How a censor blocks is as revealing as what it blocks. Voidly's new
per-content-category technique view — /v1/measurement/category-techniques
— crosses the blocking method with the content type, and a clear
pattern falls out: DNS poisoning is the near-universal tool, but several states
escalate to a harder-to-evade method for one category in particular —
real-time communication and messaging.
DNS poisoning is the default everywhere
Across every content category, DNS manipulation is the dominant censorship method — 74% to 91% of method-resolved blocking measurements globally. It is cheap and scales: poison the resolver answer and the domain "disappears" for anyone using the default DNS. News, search, social, adult content, hosting — all are blocked overwhelmingly at the DNS layer.
But messaging draws connection-level interference
The exception is communication and messaging tools. Several censors reserve TCP-reset / connection-level interference — a costlier method that requires watching and actively killing the live connection — for comms, while leaving news at the DNS layer. Among the 23 countries with enough categorised comms measurements:
| Country | Comms blocked by TCP-reset | News blocked by TCP-reset |
|---|---|---|
| Iran (IR) | 62% (45/72) | 15% (17/116) |
| Pakistan (PK) | 41% (53/130) | 0% (0/151) |
| Egypt (EG) | 24% (21/88) | 0% (0/109) |
| Cambodia (KH) | 100% (78/78) | — (no news data) |
| Myanmar (MM) | 100% (77/77) | — (no news data) |
Iran is the cleanest contrast: it reserves connection-level resets for 62% of its comms blocking but only 15% for news — a four-fold escalation aimed squarely at messaging.
Why the method matters
The choice is practical. DNS poisoning is trivially bypassed — switch to DNS-over-HTTPS or a custom resolver and the block evaporates. TCP-reset injection is different: the censor must inspect and tear down the live TCP connection, which is more expensive to operate but far harder for a user to circumvent. Spending that effort specifically on real-time communication suggests these states prioritise un-circumventable blocking of messaging over news — they would rather you could not coordinate than that you could not read.
The instructive outlier: China
China does not fit the pattern — it RST-blocks nearly everything (comms 58%, news 60%). That is the signature of a uniformly heavy, well-resourced apparatus applying its most robust method across the board, rather than the content-targeted escalation seen in Iran, Pakistan and Egypt.
Honest caveats
domain_categoryis the Citizen Lab test-list tag, present on ~23% of evidence; this is the composition of method-resolved blocking measurements (signal_levelcritical/elevated), not per-incident attribution.block_generic("method unresolved") and IODA connectivity outages are excluded — they are not censorship techniques.- Some country-category cells are thin; always read the per-cell count. The robust contrasts are IR (comms n=72, news n=116) and CN (n=231/394); KH and MM have no categorised news measurements, so there is no within-country comparison there.
- Method tagging skews toward measurements that carry a resolvable OONI
signal_type; shares (not raw counts) are reported so categories remain comparable despite differing volume.
Reproduce it live: /v1/measurement/category-techniques
(add ?country=IR or ?country=CN). Companion finding on
per-country technique fingerprints:
Every censor has a fingerprint.