Psiphon | Blog

In Indonesia, Digital Business is Booming. Make Sure Your Connectivity is too.

blog@psiphon.ca (Psiphon Inc.) — Fri, 04 Sep 2026 12:00:00 +0000

Indonesia is Southeast Asia’s largest digital economy, and growing fast. Google, Temasek and Bain estimate its digital economy reached approximately US$99 billion in GMV in 2025, up 14% over one year. E-commerce alone accounted for approximately US$71 billion, while online transport and food delivery reached US$10 billion.¹

That opportunity is distributed across an archipelago of thousands of inhabited islands, creating a business environment where payments, marketplaces, delivery platforms and logistics applications have to work across very different physical and digital environments. For companies building across Southeast Asia, that’s an important consideration. In Indonesia, digital scale isn’t just about how many customers you can reach. It’s about how reliably you can reach them wherever they happen to be.

The Network is Core to the Supply Chain: Indonesia’s geography already makes moving physical goods complicated. The World Bank has identified significant differences in transport and connectivity between major cities such as Jakarta, Surabaya, Medan and Denpasar and secondary, tertiary and rural areas, with both internet access and logistics costs affecting the development of e-commerce.² Its digital infrastructure is the backbone for Indonesia’s phenomenal growth.

When the Network Changes, Your Customers May Not Care Why. But They Will Definitely Care. From physical damage to deliberate network restrictions, maintaining Internet access in Indonesia can be challenging.³ ⁴ Regional connections can be attenuated, and traffic can be filtered or blocked. The quality of connectivity available to a customer in eastern Indonesia may not resemble the connectivity experienced by someone using the same application in Jakarta. For FinTech, e-commerce and logistics providers, these aren’t abstract infrastructure issues, these impact their core value proposition.

With Forge, Build: Psiphon Forge embeds adaptive network continuity directly into an application. Selected traffic can transparently use Psiphon’s multi-protocol network when conventional paths become filtered, throttled or otherwise degraded, while the underlying Forge library continues to evolve as network conditions change. Indonesia’s digital economy is already the largest and most dynamic in Southeast Asia. The focus, and opportunity, is in making sure applications designed to participate in that growth aren’t vulnerable to unpredictable disruptions.

The Bottom Line? You can’t control why a network changes. But you can build your application to adapt when it does.

References & Sources

1. Google, Temasek & Bain & Company. e-Conomy SEA 2025 — Indonesia.
2. World Bank. Beyond Unicorns: Harnessing Digital Technologies for Inclusion in Indonesia.
3. ANTARA News. Telkomsel says double shunt fault disrupts broadband services in Papua (2025).
4. Access Now & the #KeepItOn Coalition. 2024 Elections and Internet Shutdowns Watch.

Your Business Partners Absolutely Care Why You Don’t Work. How Psiphon Forge Builds Service Resilience, Trust and Partner Commitment.

blog@psiphon.ca (Psiphon Inc.) — Fri, 28 Aug 2026 12:00:00 +0000

While your customers may not care why your application stopped working, your business partners absolutely do. When a payment platform, logistics provider, marketplace, communications service, or SaaS application becomes unavailable, partners need to understand what happened, manage the consequences, and ultimately decide whether they can continue to depend on you.

Trust is Earned: PwC’s 2024 Trust Survey found that 93% of business executives believe building and maintaining trust improves the bottom line.¹ More recently, McKinsey’s 2026 survey of 3,000 B2B technology and telecommunications decision-makers found that loyalty is increasingly conditional: trusted delivery relationships strengthen customer “stickiness,” while failure to meet expectations creates opportunities for competing providers.² Service continuity is becoming increasingly critical in building that trust, especially for transnational organizations operating in contested and fragmented networks, and vulnerable to disruption.

Trust is Operational: Access Now documented 313 internet shutdowns across 52 countries in 2025, including significant disruptions within Africa, the Middle East, Asia and Eurasia.⁵ The World Bank recently highlighted Mozambique’s 2018 national payment-system failure as an example: hospitals, schools, hotels and small businesses were suddenly unable to process electronic payments, leaving patients unable to pay medical fees, motorists unable to purchase fuel and travellers unable to settle bills.³ Pakistan offers a different example. Freedom House documented degraded connectivity and disruptions affecting WhatsApp and Signal during 2024–25, and recurring restrictions during periods of political unrest.⁴ For a business partner, these aren’t abstract network events. They’re failed transactions, incomplete workflows, missed service commitments and support calls, and eventually a question: For business partners, this results in one key question: “Can we rely on this enterprise when conditions get difficult?”

Trust Can be Embedded: This is where Psiphon Forge changes the resilience equation. Forge embeds adaptive network continuity directly into an organization’s application, allowing selected traffic to transparently use Psiphon’s multi-protocol network when conventional connectivity is disrupted or restricted. Integration is performed once, while the underlying connectivity capabilities continue to evolve as network conditions and blocking techniques change. Forge provides an embedded, adaptive connectivity layer specifically designed for fragmented, censored and degraded networks.

Ultimately, customers rely on your services working; business partners demand it. In markets where disruption is increasingly part of the operating environment, being the partner that planned for continuity rather than explaining its absence afterward is a key cornerstone to keeping and building the trust relationship.

References & Sources

1. PwC. 2024 Trust Survey (2024). Finds that 93% of surveyed business executives agree that the ability to build and maintain trust improves the bottom line.

2. McKinsey & Company. Winning B2B Customers in Technology and Telecommunications (2026). Survey of 3,000 enterprise decision-makers across 18 countries examining B2B loyalty, switching behaviour, trusted delivery relationships and customer retention.

3. McKinsey & Company. Taking a Business-Critical Approach to Supplier Nth-Party IT Risk Management (2025). Recommends evaluating the operational, financial and reputational consequences of critical suppliers going offline, including revenue at risk and customer trust.

4. Gartner. Supplier Relationship Management: Three Keys to Partnering with Strategic Suppliers Amid Supply Chain Disruption (current). Examines supplier trust, collaboration and performance during disruptive operating conditions.

5. Access Now & the #KeepItOn Coalition. Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (2026). Documents 313 internet shutdowns across 52 countries and their effects across Africa, the Middle East, Asia and Eurasia.

6. PwC Canada. Third Party and Supply Chain Risk Management (current). Examines how mitigating service-interruption and third-party risks can strengthen relationships, maintain stakeholder trust and enable greater organizational confidence and agility.

Your Users Don’t Care Why Your App Isn’t Working

blog@psiphon.ca (Psiphon Inc.) — Thu, 20 Aug 2026 12:00:00 +0000

Why Continuity of Service Is at the Core of Your Customer Experience in Emerging Markets, and Your Most Significant Competitive Advantage

Product teams invest enormous effort refining the customer experience. They optimize onboarding, simplify workflows, improve response times, and continuously add new capabilities. Yet all of that work becomes secondary the moment an application stops responding.

Your users don’t care whether the interruption was caused by a cloud outage, ISP congestion, routing instability, Internet restrictions, or a government-ordered shutdown. They experience exactly one thing: Your app isn’t working.

This is becoming an increasingly important reality for organizations expanding across emerging markets. Digital adoption is accelerating across Africa, the Middle East, South and Southeast Asia, and parts of Eurasia—but so are network disruptions. In 2025, Access Now’s #KeepItOn coalition documented a record 313 Internet shutdowns across 52 countries, affecting every major emerging market region.¹ Freedom House reported that global Internet freedom declined for the 15th consecutive year, with governments increasingly restricting connectivity during protests, elections, and periods of political instability.² Comparitech’s Global Internet Censorship Map likewise illustrates that many of today’s fastest-growing digital economies are also among those experiencing the highest levels of Internet restriction and network fragmentation.³

The consequences are tangible. In Africa, Internet shutdowns have repeatedly disrupted mobile payments, banking, logistics, education, and healthcare, prompting the African Commission on Human and Peoples’ Rights to call for stronger protections against arbitrary shutdowns.⁴ In South Asia, shutdowns continue to interrupt commerce and digital services affecting millions of users, while countries across Southeast Asia and the Middle East have increasingly introduced temporary restrictions during periods of civil unrest or heightened political tension.^1,5 Whether the cause is technical or policy-driven, customers don’t distinguish between a network failure and an application failure—they remember whether your service was available.

This is exactly the challenge Psiphon Forge was designed to address.

Rather than assuming every customer connects over stable, predictable networks, Forge enables organizations to embed adaptively resilient network continuity directly into their own applications. Once integrated, your app traffic is transparently routed through Psiphon’s continuously evolving global network, while updated library releases continually deliver new protocols, routing techniques, and adaptive connectivity improvements as network conditions evolve.

For organizations expanding into emerging markets, continuity of service is part of the product itself. Organizations that consistently deliver service despite changing network conditions don’t simply reduce operational risk, they earn customer confidence, strengthen their reputation, and position themselves to capture a greater share of rapidly growing digital markets.

Ultimately, when expanding into emerging markets with an increasingly fragmented Internet, continuity of service isn’t just good engineering, it’s a core, and powerful, competitive advantage.

References & Sources

Access Now & the #KeepItOn Coalition. Rising Repression Meets Global Resistance: Internet Shutdowns in 2025 (2026). Documents a record 313 Internet shutdowns across 52 countries, including widespread disruptions across Africa, the Middle East, Asia-Pacific, and Eastern Europe/Central Asia.
Freedom House. Freedom on the Net 2025: An Uncertain Future for the Global Internet. Reports the 15th consecutive annual decline in global Internet freedom and documents increasing restrictions during protests, elections, and political crises across multiple regions.
Comparitech. Global Internet Censorship Map. Interactive global assessment of Internet censorship, shutdowns, and online restrictions, highlighting the prevalence of fragmented Internet environments across emerging markets.
The Guardian. Internet Shutdowns at Record High in Africa as Access “Weaponised” (2025). Reports record levels of Internet shutdowns across Africa and examines their impact on citizens, businesses, and digital economies.
Associated Press. Myanmar’s Military Rulers Enact Cybersecurity Law with Wide-Ranging Censorship Provisions (2025). Examines expanding Internet restrictions in Southeast Asia and their implications for digital services, VPNs, and online platforms.

From “Ouch” to “Phew”: How Network Continuity Not Only Pays for Itself, but Creates Opportunity

blog@psiphon.ca (Psiphon Inc.) — Thu, 13 Aug 2026 12:00:00 +0000

There are few phrases in business less satisfying than “I told you so.” Unfortunately, they’re often accompanied by a frantic scramble to recover, and uncomfortable conversations about customers who couldn’t complete a transaction, and, in many cases, simply moved on. Network continuity is one of those subjects where everyone agrees prevention is the better strategy, but usually only after discovering they could have invested in it six months earlier.

Let’s face it. Every organization has finite budgets and competing priorities. The key question is whether the evidence supports investing in preventative network resilience strategies before something goes wrong. And yes, unsurprisingly, it increasingly does.

Let’s take a quick look at the evidence. Splunk estimates that unplanned downtime costs Global 2000 organizations approximately US$600 billion annually, with companies averaging US$95 million in annual revenue losses from downtime-related incidents. Just as importantly, 81% of organizations reported losing customers following significant outages.¹

IDC found that outages also have lasting effects on customer satisfaction, and significant operational benefits², employee productivity, contractual performance, and organizational reputation³. Independent research from the Uptime Institute likewise found that more than half of organizations experienced outages costing over US$100,000, while roughly one in five suffered incidents exceeding US$1 million.⁴

IBM Security reaches a similar conclusion from a different perspective: organizations that invest in preparedness, automation, and response capabilities consistently reduce both the cost and duration of disruptive incidents.⁵

These are exactly the negative outcomes that Psiphon Forge was designed to prevent. Rather than waiting for operations teams to respond to blocked connections, degraded routes, or regional network disruptions, Forge embeds adaptively resilient connectivity directly into your application.

Integration is completed once using Psiphon’s lightweight library and local proxy architecture. From that point onward, selected application traffic is transparently routed through Psiphon’s continuously evolving global network, while updated library releases continuously deliver new protocols, routing techniques, and circumvention improvements as network conditions evolve. Your application remains stable while the resilience platform continues to improve.

We get it. Nobody enjoys paying for something that prevents a problem they hope they’ll never have, and making the pitch to “solve” rather than “resolve” isn’t easy. But the conclusion can’t be avoided: resilience isn’t simply insurance against downtime, it’s an investment that reduces operational risk, strengthens customer confidence, and creates the freedom to grow.

For organizations seeking to, or already operating across Africa, the Middle East, Southeast Asia, Eurasia, and other quickly growing and dynamic markets, investing in network continuity before disruption occurs isn’t simply protecting your infrastructure, it’s creating the confidence to innovate, expand, and compete, wherever and whenever opportunity arises.

References & Sources:

1. Splunk. The Hidden Costs of Downtime (2026). Examines the financial impact of unplanned downtime, including revenue loss, customer attrition, the cost of major outages, and the operational benefits of observability.
https://www.splunk.com/en_us/blog/cio-office/ai-downtime-risks-resilience.html

2. IDC (commissioned by IBM). Cost of Downtime and the Importance of Support (2023). Research into the effects of application and infrastructure downtime on customer experience, productivity, contractual performance, and organizational reputation.

3. IDC. Business Value of Aligning Cost Optimization, Observability, and Automation (2024). Analysis of the operational and financial benefits of proactive observability, automation, and resilience investments.

4. Uptime Institute. Annual Outage Analysis 2025 (2025). Independent research into the frequency, causes, costs, and business impacts of major digital infrastructure outages.
https://uptimeinstitute.com/resources/research-and-reports/annual-outage-analysis-2025

5. IBM Security. Cost of a Data Breach Report 2025 (2025). Global research demonstrating how preparedness, automation, and resilience investments reduce the financial and operational impact of disruptive incidents.

Those Who Evolve, Thrive. Those Who Can’t, Die. Meet Forge.

blog@psiphon.ca (Psiphon Inc.) — Fri, 07 Aug 2026 12:00:00 +0000

Evolving Economies: Africa, Southeast Asia, and the Middle East remain among the world’s most dynamic business environments. Sub-Saharan Africa is expected to grow by approximately 4.3% in 2026, while many Southeast Asian economies continue to outperform global averages as Asia remains the primary engine of global growth. Despite recent geopolitical challenges, long-term growth across these regions continues to be driven by digital transformation, mobile services, logistics, fintech, manufacturing, and cross-border commerce.

Evolving Challenges: But these same high-growth regions are also experiencing an increasing frequency of internet disruptions, censorship, network throttling, and infrastructure instability. For organizations whose applications support customers, employees, vehicles, financial transactions, or operational systems, every interruption represents lost revenue, reduced productivity, and diminished customer confidence. As networks evolve—and increasingly become fragmented—network continuity itself must evolve alongside them.

Evolving Solution: Traditional networking solutions are often deployed as static software.Once installed, they rely on protocols and techniques that gradually become less effective as networks change and blocking methods evolve.

Psiphon Forge takes a fundamentally different approach. One integration provides a continuously underlying connectivity platform. As Psiphon develops new protocols, routing techniques, and anti-blocking capabilities, those improvements are delivered through updated Forge libraries while your application’s integration remains stable. Rather than continually redesigning your networking layer, your development team benefits from nearly two decades of continuous investment in adaptive network resilience.

Evolving Simplicity: Embedding Forge into an existing application requires only a few straightforward steps:

Download the appropriate Android, iOS, or desktop Forge library.
Obtain your application-specific Psiphon configuration file.
Initialize the Forge library when your application starts.
Configure the application to send only traffic you want through the Psiphon tunnel.
Verify the integration using the recommended testing tools before deployment.

From that point onward, Forge transparently tunnels only the application traffic you choose while automatically managing protocol selection, reconnection, and adaptive routing as network conditions change. Users continue using your application exactly as before, only now it remains connected under conditions where conventional networking solutions may fail.

Evolve or Die: For organizations expanding across Africa, Southeast Asia, the Middle East, and other rapidly evolving markets, resilient connectivity is becoming a key business enabler and differentiator. Every hour spent responding to changing censorship techniques or degraded network conditions is an hour spent losing your business, and your customers. Forge makes sure your services remain optimally competitive within a truly dynamically expanding world of opportunities.

Why Psiphon Forge Works When Other Network Continuity Solutions Don't

blog@psiphon.ca (Psiphon Inc.) — Thu, 30 Jul 2026 12:00:00 +0000

Harnessing the Forge Multi-protocol Stack in Your Own Organizational and Service Applications. In our previous post, we showed that embedding Psiphon Forge into an application is surprisingly straightforward. With only a few API calls, developers can add resilient connectivity without redesigning their infrastructure.

Why Forge Works, When Others Don't: Integration is only half the story, however. The more important question is why Forge continues to work in environments where conventional VPNs, proxies, CDNs, and other continuity solutions increasingly struggle, or just don't work at all. The answer lies in the architecture beneath the API. Rather than relying on a single protocol, transport mechanism, or network path, Forge gives your application access to the same adaptive, multi-protocol connectivity stack that Psiphon has continuously evolved over nearly two decades of operating against real-world censorship and network interference. As network conditions change, protocols are fingerprinted and become ineffective. Forge can dynamically adapt to meet this challenge, without requiring changes to your application or, more importantly, intervention by your users.

The Myth of the Constant Network: Most network continuity products are designed around one transport technology. They assume the network remains fundamentally cooperative and that outages are exceptional. Increasingly, neither assumption holds true. Often unpredictable and devastating to users, network blocking events are on the rise all over the world.

What makes this so challenging is modern network blocking. Filtering systems combine deep packet inspection, protocol fingerprinting, DNS interference, IP blocking, traffic shaping, TLS analysis, and increasingly sophisticated behavioural analysis, to identify and disrupt targeted services. A single protocol, even a highly secure one, can eventually become just another identifiable signature to disrupt.

