The Architecture of an Uncensored Internet

Full report

On this page

Introduction

As global information infrastructure matures, the tension between the free flow of information and state-sponsored internet censorship has escalated into a highly sophisticated technological arms race. Nation-states increasingly view the internet not as a borderless commons, but as a domain of sovereign control. Governments utilize technical, legal, and infrastructural levers to filter, monitor, and suppress digital communications. In response, a robust ecosystem of censorship-resistance systems (CRS) has emerged, engineered to preserve access to information and protect the privacy of users operating in hostile network environments1. The architecture of an uncensored internet fundamentally relies on moving away from centralized chokepoints toward distributed, encrypted, and obfuscated paradigms. Centralized platforms—while offering superior usability, simplified governance, and efficient moderation—are highly susceptible to both legal coercion and technical blocking. By contrast, decentralization, federation, peer-to-peer (P2P) networking, and robust end-to-end encryption (E2EE) distribute risk and dilute the efficacy of state-level network interference. However, these systems inherently introduce severe trade-offs regarding abuse moderation, the proliferation of illegal content, and overall usability3. This report provides an exhaustive technical and policy analysis of the characteristics that render communication systems resistant to political censorship. It evaluates the mechanics of state-level filtering, contrasts foundational network architectures, assesses historical and contemporary circumvention technologies ranging from encrypted messaging to satellite internet, and analyzes the profound policy implications of cryptographic obfuscation. Finally, it establishes a framework of technical and legal design principles for building resilient, censorship-resistant infrastructure that balances the imperatives of civil liberties with the realities of network abuse.

Part I: The Mechanics of State-Level Censorship

Internet censorship is defined as the intentional impairing or blocking of access to online resources and services2. To disrupt information exchange, a censor attacks the information itself through corruption or deletion, or impairs the communication channel between the user and the publisher1. The implementation of these controls varies based on the state's technical capacity, legal framework, and willingness to incur collateral economic damage. Advanced censorship regimes deploy Deep Packet Inspection (DPI) technology in-line with national backbone infrastructure. DPI systems inspect the payload and metadata of network packets to identify specific application types, protocols, and content. To aid in this classification, censors rely on "distinguishers"—high-quality, low-cost feature-value pairs such as protocol signatures, packet size distributions, or timing intervals1. If a network flow's entropy or header structure matches a known circumvention tool, the DPI system terminates the connection, often via spoofed TCP RST (Reset) packets or silent packet dropping1. China’s Great Firewall (GFW) represents the most advanced censorship apparatus globally, moving beyond passive DPI to employ "active probing." When the GFW's passive sensors detect a suspicious, fully encrypted connection directed at a foreign server, it dynamically dispatches its own active probes to the destination IP address and port6. These probes attempt to communicate using various known circumvention protocols, such as Shadowsocks, V2Ray, or VMess8. If the server responds in a manner consistent with a proxy, the GFW adds the IP address to a national blocklist. Furthermore, the GFW has demonstrated the capability to perform real-time protocol fingerprinting and targeted blocking of encrypted protocols like QUIC, exploiting the computational overhead of decrypting initial packets to identify censored Server Name Indications (SNIs)7. Russia and Iran have pursued architectural isolation to assert control through the creation of domestic intranets. Russia's 2019 Sovereign Internet Law mandated the installation of Technical Means of Countering Threats (TSPU) hardware on all Internet Service Provider (ISP) networks10. This centralized DPI infrastructure allows the federal censor, Roskomnadzor, to throttle specific platforms, block Encrypted Client Hello (ECH) connections, and systematically hunt down commercial VPN protocols7. Similarly, Iran has developed the National Information Network (NIN). During periods of civil unrest, the Iranian government can sever international connectivity while keeping domestic banking, government, and media services operational6. This whitelisting approach renders traditional circumvention tools useless, as the physical routing to the global internet is completely severed.

