Reading internet shutdowns through tor metrics: spikes, bridge surges and what country graphs show
Internet shutdowns are usually described in headlines. The quieter record sits in public measurement data: tor's country-level user graphs, OONI's censorship probes and the Access Now #KeepItOn shutdown tracker. Read together, they show a consistent sequence — a disruption is documented on one platform, and tor usage from the affected country moves within days. The graphs do not record protests themselves, but what people do when access starts to fail.
Iran, September 2022: a hundredfold bridge surge
Iran's user statistics page is annotated with the events behind that autumn's curves, including "daily Internet shutdowns in Iran" during the 2022 protest wave and the 2018 blocking of Telegram. The daily estimates tell the story in numbers. Direct tor users sat at roughly 8,000 per day in early September 2022 — 8,781 on 1 September, 7,674 on 10 September. After the death of Jina (Mahsa) Amini on 16 September and the protests that followed, the count jumped to 44,568 on 21 September, 170,485 on 22 September and 200,326 on 23 September — roughly a twentyfold rise inside a week. It never fell back to baseline that year, holding between about 33,000 and 45,000 per day through late November. The bridge graph is starker. Estimated bridge users in Iran hovered between 1,500 and 1,900 through the first half of September 2022, according to the bridge-country series. Then the curve repeats: 3,779 on 19 September, 32,942 on 21 September, 161,124 on 23 September and a peak of 189,013 on 24 September — around a hundred times the baseline. By the end of October the estimate had settled to roughly 11,000–24,000 per day, and it climbed again through December, ending the year at 63,565 on 31 December 2022.Over the 13 day period, Iranians experienced ~100 hours without access to mobile networks.That line comes from a technical report on Iran's autumn 2022 shutdowns, coordinated by OONI and the Internet Society with contributions from IODA, M-Lab, Cloudflare, Kentik, Censored Planet and Article 19. It documents the mechanics: from 21 September to 3 October 2022, Iran's three major mobile networks were cut daily from about 4 p.m. to midnight; WhatsApp and Instagram were blocked from 21 September; and a near-total drop in QUIC traffic from 22 September suggested a blanket block on UDP port 443. It also noted that Psiphon and tor's Snowflake transport appeared to keep working, both showing user spikes from Iran that month.
Russia, December 2021: when the line falls
The inverse pattern shows up when blocking works. Russia's metrics page carries an annotation dated 1 December 2021: blocking of tor's directory authorities, relays, default obfs4 bridges, meek-azure and Snowflake on some Russian ISPs, with a brief halt on 8 December 2021. The underlying series shows a slow fall, not a spike. Relay users held in the low 300,000s through late November 2021, peaking at 342,458 on 23 November, then slid to 289,006 on 8 December, 278,426 by 12 December and 205,414 by 15 December — a drop of about a third in two weeks. The same page records two more patterns worth reading carefully. From 24 February 2022, the day of the invasion of Ukraine, it notes bridge users rising in Russia while relay and bridge users rose in Ukraine. An April 2019 entry describes relay users growing by roughly 100,000 in a weekly cycle — a reminder that not every odd curve is censorship, and the annotations exist so readers can tell the two apart.The shutdown record alongside the graphs
Civil-society trackers document the other half of the picture. Access Now's #KeepItOn coalition counted 296 internet shutdowns across 54 countries in 2024 — a record, up from 283 shutdowns in 39 countries in 2023. The year's worst offenders according to the coalition's report:- Myanmar: 85 shutdowns
- India: 84 shutdowns
- Pakistan: 21 shutdowns
- Russia: 19 shutdowns