Multiple Challenges Demand Adaptive Solutions: Forge approaches the problem differently. Multiple encrypted and obfuscated protocols operate as an adaptive stack rather than isolated alternatives, allowing connections to shift seamlessly as network conditions evolve while presenting a moving target to blocking systems. Because Forge is embedded directly into your own application, this intelligence becomes part of your service rather than an external tool your users must discover, install, configure, and hope continues to work. The result is not simply another way around censorship, it is a resilient communications layer designed for organizations operating across fragmented, unpredictable, and increasingly contested networks.

Always Ready, Around the Globe: Whether you're delivering financial services across Africa, coordinating logistics throughout Southeast Asia, supporting enterprise users in the Middle East, or maintaining customer applications in Eurasia, resilient connectivity is becoming an application requirement rather than a networking feature. Forge lets your organization harness the continual evolution of Psiphon's global anti-censorship infrastructure while remaining focused on your own products, customers, and mission.

Embedded Continuity: As blocking techniques evolve, so does the underlying Forge platform—meaning your application benefits from continuous improvements without constant engineering effort on your part. That's the advantage of embedding a living, adaptive multi-protocol stack rather than depending on a single technology whose effectiveness inevitably declines over time. In a world where network fragmentation is becoming a permanent operating condition, resilience belongs inside the application itself.

Network Continuity, Embedded: Forge in Three Steps

blog@psiphon.ca (Psiphon Inc.) — Thu, 23 Jul 2026 12:00:00 +0000

For organizations operating across borders, unpredictable connectivity is no longer an edge case. It’s an emerging, core infrastructure challenge that will have wide reaching implications for any organization operating transnationally.

The good news? It’s a problem we’ve already solved, and we’ve made it easy to bring that solution directly to your systems, applications and people.

Why it matters for any organization: We’ve been writing about the need to treat network continuity as a core infrastructure imperative for some time. Just take a look at our previous posts at http://forge.psiphon.ca/en/blog. We’ve covered a lot of territory, a lot of use cases, and a lot of reasons for taking it extremely seriously.

The case for action is now almost impossible to ignore. Recent censorship and network disruptions have ranged from nationwide blackouts and platform blocking to throttling, mobile-data restrictions and conflict-related temporary shutdowns.

For a transnational organization, that volatility can break the everyday connections that employees, systems, applications and services customers depend on. If a service works only when the network behaves normally, it’s not truly available in the regions and markets it is meant to serve.

Forge changes the continuity model by easily integrating network continuity directly into the services you want to deliver.

Ensuring Network Continuity in Just Three Steps

1. Select and provision. Forge supports mobile and desktop integration. Choose the Forge library or binary for your target environment and ask Psiphon to generate a configuration file for your application and operating context. This connects your implementation to the right protocols, network resources and fallback options without forcing your team to become specialists in censorship infrastructure.

2. Embed, start and route. Add Forge to the application, link in the configuration, and start the tunnel through the platform interface. Then direct the application traffic that you want to ensure network continuity for - e.g. API clients, embedded browsers, messaging, media or other service traffic - through the local Forge proxy or supported routing interface. Connection callbacks let the product respond intelligently as the tunnel connects, reconnects or encounters a degraded path.

3. Test, observe and maintain. Validate the full traffic path and test blocked destinations, DNS and IP handling, switching between Wi-Fi and mobile networks. Once Forge connectivity is established, you can continue monitor and tune your configuration as real-world network conditions evolve.

The Bottom Line

Forge handles the network layer without impinging on the services you provide. As an open source application, Forge is designed to adapt across fragmented, censored and hostile networks using Psiphon’s proven circumvention technology, helping applications, services and personnel remain reachable when conventional paths are blocked, throttled or unreliable.

Ready to build continuity into your product?

Reach out to Psiphon about creating seamless network continuity for your customers, your services, and your organization.

Resources:
Forge Site: https://forge.psiphon.ca
Psiphon’s Open Source GitHub repository: https://github.com/Psiphon-Inc
Forge Integration Support: https://forge.psiphon.ca/en/contact

Conflict & Connection. Love & War. Psiphon Forge.

blog@psiphon.ca (Psiphon Inc.) — Thu, 16 Jul 2026 12:00:00 +0000

Conflict has always been about more than territory. Throughout history, military leaders have sought to control information because it shapes the battlefield. Roads, bridges, ports, telegraph lines, radio stations, and television towers have all been strategic targets, not because they were objectives in themselves, but because controlling communications disrupted an adversary's ability to coordinate, govern, sustain economic activity, and maintain public confidence.

Today, that strategy has expanded into the digital domain. Alongside conventional military operations, governments increasingly employ internet shutdowns, network throttling, censorship, DNS manipulation, and platform blocking to degrade communications, limit the flow of information, and complicate both civilian and organizational decision making. Information control has become an increasingly important component of modern military strategy, one capable of influencing events well beyond the battlefield.

For businesses and organizations operating in affected regions, communications resilience, in the face of global volatility, has become an essential part of operational resilience.

Psiphon Forge was built for this reality. By embedding directly into existing applications and services, Forge enables organizations to maintain secure, resilient connectivity across fragmented and censored networks without requiring users to change how they work. Built on Psiphon's globally proven anti censorship infrastructure and years of experience operating in some of the world's most challenging network environments, Forge helps ensure that applications, data, and communications continue to flow when conventional network paths are disrupted.

Whether supporting supply chains, secure messaging, humanitarian operations, media organizations, or enterprise applications, Forge helps organizations maintain continuity when communications themselves become contested. Military strategies will continue to evolve, but one principle remains constant: organizations that can maintain trusted connections during periods of disruption are better positioned to serve their customers, support their people, and continue their mission.

Indistinguishability Isn't a Feature, It's a Requirement

blog@psiphon.ca (Psiphon Inc.) — Thu, 25 Jun 2026 12:00:00 +0000

If your employees, applications, communications, or data can be easily identified on a network, they can be blocked, throttled, monitored, or targeted. That's the reality of operating in many parts of the world today, where governments, network operators, and other actors increasingly deploy sophisticated systems designed to identify and disrupt specific applications, protocols, and services. Traditional VPNs often fail in these environments because they are not designed to hide their connectivity. Once identified, they become easy targets.

Psiphon was built differently. From the beginning, its objective has been indistinguishability, or "hiding in plain sight". Rather than relying on a single protocol, server, or network path, Psiphon dynamically selects from a range of obfuscated transport technologies, continuously adapts routing strategies, and intelligently allocates network resources to avoid detection and disruption. The goal is simple: make it difficult to distinguish Psiphon traffic from ordinary internet activity. This philosophy extends beyond the protocol itself to the user, the application, and the network path. It is an approach that has been tested and refined under some of the harshest censorship conditions on the planet, where Psiphon is frequently among the last connectivity and resilience platforms still functioning when networks are being blocked, degraded, or heavily filtered.

Psiphon Forge brings this capability directly into your products and services through a lightweight, embeddable API. Whether integrated into an enterprise application, messaging platform, collaboration tool, customer portal, or digital service, Forge enables organizations to protect critical communications and data flows without requiring users to install or manage a separate VPN. The result is connectivity continuity and operational resilience for your most important information wherever it operates, resides, or transmits—regardless of network conditions. For organizations working in contested regions, the objective is not merely connectivity. It is ensuring that your staff, applications, and data remain accessible without becoming identifiable. In environments where visibility can create vulnerability, indistinguishability is not a feature. It is a requirement.

To Russians with Love

blog@psiphon.ca (Psiphon Inc.) — Tue, 16 Jun 2026 12:00:00 +0000

Effective Anti-Censorship is a Partnership Between Technology and People

Internet freedom doesn’t happen through technology alone. It doesn’t happen through goodwill alone. What actually works is the combination of both: continuous technical innovation, and the engagement and participation of the ordinary people for whom it matters most — the people in the censored country, and those in the diaspora. Psiphon learned that lesson during one of the most severe internet shutdowns the world has ever witnessed: the one we just went through in Iran, in early 2026.

The Power of the Diaspora

On January 30, 2026, at the peak of Iran’s worst-ever internet restrictions, Psiphon recorded more than 9.5 million unique daily users inside the country — more than one in ten Iranians, on a single platform, in a single day. As the shutdown grew in scope and impact, half of the traffic supported by Psiphon was flowing through Conduit stations hosted by members of the Iranian diaspora. They responded en masse, and it’s because of that enthusiastic and committed participation that Psiphon was able to keep supporting Iranians during the crisis.

In the two weeks following Iran’s most severe disruptions, approximately 200,000 diaspora members signed up to run Conduit stations — not for their own access, but to help people inside reconnect. Using spare phones and home Wi-Fi connections, they built a distributed network that carried nearly half of all Psiphon bandwidth reaching Iran. Iranians who had been offline for two weeks started to reach their family and loved ones again through social media and messaging services.

In other words, the diaspora wasn’t just supporting the infrastructure — the diaspora was the infrastructure. The Russian diaspora can build the same resilient network.

From Ordinary to Extraordinary

Censorship works when there’s a centralized target to hit. But because Conduit is a participatory network, it’s a moving target. Every station — whether it’s running on an ordinary device, on a residential connection, or on a commercial network — becomes part of a distributed, growing network with no single point of failure. A government trying to suppress tens of thousands of individually operated stations, spread across dozens of countries, faces a far more challenging problem than blocking a server or a network. And the more people participate, the tougher that problem becomes to solve. That’s what makes Conduit so effective: it harnesses the power of ordinary people to make an extraordinary difference.

Show Your Extraordinary Love Through Conduit

You can download Conduit for free and host your own Conduit Station.

Or you can subscribe to Hosted Conduit. Through Hosted Conduit’s personal pairing feature, you can directly support up to 99 friends and family members inside Russia, giving the people you care about a trusted, reliable connection to the open internet. At the same time, your Hosted Conduit station contributes to the global anti-censorship capacity.

The cost is just cents a day. And every person who joins makes the network stronger for everyone who depends on it.

You may not be able to change Russian policy from the outside. But you can be part of a movement that makes censorship harder to enforce, one station at a time. Conduit worked in Iran, and you can help make it work in Russia.

Join the movement at conduit.psiphon.ca.

In a Volatile World, Your Business Doesn’t have to be a Casualty

blog@psiphon.ca (Psiphon Inc.) — Thu, 21 May 2026 12:00:00 +0000

For organizations operating across borders, geopolitical instability is no longer an exceptional event; it’s becoming part of the operating environment. Data from ACLED, UNHCR, and the International Institute for Strategic Studies all point in the same direction: conflict exposure, displacement, political violence, and civilian impact are increasing globally. ACLED reports that nearly one in six people worldwide are now exposed to conflict conditions, while incidents of violence against civilians have reached the highest levels observed in years. The consequences are visible across the Middle East, Eurasia, Africa, and increasingly Southeast Asia. From regional wars and insurgencies to state-imposed shutdowns, infrastructure disruption, and communications restrictions, volatility is affecting not only governments and populations—but also businesses, platforms, and transnational organizations that depend on stable connectivity.

Targeting Connectivity Is Now Part of the Conflict Lifecycle: Modern conflict rarely emerges all at once. It evolves through stages: political tension, protests, network throttling, censorship, localized shutdowns, infrastructure degradation, and potentially active conflict. Throughout that lifecycle, communications networks are often among the first systems affected. Organizations operating across adjacent countries or regions increasingly face environments in which cloud services become intermittently unavailable, messaging and collaboration platforms are throttled, routing instability impacts operations, local filtering disrupts applications and APIs, and network conditions change dynamically and unpredictably.

The Internet Is Fragmenting: Traditional infrastructure was built around assumptions of stability. But today’s fragmented internet environment demands something different: resilience designed directly into applications and services themselves. The global internet is steadily evolving away from a unified network toward a collection of increasingly controlled digital “islands,” shaped by national regulation, digital sovereignty, regional conflict, and local political priorities. This fragmentation affects every transnational organization—whether in logistics, SaaS, finance, media, communications, IoT, or critical infrastructure. Services that work seamlessly in one region may degrade or fail entirely in another, often with little warning. Organizations can no longer assume consistent global reach simply because they are cloud-based. The operational challenge is becoming clear: how do you maintain continuity across a dynamically shifting internet landscape?

Forge as an Additional Resilience Layer: Psiphon Forge was designed specifically for this emerging reality. Rather than replacing existing infrastructure, Forge acts as an additional resilience layer embedded directly into applications, services, and platforms. It enables adaptive, multi-protocol connectivity that continues functioning across unstable, degraded, censored, or contested networks. This matters not only during active conflict, but across the entire volatility lifecycle—before instability escalates, during periods of heightened tension, through network disruption and censorship, and during recovery and normalization. Organizations that maintain continuity through these phases gain a significant operational advantage. Communication remains available. Data continues to flow. Services remain reachable. Customers and partners retain trust precisely when reliability matters most.

Resilience Is Strategic: As conflict volatility rises globally, resilient connectivity is shifting from a technical enhancement to a strategic business capability. Organizations that prepare early will be better positioned to operate consistently across uncertain environments, while those relying solely on conventional infrastructure risk becoming casualties of fragmentation, disruption, and instability. In a world where conditions can shift from conflict-free to active conflict rapidly, resilience can no longer be treated as optional redundancy. It is becoming a core requirement for transnational operations.

As an Online Gaming Platform, It's Time to Win at Global Online Delivery

blog@psiphon.ca (Psiphon Inc.) — Fri, 08 May 2026 12:00:00 +0000

Online gaming is one of the most widely adopted digital experiences in the world today. Platforms like Roblox and Fortnite have built massive global communities, where players, creators, and developers interact in real time across the world.

Not Your Reliable Internet Anymore: But while the experience is designed to be global, the infrastructure it depends on is not. Let's face it, there is no universal standard for access; availability is controlled country by country, determined by regulation, content controls and shifting political priorities. For gaming platforms, this creates an ongoing challenge: users can be throttled, blocked, or disconnected entirely, with little to no warning.

But this isn't just a gaming issue. From broadcasting to logistics it's a reality for all transnational digital services. Performance, continuity, and real-time interaction are core to the experience, so even partial disruption has immediate consequences. As the internet continues to fragment into localized, often insulated network spaces, gaming platforms need to rethink how they deliver services. A steady state infrastructure can no longer be assumed; it needs to be designed into the platform itself, and capable of adapting dynamically to changing network conditions and censorship environments.

From Reactive to Proactive: This is where solutions like Psiphon Forge create a clear competitive advantage. By embedding adaptive, multi-protocol connectivity directly into their applications, Forge enables gaming platforms to maintain access, even in restrictive or unstable networks. The result is not just resilience, but multi-stakeholder continuity; players stay connected, creators remain engaged, and revenue streams are protected. In contrast, platforms that rely solely on traditional delivery models risk fragmentation of their user base, inconsistent performance, and loss of market presence, especially in regions where access is most volatile.

Adapt and Win: In an increasingly divided internet, the difference between platforms that can adapt and those that cannot will become increasingly critical. For game developers and platform operators, building with network resilience and continuity in mind is no longer optional, it's a core strategic imperative. Ultimately, those who integrate connectivity solutions like Psiphon Forge into their platforms immediately position themselves to reach more users, retain engagement, and operate reliably across a constantly shifting global landscape. In that context, maintaining access isn't just a technical requirement; it defines who wins.

The Real Psiphon: Continuous Innovation with Forge & Conduit

blog@psiphon.ca (Psiphon Inc.) — Tue, 28 Apr 2026 12:00:00 +0000

Most people know the Psiphon app. Few know the real Psiphon and our commitment to continuous innovations like Forge & Conduit. The Psiphon app and network is where most people encounter us, for good reason. With more than 500 million downloads, it is the most widely used anti-censorship platform in the world, enabling tens of millions of users every day to access the Internet within the most heavily restricted environments on the planet. For those users, it's the one app that they can rely on when nothing else works. What makes that possible is a global managed network operating behind the scenes: thousands of servers distributed across jurisdictions, built on a multi-protocol approach that continuously adapts to detection and blocking. When a government shuts down a platform or throttles a protocol, our systems respond in real time.

Enabling other apps to use Psiphon. Psiphon Forge takes that same infrastructure and makes it embeddable. Through a lightweight API, any application—from messaging platforms to logistics, from FinTech to broadcasting—can integrate Psiphon's anti-censorship capabilities directly into its own product. Network continuity becomes a feature of the application itself, not something users have to seek out separately. In environments where connectivity can disappear without warning, that distinction matters.

Conduit—the next layer. Conduit represents a different approach to the same problem, reflecting years of internal R&D and collaboration with our research and technology partners. Rather than relying solely on Psiphon-managed servers, Conduit enables individuals and organizations to contribute nodes to the network and be rewarded for doing so. The result is a participatory, incentivized and inherently distributed network that grows organically, and that becomes harder to block precisely because it has no single point of failure or control. At the peer-to-peer level, Conduit traffic looks different from what censors have learned to target. At the network level, it scales in ways that centrally managed infrastructure cannot.

The proof. The level of adoption reflects that, with over 1.7 million individual stations supporting users in over 200 regions. This isn't a replacement for what we've built. It's the next layer, the kind of step that only becomes possible when you've spent years understanding the problem deeply enough to rethink it. Censorship, at scale, is a distributed problem. Addressing it effectively means building a distributed response, one that operates at the protocol level, the application level, and the network-participation level simultaneously. Continuous innovation. Continuous evolution. It's what we do.

Finding and Growing Your Customer Base in Russia: Turning Connectivity Challenges Into Opportunity

blog@psiphon.ca (Psiphon Inc.) — Thu, 16 Apr 2026 12:00:00 +0000

As a business, finding and growing your customer base in Russia may seem impossible. It doesn't have to be. For many business sectors, Russia remains a market with active users and ongoing demand across sectors such as digital services, financial platforms, e-commerce, logistics, SaaS, and media delivery. With a population of approximately 143 million people, Russia is a large and dynamic market with tremendous potential, but potential that is out of reach without the right infrastructure.

