Across all years of the KIO dataset (2016–2021), a large majority of events involved full-network shutdowns and their count grew significantly from 2016 to 2019 with no significant decline observed through 2021. Censors are also increasingly employing app-specific bans and throttling alongside full shutdowns, with all three restriction categories non-mutually exclusive and rising over the period.

Using merged IODA and KIO data across 155 countries (Jan 2018–Aug 2021), elections increase the daily probability of an Internet shutdown by a factor of 16, coups by a factor of roughly 300, and protests by a factor of 9. These political mobilization events do not increase the probability of spontaneous outages, providing a discriminating signal between intentional and unintentional disruptions.

§5.2, Table 4 policy

The merged KIO-IODA dataset (Jan 2018–Aug 2021) documents 219 national-scale Internet shutdowns across 35 countries and 714 spontaneous outages across 150 countries; the 35 shutdown-affected countries collectively represent more than 1 billion estimated Internet users. Myanmar (53 IODA events), Syria (52), and Iraq (38) are the most frequently affected countries in the shutdown dataset.

§4, Table 2 evaluation

Countries where state-owned providers originate more than 50% of domestic address space show significantly higher shutdown prevalence; this state-ownership factor predicts shutdowns but shows no discernible difference for spontaneous outages. Countries with shutdowns have a median V-Dem liberal democracy score of 0.151 (maximum 0.481), compared to 0.279 for countries with spontaneous outages and 0.465 for countries with neither.

§5.1.1, Figures 8–9 policy

Over 55% of government-ordered shutdowns last a multiple of 30 minutes (vs. 15% of spontaneous outages), and 45% last precisely 4.5, 5.5, 8, or 10 hours (vs. <1% of spontaneous outages). The median recurrence interval between successive shutdown events within the same country is 1 day versus 39 days for spontaneous outages, with 67.7% of shutdowns falling exactly on 1-, 2-, 3-, or 4-day intervals versus 0.17% of outages.

§5.3, Figures 10–11 evaluation

Throughput drops correlated directly with political mobilizations: the 2012-02-14 anniversary of political detentions registered a -102.9% weekly-minimum change relative to the two-month mean, and the October 2012 currency protests showed a -86.2% weekly minimum. Round-trip time did not increase proportionally during these drops, distinguishing them from ordinary congestion.

2013-anderson-dimming §5.1, Fig. 6 throttlingmeasurement-platform

Using M-Lab NDT measurements from Iran, the paper identifies two extended throttling periods: November 30, 2011 – August 15, 2012 (77% decrease in median download throughput) and October 4 – November 22, 2012 (69% decrease), plus 8–9 shorter-term disruptions. Weekly variance analysis yields even steeper figures of -98% and -82% for the two major events.

2013-anderson-dimming §5, §5.1 throttlingmeasurement-platform

Graduated censorship — limiting the suppression rate to remain within the typical weekly variance band — evades the weekly-interval detector entirely. The paper acknowledges that detecting slow-ramp blocking requires extending the observation window beyond seven days.

2011-danezis-anomaly-based §6 throttlingmeasurement-platform

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Article 19 documents that Iran combines technical filtering with formal coercion of major foreign platforms (including Telegram, Instagram, and WhatsApp) to comply with content removal orders under threat of full blocking. The report notes that Iran's 2022 Women Life Freedom protests accelerated platform blocking when foreign operators refused compliance, demonstrating that the censorship system operates in two modes: coerce-and-allow for compliant platforms, block for non-compliant ones. Domain fronting via these platforms is therefore subject to sudden revocation if political conditions change.

2026-article19-tightening-the-net §6 ip-blockingdns-poisoningthrottling