Part II: Conceptual Foundations of Censorship Resistance

To survive in environments governed by active probing and DPI, communication systems must adopt architectural paradigms that eliminate single points of failure. The foundational components of censorship resistance dictate how data is stored, addressed, routed, and secured. Centralized systems route all data through a single entity or cluster of servers. While this allows for highly efficient data retrieval and straightforward content moderation, it creates a singular target for legal subpoenas, IP blocking, or DNS blackholing. Decentralization distributes the network across multiple autonomous nodes, ensuring that if one node is blocked, users can route around it. Federation is a specific subset of decentralization where multiple independent servers interoperate using standard open protocols. In a federated model, users on one server can communicate with users on another, preventing a censor from disabling the entire ecosystem without blocking thousands of independent domains. Peer-to-Peer (P2P) networking eliminates client-server hierarchies entirely. Every participant acts as both a consumer and a relay of information. P2P architectures provide high resilience against denial-of-service and censorship because there is no central server to block; the censor must identify and block the IP addresses of individual peers, which undergo constant churn14. This inherently relies on jurisdictional diversity. When network nodes are distributed globally across hundreds of distinct legal environments, no single government can mandate the shutdown of the entire system. End-to-End Encryption (E2EE) ensures that data is encrypted on the sender's device and decrypted only on the recipient's device. Intermediate nodes, including ISPs and platform operators, cannot access the plaintext. E2EE is fundamental to censorship resistance because it prevents censors from filtering based on content keywords. Modern E2EE protocols provide Forward Secrecy, ensuring that past compromises do not reveal older keys, and Post-Compromise Security, ensuring that future messages remain secure even if a key is temporarily compromised16. Traditional web architecture relies on location-based addressing, utilizing URLs that point to specific IP addresses. If the server at that IP is taken offline, the content is lost. Content-addressed storage identifies data by a cryptographic hash of its contents15. When a user requests a file, the network retrieves it from any peer hosting that specific hash. This decouples the data from its host, meaning that as long as one peer in the network retains a copy of the data, achieving redundancy, the information remains available and computationally verifiable. A major vulnerability in the traditional internet is the Domain Name System (DNS), which is hierarchically controlled and easily censored by local ISPs via DNS poisoning. Distributed naming systems attempt to resolve human-readable names to network addresses without central authorities. Zooko's Triangle postulates that a network naming system can only achieve two of three desirable properties simultaneously: being human-meaningful, secure against spoofing, and completely decentralized18. Systems striving to balance this triangle utilize distributed ledgers or massive Distributed Hash Tables (DHTs) to bypass centralized registrars entirely. Censorship resistance relies heavily on open-source implementations and user-controlled software. Closed-source applications can be forced by governments to push silent updates that implement client-side filtering. Open protocols ensure interoperability, while open-source software allows independent security audits. Local computation ensures that cryptographic keys remain strictly on the user's hardware, preventing platform operators from complying with compelled data requests.

Part III: Evaluating Historical and Contemporary Technologies

The evolution of censorship resistance is a direct reaction to the changing tactics of state-level adversaries. Analyzing how specific technologies operate—and how governments attempt to regulate or block them—reveals the ongoing tactical shifts in this domain.

Email, the Web, and Open Protocols

The early internet was built on open protocols like HTTP and SMTP that lacked inherent encryption. While their decentralized nature provided baseline resilience, their unencrypted metadata and plaintext payloads made them trivial for censors to filter via DPI. The global transition to HTTPS secured the payloads, but network metadata—specifically the Server Name Indication (SNI) within the TLS handshake, as well as DNS queries—remained in plaintext, allowing censors to reliably block specific websites without breaking the entire connection20.

