Also at ]Institute for Subatomic Physics, Utrecht University, Utrecht,
NetherlandsAlso at ]Coimbra Polytechnic - ISEC, Coimbra, Portugal

XENON Collaboration

# A Search for Light Dark Matter Interactions Enhanced by the Migdal effect or
Bremsstrahlung in XENON1T

E. Aprile  Physics Department, Columbia University, New York, NY 10027, USA
J. Aalbers  Oskar Klein Centre, Department of Physics, Stockholm University,
AlbaNova, Stockholm SE-10691, Sweden  F. Agostini  Department of Physics and
Astronomy, University of Bologna and INFN-Bologna, 40126 Bologna, Italy  M.
Alfonsi  Institut für Physik & Exzellenzcluster PRISMA, Johannes Gutenberg-
Universität Mainz, 55099 Mainz, Germany  L. Althueser  Institut für
Kernphysik, Westfälische Wilhelms-Universität Münster, 48149 Münster, Germany
F. D. Amaro  LIBPhys, Department of Physics, University of Coimbra, 3004-516
Coimbra, Portugal  V. C. Antochi  Oskar Klein Centre, Department of Physics,
Stockholm University, AlbaNova, Stockholm SE-10691, Sweden  E. Angelino  INAF-
Astrophysical Observatory of Torino, Department of Physics, University of
Torino and INFN-Torino, 10125 Torino, Italy  F. Arneodo  New York University
Abu Dhabi, Abu Dhabi, United Arab Emirates  D. Barge  Oskar Klein Centre,
Department of Physics, Stockholm University, AlbaNova, Stockholm SE-10691,
Sweden  L. Baudis  Physik-Institut, University of Zurich, 8057 Zurich,
Switzerland  B. Bauermeister  Oskar Klein Centre, Department of Physics,
Stockholm University, AlbaNova, Stockholm SE-10691, Sweden  L. Bellagamba
Department of Physics and Astronomy, University of Bologna and INFN-Bologna,
40126 Bologna, Italy  M. L. Benabderrahmane  New York University Abu Dhabi,
Abu Dhabi, United Arab Emirates  T. Berger  Department of Physics, Applied
Physics and Astronomy, Rensselaer Polytechnic Institute, Troy, NY 12180, USA
P. A. Breur  Nikhef and the University of Amsterdam, Science Park, 1098XG
Amsterdam, Netherlands  A. Brown  Physik-Institut, University of Zurich, 8057
Zurich, Switzerland  E. Brown  Department of Physics, Applied Physics and
Astronomy, Rensselaer Polytechnic Institute, Troy, NY 12180, USA  S. Bruenner
Max-Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  G. Bruno  New
York University Abu Dhabi, Abu Dhabi, United Arab Emirates  R. Budnik
Department of Particle Physics and Astrophysics, Weizmann Institute of
Science, Rehovot 7610001, Israel  C. Capelli  Physik-Institut, University of
Zurich, 8057 Zurich, Switzerland  J. M. R. Cardoso  LIBPhys, Department of
Physics, University of Coimbra, 3004-516 Coimbra, Portugal  D. Cichon  Max-
Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  D. Coderre
Physikalisches Institut, Universität Freiburg, 79104 Freiburg, Germany  A. P.
Colijn  [  Nikhef and the University of Amsterdam, Science Park, 1098XG
Amsterdam, Netherlands  J. Conrad  Oskar Klein Centre, Department of Physics,
Stockholm University, AlbaNova, Stockholm SE-10691, Sweden  J. P. Cussonneau
SUBATECH, IMT Atlantique, CNRS/IN2P3, Université de Nantes, Nantes 44307,
France  M. P. Decowski  Nikhef and the University of Amsterdam, Science Park,
1098XG Amsterdam, Netherlands  P. de Perio  Physics Department, Columbia
University, New York, NY 10027, USA  A. Depoian  Department of Physics and
Astronomy, Purdue University, West Lafayette, IN 47907, USA  P. Di Gangi
Department of Physics and Astronomy, University of Bologna and INFN-Bologna,
40126 Bologna, Italy  A. Di Giovanni  New York University Abu Dhabi, Abu