Unfortunately, over the last decade or so, the Russian Internet has moved from a relatively open and reliable network to one that is highly centralized and controlled, and in some cases, inaccessible to specific applications. Russia's internet environment is now a moving target in which traffic can be unpredictably filtered, blocked or degraded in real time. From e-commerce to media, from logistics to mobile enabled SaaS platforms, applications requiring network continuity will often encounter significant and unpredictable network functioning, including a complete loss of access to customers and services.

Functioning within the Russian market now depends on how well your application performs under rapidly changing, or even hostile network conditions, translating directly into substantial business impact and risk. Even traditionally utilized VPNs, once the dependable goto as a customer workaround, are now often detected and disrupted. The bottom line is that the underlying issue - network reliability - is predictably unpredictable, introducing friction at the most critical points of the user journey.

For many businesses, this has forced the need to confront the reality that continuing to provide services in Russia is simply an untenable business proposition, and the result is a decision to pull out of the Russian market altogether. This does not have to be the case, however.

Adapting and Thriving: Operating effectively in this environment requires a shift in mindset. Connectivity can no longer be assumed, it must be proactively managed within the application itself. Psiphon Forge is built for precisely this purpose, offering a lightweight, embeddable API that enables applications to adapt to changing network conditions in real time. By leveraging multiple connection methods, dynamic routing, and traffic obfuscation, Forge helps maintain reliable access even as individual pathways are blocked or degraded. Rather than relying on a fixed connection strategy, applications can continuously adjust, ensuring that core functions, transactions, messaging, data transfer, remain available to users.

Turning Constraint into Continuity, Challenge into Opportunity: For companies operating in Russia, connectivity challenges are no longer an edge case - they are simply part of the baseline environment. The organizations that succeed in Russia, and other regions with challenging network environments, will be those that are designed for this reality, building resilience directly into their products. Ultimately, the opportunity to find, keep, and grow a customer base is there for those willing to embrace the challenge. With the right approach, that challenge becomes an opportunity within an environment that has fewer and fewer competitors.

Learn more about how Psiphon Forge supports resilient connectivity: https://forge.psiphon.ca

You Built Your Product to Work Everywhere. But 'Everywhere' Doesn't Work the Way It Used To.

blog@psiphon.ca (Psiphon Inc.) — Tue, 14 Apr 2026 12:00:00 +0000

You built your product to work everywhere. But 'everywhere' doesn't work the way it used to. A logistics company routes drivers through three African countries. One morning, the app stopped loading in one of them. No error message. No alert. Drivers just can't connect. It takes the team two days to realize the government throttled the protocol their app depends on. By then, deliveries have stalled, customers have churned, and the support queue is a disaster.

This isn't a hypothetical. Versions of this story are playing out right now in fintech, in media, and in communications across dozens of markets.

The ground shifted

For fifteen consecutive years, global internet freedom has declined (Freedom House, 2025). That's not a stat about activists and dissidents. It's a stat about your users.

In 2025, government-imposed internet disruptions cost the global economy $19.7 billion. There were 212 major shutdowns across 28 countries. But the headline-grabbing total blackouts — like Iran's, now past 46 days — are only the extreme end. By that point, there's nothing any technology can route through. What happens far more often, in far more markets, is everything leading up to that point: protocols get blocked, encrypted traffic gets throttled, mobile networks get restricted. Your app doesn't crash — it just quietly stops working for a growing number of users. And in your analytics, it doesn't look like censorship. It looks like churn.

The uncomfortable truth for anyone running a global product: the internet is no longer one network. It's a patchwork of national networks, each with its own rules about what traffic gets through and what doesn't. Those rules change without warning.

The usual playbook doesn't cover this

Most engineering teams plan for downtime. Failover regions, CDN redundancy, multi-cloud — these are all smart investments, but they're designed for infrastructure problems: servers going down, cables getting cut.

What's happening now is different. Governments are deliberately filtering protocols, blocking encrypted traffic, and shutting down mobile networks entirely. Your failover doesn't help when the network itself is the problem. You can't route around a policy decision with another availability zone.

And the markets where this is happening aren't marginal. They're high-growth. They're where your next million users are.

There's a way to build for this

Psiphon has spent nearly twenty years keeping people connected in the most restricted network environments on earth, adapting in real time to censorship, throttling, and blockages across 200+ countries.

Forge puts that capability inside your product. It's a lightweight API that integrates directly into your iOS, Android, or desktop application. When a network degrades or a protocol gets blocked, Forge detects it and adapts — switching protocols, rerouting traffic — without your users noticing and without your team having to manage it.

No separate app to download. No VPN dependency. Just your product, working the way your users expect it to, even when the network underneath it doesn't.

The key is timing. Forge operates in the space before a full blackout, where connectivity is being degraded, filtered, and restricted, but not yet severed. That's where the vast majority of business impact lives, and where the window to reach your users is still open. By the time a country makes international news for a total shutdown, the businesses that depended on that market have already been losing users for months.

The question worth asking

The restrictions that lead to a full shutdown don't happen overnight — they escalate. Each step costs you users you may never get back. The question isn't what happens when the internet goes dark. It's what you're losing right now while it's still on.

The organizations that answer that question honestly are the ones building resilience into their stack now, before the next disruption decides for them.

Psiphon Network: Building the Infrastructure of Internet Freedom

blog@psiphon.ca (Psiphon Inc.) — Thu, 09 Apr 2026 12:00:00 +0000

The internet was built on a simple idea: that information should flow freely, that collaboration should have no borders, and that access should be universal. That's not the reality for billions of people. In 2024, 4.8 billion people experienced government-imposed online restrictions. As of April 8, 2026, Iran's internet shutdown has exceeded 39 consecutive days and counting, the longest nationwide internet disruption ever recorded anywhere in the world. Russia is blocking platforms and cracking down on the tools people use to get around it. Across Africa, elections are being held under the cover of digital darkness. This is the world we work in. And it's exactly why Psiphon exists.

Who We Are
Psiphon has been fighting for internet freedom since 2006. With over 150 million downloads across more than 200 countries, we've spent nearly two decades building and refining the technology that helps people access the open internet, even when their governments don't want them to. We're not a VPN company. We're infrastructure. And over the years, that infrastructure has grown into an ecosystem of tools designed to keep the internet open at every level, for individuals, for communities, and for organizations.

What We Built
Psiphon is where it all started. Our flagship circumvention tool uses a constantly evolving network of servers and protocols to route users around blocks, filters, and shutdowns. Where other tools fail, Psiphon finds a way through. Conduit puts the power of that network in people's hands. Anyone with a phone or computer can run a proxy station and help people in restricted regions access the open internet. Every station strengthens the network. Every station matters. For those who want to do more, Hosted Conduit lets subscribers run a permanent, always-on cloud-based station managed entirely by Psiphon 24/7, even when their device is off. Over 1.5 million Conduit stations that support 208 regions monthly. It's the easiest way to make a lasting contribution to internet freedom.

Psiphon Forge is our solution for organizations. A lightweight, embeddable API that integrates directly into iOS, Android, and desktop applications with minimal lift on your end — we handle the infrastructure, the protocol switching, and the ongoing maintenance so your team doesn't have to. Forge gives businesses operating in censorship-heavy or connectivity-fragile regions the resilience they need to keep their services running. Whether you're in logistics, fintech, media, or communications — if your operations depend on connectivity, Forge ensures you keep it.

Why It Matters Now
It's not just shutdowns. Restrictions on access are expanding at an unprecedented scale — across borders, across policies, and across the networks people depend on every day. The tools that worked yesterday don't always work today, and the bar keeps rising. What we do know is this: Psiphon is built to operate in the world's most demanding conditions. Our network uses obfuscated, multi-protocol tunnels engineered to hold up under aggressive filtering, making it one of the most resilient circumvention tools in the world. That reliability is what organizations and users in the most restricted environments depend on.

Join Us
Article 19 of the Universal Declaration of Human Rights says everyone has the right to seek, receive, and share information freely. The web was designed for all of us. If you believe access to information is a right, not a privilege, there's a place for you in this ecosystem. Download and use Psiphon. Run a Conduit station — or subscribe to Hosted Conduit if you can. If you're a business, integrate Forge into your platform. Or simply follow along as we continue building the infrastructure that keeps the world connected.

Free access to information isn't a technical problem — it's a human one. The tools exist. The network exists. Now it needs people behind it. Learn more at psiphon.ca.

Like Any Chain, a SaaS Network Lives or Dies by the Weakest Link

blog@psiphon.ca (Psiphon Inc.) — Thu, 26 Mar 2026 12:00:00 +0000

And here's why it matters… In one African market, a large mobile financial services provider had built out its mobile banking platform, enabling peer-to-peer transfers, remittances, and deposits for millions of users. During a recent period of social unrest, the government suddenly introduced network filtering and service blocks, impacting all mobile financial platforms. Users were suddenly unable to access core services, or subscribe to the tools needed to restore connectivity. Transactions stalled, and customers were left effectively stranded.

Psiphon, of course, worked, enabling users to reconnect and restore service continuity. The number of Psiphon users spiked dramatically as users jumped on board to resolve their connectivity, and their power to transact financially. Psiphon worked, and the fast rise in its adoption proves that what Psiphon offered was exactly what the service clientele demanded.

This incident, however, exposes a deep, underlying issue. In volatile environments, reactive fixes are not enough. Embedding Psiphon Forge directly into the mobile banking app would have ensured uninterrupted access from the start, with no dependency on external downloads, no subscription friction, and no service gap at the moment it mattered most. For financial platforms operating across unpredictable networks, continuity isn't just a feature—it's the foundation of their business.

As a SaaS Provider, Don’t Roll the Dice on Network Continuity

blog@psiphon.ca (Psiphon Inc.) — Wed, 11 Mar 2026 12:00:00 +0000

As a SaaS provider, your business is your business, but your ability to deliver services, on time, every time, is everything to your customers. Your brand, your reputation and your revenue is something you just can't afford to gamble with.

Yet increasingly, many providers are doing exactly that, because the global networks their services depend on are no longer as stable or predictable as they once were. From Southeast Asia, to the Middle East and Africa, the accelerating and unpredictable use of regional internet filtering, throttling and even shutdowns means you’re gambling on the availability of a stable digital infrastructure. When you lose that bet, you and your customers pay the price.

For SaaS companies expanding into emerging or politically complex markets, this creates a new operational reality: service reliability can no longer depend solely on conventional Internet paths. The good news? Like everything else, one company’s challenge is another company’s opportunity. In fragmented and highly competitive environments, network continuity becomes a key differentiator and advantage.

Psiphon Forge provides this advantage by embedding resilient connectivity directly into your application stack. Through adaptive tunneling, protocol diversity, and dynamic routing across a global anti-censorship network, applications can maintain reliable connections even when conventional infrastructure fails or is deliberately restricted. From FinTech, to AI, to edge computing, the goal isn’t to change how your product works—it’s to ensure it continues to work exactly as your users expect and want, regardless of the network conditions around them.

Let’s face it. Customers rarely know—or care—why a service stopped responding. They only know that it did. Ultimately, betting your uptime on the assumption that networks will behave normally everywhere is a gamble. And when your brand, customers, and revenue depend on continuous access, you know it’s time to stop rolling the dice.

When Access to Mobile Financial Services Counts, Count on Forge.

blog@psiphon.ca (Psiphon Inc.) — Thu, 26 Feb 2026 19:00:00 +0000

Many regions, such as parts of Africa, have experienced an increase in the number of intermittent and unpredictable internet blackouts, throttling or degradation, especially during elections or periods of social unrest. The result is that financial organizations and users are confronting a simple reality: connectivity for them or their customers is never guaranteed.

In economies where people rely on mobile apps to support peer-to-peer transfers, merchant payments and payroll services, even short disruptions can halt transactions, with significant and serious consequences. When Internet connectivity shrinks or disappears, mobile data services are restricted, transactions fail and everyone is impacted. For financial platforms, monetary services and digital marketplaces, your ability to harness networks is the backbone that you and your customers rely on.

Maintaining resilience through Psiphon makes a whole lot of dollars and sense. Psiphon’s global anti-censorship infrastructure, with more than 500 million downloads and millions of users operating in heavily restricted environments every day, demonstrates that secure connections remain functional, even when standard connectivity fails. Embedding Psiphon Forge into mobile financial applications keeps your network and financial channels open, ensuring that users can connect and keep using your services no matter where they are.

The lesson is simple. In contested digital environments, financial network continuity must be a priority, because if users can’t count on the network, they can’t count on your organization, or their money.

Psiphon Forge. The Power to Connect.

From Sensors to Systems: Embedded Resilience for a Fragmenting Internet

blog@psiphon.ca (Psiphon Inc.) — Tue, 10 Feb 2026 12:00:00 +0000

Let’s face it. As the Internet continues to fragment, many organizations operating transnationally are confronting the same growing challenge: how to keep the full spectrum of organizational sensors, devices, data, applications and systems online and working in environments experiencing censorship, surveillance, and degraded infrastructure. From embedded sensors in contested regions, to logistics systems interrupted by DNS filtering, to applications throttled during unrest, the risks to operational continuity are increasingly challenging, distributed, and hard to predict. The result is a fragile, brittle ecosystem, where even minor disruptions can cascade into major failures. And failure means the potential for revenue, operational and reputational loss.

Psiphon Forge was designed to directly tackle this growing issue. As a lightweight, platform-agnostic API, Psiphon Forge enables any device, application, or system—from edge sensors to cloud-based platforms—to tap into Psiphon’s global anti-censorship network. Its low overhead and multi-protocol design make it ideal for embedding resilience directly into your tech stack, allowing connectivity to persist even when traditional paths are blocked or unstable. For industries operating in contested environments—logistics, media, IoT, and secure communications—Forge maintains connectivity at every layer, across every component. With Forge, your ecosystem stays connected when it matters most, and when you’re most likely to lose it.

Work in Africa? So Do We. With Psiphon Forge.

blog@psiphon.ca (Psiphon Inc.) — Tue, 27 Jan 2026 12:00:00 +0000

Across Africa, digital access is increasingly unpredictable. With 21 shutdowns in 15 countries in 2024 alone, governments are using internet shutdowns and social media blocking to control communication flows during elections, protests, and political unrest. Under these conditions, organizations face fragile and shifting network infrastructures, leaving fewer reliable channels for coordination and information sharing. The Psiphon Forge API is specifically designed to help organizations maintain connectivity even when networks are restricted.

Our track record speaks for itself. In Ethiopia, over 2.2 million people in 2023 used Psiphon to bypass political blackouts and platform restrictions. In Sudan, more than 150,000 people stayed connected amid wartime disruptions. During political unrest in Guinea in 2024, over 120,000 people turned to Psiphon. In Uganda, more than 190,000 people relied on Psiphon to overcome blocking during the 2021 election period.

For transnational operations on the continent, this level of proven resilience matters. By leveraging Psiphon Forge’s battle-tested capabilities, organizations working across borders can maintain continuity across digital communications, services, and data platforms when conventional internet access is challenged or blocked. Psiphon Forge. The power to connect.

Psiphon Forge: The API Ensuring Continuity Across a Fragmented World

blog@psiphon.ca (Psiphon Inc.) — Tue, 13 Jan 2026 12:00:00 +0000

In today’s fragmented and heterogeneous digital world, network continuity can no longer be taken for granted. From geopolitical tensions to the growing use of regional Internet shutdowns, network security threats and unpredictable disruptions pose a significant challenge to any organization providing transnational services across Eurasia, the Middle East, and Southeast Asia. As access conditions shift without warning, organizations need infrastructure that can withstand volatility while preserving operational integrity.

Psiphon Forge, Psiphon’s embeddable API, is specifically designed to maintain network continuity regardless of region or country. Built on a resilient global network supporting over 40 million unique monthly users, Forge enables applications and infrastructure to remain viable and operational even under the harshest network conditions in the world. By abstracting complexity and embedding resilience directly into applications, Forge allows organizations to operate confidently across fragmented digital environments.

Forge integrates directly into iOS, Android, and desktop SaaS applications, delivering lightweight, protocol-diverse tunneling that adapts in real time to censorship, throttling, and infrastructure failures. For organizations across logistics, communications, and broadcasting, this capability ensures services remain operational, users stay connected, and data continues to flow—even when network access can disappear with the flip of a switch. In an increasingly unstable connectivity landscape, Psiphon Forge delivers a business-critical advantage: the power to connect.

Deliver Billions to Millions: Psiphon Delivers Your Message When Others Can't

blog@psiphon.ca (Psiphon Inc.) — Mon, 06 Oct 2025 12:00:00 +0000

Deliver Billions to Millions. Psiphon Delivers Your Message When You Can't.

In a world where governments increasingly restrict access to information, Psiphon stands alone in its ability to deliver content reliably and securely into even the most heavily censored regions. With over 18 years of experience, Psiphon is the only anti-censorship platform that combines globally leading technology, operational scale, and direct-to-user content delivery. Psiphon’s network handled over 7.1 billion pages of curated content in the past year—reaching audiences in countries like Iran, Russia, China, and Myanmar where traditional channels are blocked or degraded. Its infrastructure spans more than 60,000 distributed servers and supports 73 million daily users—figures unmatched in the secure communications and content delivery space.

More than just a circumvention tool, Psiphon is a two-way engagement platform. Whether you're a broadcaster, government agency, or civil society organization, Psiphon gives you the ability to deliver secure, targeted content—and receive feedback from users inside the firewall. Partners like USAGM, BBC, and Deutsche Welle rely on Psiphon not only to maintain access to their content, but to ensure it is seen, understood, and acted on. At this year’s Digital Frontlines 2025 conference in Riga, Psiphon will be showcasing how it supports content flow into “information restricted environments” and invites organizations with similar goals to connect. If your mission depends on reaching people where others can’t, Psiphon makes it possible—right now.