Encrypted Client Hello (ECH) and the Battle for SNI

To close the SNI metadata leak, the Internet Engineering Task Force (IETF) developed Encrypted Client Hello (ECH), an extension to TLS 1.3 that encrypts the SNI during the initial cryptographic handshake21. ECH functions by utilizing a public key obtained via DNS to encrypt the true destination, presenting a generic public name to the network observer. This theoretically prevents censors from identifying which specific site a user is visiting on a shared hosting provider or Content Delivery Network (CDN). However, governments immediately adapted to regulate this architecture. Russia's Roskomnadzor and China's GFW actively target ECH traffic9. Blocking occurs when the DPI detects both the ECH TLS extension and specific public names associated with CDN providers. Because ECH is not yet universally adopted across the internet, censors can simply drop all ECH packets without causing catastrophic collateral damage to domestic commerce12. Furthermore, ECH's reliance on obtaining keys via encrypted DNS creates a secondary vulnerability; censors in China and Iran have effectively neutered ECH by systematically blocking encrypted DNS protocols20.

VPNs and Transport Obfuscation: WireGuard vs. AmneziaWG

Virtual Private Networks (VPNs) encrypt all device traffic, but traditional protocols like OpenVPN, IPsec, and WireGuard were designed for enterprise security, not censorship resistance. WireGuard is highly performant but relies on static packet headers and predictable handshake sizes. This low-entropy signature is trivially detected and blocked by Russian TSPU and Chinese DPI systems24. To counter this, developers fork these protocols to add obfuscation layers. AmneziaWG, a fork of WireGuard, maintains the core cryptography but alters the network shape to bypass DPI26. Architecture Diagram Description: The AmneziaWG Traffic Obfuscation FlowThe client application initiates a connection to the remote server. Instead of sending the standard, predictable WireGuard handshake, the AmneziaWG client injects a configurable number of "junk packets" populated with random bytes. This disrupts the state machines of DPI sensors analyzing connection-setup profiles. The client then sends the actual initiator packet, heavily modified with random prefix bytes to shuffle the headers, making them mimic standard TLS ClientHello patterns or QUIC UDP traffic. The state-level DPI system reads these high-entropy, variable-length UDP bursts, classifies the traffic as standard web noise or VoIP activity, and allows the encrypted tunnel to establish. By padding packets and randomizing headers, AmneziaWG achieves an entropy profile matching standard HTTPS traffic, defeating Russian blocking efforts that target signatures with lower entropy25.

End-to-Middle (E2M) Proxying

Traditional circumvention proxies lead to a perpetual cat-and-mouse game where censors discover and block proxy IP addresses. End-to-Middle (E2M) proxying—utilized in academic systems like Telex, Decoy Routing, and TapDance—shifts the circumvention infrastructure into the core of the internet28. Architecture Diagram Description: End-to-Middle (E2M) ProxyingA user inside a censored country initiates a standard TLS request to a highly popular, unblocked "decoy" destination, such as a major international news site. However, the client software embeds a cryptographic steganographic tag within the random nonce of the TLS ClientHello message. An E2M-enabled ISP located outside the censoring country passively monitors internet traffic using optical splitters. When the ISP’s station detects the steganographic tag, it actively intercepts the connection, blocking it from reaching the decoy site, and instead redirects the payload to the censored destination. To the censor's DPI equipment, the traffic appears completely identical to a standard, benign connection to the decoy site. Blocking E2M proxying requires the censor to block the entire participating ISP or all popular decoy sites, which results in unacceptable economic and social collateral damage28.

Anonymity Networks and the Bridge Distribution Problem

The Tor network provides low-latency anonymity by routing traffic through three randomized, encrypted relays. Because the public Tor directory lists all entry nodes, censors easily block them. To circumvent this, Tor uses Bridges, which are unlisted entry nodes. However, distributing these IP addresses to legitimate users without the censor also obtaining them—known as the Bridge Distribution Problem—is exceedingly difficult30. Recent innovations explore using standard WebRTC TURN servers as rendezvous channels, encapsulating Tor traffic inside mundane video-conferencing UDP flows to blend in with normal internet usage30. The Invisible Internet Project (I2P) offers an alternative approach, utilizing a decentralized directory and modified Kademlia DHT to route traffic. However, empirical studies demonstrate that I2P is highly vulnerable to targeted disruption; a censor can block over 95% of peer IP addresses by operating only a small number of malicious, stable routers within the network31.