Dhabi, United Arab Emirates  S. Diglio  SUBATECH, IMT Atlantique, CNRS/IN2P3,
Université de Nantes, Nantes 44307, France  A. Elykov  Physikalisches
Institut, Universität Freiburg, 79104 Freiburg, Germany  G. Eurin  Max-Planck-
Institut für Kernphysik, 69117 Heidelberg, Germany  J. Fei  Department of
Physics, University of California, San Diego, CA 92093, USA  A. D. Ferella
Oskar Klein Centre, Department of Physics, Stockholm University, AlbaNova,
Stockholm SE-10691, Sweden  A. Fieguth  Institut für Kernphysik, Westfälische
Wilhelms-Universität Münster, 48149 Münster, Germany  W. Fulgione  INFN-
Laboratori Nazionali del Gran Sasso and Gran Sasso Science Institute, 67100
L’Aquila, Italy  INAF-Astrophysical Observatory of Torino, Department of
Physics, University of Torino and INFN-Torino, 10125 Torino, Italy  P. Gaemers
Nikhef and the University of Amsterdam, Science Park, 1098XG Amsterdam,
Netherlands  A. Gallo Rosso  INFN-Laboratori Nazionali del Gran Sasso and Gran
Sasso Science Institute, 67100 L’Aquila, Italy  M. Galloway  Physik-Institut,
University of Zurich, 8057 Zurich, Switzerland  F. Gao  Physics Department,
Columbia University, New York, NY 10027, USA  M. Garbini  Department of
Physics and Astronomy, University of Bologna and INFN-Bologna, 40126 Bologna,
Italy  L. Grandi  Department of Physics & Kavli Institute for Cosmological
Physics, University of Chicago, Chicago, IL 60637, USA  Z. Greene  Physics
Department, Columbia University, New York, NY 10027, USA  C. Hasterok  Max-
Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  C. Hils  Institut
für Physik & Exzellenzcluster PRISMA, Johannes Gutenberg-Universität Mainz,
55099 Mainz, Germany  E. Hogenbirk  Nikhef and the University of Amsterdam,
Science Park, 1098XG Amsterdam, Netherlands  J. Howlett  Physics Department,
Columbia University, New York, NY 10027, USA  M. Iacovacci  Department of
Physics “Ettore Pancini”, University of Napoli and INFN-Napoli, 80126 Napoli,
Italy  R. Itay  Department of Particle Physics and Astrophysics, Weizmann
Institute of Science, Rehovot 7610001, Israel  F. Joerg  Max-Planck-Institut
für Kernphysik, 69117 Heidelberg, Germany  S. Kazama
<EMAIL_ADDRESS>Kobayashi-Maskawa Institute for the Origin of
Particles and the Universe, Nagoya University, Furo-cho, Chikusa-ku, Nagoya,
Aichi 464-8602, Japan  A. Kish  Physik-Institut, University of Zurich, 8057
Zurich, Switzerland  M. Kobayashi  Physics Department, Columbia University,
New York, NY 10027, USA  G. Koltman  Department of Particle Physics and
Astrophysics, Weizmann Institute of Science, Rehovot 7610001, Israel  A. Kopec
Department of Physics and Astronomy, Purdue University, West Lafayette, IN
47907, USA  H. Landsman  Department of Particle Physics and Astrophysics,
Weizmann Institute of Science, Rehovot 7610001, Israel  R. F. Lang  Department
of Physics and Astronomy, Purdue University, West Lafayette, IN 47907, USA  L.
Levinson  Department of Particle Physics and Astrophysics, Weizmann Institute
of Science, Rehovot 7610001, Israel  Q. Lin<EMAIL_ADDRESS>Physics
Department, Columbia University, New York, NY 10027, USA  S. Lindemann
Physikalisches Institut, Universität Freiburg, 79104 Freiburg, Germany  M.
Lindner  Max-Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  F.
Lombardi  LIBPhys, Department of Physics, University of Coimbra, 3004-516
Coimbra, Portugal  Department of Physics, University of California, San Diego,
CA 92093, USA  J. A. M. Lopes  [  LIBPhys, Department of Physics, University