Ensure Security & Continuity, Research & Innovation Aren’t Optional

blog@psiphon.ca (Psiphon Inc.) — Thu, 25 Sep 2025 12:00:00 +0000

In an age where Internet connectivity is increasingly vulnerable to disruption, staying ahead of security, continuity and censorship challenges requires relentless innovation. The dynamic nature of modern blocking techniques, from deep packet inspection to AI-driven filtering, means that yesterday’s circumvention methods often fail under today’s scrutiny. And as these technologies are increasingly shared, your business needs a way to stay connected. That’s why Psiphon Forge’s partnerships with leading academic and technical research communities are not just strategic—they’re foundational. Innovations like complex multiprotocol adaptivity and AI-based machine learning evasion techniques have been brought to scale through these collaborations, and are already deployed across Psiphon’s global infrastructure to counter emerging threats in real time.

These research alliances also fuel Psiphon Forge’s edge in observability and adaptation. By analyzing over 100 million connections per day, our network continually refines its ability to detect, respond to, and bypass censorship events as they unfold. This intelligence directly informs product updates, protocol optimizations, and the tuning of our SDK for minimal overhead and maximum performance. For businesses integrating Forge—whether in secure messaging, logistics, or media delivery—this means continuity in the face of shifting digital ground. In fragile and censored environments, our commitment to research isn’t optional; it’s what makes Forge the world’s most adaptive and dependable embedded resilience platform.

Connectivity Is Your Organization’s Competitive Edge

blog@psiphon.ca (Psiphon Inc.) — Thu, 21 Aug 2025 13:00:00 +0000

The recent internet shutdown in Iran underscored how fragile digital infrastructure can become under pressure. For companies operating in the Middle East, such shutdowns sever the connective tissue that binds logistics, customer support, data flows, and service delivery. Much like an athlete depends on ligaments and tendons to move effectively, your organization depends on uninterrupted network access to function. When that connection breaks—due to state censorship, throttling, or blackouts—operations don’t just slow down, they collapse.

Psiphon Forge offers a preventative layer of network security and resilience. It embeds directly into your apps and infrastructure to maintain secure, adaptive connectivity across censorship-heavy regions. During Iran’s shutdown, Psiphon’s network continued supporting millions of users by routing data through obfuscated, multi-protocol tunnels designed to withstand deep inspection and filtering.

For any organization—such as defense, logistics, fintech, IoT, and communications—working in environments like the Middle East where connectivity is vulnerable to censorship and unpredictable interference, Forge acts as the connective tissue you can count on. As with any athlete, prevention isn’t just an accident, it’s a key guarantee of your ability to continue to compete.

When Censorship Hits Logistics: Solving Southeast Asia’s Connectivity Crisis

blog@psiphon.ca (Psiphon Inc.) — Tue, 19 Aug 2025 12:00:00 +0000

As regional tensions and state-level internet controls escalate in Southeast Asia, logistics operators face a critical—often overlooked—operational risk: network fragmentation. In countries like Myanmar, Vietnam, and parts of Indonesia and the Philippines, governments and ISPs can throttle connectivity, block IPs, or allow full-scale blackouts during political unrest. For logistics firms, this means core functions like fleet tracking, warehouse syncing, customs reporting, or API integration with partners can fail without warning. With operations stretched across fragile digital environments, maintaining business continuity requires more than basic redundancy—it demands resilient, censorship-resistant infrastructure embedded directly into operational systems.

Psiphon Forge offers any organization operating in contested regions a unique advantage. It’s an embeddable API derived from Psiphon’s globally recognized anti-censorship network—used by over 17 million daily users to navigate firewalls in countries like Iran, Russia, and Myanmar. Forge enables real-time, encrypted, protocol-diverse tunneling that automatically bypasses throttling, blackouts, or filtering. For logistics providers, this means uninterrupted visibility across border crossings, failover routing for fleet data, and secure syncing from firewalled depots—even in censorship-prone zones. Whether integrated into mobile driver apps or backend ERP platforms, Forge ensures applications stay functional across even the most adversarial network conditions.

Africa’s Rising Network Challenges: The Case for Business Internet Resilience

blog@psiphon.ca (Psiphon Inc.) — Sat, 16 Aug 2025 12:00:00 +0000

Across Africa, businesses are contending with increasingly unstable digital environments. Governments in several countries have imposed internet shutdowns during elections, protests, or periods of unrest, often crippling essential services like mobile payments, logistics platforms, and cross-border communications. These shutdowns are not only disruptive socially—they impose heavy costs on business continuity, with some estimates placing daily economic losses from blackouts in the tens of millions of dollars. At the same time, fragmented infrastructure and ISP throttling compound these risks, leaving companies without predictable or secure digital access in critical moments.

For organizations expanding in Africa, ensuring resilience in such environments is no longer optional. Psiphon Forge provides a unique solution: an embeddable API that keeps applications running even under the harshest censorship or network stress. Built on Psiphon’s proven global anti-censorship infrastructure, Forge enables seamless failover routing, adaptive tunneling across 12+ protocols, and encrypted, tamper-proof data delivery. This means logistics providers can track fleets across borders despite ISP interference, financial services can safeguard transactions during shutdowns, and media or SaaS platforms can stay online in regions where state filtering would otherwise silence them. In a continent where connectivity remains both a challenge and an opportunity, Psiphon Forge is becoming an essential resilience layer for businesses that simply cannot afford downtime.

Lessons from Iran’s 2025 Internet Shutdown: What Businesses Operating in the Middle East Can Learn

blog@psiphon.ca (Psiphon Inc.) — Fri, 15 Aug 2025 15:00:00 +0000

When Iranian authorities initiated a near-total internet blackout during the 2025 conflict with Israel, the move disrupted far more than public discourse—it paralyzed digital infrastructure across the country.

Cloud-dependent platforms largely went dark, and from financial transactions to logistics, both businesses and millions of people lost the ability to participate in their digital infrastructure.

Despite the fact that Psiphon maintained connectivity for over 1.5 million Iranians at the height of the shutdown, it underscored a critical and growing risk: in contested regions, internet access is not a given—it is a political and social strategy that is vulnerable to abrupt, unpredictable, and unilateral control.

This isn’t an isolated case. Across the Middle East, Central Asia, and parts of Southeast Asia, governments are increasingly using network control. From throttling during protests to geoblocking entire platforms, digital interference has become normalized. Businesses reliant on stable connectivity—whether for defense, cross-border logistics, IoT, communications, enterprise software, or cloud-based customer platforms—must now factor censorship and disruption into their risk models.

Psiphon Forge addresses these realities with an embeddable, battle-tested API that ensures application-level resilience through multi-protocol tunneling and real-time network adaptation. Built on Psiphon’s global anti-censorship infrastructure, Forge helps businesses maintain critical operations and data flows, even in regions where connectivity is deliberately constrained.

The lesson of the Iranian shutdown is clear when it comes to networks. Making sure your network infrastructure can withstand unpredictability and maintain connectivity must be part of “business as usual.”

Cybernews Interview, Psiphon: “the world is becoming more and more privacy-conscious”

blog@psiphon.ca (Psiphon Inc.) — Tue, 21 Jun 2022 12:05:00 +0000

Most of us are aware of the necessity of having strong VPN protection in place. But what are the inherent issues with standard VPN applications, and how can they be solved?

While choosing the best VPN often comes down to its features, the problem with many of the modern VPN applications concerns easily recognizable traffic in certain Internet environments despite the implemented end-to-end encryption. But what can be done about it?

To discuss this matter, we’ve reached out to Alexis Gantous, a member of the Business Development and Operations team at Psiphon Inc, a company that works on providing uncensored Internet access for Windows and mobile devices.

How did the idea of creating Psiphon originate?

Psiphon was founded out of a research project at the University of Toronto’s Citizen Lab, founder and CEO Michael Hull saw the opportunity to take the original peer-to-peer system and further develop it to fill the needs of millions around the world who face restrictions to their access to information online.

Can you introduce us to your circumvention system?

One of the big issues with standard VPN applications is that the traffic, while it’s encrypted, can be very easily recognizable and disrupted in the Internet environments that perform DPI and aggressive filtering of Internet traffic. Psiphon’s state-of-the-art protocols offer multiple creative pathways to obfuscate and connect our users to the content they are seeking online. This, combined with our diverse network of servers placed in over 20 countries around the world, means Psiphon has a robust circumvention network that can much more reliably stand up to interference, as evidenced by tens of millions of citizens around the world turning to Psiphon when facing severe blocking events.

Tell us more about Psiphon’s vision.

Any potential user should be able to review our code and ensure that we are providing the service that we claim to. At Psiphon, we are committed to ensuring our user’s privacy and security are maintained to the best of our ability. We do not require users to create accounts or submit any personally identifiable information to use our service. All of our code is open source and over the years we have posted several 3rd party audits of our code, including penetration tests on our blog.

Do you think the recent global events altered the way the public perceives cybersecurity?

I do, there is a lot of confusing information out there for people new to the topic of cybersecurity. But with the number of data breaches and hacks that have occurred over the last few years, reports of organized hacking groups on the rise, etc., the public and private sectors are starting to increase the focus on cybersecurity risks and exposure.

What would you consider to be the worst Internet habits detrimental to one’s digital privacy and security?

Password security or lack thereof is number one, important accounts especially with access to personal or banking information should always be protected with strong passwords and multi-factor authentication where possible.

Protecting one’s Internet connection on public wifi connections is always a big topic as well and the use of Psiphon or a VPN that encrypts your connection can be very helpful. Finally, be wary of unfamiliar or unexpected emails/messages that ask you to click a link or enter passwords/information. These types of scams are on the rise and can be less obvious than you might expect.

What best practices or tools should Internet users adopt instead?

Password managers can be a great tool to save you from having to remember many complicated strong passwords, many are free for personal use and ensure that you don’t use the same passwords for everything. Typically they also ensure multi-factor authentication with apps like Authy or Google Authenticator which can be another great step in protecting yourself online.

With remote work becoming the new normal, what security measures should companies invest in to secure their network?

As mentioned already, passwords and MFA are important for personal use but should be even more important for businesses, many phishing scams target employees and payroll staff of small companies.

Make sure that employees have access to a reputable VPN service that publishes and adheres to open source development principles and methods. This will ensure employees have access to important services for work and will help to protect company information and data.

Do you have any predictions for the future of the Internet? What improvements do you hope to see in the next few years?

It seems much of the world is becoming more and more privacy-conscious. I predict that we will see more legislation following the lead of GDPR and European regulations around privacy and consent-oriented handling of user data.

What does the future hold for Psiphon?

At Psiphon, we are continually improving and refining our technology, we have some exciting projects in the work including a newly released service called MalAware which, when connecting to our network through a Psiphon app will automatically monitor for any connections coming from malware/adware on your device and notify you if your device has been compromised.

7ASecurity’s Recent Security Audit of Psiphon’s Code Finds “No Significant Security Flaws”

blog@psiphon.ca (Psiphon Inc.) — Tue, 02 Nov 2021 11:30:00 +0000

As part of our ongoing commitment to achieving the highest standards of transparency and security, Psiphon commissioned 7ASecurity to conduct a security review of its code base related to four new Psiphon enhancements. The resulting report is public and can be found at: https://7asecurity.com/reports/pentest-report_psiphon-e.pdf.

Using a “white box” approach, meaning the complete source code was available, the security team set out to determine Psiphon’s adherence to secure coding best practices, and to provide safeguard recommendations, where appropriate, based on their findings. The security team used a variety of tools and methods against all Psiphon source code and third party libraries. Network traffic was also analyzed to identify potential attack vectors, fingerprinting and Psiphon’s behaviour under attack.

The team’s conclusions were that:

“The Psiphon platform was found to be resilient to a broad range of attack vectors and provided an overall solid impression.

This reflects well on the team behind the solution. 7ASecurity detected only 1 security vulnerability of low severity. Hence, no significant security flaws could be identified during this assignment. The remaining 4 findings were classified as miscellaneous weaknesses and thus, not considered as vulnerabilities.”

Psiphon’s code base is open source, and can be accessed on GitHub. Previous security audits of Psiphon’s code can be found via our website and on the Psiphon blog.

We thank the 7ASecurity team’s efforts and are pleased that Psiphon’s software engineers and source code continue to be so well regarded.

Facebook Disappears from the Internet; Globally, People Assume Censorship

blog@psiphon.ca (Psiphon Inc.) — Wed, 06 Oct 2021 15:15:00 +0000

Figure 1: People around the world naturally turned to Psiphon in response to the Facebook outage.

Summary:

Psiphon’s global usage surged by 1.75 Million daily unique users during the Facebook outage on October 4th, 2021.
The rise was particularly acute in regions where Facebook platforms - including Instagram, WhatsApp, and Facebook itself - experience regular disruptions due to intermittent, but active censorship.
The regions that saw the most significant increases in usage include several countries where major censorship events have occurred within the past few years: Azerbaijan, Cuba, Ethiopia, Indonesia, Iraq, Libya, Mexico, Sudan, and Syria.
Cuba showed a 4.6x increase from baseline usage, from 70,000 to over 300,000 daily unique users, reinforcing Psiphon’s important role in the region. In July 2021, the Psiphon network supported a surge of 1.4M users from Cuba during targeted blocking of social media and messaging platforms, a still-immanent threat from censors.
This demonstrates that Psiphon is a key and trusted global connectivity solution.

On October 4th, Facebook experienced a significant global outage affecting all of its platforms, including Facebook, Instagram and WhatsApp. The outage, which lasted for at least 6 hours, was widely reported and had a dramatic impact on users of the platform.

In the days that followed, analysis by network monitors like Cloudflare and Kentik revealed how Facebook had, functionally, disappeared from the Internet. But for users, the inaccessibility of Facebook platforms evidently resonated with major censorship events that previously targeted these apps and websites. As before, enabling Psiphon followed as a natural response to the failure to access Facebook and its other products.

Psiphon’s global usage surged by over 1.75 Million users during the day of the outage. The growth was particularly acute in regions such as Cuba that have experienced significant, intermittent censorship events, but even in regions experiencing less direct censorship, such as Indonesia, significant growth was also observed.

The population scale uptake is a clear indication of the trust that Psiphon has accrued through its in supporting user connectivity globally. Since online censorship is likewise often opaque and difficult to attribute, the Facebook outage though of a technical in nature was in many ways not readily distinguishable from a blocking event. Often the last platform standing during censorship events, Psiphon adoption during the outage appears a natural and immediate reaction to presumed filtering.

The visualizations below show the surge in Psiphon daily active users in response to the outage.

Azerbaijan: 35,000 users (8x)
Cuba: 300,000 users (4.6x)
Ethiopia: 45,000 users (1.9x)
Indonesia: 250,000 users (1.9x)
Iraq: 210,000 users (11x)
Libya: 22,000 users (1.8x)
Mexico: 38,000 users (1.5x)
Sudan: 100,000 users (2.4x)
Syria: 225,000 users (1.5x)

Please note that the data shown can be accessed through Psiphon’s public data access portal, https://psix.ca. The Psiphon data portal is part of our full and ongoing commitment to open source software and open data.

Shutdown in Myanmar: A Fresh Story with Old Challenges

blog@psiphon.ca (Psiphon Inc.) — Mon, 26 Jul 2021 15:48:00 +0000

Supporting 5 million users in Myanmar is no small feat

When the Internet goes dark, so does communication with the rest of the world. We know that many regimes use Internet censorship as a method to suppress public awareness, civil protest, and mobilization, and a shutdown event is often a signal of bad things to come. This means more bad news is lurking around. When the lights of the routers went off in Myanmar, the whole world changed for millions of Burmese...

Read more about Psiphon in Myanmar

The battle for Myanmar plays out on Twitter, TikTok and Telegram

More Governments Disrupt Internet for Political Control

“Shocked and sheer disbelief” was how a young Burmese described the situation after the coup in February. “I lost my sense of direction,” and also “my job”. He was not the only person who experienced this level of dislocation: close to 2 million Burmese flocked to the Psiphon network in the span of only a few days. The number subsequently increased to 5 million in the next couple of months.

The graph below shows the number of Psiphon users between late January 2021 and late July, 2021. Note the dramatic jumps in user count on Feb 3rd (coinciding with the coup) and on May 2nd, coinciding with the restart of mobile services.

Both Psiphon and Psiphon pro were the top downloaded apps in Myanmar on May 17th, totalling over 1.7 million downloads (SensorTower.com).

The Cost of Restoring access to the International Internet

A network of servers that can absorb such a huge increase in usage needs to have a solid infrastructure and a lot of reserved capacity for when people need access to the international Internet. But, how do these things work when censors block the Internet?

Imagine the Internet as roads, and people surfing on the Internet as driving on these lanes. Some roads are local to a city while others can connect you to other parts of the country. Censorship is similar to disallowing traffic on national or local highways. It can be done in various ways from enforcing slow speeds to removing road signs on how to leave the city.

That is when anti-censorship tools like Psiphon come into play and unblock the roads. Psiphon uses different tactics to connect people to the international Internet.

The Psiphon Network operates nine distinct protocols that connect people and deliver the censored content. These protocols, when run in the Psiphon Network proper, help distribute network load and ease congestion when people access the International Internet, which means a faster connection and a more reliable experience.

The flexibility that these custom Internet Freedom protocols give services like Psiphon, makes answering people’s calls in Myanmar, Belarus or Azerbaijan possible when Internet access is limited, but it comes at a real cost; every byte that traverses the Psiphon Network is crossing a series of commercial networks, and each charge their own price for the servers and network infrastructure.

Balancing need and costs

Making sure the network is ready to support millions of users, whenever it’s needed, remains one of the biggest challenges for the Internet Freedom community in their fight against censorship all over the world.

As would be the case for any other freely accessible service provider, Psiphon cannot sustain the types of population scale surges seen in Myanmar indefinitely, nor support a number of these surges occurring simultaneously. This is truly unfortunate, since it could mean the loss of many people’s last hopes to access the open Internet, just when they need it most.

After all, while Internet freedom is a fundamental human right, it is definitely not free.

Get Involved

Internet freedom is a right for all, but only a few of us have the means to support people in regions practicing censorship to access the open internet. Be one of them.