Distributed File Systems: BitTorrent and IPFS

BitTorrent and the InterPlanetary File System (IPFS) provide censorship resistance via content addressing and P2P distribution15. IPFS utilizes the Kademlia DHT to resolve Content Identifiers (CIDs) to the IP addresses of peers hosting the data, and it uses Bitswap to transfer the data blocks15. While highly resilient against traditional centralized IP blocking, IPFS is vulnerable to localized P2P attacks. Architecture Diagram Description: IPFS DHT Sybil Eclipse AttackAn adversarial actor generates hundreds of malicious "Sybil" node identities within the IPFS network, calculating their cryptographic Node IDs to be mathematically adjacent to the target CID of a banned document. When a legitimate user inside the network queries the DHT to find the location of the banned CID, the Kademlia routing algorithm directs the request to the nodes closest to the hash. The request lands on the attacker's Sybil nodes. The Sybil nodes intentionally drop the request or return false routing information. The content is effectively eclipsed from the user, achieving total censorship without the need for network-level DPI or firewall intervention. \[cite: 14, 32, 33\]

Federated Social Networks: The AT Protocol

Centralized social media platforms act as the ultimate arbiters of speech and are highly susceptible to government takedown requests. Federated alternatives, such as those operating on the Authenticated Transfer (AT) Protocol, decouple the infrastructure34. The AT Protocol separates data hosting from data indexing and presentation. Users store their cryptographic identities and post records on Personal Data Servers (PDS)35. A centralized but swappable AppView aggregates this data for user consumption. Because users control their own PDS, data portability is guaranteed at a protocol level. If a government forces an AppView operator to censor a specific PDS, the user can seamlessly migrate their cryptographic identity to a new AppView, neutralizing the censorship action without losing their underlying social graph34. Governments attempting to regulate this architecture are forced to individually block thousands of independent PDS instances, vastly increasing the cost of censorship.

Encrypted Messaging: Signal and MLS

Messaging applications rely on robust E2EE to prevent content censorship and mass surveillance. The Signal Protocol, utilizing the Double Ratchet algorithm, ensures that every message uses a unique, ephemeral encryption key derived from a continuous cryptographic chain17. Scaling this security to large group chats historically required encrypting a single message multiple times, which is computationally inefficient and difficult to maintain over poor network connections. The IETF's Messaging Layer Security (MLS) protocol solves this using asynchronous Ratchet Trees, allowing highly efficient, mathematically provable E2EE for massive group chats17. This prevents state actors from monitoring large dissident communication channels. Furthermore, to combat the looming threat of quantum computers breaking current encryption, these protocols are rapidly integrating Post-Quantum cryptographic handshakes, such as Signal's PQXDH37.

Decentralized Identity

Decentralized Identity (DID) systems allow users to prove claims about themselves without relying on a centralized identity provider, such as a state ID system or a corporate tech giant. By anchoring verifiable credentials to distributed ledgers or P2P networks, DIDs prevent censors from revoking a user's digital existence or denying them access to digital services based on political affiliation. This fundamentally shifts the locus of identity control from the state to the individual.

Physical Layer Resilience: Mesh Networks and Satellite Internet

When authoritarian states sever terrestrial fiber-optic lines, logical circumvention via protocols fails entirely. True physical-layer censorship resistance theoretically relies on ad-hoc mesh networks, where user devices pass traffic directly to one another via Bluetooth or Wi-Fi Direct. However, mesh routing protocols suffer from severe bandwidth limitations, rapid battery drain, and require a high physical density of participating nodes to maintain a stable network topology. Satellite internet, notably SpaceX's Starlink, bypasses local terrestrial ISPs. However, satellite internet is not immune to censorship or state control. Starlink terminals rely on ground stations, which are frequently located in the same geographic region as the users, subjecting them to local regulatory control40. Furthermore, the physical layer is susceptible to electronic warfare, such as Russian jamming and non-destructive cyberattacks against satellite uplinks41. Operators also enforce strict geofencing based on GPS coordinates. During the Myanmar civil war, SpaceX unilaterally disabled thousands of terminals allegedly used by scam centers, demonstrating that commercial satellite internet remains a centrally governed system capable of sweeping, localized disconnection at the whim of the corporate operator or under pressure from host nations42.

