How Tor Is Fighting—and Beating—Russian Censorship

For years, the anonymity service Tor has been the best way to stay private online and dodge web censorship. Much to the ire of governments and law enforcement agencies, Tor encrypts your web traffic and sends it through a chain of computers, making it very hard for people to track you online. Authoritarian governments see it as a particular threat to their longevity, and in recent months, Russia has stepped up its long-term ambition to block Tor—although not without a fight.

In December 2021, Russia’s media regulator, Roskomnadzor, enacted a 4-year-old court order that allows it to order internet service providers (ISPs) to block the Tor Project website, where the Tor Browser can be downloaded, and restrict access to its services. Since then, censors have been locked in a battle with Tor’s technical team and users in Russia, who are pushing to keep the Tor network online and allow people to access the uncensored web, which is otherwise heavily restricted in the country.

Russia’s efforts to block Tor come in two flavors: the technical and the political. So far, Tor has had some success on both fronts. It has found ways to avoid Russian blocking efforts, and this month, it was removed from Russia’s list of blocked websites following a legal challenge. (Although this doesn’t mean blocking efforts will instantly end.)

“We are being attacked by the Russian government, they are trying to block Tor,” says Gustavo Gus, community team lead of the Tor Project. The past few months have seen Russian officials adapt their tactics, Gus says, while the Tor Project’s anti-censorship engineers have successfully launched updates to stop its services from being blocked. “The fight is not over,” Gus says. “People can connect to Tor. People can easily bypass censorship.”

In Russia, the internet infrastructure is relatively decentralized: ISPs can receive blocking orders from Roskomnadzor, but it’s up to individual companies to implement them. (China is the only country to have effectively blocked Tor, which was possible due to more centralized internet control). While Russian authorities have been installing new equipment that uses deep packet inspection to monitor and block online services, the effectiveness of these blocks is mixed.

“The censorship that’s happening in Russia is not constant and uniform,” Gus says. Gus explains that because of different ISPs, Tor may be blocked for some people but not others, even those in the same city. Both Tor’s metrics and external analysis appear to show the dwindling effectiveness of Russian censorship.

Tor’s data shows that since the end of 2021 there has been a big drop in the number of people directly connecting to Tor in Russia. However, people are able to connect to its services using volunteer-run bridges—entry points to the network that can’t easily be blocked, as their details aren’t public—and Tor’s anti-censorship tool Snowflake. External data from the internet monitoring group Open Observatory of Network Interference shows a big rise in people in Russia accessing Tor using Snowflake.

Since the start of Russia’s war with Ukraine in February, Russian officials have introduced a slurry of new laws to control the internet and have clamped down on civil society groups. Natalia Krapiva, tech legal counsel at NGO Access Now, says Russia blocking Tor is part of larger efforts to control people’s access to information, such as the Kremlin’s VPN clampdown. “Russia is trying to eliminate any possible sources of truthful alternative information about the war and about what is going on in Russia internally,” Krapiva says. This feeds into a “chilling effect,” where people change their behavior or self-censor. “Certain measures, even if they don’t directly block or censor, create this fear of retaliation and fear of consequences coming later on.”

There have been two major incidents against Tor’s Snowflake, Gus says. The first, in December, was fixed within 10 days. The second, in May of this year, was also patched shortly after it was discovered. “They were blocking Snowflake in different ways,” Gus says. These attacks against Snowflake often involve fingerprinting, which uses small details about browsers and internet connections to try and uniquely identify the technology that someone is using. For instance, the number of times a browser connects with an external source may make it stand out from other browsers. If Snowflake can be identified, it is easier to block.

Gus claims that some of the censorship efforts are being conducted by hand. “I have some evidence that they are doing that manually,” he says. Gus claims it is likely that some officials in Russia appear to be downloading Tor and then fetching bridges so they can then take steps to block access. “They try to simulate that they are a user so they can get the bridge address, and then they block it,” he says. Roskomnadzor, the Russian internet regulator, had not replied to a request for comment at the time of publication.

The latest version of the Tor browser, 11.5, which was released last week, introduces new features to automatically try to help people circumvent censorship based on their location. In addition to issuing updates to circumvent the way Tor is being blocked, the nonprofit technology organization has also been directly gathering information from people in Russia. Gus says it has introduced more support for Russian users, who can report back if they are being blocked. There are also more volunteer-run bridges that people in Russia can use to access Tor.

Gus also says that using Telegram to share details of Tor bridges has been effective in fighting blocks. “The bridges that they were blocking were not the same bridges that we were sharing with users,” Gus says, adding that Tor has plans to share bridges via Signal and WhatsApp in the future.

Tor is also working to stop the potential abuse of bridges. In 2016, researchers proposed a system called Salmon that aims to weed out those accessing bridge details with the intent of blocking or abusing them. Gus says the Tor team is working to turn this proposal into reality, and it would essentially assign “reliability” scores around the use of bridges. If someone requests a bridge and it ends up getting blocked, they may be considered less trustworthy. “If I give you another bridge and it gets blocked again, then you will get another bad score,” Gus says.

Russia’s efforts to block Tor aren’t just confined to within its own borders, though. In some areas of occupied Ukraine, such as the city of Kherson, Ukrainian internet connections are being rerouted through Russian networks, and that brings censorship and surveillance with it. Gus says that as this shift has started to happen—signaling a potential long-term occupation and “Russification” of the areas—people using Tor in Ukraine have reported it not working and websites not loading. “They are being affected by the same censorship that people in other places in Russia were reporting to us,” Gus says.

If people are able to access Tor—both in Russia and occupied Ukraine—they will be able to access news and information that isn’t controlled by the Russian government. Sarkis Darbinyan, head of legal practice of Russian digital rights group Roskomsvoboda, says more than 5,500 websites have been blocked in Russia since its full-scale invasion of Ukraine in February. “For getting access to truthful information for Russian users, it is now critical to have tools like VPN and Tor, which let people quickly and effectively restore their violated rights,” Darbinyan says.

Roskomsvoboda has been representing Tor in its legal cases against Russian authorities pro bono. So far it has successfully overturned Roskomnadzor’s December decision to block Tor—in part because of procedural issues. Although other related legal proceedings are ongoing, Darbinyan says Roskomsvoboda is seeking a “complete cancel” of the decision that Tor should be blocked.

Krapiva describes the court case against Tor as a “rare victory” for digital and human rights in Russia. However, she cautions that it is likely to be a “temporary” win, and that Russian authorities may try to legally block Tor again. But this doesn’t mean it will be able to stop people from using Tor. “We’re still seeing that the technologies they have can be quite effective for blocking some things, but are not 100 percent effective,” Krapiva says. “In practice, whether Tor will be fully blocked—I doubt it, to be honest. But legally, I think they will try again, and might eventually succeed.”