of Coimbra, 3004-516 Coimbra, Portugal  E. López Fune  LPNHE, Université
Pierre et Marie Curie, Université Paris Diderot, CNRS/IN2P3, Paris 75252,
France  C. Macolino  LAL, Université Paris-Sud, CNRS/IN2P3, Université Paris-
Saclay, F-91405 Orsay, France  J. Mahlstedt  Oskar Klein Centre, Department of
Physics, Stockholm University, AlbaNova, Stockholm SE-10691, Sweden  M.
Manenti  New York University Abu Dhabi, Abu Dhabi, United Arab Emirates  A.
Manfredini  Physik-Institut, University of Zurich, 8057 Zurich, Switzerland
Department of Particle Physics and Astrophysics, Weizmann Institute of
Science, Rehovot 7610001, Israel  F. Marignetti  Department of Physics “Ettore
Pancini”, University of Napoli and INFN-Napoli, 80126 Napoli, Italy  T.
Marrodán Undagoitia  Max-Planck-Institut für Kernphysik, 69117 Heidelberg,
Germany  J. Masbou  SUBATECH, IMT Atlantique, CNRS/IN2P3, Université de
Nantes, Nantes 44307, France  S. Mastroianni  Department of Physics “Ettore
Pancini”, University of Napoli and INFN-Napoli, 80126 Napoli, Italy  M.
Messina  INFN-Laboratori Nazionali del Gran Sasso and Gran Sasso Science
Institute, 67100 L’Aquila, Italy  New York University Abu Dhabi, Abu Dhabi,
United Arab Emirates  K. Micheneau  SUBATECH, IMT Atlantique, CNRS/IN2P3,
Université de Nantes, Nantes 44307, France  K. Miller  Department of Physics &
Kavli Institute for Cosmological Physics, University of Chicago, Chicago, IL
60637, USA  A. Molinario  INFN-Laboratori Nazionali del Gran Sasso and Gran
Sasso Science Institute, 67100 L’Aquila, Italy  K. Morå  Oskar Klein Centre,
Department of Physics, Stockholm University, AlbaNova, Stockholm SE-10691,
Sweden  Y. Mosbacher  Department of Particle Physics and Astrophysics,
Weizmann Institute of Science, Rehovot 7610001, Israel  M. Murra  Institut für
Kernphysik, Westfälische Wilhelms-Universität Münster, 48149 Münster, Germany
J. Naganoma  INFN-Laboratori Nazionali del Gran Sasso and Gran Sasso Science
Institute, 67100 L’Aquila, Italy  Department of Physics and Astronomy, Rice
University, Houston, TX 77005, USA  K. Ni  Department of Physics, University
of California, San Diego, CA 92093, USA  U. Oberlack  Institut für Physik &
Exzellenzcluster PRISMA, Johannes Gutenberg-Universität Mainz, 55099 Mainz,
Germany  K. Odgers  Department of Physics, Applied Physics and Astronomy,
Rensselaer Polytechnic Institute, Troy, NY 12180, USA  J. Palacio  SUBATECH,
IMT Atlantique, CNRS/IN2P3, Université de Nantes, Nantes 44307, France  B.
Pelssers  Oskar Klein Centre, Department of Physics, Stockholm University,
AlbaNova, Stockholm SE-10691, Sweden  R. Peres  Physik-Institut, University of
Zurich, 8057 Zurich, Switzerland  J. Pienaar  Department of Physics & Kavli
Institute for Cosmological Physics, University of Chicago, Chicago, IL 60637,
USA  V. Pizzella  Max-Planck-Institut für Kernphysik, 69117 Heidelberg,
Germany  G. Plante  Physics Department, Columbia University, New York, NY
10027, USA  R. Podviianiuk  INFN-Laboratori Nazionali del Gran Sasso and Gran
Sasso Science Institute, 67100 L’Aquila, Italy  J. Qin  Department of Physics
and Astronomy, Purdue University, West Lafayette, IN 47907, USA  H. Qiu
Department of Particle Physics and Astrophysics, Weizmann Institute of
Science, Rehovot 7610001, Israel  D. Ramírez García  Physikalisches Institut,
Universität Freiburg, 79104 Freiburg, Germany  S. Reichard  Physik-Institut,
University of Zurich, 8057 Zurich, Switzerland  B. Riedel  Department of