Part IV: The Disadvantages and Trade-offs of Censorship Resistance

The architectural decisions that prevent state censorship inherently create severe, often intractable challenges for maintaining safe, reliable, and usable networks. By mathematically removing central points of control, engineers simultaneously remove the mechanisms used to police network abuse.

Abuse Moderation, Malware, and Illegal Content

In a centralized system, administrators can swiftly respond to warrants and remove Child Sexual Abuse Material (CSAM), malware distributors, and terrorist propaganda. In a decentralized, E2EE, or content-addressed system, centralized removal is impossible. On IPFS, once data is distributed, it cannot be deleted globally; it persists as long as one node chooses to pin it. Malicious actors heavily leverage this immutable storage to host phishing sites, ransomware payloads, and botnet command-and-control infrastructure, secure in the knowledge that their assets cannot be taken down by traditional domain seizures or ISP intervention.

Spam, Misinformation, and Trust

Without central gatekeepers, P2P and federated systems are highly vulnerable to Sybil attacks and spam campaigns. In federated networks like the AT Protocol, moderation cannot be enforced globally. Instead, it must be handled via composable, third-party labeling services, such as the open-source Ozone tool35. While this preserves free speech by allowing users to choose their own moderation parameters, it places a heavy cognitive burden on the individual to actively subscribe to effective moderation lists to filter out state-sponsored misinformation and harassment.

Reliability, Governance, and Usability

Decentralized systems suffer from high latency and data availability issues. If the peers hosting an IPFS CID go offline, the data becomes temporarily unavailable, creating a brittle user experience compared to centralized CDNs. Furthermore, open-source circumvention tools often require significant technical expertise to configure. Modifying AmneziaWG obfuscation parameters to bypass specific DPI heuristics requires an understanding of network transport layers, creating a significant usability barrier for average citizens26. Governance is equally fraught. Decentralized protocols require slow, consensus-based processes for upgrades. If a critical vulnerability is discovered in a P2P protocol, there is no central authority to force a patch, leaving legacy nodes perpetually vulnerable to exploitation.

Part V: Law Enforcement, Regulation, and the "Going Dark" Debate

The global proliferation of censorship-resistant, E2EE technology creates profound friction with law enforcement and national security agencies. Under the banner of the "Going Dark" debate, intelligence agencies argue that ubiquitous encryption hinders the investigation of serious crimes, human trafficking, and terrorism.

The Threat of Client-Side Scanning (CSS)

In response to unbreakable transport encryption, governments and some industry actors have proposed Client-Side Scanning (CSS) as a compromise43. Instead of weakening encryption in transit, CSS operates directly on the user's device. Before an image or message is encrypted and transmitted, the local operating system hashes the file or applies a machine-learning classifier to compare it against a database of objectionable material43. If a match is found, the content and user metadata are silently flagged and forwarded to law enforcement4.

Security and Policy Analysis of CSS

In their seminal analysis, "Bugs in our Pockets: The Risks of Client-Side Scanning," leading cryptographers and security researchers definitively argue that CSS is a dangerous and fundamentally flawed architecture3. The researchers conclude that CSS is conceptually identical to bulk mass surveillance, effectively placing a wiretap on every citizen's pocket4. Technically, CSS vastly expands the attack surface of consumer devices. The databases of targeted hashes or the machine-learning models can be reverse-engineered or poisoned by adversaries to create "BadNets," allowing malicious actors to evade detection entirely or generate false positives to frame innocent users45. From a policy perspective, CSS transforms E2EE from a mathematical guarantee of privacy into a conditional privilege granted by the state45. If the architecture of CSS is deployed globally for CSAM, authoritarian regimes will inevitably legally mandate the expansion of the scanning database to include political dissent, protest imagery, or religious content4. The opacity of mobile operating systems ensures that citizens cannot audit what is being scanned, creating a massive chilling effect on free speech and effectively destroying the concept of digital privacy for law-abiding citizens4.

