The Geography of Anonymous Communications: Predicting Escalation of Anonymity Networks During Events of Civil Unrest



Sandberg, Brian

Journal Title

Journal ISSN

Volume Title



Civil unrest can trigger escalation of anonymous communication to conceal user identity for protection or to circumvent censorship. Anonymization tools such as the Tor Network can support planning, orchestrating, or responding to protest events, while hiding user’s real location and identity. This research aimed to understand the relationship between protest events and Tor usage. Protests may be spontaneous or planned, and the affordances of anonymity networks may involve one or two day time lags preceding or following an event occurrence. Accurately characterizing this relationship required accounting for these different temporal usage patterns. A methodology was developed to automatically discover the best estimator for predicting Tor usage in response to protest events. Different classifiers were fit to data representing the different events types, number of events, actor categories, fatalities, and Tor metrics. It was also of interest to understand the use of anonymizing technology against the backdrop of different government regimes. While protests in democracies may be conducted overtly, those in authoritarian regimes may require more covertness by participants. Experiments were conducted using over five years of conflict event and Tor usage data. Nine countries were selected from the Armed Conflict Location and Event Dataset (ACLED), which focuses on countries in Africa. A selection criterion was based on large populations with Internet penetration rate of at least 25%, and an active history of protest events that occurred over the time period of the study. In addition, an even distribution of countries was selected based on their designation of free, partly-free, and not-free by the Freedom House organization. This research produced unique quantitative results demonstrating the contribution of anonymity networks to the formation and functioning of social movements and collective behavior. Prediction F1 Score was over 86%, which indicated a strong signal existed between civil unrest events and Tor usage. Results are significant given the multitude of use cases for Tor, with consistent escalation occurring during protest events, particularly in authoritarian regimes.



Anonymous communications, Crisis Event Data (ACLED), Supervised learning, Anonymity networks, Tor Network usage metrics, Automated Machine Learning (AutoML)