Physics & Kavli Institute for Cosmological Physics, University of Chicago,
Chicago, IL 60637, USA  A. Rocchetti  Physikalisches Institut, Universität
Freiburg, 79104 Freiburg, Germany  N. Rupp  Max-Planck-Institut für
Kernphysik, 69117 Heidelberg, Germany  J. M. F. dos Santos  LIBPhys,
Department of Physics, University of Coimbra, 3004-516 Coimbra, Portugal  G.
Sartorelli  Department of Physics and Astronomy, University of Bologna and
INFN-Bologna, 40126 Bologna, Italy  N. Šarčević  Physikalisches Institut,
Universität Freiburg, 79104 Freiburg, Germany  M. Scheibelhut  Institut für
Physik & Exzellenzcluster PRISMA, Johannes Gutenberg-Universität Mainz, 55099
Mainz, Germany  S. Schindler  Institut für Physik & Exzellenzcluster PRISMA,
Johannes Gutenberg-Universität Mainz, 55099 Mainz, Germany  J. Schreiner  Max-
Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  D. Schulte
Institut für Kernphysik, Westfälische Wilhelms-Universität Münster, 48149
Münster, Germany  M. Schumann  Physikalisches Institut, Universität Freiburg,
79104 Freiburg, Germany  L. Scotto Lavina  LPNHE, Université Pierre et Marie
Curie, Université Paris Diderot, CNRS/IN2P3, Paris 75252, France  M. Selvi
Department of Physics and Astronomy, University of Bologna and INFN-Bologna,
40126 Bologna, Italy  P. Shagin  Department of Physics and Astronomy, Rice
University, Houston, TX 77005, USA  E. Shockley  Department of Physics & Kavli
Institute for Cosmological Physics, University of Chicago, Chicago, IL 60637,
USA  M. Silva  LIBPhys, Department of Physics, University of Coimbra, 3004-516
Coimbra, Portugal  H. Simgen  Max-Planck-Institut für Kernphysik, 69117
Heidelberg, Germany  C. Therreau  SUBATECH, IMT Atlantique, CNRS/IN2P3,
Université de Nantes, Nantes 44307, France  D. Thers  SUBATECH, IMT
Atlantique, CNRS/IN2P3, Université de Nantes, Nantes 44307, France  F. Toschi
Physikalisches Institut, Universität Freiburg, 79104 Freiburg, Germany  G.
Trinchero  INAF-Astrophysical Observatory of Torino, Department of Physics,
University of Torino and INFN-Torino, 10125 Torino, Italy  C. Tunnell
Department of Physics and Astronomy, Rice University, Houston, TX 77005, USA
N. Upole  Department of Physics & Kavli Institute for Cosmological Physics,
University of Chicago, Chicago, IL 60637, USA  M. Vargas  Institut für
Kernphysik, Westfälische Wilhelms-Universität Münster, 48149 Münster, Germany
G. Volta  Physik-Institut, University of Zurich, 8057 Zurich, Switzerland  O.
Wack  Max-Planck-Institut für Kernphysik, 69117 Heidelberg, Germany  H. Wang
Physics & Astronomy Department, University of California, Los Angeles, CA
90095, USA  Y. Wei  Department of Physics, University of California, San
Diego, CA 92093, USA  C. Weinheimer  Institut für Kernphysik, Westfälische
Wilhelms-Universität Münster, 48149 Münster, Germany  D. Wenz  Institut für
Physik & Exzellenzcluster PRISMA, Johannes Gutenberg-Universität Mainz, 55099
Mainz, Germany  C. Wittweg  Institut für Kernphysik, Westfälische Wilhelms-
Universität Münster, 48149 Münster, Germany  J. Wulf  Physik-Institut,
University of Zurich, 8057 Zurich, Switzerland  J. Ye  Department of Physics,
University of California, San Diego, CA 92093, USA  Y. Zhang  Physics
Department, Columbia University, New York, NY 10027, USA  T. Zhu  Physics
Department, Columbia University, New York, NY 10027, USA  J. P. Zopounidis
LPNHE, Université Pierre et Marie Curie, Université Paris Diderot, CNRS/IN2P3,
Paris 75252, France<EMAIL_ADDRESS>
###### Abstract