Regulatory Approaches and Balancing Goals

Governments attempt to regulate decentralized architectures through several intersecting vectors:

1. Criminalizing Circumvention: Russia has explicitly banned the dissemination of VPN-related information, making it illegal to educate users on bypassing censorship, thereby forcing self-censorship and driving tools underground13.

2. Liability for Node Operators: Censors attempt to hold the operators of Tor exit nodes, IPFS gateways, or E2M decoy routing ISPs legally liable for the illicit traffic passing through their infrastructure, discouraging participation in decentralized routing.

3. App Store Takedowns: Rather than attacking the protocol mathematically, censors apply legal pressure to Apple and Google to remove circumvention applications from regional App Stores, exploiting the centralization of mobile software distribution.

Societies attempting to balance the competing goals of civil liberties and law enforcement must recognize that mathematically, there is no such thing as a secure backdoor. Any access mechanism created for democratic law enforcement is simultaneously a vulnerability that will inevitably be discovered and exploited by hostile state actors, criminal syndicates, and authoritarian regimes4.

Part VI: Design Principles for a Resilient Internet

To construct an internet architecture capable of withstanding both authoritarian censorship and malicious abuse, engineers and policymakers must adhere to specific, uncompromising design principles.

Technical Design Principles

1. Protocol Obfuscation as a Default: Privacy protocols can no longer rely purely on mathematical secrecy; they must achieve steganographic invisibility. All new transport protocols must feature highly randomized packet headers, timing jitter, and payload padding to match the high entropy of standard HTTPS or UDP traffic, thereby rendering DPI heuristics useless without severe overblocking26.

2. Decentralized Bootstrapping (Rendezvous): Systems must decouple the discovery phase from the connection phase. Relying on centralized directories for node IPs is a fatal flaw. Systems should utilize domain fronting, ECH, or covert channels to distribute bridge and peer information dynamically30.

3. Cryptographic Modularity and Agility: Protocols must be designed to swap cryptographic primitives seamlessly. As quantum computing advances, the ability to seamlessly integrate algorithms into systems like the Double Ratchet is vital for long-term data security37.

4. Content-Addressing with Localized Pinning: To prevent global takedowns, data should be distributed via content addressing. However, to mitigate abuse, systems should allow node operators complete autonomy to drop or refuse to host specific CIDs, isolating illegal content to rogue nodes rather than forcing the entire network to host it.

Legal and Policy Design Principles

1. Absolute Protection of E2EE: Policymakers must reject any legislation mandating encryption backdoors, key escrow, or mandatory Client-Side Scanning4. The collateral damage to national security, banking infrastructure, and human rights far outweighs the investigative benefits.

2. Safe Harbor for Infrastructure Relays: Jurisdictions that value a free internet must enact robust safe harbor laws that explicitly exempt the operators of intermediary routing nodes from liability for the encrypted payloads passing through their hardware.

3. Right to Cryptographic Self-Defense: Users must maintain the legal right to run open-source, locally compiled software and manage their own cryptographic keys. Hardware manufacturers must not be allowed to lock down devices to the point where users cannot install independent, unapproved circumvention applications.

