Russia's TSPU vs. Tor: five years of throttling, blocking and workarounds
On 1 December 2021, users on a number of Russian internet providers found that the Tor network had stopped working. The blocker was not a single national firewall but a layer of deep packet inspection hardware known as TSPU — technical means of countering threats — installed inside internet providers themselves. Five years later the measurement record tells a clear story: direct Tor connections in Russia have fallen by roughly ninety percent, while bridge connections have become the main way the country's remaining users reach the network.
The December 2021 blocking wave
OONI's report documented the start: from 1 December 2021, some Russian ISPs began blocking access to Tor. Of more than 65 networks tested, 15 showed signs of blocking, applied mostly by dropping connections to relay IPs and default obfs4 bridges until they timed out. Enforcement was uneven — on some networks only part of the users were affected, and techniques ranged from block pages to TLS interference. The report also traced the pressure on the Tor Project's website: some providers had blocked www.torproject.org as early as September 2021, and after a Roskomnadzor notice on 6 December the site entered the national blocklist on 7 December. At the time, Russia had the second-largest Tor user base in the world, with more than 300,000 daily users. “Right after we published this article, the Russian government has officially blocked our main website in Russia.” — Tor Project, 7 December 2021
The same week, the project launched a campaign asking volunteers to run bridges. Tor Metrics' related-events log for Russia records the wave as the blocking of directory authorities, relays, default obfs4 bridges, meek-azure and Snowflake on some ISPs, with a temporary cease of the blocking for less than a day starting on 8 December 2021 — on-and-off interference rather than one permanent wall. What degrades
For direct connections the degradation is technical and measurable. Censored Planet's study of the TSPU, presented at the Internet Measurement Conference in 2022, describes the devices as in-path and stateful, with blocking triggered by domain names in the TLS SNI field, by IP address and by QUIC traffic fingerprints. The researchers' own Tor entry node in Paris was blocked out-of-registry — outside any official list — from December 2021, and the residual blocking of its IP persisted long after the node was switched off in March 2022. On blocked addresses, outgoing connections pass through, but responses come back with their payload stripped and resets injected; even pings are dropped. Throttling is the quieter variant. In March 2021 Russia throttled Twitter nationwide — the first documented large-scale, targeted use of throttling for censorship — triggered by domain names in the TLS handshake and capping traffic to 130-150 kbps by dropping packets that exceeded the rate. Applied to Tor, the same method does not produce a clean error page; it produces slow handshakes and circuits that fail mid-transfer. Censored Planet observed such throttling on Russian networks between 26 February and 4 March 2022, after which the behavior was replaced by outright blocking. What keeps working
Bridges. The 2021 wave also hit the default ones: the Tor Project reported that default bridges, including obfs4 bridges provided through Moat and Snowflake, were not working in some Russian regions. The bridge campaign reached its goal of 200 new obfs4 bridges and passed 400, and private, unlisted bridges remain the dependable path, because a censor cannot enumerate what it does not know about. Tor Metrics counted roughly 310,000 daily direct-connecting users in Russia in late November 2021; by the end of January 2022 the figure had fallen to around 165,000-175,000. In October 2026 direct users have been oscillating between 18,000 and 23,000 per day. Bridge use tells the opposite story: between roughly 89,000 and 98,000 per day in October 2026, several times the direct count. Most Russians who still use Tor do so over bridges rather than plain connections. The machinery behind it
Censored Planet's research explains why evasion is hard. By fingerprinting TCP fragmentation behaviors, the 2022 study identified over one million endpoints across 650 Russian autonomous systems sitting behind TSPU devices, and found 70 percent of them to be at most two network hops from the end user — close enough to inspect essentially everything. Throttling and blocking behaviors were consistent across different ISPs, pointing to central coordination. The authors note that the TSPU went from ideation to deployment in three years and warn the architecture may become a blueprint for censorship systems elsewhere. Where things stand
Five years on, the situation is stable in an unhappy way. Direct Tor connections remain suppressed to the low tens of thousands of daily users, enforcement differs from network to network, and the bridge path carries most of the load. No public reporting has recorded a formal reversal of the policy. What the record does show is adaptation: each blocking round pushed users toward transports the censor had not yet learned to recognize, and most of them stayed there. Russia's campaign is one instance of a wider playbook. Our overview of national blocking patterns puts the TSPU era in context alongside how other countries try to filter Tor.