Direct dark matter detection experiments based on a liquid xenon target are
leading the search for dark matter particles with masses above $\sim$ 5
GeV/c2, but have limited sensitivity to lighter masses because of the small
momentum transfer in dark matter-nucleus elastic scattering. However, there is
an irreducible contribution from inelastic processes accompanying the elastic
scattering, which leads to the excitation and ionization of the recoiling atom
(the Migdal effect) or the emission of a Bremsstrahlung photon. In this
letter, we report on a probe of low-mass dark matter with masses down to about
85 MeV/c2 by looking for electronic recoils induced by the Migdal effect and
Bremsstrahlung, using data from the XENON1T experiment. Besides the approach
of detecting both scintillation and ionization signals, we exploit an approach
that uses ionization signals only, which allows for a lower detection
threshold. This analysis significantly enhances the sensitivity of XENON1T to
light dark matter previously beyond its reach.

Dark Matter, Direct Detection, Xenon, Migdal effect, Bremsstrahlung

###### pacs:

95.35.+d, 14.80.Ly, 29.40.-n, 95.55.Vj

The existence of dark matter (DM) is supported by various astronomical and
cosmological observations Clowe  _et al._ (2004); Rubin  _et al._ (1980);
Aghanim  _et al._ (2018) but its nature remains unknown. The most promising DM
candidate is the so-called weakly interacting massive particle (WIMP) Jungman
_et al._ (1996), which explains the current abundance of dark matter as a
thermal relic of the Big Bang Lee and Weinberg (1977). In the last three
decades, numerous terrestrial experiments have been built to detect the faint
interactions between WIMPs and ordinary matter. Among them, experiments using
dual-phase (liquid/gas) xenon time projection chambers (TPCs) Akerib  _et al._
(2016); Cui  _et al._ (2017); Aprile  _et al._ (2018) are leading the search
for WIMPs with masses from a few GeV/c2 to TeV/c2. The mass of the WIMP is
expected to be larger than about 2 GeV/c2 from the Lee-Weinberg limit Lee and
Weinberg (1977) assuming a weak scale interaction. On the other hand, DM in
the sub-GeV/c2 mass range has been proposed in several models Battaglieri  _et
al._ (2017); Boehm  _et al._ (2004); Boehm and Fayet (2004). In this letter,
we report on a probe of light DM-nucleon elastic interactions by looking for
electronic recoils (ERs) in XENON1T, induced by secondary radiation
(Bremsstrahlung Kouvaris and Pradler (2017) and the Migdal effect Migdal
(1941); Ibe  _et al._ (2018)) that can accompany a nuclear recoil (NR). ER
signals induced by the Migdal effect and Bremsstrahlung (BREM) can go well
below 1 keV, where the detection efficiency for scintillation signal is low.
Therefore, in addition to the analysis utilizing both ionization and
scintillation signals, we performed analysis using the ionization signal only,
which improves the detection efficiency for sub-keV ER events. We present
results from a proble of light DM (LDM) with masses as low as 85 MeV/c2.

The XENON1T direct dark matter detection experiment Aprile  _et al._ (2017a)
uses a dual-phase TPC containing 2 tonnes of ultra-pure liquid xenon (LXe) as
the active target material. It is located at the INFN Laboratori Nazionali del
Gran Sasso (LNGS) in Italy, which has an average rock overburden of 3600 m
water-equivalent. The prompt primary scintillation (S1) and secondary
electroluminescence of ionized electrons (S2) signals are detected by top and
bottom arrays of 248 Hamamatsu R11410-21 3′′ photomultiplier tubes (PMTs)
Aprile  _et al._ (2015, 2017b). They are used to reconstruct the deposited
energy and the event interaction position in three dimensions, which allows
for fiducialization of the active volume Aprile  _et al._ (2019a, b). The
XENON1T experiment has published WIMP search results by looking for NRs from
WIMP-nucleus elastic scattering using data from a one-tonne-year exposure,
achieving the lowest ER background in a DM search experiment Aprile  _et al._
(2018). The excellent sensitivity of LXe experiments to heavy WIMPs comes from
the heavy xenon nucleus which gives a coherent enhancement of the interaction
cross-section and from the large NR energy. The sensitivity to sub-GeV/c2 LDM,
on the other hand, decreases rapidly with lowering DM mass since detectable
scintillation and ionization signals produced by these NRs become too small.
The energy threshold (defined here as the energy at which the efficiency is
10%) in a LXe TPC is mainly limited by the amount of detectable S1 signals. A
significant fraction of deposited NR energy is transferred into heat due to
the Lindhard quenching effect Lindhard  _et al._ (1963). Thus the detection
efficiency for these NRs becomes extremely low, with less than 10% for NRs
below 3.5 keV in XENON1T Aprile  _et al._ (2018). It is challenging to detect
the NR signals from LDM interactions.