Conclusion

The architecture of an uncensored internet is not defined by a single technology, but by a layered ecosystem of cryptographic guarantees, decentralized routing, and sophisticated transport obfuscation. As states enhance their capabilities with Deep Packet Inspection, active probing, and Sovereign Intranets, the engineering community has responded with paradigm-shifting innovations. Tools like AmneziaWG demonstrate that protocol mimicry can defeat national firewalls, while federated platforms like the AT Protocol prove that social graphs can survive centralized takedowns. However, the pursuit of total censorship resistance requires society to confront the inescapable reality of the "Going Dark" paradigm. The same cryptographic architectures that protect human rights defenders in hostile regimes simultaneously shield malicious actors. Proposed compromises, such as Client-Side Scanning, fail to bridge this divide; they instead introduce catastrophic systemic vulnerabilities that compromise the digital security of the entire global population. Ultimately, technical resilience is insufficient without a corresponding legal and policy framework that fiercely defends the right to privacy. A truly resilient internet must be built on the premise that network infrastructure is a neutral carrier of mathematically verifiable data, immune to the political or legal demands of any single jurisdiction.

Works cited

1. (PDF) SoK: Making Sense of Censorship Resistance Systems, https://www.researchgate.net/publication/305423571\_SoK\_Making\_Sense\_of\_Censorship\_Resistance\_Systems

2. 2026-03.pdf \- CERIAS \- Purdue, https://www.cerias.purdue.edu/assets/pdf/bibtex\_archive/2026-03.pdf

3. Bugs in our pockets: the risks of client-side scanning, https://academic.oup.com/cybersecurity/article-abstract/10/1/tyad020/7590463

4. (PDF) Bugs in our Pockets: The Risks of Client-Side Scanning, https://www.researchgate.net/publication/355233857\_Bugs\_in\_our\_Pockets\_The\_Risks\_of\_Client-Side\_Scanning

5. Towards a Censorship Analyser for Tor \- USENIX, https://www.usenix.org/system/files/conference/foci13/foci13-winter.pdf

6. editor's note \- Federal Communications Law Journal, http://www.fclj.org/wp-content/uploads/2024/03/Volume-76-Issue-2-Full-updated.pdf

7. Throttling Twitter: an emerging censorship technique in Russia, https://www.researchgate.net/publication/355829060\_Throttling\_Twitter\_an\_emerging\_censorship\_technique\_in\_Russia

8. How China Detects and Blocks Shadowsocks \- Great Firewall Report, https://gfw.report/publications/imc20/en/

9. Exposing and Circumventing SNI-based QUIC Censorship of the, https://gfw.report/publications/usenixsecurity25/en/

10. SOVEREIGN DIGITAL SIEGE & CRITICAL MARITIME CHOKEPOINTS, https://www.debugliesintel.com/sovereign-digital-siege-critical-maritime-chokepoints-a-unified-geopolitical-intelligence-compendium/

11. AmneziaWG Explained: The WireGuard Fork Built to Disappear, https://encapsulated.network/what-is-amneziawg/

12. Encrypted Client Hello didn't solve censorship, but still may have a, https://betanews.com/article/encrypted-client-hello-didnt-solve-censorship-but-still-may-have-a-role-to-play/

13. Report on Human Rights Implications of VPN Censorship in Russia, https://files.rks.global/vpn-block-report\_01.25.pdf

14. Kademlia \- Wikipedia, https://en.wikipedia.org/wiki/Kademlia

15. How IPFS works \- IPFS Docs, https://docs.ipfs.tech/concepts/how-ipfs-works/

16. How to Choose the Right Encrypted Communication Platform, https://growthshuttle.com/choose-encrypted-communication-platform/

17. End-to-End Encryption and Quantum Computers: What Breaks, https://quantumsecuritydefence.com/quantum-news/end-to-end-encryption-quantum-breakage/

18. Zooko's triangle — Grokipedia, https://grokipedia.com/page/Zooko's\_triangle

19. The GNU Name System \- Hacker News, https://news.ycombinator.com/item?id=32222360

20. Encrypted Client Hello (ECH) in Censorship Circumvention \- LibreCat, https://ris.uni-paderborn.de/record/60503

21. Encrypted Client Hello didn't solve censorship, but still may have a, https://adguard-dns.io/en/blog/encrypted-client-hello-misconceptions-future.html