What can you do? Raise awareness by talking about the internet situation in Myanmar, and invite others to talk about it on social media with your friends and people who care about freedom of information. You can also directly support tools like Psiphon that help people in need. Subscribe to Psiphon if you are not in Myanmar. Showing your support for everyone who has been denied their right to access information on the internet will mean a lot to them, and it means a lot to the people who do their best to bring light into the darkness of censorship.

Amid major network disruptions, 1.76M Psiphon users in Belarus

blog@psiphon.ca (Psiphon Inc.) — Thu, 20 Aug 2020 15:00:00 +0000

The Psiphon network supported a peak 1.76 million daily active users during significant network interference that started August 9th, a figure that represents nearly 1 in every 3 internet users.

A large-scale disruption to international internet access was observed in Belarus, beginning during the contested presidential election on August 9th. Widespread filtering was reported across all Belarusian networks, affecting popular messaging apps including Telegram, Viber, and WhatsApp; social media platforms Facebook, Twitter, Instagram, and Youtube; major app markets including Google Play and the App Store; email providers Gmail, Mail.ru, and Yandex; maps, banking, online media, and many other services. Rolling blackouts of the mobile networks also occurred nightly between 6PM and 6AM. The majority of VPNs were reportedly blocked as a result of generalized SSL/TLS filtering. Tor direct connections were disrupted by the increased network change, while Tor bridge users reached a peak 8,000 per day during the shutdown period. Network outages were tracked by RIPE Labs, Oracle Internet Intelligence, IODA, and other network monitors.

Traceroute completions on main mobile operator MTS Belarus (AS25106) showed clear outages through 60280 and 6697 (source: Oracle)

As a backdrop to the network disruptions, Belarus had entered its largest mass demonstrations in history.

Journalists reported difficulty freely accessing and reporting information from the country, and recommended Psiphon. Internet users noted Psiphon was one of the few tools able to bypass . Even with the attempted blocking of the app stores and Psiphon sites, users acquired the software via alternate distribution channels, such as email responder and proxy. Additionally, Belarusian users distributed Psiphon binaries via Telegram channels, hosted URLs, and even on USB. Use of the Psiphon network surged to a peak 1.76 million daily active users; given a population of 9.5 million and internet penetration rate of 60%, a figure that represents 30% of internet users in Belarus. Total bandwidth transferred from Belarus via Psiphon between Aug 9-17 exceeded 2 Petabytes. Circumvention tools proved a vital infrastructure to freely access information, as well as basic communications and services.

Internet users, researchers, and international observers were able to utilize the Psiphon Data Engine metrics portal (available at psix.ca) to monitor blocking, network performance, and corresponding circumvention usage. Some sources noted during the shutdown period, the volume of Psiphon use in Belarus had surpassed even that of Iran.

From the Psiphon Data Engine (PDE) public dashboard (https://psix.ca/)

Network observers such as the Internet Protection Society and others detected that deep packet inspection (DPI) technology was being used to block SSL causing significant traffic issues. NetBlocks also noted keyword filtering appeared to target at least 10,000 URLs. Prague-based Qrator Labs saw the concurrent outage of 80% of IPv6 prefixes within Belarus, and inferred that filtering of downstream autonomous systems (AS) was taking place at the level of two upstream ASes that dominate international transit, AS6697 and AS60280. Official releases by the National Center for Response to Computer Incidents, the National Traffic Exchange Center, and Beltelecom all stated the disruptions were the result of external cyberattacks and equipment failures.

Psiphon network performance and session quality remained at or above the regional average over the days of the shutdown. While the generalized disruption of SSL at the transport layer disrupted the core functionality of many VPNs, the traffic obfuscation and multiprotocol structure used by Psiphon provides greater resilience to protocol-based blocking, with network traffic able to adapt dynamically to the very restrictive new filtering scheme.

Bytes per hour, Belarus. A peak 55 Terabytes / h were transferred via the Psiphon network.

A key observation by Qrator Labs is the high level of centralization of control over Belarusian networks. DPI equipment installed at the point of international gateways allows the upstream operators to disconnect or pass filtering rules to downstream ISPs. Researchers documented a similar network topology in Iranian ASes last year. In November 2019, Iran executed an extensive disconnection of international internet connectivity that lasted for 10 days.

Indeed, the current generation of DPI filtering technologies can be leveraged at various forms of encrypted internet traffic, increasingly deployed at national scale and at capacities approaching 1TBit/s. In these circumstances access to resilient circumvention infrastructures such as Psiphon remains crucial to the free exchange of information.

blog@psiphon.ca (Psiphon Inc.) — Tue, 28 May 2019 00:00:00 +0000

بلاگ فارسی

blog@psiphon.ca (Psiphon Inc.) — Thu, 13 Dec 2018 17:15:00 +0000

شبکه‌های اجتماعی سایفون به زبان فارسی هم راه‌اندازی می‌شود. ما به تلاش برای فراهم کردن ارتباط مطمئن و موثر در ایران افتخار می‌کنیم و به دنبال بهبود ظرفیت کمک و بهتر‌کردن تجربه‌ کاربران در ایران هستیم. شبکه‌های اجتماعی فارسی زبان سایفون مسیر‌های ارتباطی جدیدی را برای دریافت نظرات کاربران ایرانی باز می‌کند.

برای ارتباط با ما حساب فارسی سایفون در توییتر، صفحه فیس‌بوک و اینستاگرام سایفون را دنبال کنید.

Join us in Persian

blog@psiphon.ca (Psiphon Inc.) — Thu, 13 Dec 2018 17:03:00 +0000

Psiphon is pleased to announce the launch of its Persian language social media! We are proud to provide reliable and efficient connectivity in Iran, and have expanded our capacity to help improve user experience. These channels will open new avenues of communication and streamline the feedback process for Persian users around the world.

We invite you to connect with us to receive updates about Psiphon, or to get in touch with our Persian language team! Find us on Twitter, Facebook and Instagram.

شبکه‌های اجتماعی سایفون به زبان فارسی هم راه‌اندازی می‌شود. ما به تلاش برای فراهم کردن ارتباط مطمئن و موثر در ایران افتخار می‌کنیم و به دنبال بهبود ظرفیت کمک و بهتر‌کردن تجربه‌ کاربران در ایران هستیم. شبکه‌های اجتماعی

.فارسی زبان سایفون مسیر‌های ارتباطی جدیدی را برای دریافت نظرات کاربران ایرانی باز می‌کند

.برای ارتباط با ما حساب فارسی سایفون در توییتر، صفحه فیس‌بوک و اینستاگرام سایفون را دنبال کنید

Wickr Secure Open Access

blog@psiphon.ca (Psiphon Inc.) — Fri, 07 Sep 2018 14:51:00 +0000

Psiphon is proud to announce an exciting new partnership. Over the last few months we have been working with Wickr to create a new feature for their secure messaging platforms:

Wickr: Secure Open Access.

With this feature Wickr and Psiphon have made it possible for teams and enterprises in any part of the world — US, Europe, Asia or Latin America — to have reliable end-to-end encrypted messaging, calling, file and screen sharing with no interruptions in service. No other secure communications platform enables unfettered connection anywhere in the world this way.

Wickr, already well established in the secure messaging environment with their versatile platform, recognized that as organizations are increasingly global, there can be both security as well as accessibility concerns when trying to ensure secure communication for people all around the globe.

Wickr believes their end users shouldn’t have to worry about being able to connect to their colleagues, friend or family - no matter where they are, and Psiphon agrees.

By integrating Psiphon's sophisticated network protocols into their new feature, Wickr will allow their end users to seamlessly protect their traffic and send it over the Psiphon network, ensuring they always stay connected no matter where they are.

You can read more about our new partnership here.

The New Normal for the Iranian People: Population-scale Response to State-Level Communication Disruption

blog@psiphon.ca (Psiphon Inc.) — Tue, 15 May 2018 17:22:00 +0000

In December 2017-January 2018, protests erupted throughout Iran, calling for change in the country. Unlike the protests of 2009, known as the Green Revolution, this civil unrest involved many Iranians that previously were unaffiliated with any political opposition movement. In response, the Iranian government enacted blocks on Telegram and Instagram in the country. To gain access to these applications and circumvent censorship, Iranian users flooded to tools like Psiphon. In order to shed light on these protests and the resulting surge in users, Psiphon has collected and analyzed network data from before, during and after the protests. This data has been combined with an understanding of the political, social and economic situation in Iran for a deeper look at how Internet connectivity and freedom impacts Iranian society as a whole. Ultimately, this blocking event has proven the importance of the Internet and access in Iran and highlighted the growing technical abilities and scope of the Iranian censorship regime.

Key Observations

On December 28, 2017, protests broke out in the northeastern city of Mashhad; smaller protests also occured in the nearby cities of Neyshabour and Kashmar. Initially calling for solutions to economic grievances, protests eventually covered social issues such as corruption, the presidency of Hassan Rouhani and Iran’s involvement in foreign conflicts. Some protestors even directly criticized Supreme Leader Ali Khamenei. Over the following days, the movement spread across Iran, with protests in nearly every single province. Protests occurred in many smaller cities and included many Iranians not officially or previously affiliated with any organized opposition group. Additionally, protests occurred daily in the capital of Tehran until January 9, 2018.

In response to the nationwide demonstrations, the Iranian government and the Islamic Revolutionary Guard Corps (IRGC) responded with force, both physically and virtually. However, due to the fact that this was a largely rural movement, it is possible that IRGC forces found it harder to physically limit the protests and the Iranian government turned to Internet and application blockages to quell the movement. Still, a number of protesters were arrested and, in some cities, tear gas, water cannons and other tactics were used to break up demonstrations.¹² Three days into the protests, on December 31, the Iranian government blocked access to both Telegram and Instagram, the country’s most popular messaging and social media platforms, respectively. Thanks to Psiphon and other censorship circumvention technologies, Iranians were able to connect and maintain information sharing across these sites.

Reasons behind the protests

Despite some of the optimism stemming from easing of economic sanctions, Iranians were overburdened by economic hardship in 2017. Though Iran’s oil and gas industry has grown considerably in the last year, with production rising 62%, economic relief has not as quickly expanded to other sectors of the economy, which has only seen a growth of about 3.3%.³ Unemployment rose from 12.4% to 12.6% from January to July 2017 and continues to hover around 12%.⁴

In a survey of Iranian activists conducted by the link-sharing platform Balatarin, individuals indicated that economic issues and corruption were the leading causes behind the protests. In addition, rising inflation and the cost of living proved to be the most significant priority for Iranian families, followed by citizens’ rights. These concerns were reflected in the calls of protesters: "If embezzlement decreases, then our problems will be solved!”, "Come out fellow countrymen, scream and shout for your rights!", and “The youth are unemployed [while] the mullahs sit behind a desk!”^5.

In early December, President Rouhani released his version of the budget, promising alleviation of economic pressures, including rising employment and inflation. This relatively conservative budget went to the Majlis for approval on December 14. During the month of December, a substantial increase in social media usage by Iranians was seen on the Psiphon network leading up to the protests. On December 19, usage tripled, from an average of 2 terabytes (TB) to 6TB. On December 30, usage tripled again, hitting 18TB. It is possible that this build up was indicative of the unrest to come, as more Iranians moved to social media to express their grievances, before ultimately taking to the streets.

The censorship regime in Iran

Censorship of online content inside Iran is institutionalized at the highest levels of government. In March 2012, Iran’s Supreme Leader, Ayatollah Ali Khamenei, authorized the creation of the Supreme Council of Cyberspace (SCC), which is comprised of 17 members from various government institutions plus an additional 10 members appointed by Khamenei himself. It has become the central agency for implementing and upholding policies pertaining to the censorship of online content inside Iran.⁷ At its inception, Khamenei asked then-President Ahmadinejad to chair the Council⁸, though 2015 reforms resulted in the transfer of authority to the Supreme Leader⁹ and the consolidation of decision-making authorities of the pre-existing High Council of Informatics, Supreme Council of Information, and Supreme National Security Council of Information Exchange (AFTA) under the sole jurisdiction of the SCC.¹⁰

All Iranian internet service providers (ISPs) function under the jurisdiction of the Communication Regulatory Authority of Iran (CRA), which is responsible for telecommunications licensing and enforces censorship policies outlined by the the Committee for Determining Offensive Contents under the powers of the executive. It oversees the implementation the technical censorship policies that support the initiatives of the SCC. Such actions include:

The limitation of private home user bandwidth to 128 kilobytes per second (kb/s).

The redirection of Domain Name Service (DNS) queries, causing certain DNS requests to respond with fake local IP addresses that act as black holes to drop traffic intended for blocked domains.

The inspection of internet packet headers and URLs for keywords that may lead to sites with content that may feasibly be deemed immoral or could cause political or economic turmoil, and the manipulation of such traffic.

Especially during periods of political and economic unrest, ISPs will limit speed (aka throttle), either to specific sites or internet communication protocols, or all traffic.¹¹

The government counterfeiting of web certificates to popular sites in order to conduct man-in-the-middle attacks.¹²

Traditional censorship practices have already been installed throughout the Iranian network. Website owners are required to register with the Ministry of Culture and Islamic Guidance or risk being blocked. Website owners and private citizens that post potentially inflammatory content receive official removal requests. The Iranian Revolutionary Guard Corps routinely arrests Telegram channel administrators to coerce them into removing content or delete channels entirely. News sites are sent warnings about how they should report on controversial topics, such as the Nuclear Deal. All of these practices lead to significant self-censorship in order to avoid arrest.¹³ And censorship capabilities have become more pervasive in recent year, as the CRA has implemented policies to diversify and expand telecommunications networks throughout Iran.

Censors’ response to the protests

On December 30, Iran’s Minister of Information and Communications Technology Mohammad-Javad Azari Jahromi tweeted a request for the removal of @amadnews, a Telegram channel, to Telegram founder Pavel Durov. Telegram complied, removing the channel for its use of violent language. It is important to note that Twitter is a blocked platform in Iran, though Jahromi has requested that Twitter be made available to all Iranians. It is not uncommon for Iranian officials to use this banned social media platform, however it is particularly interesting that, in this case, it was used to publicly communicate removal requests for content on a popular application that has been heavily monitored, though still permitted, by the government. Telegram refused to comply with further content removal requests, explaining that the channels were, in fact, merely using the platform for peaceful protest. Because of this, the Iranian government directed Iranian ISPs to block traffic to the Telegram app and web interface on December 31.¹⁴ On the same day, Instagram, a popular picture and video sharing application, was also blocked. The block on Instagram lasted until January 6, while the Telegram block lasted until January 13.

During this time, Iranians continued to protests and access these platforms and others through circumvention software. This is evidenced by both continued, and even increased, engagement on both platforms. Though a brief drop in usage occurred initially, data shows that the number of posts and views on Telegram in Iran quickly returned to the about the same levels as before the blocking event. On Instagram, users flocked to Persian language news and media accounts. BBC Persian continued to call for videos and photos of the protests through its Instagram account and Telegram channel, despite both platforms being blocked by the government. In fact, BBC Persian’s Instagram following grew by about 200,000 in less than two weeks; one week of which Instagram was blocked in Iran. It had previously taken the account about nine months to gain that same amount of followers. A similar phenomenon occurred on the Instagram accounts of Radio Farda and Voice of America-Persian News Network (VOA-PNN).

Iranian user behavior and analytics

Psiphon has worked to offer users multiple ways of using our software, whether for mobile or desktop use. There are three major platforms through which one can download Psiphon: Google Play store, the Apple App Store, and through email auto-responders. On January 1, downloads peaked with:

766,235 via Google Play
458,768 via the App Store
82,280 via auto-responders

Psiphon has dedicated email auto-responders for specific clients. On December 31, BBC Persian took to Instagram and posted a warning to all Persian speaking followers, instructing them on how to download Psiphon via their email auto-responder. On that day, BBC Persian, normally responsible for about 60 Psiphon downloads per day, was responsible for 60,695 Psiphon downloads. This is just one example of the many important relationships that are required to ensure internet access to people all over the world.

Google Play showed Psiphon as the most downloaded app in Iran during the protest, with competing tools rising and falling in the rankings as they proved ineffective for users. Applications for other circumvention tools, like VPNs and Lantern, a peer-to-peer software used for censorship bypass, rose and fell on the charts as users found that connections made through these apps were unreliable or slow, as expressed on Twitter. Psiphon remained the number one app in Iran on Google Play for over two weeks. Not only did Psiphon see a consistent increase in users, but this increase was at a much larger scale than other tools. Tor analytics showed a similar trend of increased use, with a spike during the protests. However, this increase peaked at just under 12,500 daily connections, while Psiphon’s network supported 287,925,106 connections on January 2 alone.¹⁵

Not only were new users downloading the app, but network analytics show that they were actively using it. Over the course of the protests, Psiphon added 22.2 million new users to the network. Data transfer during the protest period hit 61 megabytes (MB) per user per day at its lowest point. Emergency network scaling allowed for the Psiphon network to transfer and average of 124MB per user per day. As a point of reference, if an American paying $35 per month for a 2 gigabyte (GB) monthly plan through Verizon were to spread their data usage out equally throughout the month, they would be able to use a maximum of 66MB per day. Additionally, the global average mobile data plan is 4GB monthly, translating to 133 MB per day. During the entire protest period, our network transferred 19.54 petabytes (PB), equivalent to the amount of data processed by Google all over the world each day. Psiphon saw a peak data transfer on January 9 of of 1.445PB, which is equal to the same data as all of the 10 billion photos on Facebook.

All in all, a massive amount of data was transferred over the Psiphon network in response to the protests and blocking. The success and scalability of the Psiphon network during peak blocking periods can be credited to its heterogeneous infrastructure, varied partnerships, and significant focus on innovative research and development. By incorporating circumvention protocols such as Refraction Networking and MEEK, Psiphon’s network had become more redundant, resilient, and has increased its surge capacity.

