>From mirimir: > On 09/04/2013 02:09 AM, Collin Anderson wrote: > >> On Tue, Sep 3, 2013 at 9:39 PM, mirimir <[email protected]> wrote: >> >>> I wonder what it might mean. >>> >> >> I don't believe much, Syria's increase was relatively marginal and >> potentially related to normal trends of weekly or holiday use. For the most >> party, suspect countries have increased orders of magnitude in users -- >> Syria is only a few percent and it's decreased since. > > Huh? Syria went from ca. 1e+3 in late June 2013 to over 4e+3, initially > a spike in early July, and then plateauing in early August. > > That's hardly a few percent. It's a factor of four. And that's plainly > obvious from the Tor metrics site: ...
I agree there is an anomoly in Syrian usage, but it appears independent of the overall anomoly. Since it occurred first, it's conceivable that Syria was a testing ground for a botnet or that events in Syria indepently created either an increase in local Tor demand or accessibility. Reviewing known Syrian political and war events occurring, as well as the Muslim and Syrian holiday and festival calendars, as well as reviewing Tor usage data worldwide, and a sampling of major news stories related to privacy and encryption, I came up with something of a timeline, although I draw no conclusions from it. Timeline through August 31 ========================== * February, a dramatic, roughly ten-fold decrease in Syrian directly connnecting Tor users. * July 9-14, spike in Syria directly connecting users from est. ~ 1,000 users, peaking at just over 4,000 users on July 12, and returning to ~ 1,000 users by July 15. Approximately four-fold increase at peak on July 12. Syrian Usage in the near term both before and after fluctuates up to ~50% and 1,000 is a bit below average; it leveled off around 1,200 within a few days of this event, holding steady until August 6. * August 6, rebels in Syria had a strategic victory by capturing Menagh Military Airport after a one-year siege. * August 6-7, Tor usage increased four-fold in Syria, and has ranged between ~3,500 and 4,500 directly connecting users since (~4,000 on August 31). * August 8, Ramadan one-month fasting ended. * August 8, Lavabit and Silent Circle shut down. So the above events correlate with Syria's four-fold increase in usage, though usage had been extraordinarily low since a dramatic ten-fold decrease in February (with a brief July spike that peaked at four-fold prior usage on July 12), so there might be another reason. * August 10, PirateBrowser released. * August 13, Report that PirateBrowser had reached more than 100,000 direct downloads, had 5,000 seeds on its major torrent, and was continuing to average "well over 1,000 downloads per hour". http://torrentfreak.com/pirate-bays-anti-clocks-100000-downloads-in-three-da ys-130813/ * August 15, Washington Post published NSA audit showing privacy abuses, particularly in re. US citizens. (I have not reviewed dates of all NSA or online security revelations from The Guardian, Washington Post, New York Times, and other sources that have been constant since the June revelations, with at least one major story per week.) http://articles.washingtonpost.com/2013-08-15/world/41431831_1_washington-po st-national-security-agency-documents - August 18: Worldwide directly connecting Tor users: ~ 500,000 plateau dating back to September, 2012. *** August 19-21, Worldwide Tor usage began accelerating. * August 21, apparent major chemical/gas attack in Syria (though no obvious effect on Syrian usage). * August 22-23, acceleration picked up pace a bit. * August 24-25, increases worldwide were steady rather than accelerating. * August 26-31, slight exponential acceleration resuming and continuing on the whole. * August 29, the Washington Post published NSA black budget documents and article, with a major revelation on the human and financial capital invested in undermining online encryption. http://www.washingtonpost.com/world/national-security/black-budget-summary-d etails-us-spy-networks-successes-failures-and-objectives/2013/08/29/7e57bb78 -10ab-11e3-8cdd-bcdc09410972_story.html - August 31: ~ 2.35 million (eyeball from graph) directly connecting Tor users, a factor of about 4.7 in 12 days. There has been increased pressure on journalists recently as well, with the large number of arbitrary arrests in Egypt, including shootings by the military, the captures and deaths of journalists in Syria, the controversy over releases of national security information in the wake of the NSA revelations, the UK destruction of data at The Guardian HQ, the UK detention of The Guardian's Glenn Greenwald's partner and confiscation of his data, and the perception that the UK moves were with the cooperation/at the request of the U.S. There are international moves to mount an attack on Syria since the apparent gas/chemical attack on August 21 that might increase demand for online private communications. ## I only looked at the standard directly connecting Tor usage in my commentary, not bridge users, and not the experimental data looking at mirrors and DAs intended to include bridge users. The experimental data, on quick glance, looks to shows a similar pattern with roughly 50% more users than I've reported; ~ 750,000 on August 18, and ~ 3.5 million on August 31. ## Asa -- tor-talk mailing list - [email protected] To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
