Throttling Twitter: Decoding the New Era of "Quiet" Censorship in Russia

TL;DR

In early 2021, Russia transitioned from blunt blocking to a more surgical censorship technique: targeted throttling. Unlike the Great Firewall of China which often cuts connections, Russia's new "TSPU" system degrades Twitter's speed to a crawl (~130 kbps), making the service virtually unusable while avoiding the "site blocked" page. This paper provides the first deep-dive technical analysis of this national-scale throttling event.

Background: From Decentralized Blocking to Centralized Control

Historically, Russia's censorship was decentralized—Roskomnadzor (the regulator) sent a "black list" to thousands of ISPs, who then implemented blocking using various hardware. This changed with the introduction of TSPU (Technical Solution for Threat Countermeasures). These are centralized DPI boxes controlled directly by the state. The throttling of Twitter served as the debut performance for this infrastructure.

Identifying the Trigger: Why "microsoft.com" Broke

The researchers discovered that the throttler is triggered by the Server Name Indication (SNI) in the TLS Client Hello.

One of the most fascinating (and embarrassing) findings was the "collateral damage." Initial rules were so poorly written that any domain containing the string t.co was throttled. This meant microsoft.com and reddit.com were accidentally slowed down because they contained the substring t.co. This confirmed the use of simple string/regex matching within the DPI logic.

Figure 1: Timeline of the Twitter throttling incident and regulatory actions.

Methodology: The "Record and Replay" Attack on the Censor

To understand the "black box" of Russian throttling without relying on Twitter's servers, the team used the Record and Replay method:

1. Record: Capture a valid TLS handshake with a Twitter SNI.
2. Replay: Send the exact same sequence of bytes from a Russian client to a controlled server at the University of Michigan.
3. Vary: Change specific bytes (inverting bits) to see what breaks the throttling.

Key Findings on the Throttling Mechanism:

• Traffic Policing: It doesn't delay packets; it drops them once they exceed ~130-150 kbps.
• Stateful but Limited: The throttler keeps track of the connection for about 10 minutes of inactivity.
• Asymmetry: Throttling only triggers if the connection is initiated from inside Russia toward the outside.
• Location: Testing with TTL (Time-To-Live) revealed the throttler is very close to the user—usually within the first 5 network hops.

Figure 2: Sequence number analysis showing the "gaps" where the throttler dropped packets to enforce the rate limit.

How to Bypass the Throttler

Because the DPI hardware has limited resources, it uses heuristics that can be exploited:

1. TCP Fragmentation: If the SNI is split across two TCP segments, the throttler (which doesn't perform full TCP reassembly) fails to "see" Twitter.
2. Protocol Stuffing: Pre-pending the Client Hello with non-standard valid TLS records (like Change Cipher Spec) confuses the parser.
3. Encrypted Client Hello (ECH): The most robust solution is to encrypt the SNI entirely within TLS 1.3, leaving the censor with nothing to match against.

Critical Insight: The "Quiet" Success of the Censor

The most striking takeaway isn't technical; it's political. Under the pressure of throttling, Twitter eventually complied with 91% of Russia's takedown requests. Throttling is effective because it provides the state with "plausible deniability" (the user might just think their Wi-Fi is bad) while successfully coercing platforms into compliance.

Conclusion

The Russian Twitter incident is a wake-up call. As censorship moves from "Off/On" to "Fast/Slow," measurement tools must shift from checking reachability to measuring throughput. The era of Quality of Service (QoS) as a weapon has officially arrived.