22. Risky Biz News: Russia blocks Cloudflare ECH connections, https://news.risky.biz/risky-biz-news-russia-blocks-cloudflare-ech-connections/

23. Encrypted Client Hello (ECH) in Censorship Circumvention, https://corpus.lantern.io/papers/2025-niere-encrypted/

24. AmneziaWG Obfuscation \- GL.iNet Router Docs 4, https://docs.gl-inet.com/router/en/4/faq/amneziawg\_obfuscation/

25. VPN Protocols: History, Differences, and Principles of Operation, https://amnezia.org/blog/vpn-protocols-and-how-they-differ

26. AmneziaWG VPN: WireGuard for Censorship Bypass \- SelfTunnel, https://blog.selftunnel.com/amneziawg-vpn-explained/

27. How VPNs Really Work in 2026: Protocols, Leaks & Limits | Medium, https://medium.com/@danielabsi/how-vpns-really-work-in-2026-protocols-leaks-ownership-and-the-lies-in-the-marketing-1ea2ff34564f

28. Anticensorship in the Network Infrastructure \- Telex \- USENIX, https://www.usenix.org/legacy/event/sec11/tech/full\_papers/Wustrow.pdf

29. TapDance: End-to-Middle Anticensorship without Flow Blocking, https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-wustrow.pdf

30. Extended Abstract: Using TURN Servers for Censorship Evasion, https://www.petsymposium.org/foci/2025/foci-2025-0003.pdf

31. An Empirical Study of the I2P Anonymity Network and its Censorship, https://www.semanticscholar.org/paper/An-Empirical-Study-of-the-I2P-Anonymity-Network-and-Hoang-Kintis/bfa85023f2376b4821515843554a881b3660f96a

32. Content Censorship in theInterPlanetary File System \- arXiv, https://arxiv.org/html/2307.12212v2

33. A straightforward censorship attack against IPFS, https://discuss.ipfs.tech/t/a-straightforward-censorship-attack-against-ipfs/17992

34. AT Protocol \- Wikipedia, https://en.wikipedia.org/wiki/AT\_Protocol

35. Introduction to AT Protocol – mackuba.eu, https://mackuba.eu/2025/08/20/introduction-to-atproto/

36. signal-security-architecture.md \- GitHub, https://github.com/iAnonymous3000/Pr0f3ss0r-1nc0gn1t0/blob/main/content/blog/security/signal-security-architecture.md

37. Signal Protocol \- Wikipedia, https://en.wikipedia.org/wiki/Signal\_Protocol

38. Secure video conferencing for Matrix \- Element, https://element.io/blog/secure-video-conferencing-for-matrix/

39. Signal and Messaging Layer Security \- Artech House, https://us.artechhouse.com/Signal-and-Messaging-Layer-Security-P2439.aspx

40. Internet shutdowns at record high in Africa as access 'weaponised', https://news.ycombinator.com/item?id=43325628

41. Russian cyber and information warfare in practice \- Chatham House, https://www.chathamhouse.org/2023/12/russian-cyber-and-information-warfare-practice/03-distinctive-features-war

42. SpaceX disables 2,500 Starlink terminals allegedly used by Asian, https://news.ycombinator.com/item?id=45680547

43. \[2110.07450\] Bugs in our Pockets: The Risks of Client-Side Scanning, https://arxiv.org/abs/2110.07450

44. Point-Counterpoint | Client-Side Scanning \- Judicature, https://judicature.duke.edu/articles/you-are-being-scanned/

45. Bugs in our Pockets: The Risks of Client-Side Scanning, https://www.semanticscholar.org/paper/Bugs-in-our-Pockets%3A-The-Risks-of-Client-Side-Abelson-Anderson/29c2bd88f7c7c83c94fb015b7397755182ee63de

46. Fact Sheet: Client-Side Scanning \- Internet Society, https://www.internetsociety.org/resources/doc/2020/fact-sheet-client-side-scanning/