Psiphon’s “new normal” in Iran

Psiphon has now adapted to a “new normal” in Iran. Part of this new normal is the significant increase in the amount of data being transferred over Psiphon’s network to social media platforms alone. This can be seen in the graph on the left, which shows that, on average, over 16TB of social media traffic is being transferred over the Psiphon network. This includes major platforms such as Facebook, Twitter, and Instagram.

The prevalence of the Iranian video sharing service Aparat on this graph, especially over Youtube, may be indicative of future threats to internet freedom in Iran. In order to post on Aparat, users need to connect their real identities with a registered account. This is part of the Iranian government’s larger initiative to produce a “halal net,” formally called the National Information Network (NIN).

This new normal also includes potential disruptions, both technical and political, that Iranian users face. In the first few days of February, Iranians took to the streets again in a number of strikes and protests against months of unpaid wages by their employers. These strikes spanned various industries, including bus drivers and railway workers. This activity was reflected on Psiphon’s network with a surge of users on February 5, from 3 million average daily unique users to 4 million. In times of political unrest, Psiphon has become the go-to censorship evasion tool for many Iranians.

This is also true for disruptions of a technical nature. On February 20, users in the Middle East and Europe became unable to access Telegram. On that day, the Psiphon network saw a significant surge in traffic from Iran, with over 3 million connections made. Suspecting a censorship event, Iranians users flooded to Psiphon to test the connection to Telegram. Through Psiphon, they were able to determine that there was a technical error in Telegram’s service, rather than a blocking event by the Iranian government. These incidents show that Psiphon is a trusted tool when internet accessibility is not guaranteed.

The continued Telegram battle

Telegram has continued to be a target for the Iranian regime and the government has moved to permanently block Telegram. On April 30, after the app’s use by government officials was prohibited, the Iranian judiciary issued a court order for all Iranian ISPs to begin blocking Telegram, effective immediately.¹⁶ Iranians have been encouraged to use domestic communication applications, which are generally avoided as they are widely-known to be subject to tight government control and surveillance. On May 7, six lawyers filed a petition to the Court for Government Employees in Iran to end the ban on Telegram in an unprecedented use of legal action against the Iranian government.

On April 26, Psiphon was contacted by the developers of TelegramDR with a request for assistance integrating and supplying network traffic for the Telegram Digital Resistance app. In anticipation of the long-threatened blocking of Telegram, Psiphon developers and outreach team members worked to successfully meet the April 30 deadline and offer Iranian citizens an effective tool for secure communication. On May 1, in direct response to the blocking event, TelegramDR was released on Google Play. Since the release, over 700,000 Iranians depend on TelegramDR, pushing over 5TB of traffic per day, indicating that the intensification of internet service blocking will surely be met with innovative circumvention techniques.

Conclusion

Since the Green Revolution of 2009, web and mobile online penetration of Iranian citizens has climbed dramatically. In fact, it has more than doubled. As of 2016, internet users make up over half of the Iranian population; in 2009, this was just under 14%.¹⁷ Access to the internet has become more widespread and quality has greatly improved. With this comes a greater reliance on internet-based platforms by Iranians, for everything from financial services to business operations. In addition, the influence of social media in the country has rapidly grown. Many businesses and news organizations rely on social media to connect with their customers. In addition, social media is slowly becoming the preferred method of communication among Iranians. This has been seen on the Psiphon network with more bytes transferred to social media sites than ever before. As stated previously, from the period before the protests and the blocking event to the end of the protests, Psiphon gained 22.2 million new users. This has led to an increase of one million average daily users; prior to the blocking Psiphon on average supported two million users per day in Iran and now supports about three million users per day.

Psiphon continues to operate at this new normal and must be prepared to increase capacity further in the event of another blocking event. However, there are considerable operating costs associated for any circumvention tool. In order to provide reliable connections to users in Iran, circumvention tools, like Psiphon, need consistent support. In addition, without access to these tools, Iranians may be compelled to migrate to government-supported and controlled domestic social media platforms. In order to maintain support for internet freedom, existing program models and support may require re-engineering. This would ideally include broader support from major social media platforms as their content is being delivered by much smaller, less funded organizations. In addition, more investments in technologies that can deliver content, expand the range of services, provide augmented capacity and adaptation will be necessary. As the Iranian government devotes resources to the development of its NIN, the internet freedom community will need to continually improve and build its capabilities.
--
By: Ariel Leuthard and Jacob Klein

1 “More Students Arrested in Iran as Protests Continue,” Radio Farda, January 2, 2018.

2 Associated Press, “At least 9 killed in Iran overnight as protesters, security forces clash,” retrieved from Politico, January 2, 2018.

3 “Iran’s Economic Outlook,” The World Bank, October 11, 2017.

4 “Iran’s Economic Outlook,” The World Bank, October 11, 2017.

5 Saidi, Mike, “Iranian Anti-Regime Protests and Security Flaws: A Dataset,” Critical Threats Project, American Enterprise Institute, January 12, 2018.

6 “Iran’s Rouhani submits conservative 2018 budget as US tensions overshadow economy,” Reuters, December 10, 2017.

7 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

8 “Iran’s supreme leader calls for new internet oversight committee,” Los Angeles Times, March 7, 2012.

9 “Khamenei consolidates power over Internet policy in hardline council he controls,” Center for Human Rights in Iran, September 14, 2015.

https://www.iranhumanrights.org/2015/09/khamenei-internet-policy-iran/

10 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

11 This has been reported for connections to Google services such as Gmail as well as traffic via specific protocols including HTTPS, SSH and VPN tunnels.

12 Simurgh Aryan, Homa Aryan, and J. Alex Halderman, “Internet Censorship in Iran: A First Look,”, Presented as part of the 3rd USENIX Workshop on Free and Open Communications on the Internet,” 2013.

13 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

14 Durov, Pavel, Telegram post, December 31, 2017.

15 “Directly connecting users from Iran,” Tor Project, accessed February 2018.

16 Parisa Hafezi, “Iran’s judiciary bans use of Telegram messaging app: state TV,” Reuters, April 30, 2018.

17 World Bank, “World Development Indicators Dataset: Iran,” retrieved March 2018.

The State of Data Logging: An Evaluation of Threat Levels and Security Practices

blog@psiphon.ca (Psiphon Inc.) — Tue, 15 May 2018 13:12:00 +0000

Psiphon Inc. has for years been leading the charge to open the internet to those living under censoring regimes. Despite facing no content restrictions online, users from Western countries are turning to VPNs such as Psiphon, to protect their personal privacy online. Yet in March 2017, the Pew Research Center released a startling statistic that some 70% of American internet users are not sure what purpose a VPN serves.¹

If the ever-increasing number of Psiphon accounts is any indication of the growing number of VPN users worldwide, a substantial influx of independent users are entering a market in which they have no metric for critically evaluating the products. This group now bears the burden of understanding risks in the unfamiliar domain of cybersecurity. As such, they are therefore highly susceptible to misinformation. One such term that puts users on high alert is the pervasiveness of the term data logging throughout VPN websites and forums, and a misrepresentation of individual risks and methods to efficiently protect oneself.

According to Techopedia, “data logging is the process of collecting and storing data over a period of time in order to analyze specific trends or record the data-based events/actions of a system, network or IT environment. It enables the tracking of all interactions through which data, files or applications are stored, accessed or modified on a storage device or application.”² Many VPNs market a zero-logging policy as a seemingly unique product feature, thus insinuating that the internet traffic of average citizens is otherwise at constant risk of being logged and possibly exploited for commercial and legal purposes.

This has become a hot button issue following the April 2017 repeal of certain FCC protections that would have required American Internet Services Providers (ISPs) to obtain permission before sharing user data (had it ever taken effect as intended in December 2017). The thought of their government advocating for ISPs to make logs of our personal internet histories and then selling or disclosing them without consent is alarming to most internet users.

As a strong proponent of internet freedom, Psiphon strives daily to ensure that our users receive fair and open access to an uncensored internet without repercussions. The expanding legality of the unauthorized use of user data and browsing history creates a troubling narrative that demonstrates that profits often outweigh ethics. But Psiphon took a deeper dive into understanding the landscape of traffic and data logging practices.

A Brief Comparative Analysis of Data Logging Policies in the US, the EU, and Canada

In general, Western nations have defined protections and regulations through the scope of stored data security. These laws set provisions pertaining to the standards of security to which firms are held while collecting and storing user data. They also outline the issues of legality pertaining to information disclosure. However, all the laws referenced in this paper leave the decisions regarding the type of data and the situations in which it is collected, was well as the duration such data is retained, in the discretion of the collecting organization. While in many cases these organizations must justify the logic behind their policies to a central governing body, such legislation creates a double-edged sword, as it tacitly supports data retention in many cases.

For example, there are no over-arching regulations in the US pertaining to data logging at present. ISPs are free to collect and store user data, provided that the user is made aware that they are subject to such practices in the terms of service or user licensing agreement. However, companies are governed by the Stored Communications Act, which interdicts the disclosure of user data, including electronic communications, “to any person other than the addressee or intended recipient.”³ While the American government burdens all firms with protection of user data, they do not expressly limit logging practices or reasonable duration of data storage.

The bigger question of ISP logging is not a new one, and it also is not a stand-alone issue. In fact, the question of data logging is rooted in the same legal questions recently resurged net neutrality debate in the US.

The European Union passed a piece of bloc-wide legislation titled the General Data Protection Regulation (GDPR) in April 2016 that builds upon the original Data Protection Directive of 2012 and outlines data security guidelines, user rights, and legal classifications of subjects. However, individual member states are obliged to determine the appropriate duration of data retention and are not subjected to a bloc-wide mandated timeframe.

Data retention regulations in the EU are designed to ensure the security of user data and its availability to law enforcement agencies, and much of the language used in the original Data Protection Directive suggests that data retention is necessary for the ease and timeliness of legal investigations. It goes as far as to codify Article 6, which allows for specific legal classifications such as suspected criminals, convicted criminals, and victims to be legally distinguished from other persons during logging and data retention processes.

Independent firms are responsible for determining the appropriate duration of retention for data collected, while additional periods of retention may be set for “archiving in the public interest scientific, statistical or historical use.”⁴ However, under the provisions of the GDPR, a private citizen has the “right to be forgotten” and may request that their personal data be removed from a server.

Finally, Canada’s federalist structure has created a multi-tiered jurisdictional organization regarding its data logging regulations. It has enacted the Personal Information Protection and Electronic Documents Act (PIPEDA), which outlines nationwide directives and regulations regarding the collection of information for commercial activity, and setting a national standard definition for personally identifiable information, which includes:

• age, name, ID numbers, income, ethnic origin, and blood type;

• opinions, evaluations, comments, social status, or disciplinary actions, etc.

• employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).⁵

Similar to the EU Directive, provisions are included to allow for the disclosure of information to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) pertaining to individuals who are suspected of criminal acts such as financing terrorism. However, PIPEDA does not explicitly outline processes for securing information and limiting the legal duration of storage of information. While paragraph 4.5.3 states that “information that is no longer required to fulfill the identified purposes should be destroyed,” individual firms are at liberty to implement their own procedures.

Further down the chain, provinces that are capable of creating their own laws to ensure data protection may supersede the PIPEDA provisions.

So, are the alarmist VPNs right?

VPNs successfully alarm prospective customers for three fundamental flaws in current logging regimes:

1. Your personally identifiable data may not be adequately secure

2. ISPs and online companies may use your personal data for commercial gain

3. Databases of personal information being held by ISPs and online companies are at the disposal of law enforcement and government agencies

All three evaluated states have allowed for the legal collection and retention of personally identifiable user data. While ISPs and online companies are legally obliged to secure such information, at its core, this has created a weak trust-based system that lacks clear oversight in virtually every jurisdiction. It is easy to say that those who are not using the internet for compromising or illegal activities need not worry, but at Psiphon we believe that all internet users have a reasonable expectation of privacy, regardless of online behaviors.

As such, it can be assumed that ISPs have the right to log user data. This may be troubling to individual internet users who fear the unauthorized use of private information such as medical records or banking information, or the malicious intrusion into such databases. Additionally, if an ISP received a National Security Letter or warrant requesting user records, they would be bound by law to provide such information to law enforcement.

With the current laws in place, online companies are not at liberty to sell personally identifiable data for commercial purposes or to disclose such information. However, they are well within their rights to retain and use this data for a variety of internal processes such as customer statistics. With the potentially imminent erosion of net neutrality in the United States, stores of personally identifiable data may be exploited or released without consent. Yet, a leading cause for concern among VPN users is the risk of such data being maliciously exfiltrated, despite the best intentions of the service provider.

Internet users will always bear the burden of educating themselves on the practices of the companies with whom they engage. A primary concern is that some end users may be unable to understand the meaning or consequences of terms of use and may base their usage on vague and often misleading social and technical standards of whether the VPN is trustworthy and reliable. Not to mention the market research that must be done to ensure that VPNs are truly abiding by the privacy policies they put forth to potential users, especially if the VPN service requires the creation of user accounts that are built around personally identifiable information.

What’s more, once an educated decision is reached, users in specific geographic locations and on specific sites may find that they feel comfortable using an unencrypted or standard https connection. But where there is still confusion or concern, a no-log VPN such as Psiphon may be used to protect personally identifiable data from being collected online.

Can a VPN protect me from data logging?

Many internet users turn to VPNs to anonymize themselves online and avoid data logging practices of commercial services online. However, it must be stated that no VPN can offer complete anonymity online. But those that are committed to a freely accessible internet, such as Psiphon, incorporate strong security measures into their services that protect the privacy of their users. By using a VPN proxy, internet traffic cannot be attributed to specific users, but users are still connected to and participating in the use of internet services.

In an effort to gain user trust and increase individual privacy, commercially available VPNs often highlight no-logging policies. They claim to discard all records of use, thus making it impossible. However, many VPN service agreements do not provide detailed explanations of such policies. In order to create an account or open an encrypted session, a VPN might require some detailed user information. Once again, the burden falls on the individual user to carefully read through the terms of service and make a determination whether to trust the VPN.

The structure of the internet requires that certain information must be exchanged in order for online communication to occur. No data can be sent or received without a functioning IP address, which includes the legitimate IP address of the VPN user. However, because none of the legislation assessed in this paper mandates that VPNs store user data for a specified amount of time, the core values of Psiphon and other VPN services might cause them to erase such information from their networks upon termination of an encrypted session.

What makes Psiphon different from traditional VPN services? Quite simply, we are borne from and exist predominantly for internet freedom. By design, the Psiphon platform does not store any personally identifiable information regarding end users’ browsing session. Because using Psiphon does not require an account, the software is virtually incapable of creating or storing information pertaining to any individual user. There is therefore no record of use, reassuring those who evade surveillance or fear the disclosure of personally identifiable information to unauthorized parties that using the Psiphon network cannot be attributed to a unique user or geolocation.

To ensure that our network remains efficient and scales with changing level of demand, we engage in internal data assessment, which includes traffic volume and user location information aggregated at the country level.⁶ This is the most detailed information retained by the service. But if, for example, a nefarious outside actor was to breach this statistical information, no personally identifiable information would be at risk.

--
By: Jacob Klein

1 http://www.pewinternet.org/2017/03/22/what-the-public-knows-about-cybersecurity/
2 https://www.techopedia.com/definition/596/data-logging

3 S.Rep. No. 99-541, 97th Cong. 2nd Sess. 37, reprinted in 1986 U.S.C.C.A.N. 3555, 3591.

4 Ibid. Paragraph 26.

5 http://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html
6 However, city-level data will be automatically aggregate only after the usage within a country surpasses a threshold at which it would be statistically impossible for individual users to be identified via an evaluation of the number of active connections within the city.

Why You Don't Need Google's Domain Fronting

blog@psiphon.ca (Psiphon Inc.) — Tue, 24 Apr 2018 13:22:00 +0000

Google’s removal of domain fronting emphasizes the need for solutions like Psiphon.

Google has confirmed that they will block domain fronting across Google domains and App Engine. For many apps and publishers, this represents a step backwards in the fight for internet freedom. While Psiphon has never relied on this Google service, many app developers continued to depend on the practice as a convenient and straightforward means of circumventing state-level censorship, despite the long-running speculation that Google would close this loophole (eg. Will Scott’s blog post in 2017).

While the announcement has been met with criticism from internet activists and service providers alike, Google has defended their decision, saying “domain fronting has never been a supported feature”.

Domain fronting has been a popular means of censorship circumvention for several years, being embraced by popular apps like Signal, who publicly adopted the practice in 2016. While using Google domains to front traffic does not require advanced technical knowledge, it is a half measure that relies on Google, without consultation, to provide infrastructure for something it was not designed to do. In short, using the Google App Engine for domain fronting meant taking advantage of an unsupported loophole. For this reason, the practice would inevitably face restrictions as it gained popularity.

"Now that Google is disabling domain fronting it's a good time for tools to start thinking about new infrastructures for circumvention. Recent Telegram efforts in Russia proved how dangerous Google/Amazon reliance was for access to the entire Internet."
https://t.co/0ZblXVE8ED
— mahsa alimardani 🌒 (@maasalan) April 19, 2018

In 2015, Cloudflare also ended domain fronting across its domains when it began matching the SNI and host header of web traffic, after its infrastructure was implicated in censorship circumvention.

Most recently, in a frenzied attempt to block Telegram, which has made use of this loophole, Russian censorship authority Roskomnadzor blocked an estimated 17 million IP addresses. The interference disrupted access to Gmail, Google search, Google Play, YouTube, and other Google services.

Domain fronting is hardly the preeminent censorship circumvention solution. In cases where Google itself is blocked, as it is in Iran, any site or application that used Google for domain fronting would be unavailable as well. Psiphon’s network relies on a wide variety of protocols and obfuscation techniques to deliver Internet freedom. The complex and ever-changing nature of our network protects against over-reliance on one technology or approach.

