,000 is a bit below average; it leveled off around 1,200 within a few
days of this event, holding steady until August 6.

* August 6, rebels in Syria had a strategic victory by capturing Menagh
Military Airport after a one-year siege.
* August 6-7, Tor usage increased four-fold in Syria, and has ranged between
~3,500 and 4,500 directly connecting users since (~4,000 on August 31).
* August 8, Ramadan one-month fasting ended.
* August 8, Lavabit and Silent Circle shut down.

So the above events correlate with Syria's four-fold increase in usage,
though usage had been extraordinarily low since a dramatic ten-fold decrease
in February (with a brief July spike that peaked at four-fold prior usage on
July 12), so there might be another reason.

* August 10, PirateBrowser released.
* August 13, Report that PirateBrowser had reached more than 100,000 direct
downloads, had 5,000 seeds on its major torrent, and was continuing to
average "well over 1,000 downloads per hour".
http://torrentfreak.com/pirate-bays-anti-clocks-100000-downloads-in-three-da
ys-130813/

* August 15, Washington Post published NSA audit showing privacy abuses,
particularly in re. US citizens. (I have not reviewed dates of all NSA or
online security revelations from The Guardian, Washington Post, New York
Times, and other sources that have been constant since the June revelations,
with at least one major story per week.)
http://articles.washingtonpost.com/2013-08-15/world/41431831_1_washington-po
st-national-security-agency-documents

- August 18: Worldwide directly connecting Tor users: ~ 500,000 plateau
dating back to September, 2012.

*** August 19-21, Worldwide Tor usage began accelerating.
* August 21, apparent major chemical/gas attack in Syria (though no obvious
effect on Syrian usage).
* August 22-23, acceleration picked up pace a bit.
* August 24-25, increases worldwide were steady rather than accelerating.
* August 26-31, slight exponential acceleration resuming and continuing on
the whole.
* August 29, the Washington Post published NSA black budget documents and
article, with a major revelation on the human and financial capital invested
in undermining online encryption.
http://www.washingtonpost.com/world/national-security/black-budget-summary-d
etails-us-spy-networks-successes-failures-and-objectives/2013/08/29/7e57bb78
-10ab-11e3-8cdd-bcdc09410972_story.html

- August 31: ~ 2.35 million (eyeball from graph) directly connecting Tor
users, a factor of about 4.7 in 12 days.


There has been increased pressure on journalists recently as well, with the
large number of arbitrary arrests in Egypt, including shootings by the
military, the captures and deaths of journalists in Syria, the controversy
over releases of national security information in the wake of the NSA
revelations, the UK destruction of data at The Guardian HQ, the UK detention
of The Guardian's Glenn Greenwald's partner and confiscation of his data,
and the perception that the UK moves were with the cooperation/at the
request of the U.S.

There are international moves to mount an attack on Syria since the apparent
gas/chemical attack on August 21 that might increase demand for online
private communications.

## I only looked at the standard directly connecting Tor usage in my
commentary, not bridge users, and not the experimental data looking at
mirrors and DAs intended to include bridge users.  The experimental data, on
quick glance, looks to shows a similar pattern with roughly 50% more users
than I've reported; ~ 750,000 on August 18, and ~ 3.5 million on August 31.
##

Asa
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsusbscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk