What this is

Single-country anomaly detectors (DBSCAN, STL) catch local censorship events. They miss the more interesting kind: cross-country synchronized events — e.g. every Gulf state blocking the same app on the same day, or post-Soviet states tightening together around a regional flashpoint.

The multi-country anomaly burst detector (scripts/build-anomaly-bursts.py) scans 90 days of DBSCAN flips, groups them into single-day buckets, and surfaces days where K≥3 distinct countries flipped together as a candidate coordinated event. Each burst is then characterised by its modal shared domain, blocking method, and signal type from the evidence underlying the flip — producing a hypothesized common factor like shared_domain:chat.openai.com or shared_signal_type:outage.

What the first run found

90-day scan, 3,718 (country, day) cells scored against the live DBSCAN model, 820 anomalous flips, 73 bursts with K≥3 countries. 33 are statistically significant at p_adj < 0.05 under Bonferroni correction over the 91 days scanned.

The largest burst — 2026-05-03 with 58 countries co-flagged — was driven by OONI's globally- coordinated probe sweep of chat.openai.com on that date, not by coordinated censorship. This is the exact failure mode the brief warned about: co-occurrence is not coordination. A simultaneous burst can be a coincidence, a shared upstream outage, a probe-network methodology change, or real cross-state coordination — the detector can only flag the candidate, not adjudicate the cause.

More interesting candidate bursts include the 2026-04-12–14 sequence flagging protonvpn.com blocking spreading across 23–26 countries (which is consistent with a real anti-circumvention pattern), and recurring twitter.com (24 countries on 2026-04-21, 22 on 2026-04-24) and facebook.com (31 countries on 2026-04-13, 22 on 2026-04-16) bursts that warrant editor follow-up before any “coordinated censorship” framing.

How it works

• For each (country, day) cell with ≥5 measurements over the 90-day lookback, score with the same rolling-window DBSCAN that powers /v1/anomaly/dbscan/{cc} (window 45d, eps=75th-pct kNN, min_samples=3).
• Group flip events by day. Flag days where K≥3 distinct countries flipped.
• For each burst, mine the evidence table on those (cc, day) cells to find the modal blocking method, signal type, and affected domain across all members — this is the hypothesized shared factor.
• p-value: under independence per-country flip rates, p_event = product(member_rates), p_any = 1 − (1 − p_event)^N_days, p_adj = min(1, p_any × N_days) Bonferroni.
• Cap output to top 50 by significance. Significant-first sort, then by p_adj asc, then by k_countries desc.

Endpoints

• GET /v1/atlas/anomaly-bursts?limit=20&significant=true&min_k=5 — list recent bursts
• GET /v1/atlas/anomaly-bursts/{burst_id} — full details: per-country anomaly scores, per-country base rates, full shared-signal/method/domain distributions

Honest caveats

• Co-occurrence ≠ causation ≠ coordination. Any burst could be coincidence, shared infra failure, OONI methodology change, holiday traffic shift, or a fiber cut that happens to bisect a region. The detector flags candidates — a human editor must adjudicate.
• 6-hour bucketing collapsed to day. The brief asked for 6-hour windows; upstream evidence observed_at is day-granular, so buckets are day-level in practice. Finer bucketing would require per-test-time data we don't aggregate.
• Independence assumption is wrong. Censorship- adjacent neighbors correlate. Bonferroni p_adj is a conservative bound, not a causal-inference test.
• Underlying DBSCAN is noisy. AUC vs labeled incidents is 0.65 — just above the promote floor. Bursts should be treated as exploration hooks, not alerts.
• OONI methodology bursts are a known false positive. Synchronised probe-sweep additions look identical to coordinated censorship at this aggregation level. Cross-check the burst date against OONI's probe release log before drawing causal conclusions.

Why this matters

Most published censorship-detection work focuses on single-country single-event detection — the DBSCAN baseline already covers that. The burst detector adds an explicit cross-country axis that's rarely surfaced in real-time: candidate coordinated campaigns ranked by statistical significance, with their hypothesized common factor pre-computed from raw evidence. Even if the headline number (33 significant bursts in 90 days) is half false-positives, the other half are real shared events worth investigating — and the pipeline runs daily, automatically, without an analyst needing to remember to look.