The importance of a diversified circumvention toolbox cannot be overstated - for apps like Signal, reliance on Google domain fronting resulted in the need for an immediate and complete shift to another CDN. Tools like Psiphon seek to mitigate this risk by implementing numerous protocols, thereby eliminating reliance on any one method. Both Telegram and Tor’s use of multiple domain fronts minimized the disturbance caused to their services.

Psiphon Completes Another Third Party Security Review

blog@psiphon.ca (Psiphon Inc.) — Fri, 16 Feb 2018 15:37:00 +0000

In late June 2017, Psiphon continued to prove its commitment to open source development (you can access our code repository here), by commissioning Cure53 to perform a security audit of our services. The security review took 22 days and a total of 9 testers to complete what was described as a review with a “vast scope” and the Cure53 testers were very thorough. This is our 2nd security audit of this kind in 3 years (you can see the results of the 1st one, performed by iSec here).

The report’s description of what was included in the scope reads:

“In scope were multiple components of the Psiphon software compound, including the tunnel-core client and server, the library glue, the Psiphon iOS app and, last but not least, the Psiphon iOS browser. This very broad premise and scope explain the necessity for involving a rather large number of testers with properly matched expertise in different arenas. In sum, the tests included code audits, actual penetration tests, protocol and configuration reviews, and a cryptographic audit."

We are very happy with the results of the security audit and proud to relay that “no noteworthy security risks could be unveiled” (pg.19). In the spirit of transparency you can read the full detailed report in pdf form here. Of the two vulnerabilities found, one has already been fixed (and confirmed by Cure53) and steps have been taken to address the other in upcoming releases.

The testers also noted 7 other miscellaneous issues that you can find listed in the report, four of these have also already been addressed.

“The testers shared a conviction that the software compound greatly benefitted from a number of software security audits in the past. Needless to say, this is reflected in findings. Among the total nine issues discovered, only two were marked as security vulnerabilities and were further ascribed with the lowest “Informational” severity ranking.”

The Cure53 testers noted several times throughout the report how clean and quality driven the code is and came to the following conclusion:

“Despite investing considerable time and personnel resources into attempting a compromise, the Psiphon components in scope held up to scrutiny and presented themselves strong and robust in face of adversarial efforts. The bottom line is that no noteworthy security risks could be unveiled.”

We hope that you will find this report interesting, and that it will assure you of our commitment to providing first-class software that will always be open source and secure.

Internet Freedom Festival 2017

blog@psiphon.ca (Psiphon Inc.) — Mon, 20 Mar 2017 14:09:00 +0000

Another successful Internet Freedom Festival (IFF) was held 6-10 March, 2017. The week-long “global unconference” festival takes place every year in Valencia, Spain. It is a great opportunity for those in the Internet Freedom community to meet up, share experiences, learn from one another, and discuss issues affecting the Internet today. Once again, Psiphon team members were in attendance at this year’s IFF.

This year’s sessions focused on eight different themes: Community; Training & Best Practices; Internet Freedom: Present and Future; Tools & Technology; Policy & Advocacy; Regions & Groups; Communications & Design; and Journalism & Media. The IFF encourages collaboration, diversity, and inclusivity. The days were filled with engaging sessions, each of which presented an opportunity to meet colleagues from around the world and undertake the shared common goal of Internet Freedom.

Learn more about what participants have to say about the IFF through the Twitter hashtag #InternetIFF.

# 1st Vietnam Cyber Dialogue

A day before IFF kicked off, the first ever Vietnam Cyber Dialogue (VCD) took place. Inspired by ASL 19’s Iran Cyber Dialogue, the event was a lively gathering of community leaders, activists, policy makers, and technologists working towards improving access to information and greater freedom of expression in Vietnam. The event was organized by Article 19, Việt Tân, Aspiration, and Reporters Without Borders.

Ahead of the event, Việt Tân shared “10 Things to know about Vietnam and the internet,” with attendees. Vietnam has the largest number of internet users in Southeast Asia and a vibrant cyber community. There is certainly lots to discuss when it comes to Vietnam’s media landscape and online environment. The VCD provided safe space for collaboration and dialogue between the Vietnamese community, its diaspora, and technologist allies. Hear what Việt Tân’s Loa and The 88 Project had to say about the Vietnam Cyber Dialogue in this YouTube video.

# Upcoming events

If you’re interested in Internet Freedom check out these upcoming events:

Iran Cyber Dialogue 27-28 March, 2017
RightsCon Brussels 2017 29 – 31 March, 2017

Happy 2017 to Psiphon Users!

blog@psiphon.ca (Psiphon Inc.) — Mon, 02 Jan 2017 12:48:00 +0000

2016 was an eventful year, with plenty of world events to be informed about. While access to the Internet and thus information around the world grew, censorship of all kinds including the blocking of websites also rose.

Here at Psiphon we have also seen more users of our software than ever before, and while this comes hand in hand with increasing information controls on the internet, we are happy to be able to help people get round them.

Freedom House’s annual report on Internet Freedom noted a decline in said freedom for the sixth year running, and found that two-thirds of Internet users around the world live in countries where criticizing the government, military or monarchy results in censorship. Their other major observation was that governments are increasingly targeting messaging apps.

This chimes with some of the things we’ve seen on our network this year. For example in January VoIP services were blocked in Morocco, upsetting users of popular free calling services like Viber, Whatsapp, Skype and Facetime. For the month long duration of the ban, we saw our Moroccan traffic triple in the first week and then double each week after that. Then in May a Brazilian judge ordered the blocking of Whatsapp, not for the first time. Again we saw traffic from the country triple, this time in 24 hours.

National elections are another flashpoint for censorship, and we’ve seen people turn to Psiphon as their governments block social media or oppositions websites, for example in August in Gabon. Another trend we’ve seen this year is the shutting down altogether of the internet in some countries during turbulent events - something that even Psiphon can’t do anything about.

Our hope is that in 2017 we can help people around the world to communicate and stay informed without restrictions. Happy New Year to all our friends and we wish you a safe, happy and free 2017!

Psiphon Is 10 Years Old!

blog@psiphon.ca (Psiphon Inc.) — Tue, 13 Dec 2016 14:37:00 +0000

This month Psiphon turns 10 years old! We would like to thank you for your support, as we look forward keeping the Internet open for many more years!

Psiphon began at the University of Toronto’s Citizen Lab as a ‘network of trust’ amongst people who knew each other. The first version of the software allowed a person’s computer in a non-censored country to act as a server for a friend in a censored region, and helped to prove that there was a real need for the open Internet.

Psiphon 2 was developed soon after, no longer requiring people in censored regions to know people in an uncensored country. Psiphon runs servers, known as Psiphon nodes, which act as proxies for users in censored regions, and can be accessed via a simple URL.

In 2008, Psiphon won the Netxplorateur Grand Prix 2008. The panelists called Psiphon “the world’s most original, significant and exemplary Net and Digital Initiative.” The following year, Psiphon was recognized with The Economist Best New Media Award by Index on Censorship.

In 2011 a downloadable Psiphon app – known as Psiphon 3 – was launched for Windows, allowing any application that recognized system proxies to access the network through a Psiphon tunnel. At the end of 2012, Psiphon 3 became available for mobile devices. Psiphon 3 is dynamic and resilient. Our specialist team of top developers continuously work to improve the software and fight the ever more advanced censorship techniques faced on the internet. This means Psiphon often works when other simple VPNs do not. All of Psiphon’s software is open source, and has been independently security audited.

Psiphon popularity is due in a large part to promotion through our media sponsors and partners. We work closely with Toronto-based NGO ASL19, who help Internet users in the Middle East and North Africa region assert their digital rights online and access information. We also work with major broadcasters, including Deutsche Welle, BBC, and Voice of America, to help them reach their audiences, and to provide Psiphon users with access to news and to an open Internet.

We have also been able to work with many organizations to help bring awareness to their various projects through our content distribution network. Last year we promoted the BFI Flare Film Festival, which helped raise awareness of LGBT issues. We also promoted Action Against Hunger after the earthquake in Nepal to bring awareness and donations to the disaster-stricken region. This year, we have also worked with Google’s Jigsaw and VICE News to promote a series of documentaries about freedom of expression, as well as partnering with Global Citizen to encourage US voters to take part in this year’s Presidential election.

Aside from our diverse partnership opportunities, our team actively engages in local events and international conferences to gain understanding and share ideas about pressing issues that are affecting Internet freedom. Last week, we hosted a session at the Internet Governance Forum on the implications of VoIP crackdown on government, telecom, and civil society. We also recently attended the first Asia Pacific School of Internet Governance in Thailand to learn about the rising problems to Internet Governance in Asia Pacific. We have participated numerous times at the Internet Freedom Festival where we learn about censorship trends and connect with the wider Internet freedom community, and contributed to a PETS paper for the wider technical community.

It has been an eventful, innovative, and exciting ten years for Psiphon! We look forward to what the future brings. Look out for more innovations and product releases in 2017!

Visit psiphon.ca to see our 10-year anniversary web site, and be one of the first to play our game!

Want to collaborate with Psiphon in 2017? Contact us at info@psiphon.ca

Follow our Twitter and Facebook for more updates!

Gambia's Election Shutdown

blog@psiphon.ca (Psiphon Inc.) — Wed, 07 Dec 2016 17:06:00 +0000

Access Now recently reported that there have been over 50 Internet shutdowns around the world in 2016, compared to 15 known shutdowns the previous year. Many of these shutdowns have taken place in Africa - as seen in a recent Psiphon blog piece documenting a shutdown and social media blocking event in Gabon.

Last week, another shutdown happened in Gambia. Just after 9pm local time on November 30th 2016, we received a message from our friend Moses Karanja, a researcher at the research fellow at the Centre for Intellectual Property and Information Technology Law (CIPIT) in Kenya. Moses asked if we were able to verify reports he had seen on social media, saying that the Internet was unavailable in Gambia.

From our network monitoring, we could see that there had been a total drop-off in Psiphon traffic at just after 8pm local time. To verify this, we contacted Akamai’s State of the Internet team, to see if they had also seen a drop in traffic. Within a few minutes, they confirmed it for us, and tweeted to let the world know.

#Internet disruption in #Gambia has dropped @akamai traffic to the country to zero over the last hour. (h/t @PsiphonInc) pic.twitter.com/MUe4NWvFss
— StateOfTheInternet (@akamai_soti) November 30, 2016

We followed this up with our own tweet, showing a similar effect on our network.

Ongoing Internet outage identified in #Gambia. No network traffic from Gambia since 2010 GMT. pic.twitter.com/SiNFKO6rvU
— Psiphon Inc. (@PsiphonInc) November 30, 2016

This outage occurred on the eve of the country’s presidential election on December 1st. The incumbent, Yahya Jammeh, had warned against people taking part in any protests that would follow an election he expected to win.

Following Jammeh's defeat in the election to Adama Barrow, the candidate chosen to represent seven opposition parties, Internet and telecommunication services began to be restored. The outage was expected to last into Saturday December 3rd, but instead was reversed by 11.30 on Friday December 2nd.

The reporting of the shutdown and confirmation at the network level came about due to close collaboration between the research community and the private sector, and helped to highlight the growing number of Internet shutdowns that are occurring across the world. For more information, read this piece from Moses Karanja, as he continues to track and document Internet shutdowns in Africa.

Global Citizen ShowupVote and the United States Election

blog@psiphon.ca (Psiphon Inc.) — Thu, 01 Dec 2016 11:15:00 +0000

Ahead of the 2016 United States elections, Global Citizen launched its “Show Up and Vote” campaign to encourage young Americans to vote. In addition to an online campaign, represented by the hashtag #ShowupVote, Global Citizen hosted a series of events and concerts with high-profile artists.

Psiphon #ShowupVote Promotion During Elections

In the week ahead of the election, Psiphon promoted the #ShowupVote campaign to our US audience,
showing a selection of images and a brief paragraph explaining the importance of the project.

In the final two days ahead of the election, the promotion was changed to ensure maximum visibility of the #ShowupVote content.

As election day ended, Psiphon followed this up by taking users to Global Citizen’s live coverage, giving them a chance to follow the results as they came in.

Overall, Global Citizen’s content was seen 1.5 million times in the US.

Worldwide Interest in U.S. Elections

In highly censored regions, during national and international news events, it is common for the use of circumvention tools to increase as people attempt to acquire news from a variety of sources. The U.S. election was no exception.

There was an increase in use of Psiphon in many countries, including from Vietnam, Russia, Iran, Kazakhstan, Saudi Arabia, and the United Arab Emirates, during the lead-up to and on the day of the election. The increase was most notable from China, where live-streaming coverage of the U.S. election was banned and TV networks were told to avoid “excessive” coverage of the event.

Psiphon's First Time Supporting Toronto Reel Asian Film Festival

blog@psiphon.ca (Psiphon Inc.) — Mon, 28 Nov 2016 12:36:00 +0000

The 2016 Toronto Reel Asian International Film Festival has come to a close after a successful run from 8th to 19th November, 2016. As the largest Asian film festival in Canada, Reel Asian has been bridging the Pan-Asian contemporary cinema and Canadian community through creating a platform for emerging and award-winning directors, actors and the local community to share their work and opinions on films. This year, over half of the film titles were directed by North American filmmakers.

This year marked the 20th anniversary, and for the first time new elements were introduced for the film festival– including Reel Asian’s inaugural WEE ASIAN Kids Programme for parents and children, free entries to 10 films for senior and student audience, as well as a new 20/20 Interview Series. 20 candidates who either have worked or attended the film festival in the past 20 years were invited to talk about their memorable stories with Reel Asian, as well as the impact of the film festival on their lives.

Psiphon is very excited to collaborate with Reel Asian for the first time in celebration of their 20th anniversary. As much as the festival is a huge success itself with higher than before ticket sales, we helped expand their online exposure to our users in Canada and China, which received over 2.3 million views over the course of the festival. Through Psiphon’s content delivery, our users from China learned about media arts that were screening overseas. Psiphon users in Canada and China were also able to watch trailers of selected films on Psiphon Today.

Since our previous partnership with BFI Film Flare Film Festival, Psiphon continues to pursue opportunities to support art and cinematic initiatives. We are more than happy to connect our users to media arts that are relevant to them and provide an open platform for them to engage with the events.
Toronto Reel Asian International Film Festival will happen again in November 2017 with great films!

Check out this year’s Reel Asian Award winners and more festival highlights at www. reelasian.com

Want to collaborate with Psiphon Inc. for your next event? Email us at info@psiphon.ca

Social Media and Internet Ban in Turkey

blog@psiphon.ca (Psiphon Inc.) — Mon, 21 Nov 2016 20:05:00 +0000

Following the detainment of 12 pro-Kurdish lawmakers from the Peoples’ Democratic Party (HDP) in the early hours of November 4^th, Facebook, Twitter, Instagram, YouTube, WhatsApp and Skype were blocked in Turkey. There were reports that Turk Telekom internet provider completely disabled access to the internet or throttled the connection to the point that it was impossible to connect.

Despite lack of official decision about the restrictions, and BTK’s explanation that there was a technical problem throughout Turkey, Prime Minister Binali Yildirim made a statement later in the day and said “For security reasons, these kinds of measures can be taken time to time. These are temporary measures. Everything goes back to normal after the danger is eliminated.”

Social media and internet bans ended the following evening in most of the country, but there were still some short-term connection problems during the weekend in some regions, and it was reported that some Turk Telekom users did not have internet for longer periods.

On the same day, multiple local outlets reported that Turkey’s Information and Communication Technologies Authority (BTK) ordered internet providers in the country to block censorship circumvention tools, including Psiphon. Despite the rumor, Psiphon saw no indication that its services were affected negatively.

The BTK denied that circumvention tools were ordered blocked; however Ahment Arslan, the Minister of Transport, Maritime and Communication, said “We only restrict the use of VPNs because of terrorism reasons. Surely nobody would have an objection about this.”

Psiphon Attending the First APSIG

blog@psiphon.ca (Psiphon Inc.) — Mon, 24 Oct 2016 12:17:00 +0000

On September 11th to 15th 2016, Psiphon attended the first Asia Pacific School of Internet Governance (APSIG) hosted in Bangkok, Thailand.

The weeklong regional school took place at the Asian Institute of Technology (AIT), where more than 30 participants from various countries in Asia Pacific came together to share their experience and knowledge on the Regional Internet Governance issues. Organized by the Internet Education and Research Laboratory (inTERLab), the five-day workshop featured keynote speakers from various backgrounds such as international organizations, academic institutes, civil society, government and business sectors. These organizations include: Internet Corporation for Assigned Names and Numbers (ICANN), Electronic Frontier Foundation (EFF), Asia-Pacific Network Information Centre (APNIC), Korea Advanced Institute of Science and Technology (KAIST), OpenNet Korea and Com First India.

As a software company that develops a trusted tool that enables unrestricted Internet content access, Psiphon was very excited to share its feedback on Internet Governance issues, including the improvement of public awareness on Internet content freedom in the Asia Pacific Region. We were extremely happy to connect with established users, within the school, to collect and understand feedback provided in regards to our software. Furthermore, Psiphon built relationships with new users from South and Southeast Asian countries, such as Thailand, Pakistan and Philippines. During the role-play workshops, Psiphon contributed to the final report on the facilitation of new Internet users in the next decade. This report is now available on the APSIG official website at apsig.asia.

APSIG is a pilot program envisioned by Dr. Kilnam Chon and the next APSIG will also be hosted in Bangkok, Thailand.
Want to invite Psiphon Inc. to your next event? Email us at info@psiphon.ca

Psiphon’s First Time Sponsoring the Toronto Chinatown Festival

blog@psiphon.ca (Psiphon Inc.) — Wed, 28 Sep 2016 13:50:00 +0000

On August 20th and 21st, Psiphon joined the 16th annual Toronto Chinatown Festival for the first time as one of the event sponsors.

In this 2 day event, Psiphon raised public awareness on Internet content access by reaching out to over 200,000 participants and educating more than 200 visitors on Psiphon’s software. Psiphon has also given out 10 visitors a free month of Psiphon Pro and custom made festival giveaways to booth visitors during the event.

As an important neighborhood in the downtown core, Chinatown BIA hosts the Toronto Chinatown Festival every year aiming to bring upon pan-Asian community in the city to celebrate its rich cultural heritage.

Want to invite Psiphon to your next event? Email us at info@psiphon.ca

¡Hola Cuba!

blog@psiphon.ca (Psiphon Inc.) — Wed, 28 Sep 2016 13:03:00 +0000

Did you know that Cuba is one of the countries with the most restricted internet access in the world? Home internet access is forbidden, and even though the government is introducing more and more public WiFi spots, they cost 2$ an hour, which in Cuba is one tenth of the monthly wage. Even then users cannot surf the web freely - they are subject to government surveillance and anti-government websites are blocked. Internet speeds are extremely slow.

Psiphon was in Miami this month at the Cuba Internet Freedom Forum , a conference to discuss and exchange ideas, look at the current state of the internet in Cuba and look for ways to support its growth.

Tell all your Cuban friends that Psiphon will help them access the open free internet!

Amid Second Ban, Psiphon Keeps WhatsApp On in Brazil

blog@psiphon.ca (Psiphon Inc.) — Sun, 08 May 2016 13:39:00 +0000

In December, Psiphon blogged about a previous blocking event in Brazil, available here.

Psiphon use surged again in Brazil in response to another nationwide suspension of WhatsApp messaging service. On May 2nd, Brazilian state judge Marcel Maia Montalvão issued an order to block WhatsApp for 72 hours. The judge is seeking user data from WhatsApp as part of a criminal investigation. The five main mobile operators were ordered to block the messaging service, beginning at Monday at 2 p.m. local time.

In response to the recent suspension of WhatsApp services, company CEO Jan Koum posted a message to Facebook stating, “Yet again millions of innocent Brazilians are being punished because a court wants WhatsApp to turn over information we repeatedly said we don’t have. Not only do we encrypt messages end-to-end on WhatsApp to keep people’s information safe and secure, we also don’t keep your chat history on our servers. When you send an end-to-end encrypted message, no one else can read it – not even us.”

The suspension was overturned by another judge on Tuesday following an appeal from WhatsApp’s lawyers, allowing WhatsApp to resume services in Brazil.

In March, Judge Montalvão ordered the arrest of Facebook executive Diego Dzodan on charges of obstructing justice after WhatsApp failed to deliver messages subpoenaed in the criminal investigation. A day later, an appeals judge overturned that order and Dzodan was released. Although WhatsApp is owned by Facebook Inc, the two companies operate separately.

During a press conference that followed, Dzodan stated that WhatsApp is unable to turn over the data because it doesn’t store users’ messages after they’ve been delivered. In addition, the messaging service uses end-to-end encryption and messages cannot be intercepted.

Using Psiphon, Brazil’s WhatsApp users were able to retain or restore access to the application. The Psiphon user base in Brazil tripled within the first 24h of the ban. Brazil’s Globo news network recommended Psiphon to circumvent the blocking.

Psiphon in Brazil: bytes per hour, 29 April – 4 May 2016:

This case demonstrates that in response to censorship, blocking, and other restrictions, internet users will turn to known tools that connect them to content and to each other.

Psiphon Usage Surges as Brazil Blocks WhatsApp

blog@psiphon.ca (Psiphon Inc.) — Thu, 17 Dec 2015 13:15:00 +0000

At 9PM ET on December 16th WhatsApp was blocked in Brazil. The ban came after a judge ordered that the messenger app be blocked for 48 hours when the company refused to hand over private user information related to a criminal case. For months, Brazilian telecommunications companies have been attempting to shut down WhatsApp because it provides free messaging and voice services. WhatsApp is the most popular messenger service in Brazil and telecoms blame it for luring millions away from paid cell phone use.

Internet users in Brazil reacted strongly to the ban, criticizing the decision to block WhatsApp widely on social media. Millions turned to alternate messenger services and shared circumvention techniques over social media. Psiphon was praised by people in Brazil for being free, open source, and able to keep them connected throughout the blocking event. Psiphon’s surge capacity was able to cope with the increased demand, with peak data use of more than 8x that of a normal day. Psiphon’s unique users in Brazil went from 54,000 on December 16 to 946,000 on December 17.

Less than a day after the block was put in place, a second judge overturned the lower court’s decision and WhatsApp was unblocked. He stated that “it does not seem reasonable that millions of users be affected” because WhatsApp refused to disclose user information. While the surge use of Psiphon settled quickly, more than twice the expected amount of data was being served hours after the block was lifted.

Update: In May 2016 Brazil blocked WhatsApp again, and again users turned to Psiphon.

Android Browser Same Origin Policy Bypass Security Vulnerability (CVE-2014-6041)

blog@psiphon.ca (Psiphon Inc.) — Thu, 17 Sep 2015 22:33:00 +0000

A severe security vulnerability in the Android AOSP browser has been disclosed: http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html

The Psiphon team has determined that the built-in browser ("browser-only mode") in our Psiphon app is affected, on Android versions 3.0 to 4.3, through its use of Android AOSP browser via the WebView component. There is no known mitigation for this security vulnerability other than to disable JavaScript in our built-in browser WebView components.

We are releasing Psiphon for Android version 62 which will disable JavaScript in the built-in browser on these versions of Android. We plan to leave this restriction in place until a less disruptive, effective mitigation becomes available; or the Android AOSP browser becomes widely patched.

Psiphon Gives Global Boost to BFI Flare Film Festival 2015

blog@psiphon.ca (Psiphon Inc.) — Sun, 26 Apr 2015 00:18:00 +0000

From March 25 - 31, Psiphon partnered with British Council to deploy the BFI Flare #FiveFilms4Freedom campaign, a global digital human rights initiative and history’s first global, digital LGBT cinematic event. A leader in contemporary LGBT cinema for 29 years, BFI Flare 2015 sought to encourage the world to watch a film together, and show that love is a basic human right.

Psiphon helped maximize the global impact of the campaign, connecting the festival’s LGBT filmmakers and their stories to audiences in 135 countries around the world, in some of the most heavily censored societies — places where freedom of expression is not a given, in particular for members of the LGBT community. According to #FiveFilms4Freedom Director Alan Gemmell, the initiative “was a truly ground-breaking way to support freedom and equality all over the world and showcase some of our finest short filmmakers… we’re incredibly proud that our campaign reached tens of millions of people and that we were able to show solidarity with people around the world who risk their lives everyday just to live and love.”

Through the Psiphon platform, more than 5 million viewers were made aware of the festival, and viewed the landing page 13 million times.

The partnership was a litmus test of Psiphon’s capabilities as a publishing platform, and demonstrated its power to connect diverse international audiences to culturally-relevant content, to each other, and to a global conversation on a massive scale.

Psiphon CEO Karl Kathuria was pleased with the outcome. “We are really excited to have helped raise awareness of this film festival,” he said. “Many people using our software are in countries where it can be difficult to access LGBT content, so this is a unique opportunity to connect them with #FiveFilms4Freedom and help them to join in with the conversation over social media.”

Kathuria confirmed that Psiphon will continue to pursue future initiatives in art, cinema, and other cultural activities. “As a content delivery tool, our technology holds substantial and untapped potential to engage a global audience, regardless of information controls that might be imposed on them. Psiphon will be pursuing several more opportunities to promote and distribute content for cinematic events over the remainder of 2015.”

#FiveFilms4Freedom will return in 2016 with an expanded international programme. Psiphon’s free and open source software continues to be available for Windows desktops and Android mobile devices, helping people all over the world connect with each other over the open internet.

To learn more about the #FiveFilms4Freedom project, visit: http://film.britishcouncil.org/our-projects/2015/fivefilms4freedom

To learn more about BFI Flare, visit: http://www.bfi.org.uk/flare

To learn more about the British Council, visit: http://www.britishcouncil.org/

You can also stay in touch with Psiphon via Twitter and Facebook.

A Technical Description of Psiphon

blog@psiphon.ca (Psiphon Inc.) — Wed, 03 Dec 2014 11:10:00 +0000

Here's an update to address two recent questions: in simple terms, what is Psiphon and how does it differ from a VPN service; and, what has changed since the technical design document was last updated.

Psiphon 3 is a centrally managed, geographically diverse network of 1000s of proxy servers. Most of our infrastructure is hosted with cloud providers. Psiphon 3 is a "one hop" architecture with secure link encryption between clients and servers. We offer clients for the most popular platforms: Windows, Android, and iOS (in alpha).

Psiphon is open source. Our service offers a strong privacy policy; there are no user accounts and user network addresses are not logged.

Psiphon differs from standard VPN services in a couple of key ways:

We deploy strategies to distribute subsets of servers to users aiming to provide each user with a handful of servers they can reach while not revealing the entire network to one user. To achieve this goal, the size of our network -- and in particular the diversity of our network addresses -- isn't simply a function of our traffic load.
We use protocol obfuscation to bypass DPI blocking.

Psiphon's technical design document is out-of-date and what follows is a very brief summary of major technical changes we've implemented since the project launched in 2011.

We added the obfuscated SSH protocol to mitigate DPI fingerprinting. This fully random-looking protocol is deployed with a unique obfuscation key per Psiphon server.
We added an optional HTTP prefix to our protocol to mitigate DPI-based whitelisting of HTTP traffic. This simple prefix is sufficient for regex-based DPI (nDPI and l7-filter) to classify Psiphon traffic as HTTP; and was sufficient to defeat an actual adversary at the time we deployed it.
We added remote server lists to augment the embedded and discovery servers concepts. While discovery happens only when connected to an existing server, remote server lists can be downloaded even when all servers are blocked. Remote server lists are distributed on S3 and accessed via https://s3.amazonaws.com without a distinguishing bucket name in the URL. In this way, it is difficult for an adversary to block our remote server lists without blocking all of S3 or implementing HTTPS traffic analysis.
Email is now a major client propagation mechanism. We have an auto-responder that returns links and attachments to custom sponsor/channel Psiphon clients depending on the email address users send to.
We released an Android client in 2012. The first version included an embedded browser based on Android's WebView. In 2012/2013 we added support for whole device tunneling, which tunnels all Android apps through Psiphon. We have an iptables whole device mode (for rooted Android 2.2+ devices); and a whole device mode that uses Android's VpnService with tun2socks (for any Android 4+ device). Additional features added include egress region selection and proxy chaining.
We have an iOS client now in alpha testing. This app has an embedded browser.
Our in-app feedback mechanism sends us messages and optional diagnostics from users. This system has helped us debug many platform issues and blocking issues.
Changes to discovery algorithms: our discovery algorithms evolve as part of an ongoing process of optimizing our network. Major changes include sharing discovery servers across propagation channels; and adding time-of-day as a dimension.
Optimizations to connection algorithms: our clients now launch connections to many servers at once when connecting, and keep the "best" connection. This assists in load balancing as well as reducing user wait time as individual blocked servers do not stall the connection sequence.
Client auto-upgrade was enhanced to use incremental download and to use out-of-band download sites (authenticated with digital signatures). These changes made it more likely that a new client can be distributed at a time of blocking.

Independent Security Assessment of Psiphon 3

blog@psiphon.ca (Psiphon Inc.) — Tue, 14 Oct 2014 22:45:00 +0000

At Psiphon, we’re committed to open source development. We talked about this in a previous blog post, and you can access our source code here.

We were recently offered the chance to take this openness a step further with a formal security audit of our Windows and Android products, to be carried out by iSEC Partners. As part of our effort to be transparent in the way we operate, we are pleased to publish this report in full, which you can access here.

Overall, we are very happy with the results of the security audit, and for it to be recognized that we are “actively invested in ensuring the security of [our] users”. We have already addressed the one High Severity item uncovered by iSEC Partners, and will continue to address the other recommendations over time.

The main findings of the report are:

Psiphon follows most industry best-practices and takes measures to mitigate against attacks where it cannot.
Most findings were suggestions to further improve the system, particularly in relation to the growth in the number of people using the software.
No inherent architecture flaws were discovered.
One High Severity issue was found, related to automated server patching. We have now deployed automated server patching using Ansible.
Longer-term recommendations are being considered, and where appropriate built in to our development plans.

One particular finding of interest is the recognition by iSEC Partners that there is a potential for security issues related to the browser that we use for browser-only mode. We wrote about that recently when a new security flaw in the browser was discovered, and have already taken steps to mitigate against it.

We were very pleased to be given the opportunity to engage with this security review. We hope that you will find this report interesting, and that it will reassure you of our commitment to providing first-class software that will always be open source and secure.

Heartbleed and Psiphon

blog@psiphon.ca (Psiphon Inc.) — Sat, 04 Oct 2014 12:51:00 +0000

Summary of Heartbleed impact on Psiphon:

Some Psiphon servers were using affected versions of OpenSSL, leaving the Python web server vulnerable to the Heartbleed attack. Data at risk, within the web server component process, included Psiphon network topology information and network usage statistics in addition to web server key material.
The SSH/SSH+ Psiphon tunnels were not at risk. User traffic flowing through the Psiphon servers was not at risk. VPN Psiphon tunnels were potentially at risk for man-in-the-middle attacks as the per-session authentication secret is in Python web server memory.
On April 8, 2014, OpenSSL patches were applied to all affected Psiphon servers. In addition, all affected servers had their non-SSH/SSH+ capabilities revoked (out-of-band updates to all clients), ensuring clients will not attempt to use potentially compromised web server key material outside of the secure tunnel.
The Windows client does not use OpenSSL and is not affected by the Heartbleed attack.
The Android client does not use OpenSSL for its tunnel, but does use Android Java SSL for its web requests to Psiphon web servers and Amazon S3. As Android version 4.1.1 is affected by Heartbleed, our app on this particular version of Android remains vulnerable to Amazon, Psiphon servers, or a man-in-the-middle peeking at app memory.
The email auto-responder server had the affected version of OpenSSL. The attack against it would be to get it to make a SSL connection to a remote mail server (by sending an email request from an address that uses that server), which could then peek into the memory of the mail server. This could potentially expose email content, including addresses. The OpenSSL patches were applied April 8, 2014.
The feedback processing server had the affected version of OpenSSL. It may have used that library (via Python + Boto to make SSL connections to Amazon AWS services and Google Gmail server. This means that Amazon or Google could have accessed user feedback data. However, it should be noted that this data is already hosted in Amazon EC2 and a subset of this data is emailed to us via Gmail. The OpenSSL patches were applied April 8, 2014.
Psiphon was not using an affected version of OpenSSL.

Psiphon and the 2013 Iranian Election

blog@psiphon.ca (Psiphon Inc.) — Sun, 27 Oct 2013 10:58:00 +0000

Psiphon has over a million active users every week. People use our software to get news, information and social media content that they would otherwise not be able to see. We offer apps for Windows and Android devices, mostly distributed through partnerships with news broadcasters and human rights organisations.

This year, we’ve made a particularly big impact in Iran, coinciding with their Presidential election. Iran has always been a big challenge for us, and it’s also where we see the most people using our software. In a normal week, we see as many as 1.5 million unique users connect to our network from inside Iran. There are somewhere around 45 million people connected to the network in Iran, which accounts for 60% of the population.

We knew that the election period was going to cause some problems, but had no idea exactly what we would face. First, as early as March there were reports that VPN software was being blocked inside the country, as reported on Wired magazine’s site. Psiphon stayed available throughout this period, and in fact the user base doubled in just four weeks. We brought many more servers online to cope with the additional load on our network.

Then, at the beginning of May, the disruption to the Internet in Iran was brought to a whole new level. We saw a sudden spike in connections, suggesting that the software was rapidly disconnecting and reconnecting. With help from Collin Anderson and ASL19, we learned that SSL connections were being cut after 60 seconds, and all connections to sites outside of Iran were being severely throttled.

People using Psiphon were still able to connect and see some content, but had a heavily degraded experience. Psiphon’s built-in feedback mechanism allowed people to provide diagnostic information that helped us further -- we were receiving feedback at the rate of thousands of messages per day, all containing vital clues that could help us get back to normal.

Our development team rapidly released an update to Psiphon that provided the first workaround. Six further releases followed in the weeks leading up to the election. Psiphon’s software automatically updates, and these releases were pushed directly to the end users. At least half of our user base had the upgrade within a day of it being released, and by the time of the election, 90% of Psiphon users were connecting with known working versions.

Psiphon’s goal for the period of the election was to try and keep our network alive, so that anyone with an Internet connection was still able to get to the content they wanted to see. As many as 500 active servers were used to achieve this, on diverse networks, with close monitoring by the technical teams to ensure the system was available throughout that time.

Reports from Iran suggest that the throttling of SSL, and blocking of all non-HTTP traffic, was increased for the election period, and most specifically on June 14, the day of the election itself. Psiphon’s software remained available throughout this period. Although there was a reduction in traffic caused by the extreme throttling, there were still over 400,000 connections made by 125,000 unique users.

Psiphon also distributed content for projects set up to support Iranians specifically over the election period. These include The Global Dialogue and We Choose, projects offering a platform through which the Iranian Internet audience could discuss matters related to the election, and vote on candidates in a secure, open and fair process.

You can read a lot more technical detail about the election period in a report from our colleagues at ASL19.

What of the future in Iran? We’ve seen some encouraging signs from Hassan Rouhani, such as his openness to social media, but our user base is still growing, and so are the reports we’re getting of sites being blocked. Last week, Deutsche Welle’s new Director General, Peter Limbourg, called on Rouhani to stop blocking his organization’s Persian site. He also praised the work that we are doing at Psiphon to distribute DW content into Iran.

This month, we’re also starting two new partnerships with Manoto 1 and Radio Zamaneh. Both of these broadcasters have a large audience of Farsi speakers, and are trying to get their content seen and heard in Iran. We’re very pleased to be working with these broadcasters, and know that this will help to bring news, information and social media content to even more Iranians.