Unlike NRs, ERs lose negligible energy as heat because recoil electrons have
small masses compared with xenon nuclei. This leads to a lower energy
threshold for ER signals. Probing the ER signals induced by the Migdal effect
and BREM enables a significant boost of XENON1T’s sensitivity to LDMs, thanks
to the lowered threshold.

When a particle elastically scatters off a xenon nucleus, the nucleus
undergoes a sudden momentum change with respect to the orbital atomic
electrons, resulting in the polarization of the recoiling atom and a kinematic
boost of the electrons. The de-polarization process can lead to BREM emission
Kouvaris and Pradler (2017), and the kinematic boost of atomic electrons can
result in ionization and/or excitation of the atom, which eventually causes
secondary radiation, known as the Migdal effect (MIGD) Migdal (1941); Ibe  _et
al._ (2018).

The differential rate of BREM emission with photon energy EER is given by

$\frac{d^{2}R}{dE_{\mathrm{ER}}dv}\propto\frac{\left|f(E_{\mathrm{ER}})\right|^{2}}{E_{\mathrm{ER}}}\sqrt{1-\frac{2E_{\mathrm{ER}}}{\mu_{N}v^{2}}}\left(1-\frac{E_{\mathrm{ER}}}{\mu_{N}v^{2}}\right),$
(1)

where $v$, $\mu_{N}$, and $f(E_{\mathrm{ER}})$ are the velocity of DM, the
reduced mass of the xenon nucleus and DM, and the atomic scattering factor,
respectively Kouvaris and Pradler (2017).

The differential rate of MIGD process giving an NR of energy ENR accompanied
by an ER of energy EER is given by

$\large\begin{array}[]{lll}\frac{dR}{dE_{\mathrm{ER}}}&\simeq&\int
dE_{\mathrm{NR}}dv\frac{d^{2}R}{dE_{\mathrm{NR}}dv}\\\
&&\times\frac{1}{2\pi}\sum_{n,l}\frac{d}{dE_{\mathrm{ER}}}p^{c}_{q_{e}}(n,l\rightarrow
E_{\mathrm{ER}}-E_{n,l}),\end{array}$ (2)

where $p^{c}_{q_{e}}$ is the probability for an atomic electron, with quantum
numbers ($n$, $l$) and binding energy $E_{n,l}$, to be ionized and receive a
kinetic energy $E_{\mathrm{ER}}-E_{n,l}$ Ibe  _et al._ (2018). $p^{c}_{q_{e}}$
is related to $q_{e}$ which is the momentum of each electron in the rest frame
of the nucleus after the scattering. The shell vacancy is immediately
refilled, and an X-ray or an Auger electron with energy $E_{n,l}$ is emitted.
$E_{n,l}$ is measured simultaneously with the energy deposited by the ionized
electron, since the typical timescale of the de-excitation process is
$\mathcal{O}$(10) fs. Atomic electrons can also undergo excitation instead of
ionization, in which case an X-ray is emitted during de-excitation Ibe  _et
al._ (2018). Excitation, however, is sub-dominant compared to the ionization
process, and thus is not considered in this analysis. Only the contributions
from the ionization of M-shell ($n$=3) and N-shell ($n$=4) electrons are
considered in this work, as inner electrons ($n$$\leq$2) are too strongly
bound to the nucleus to contribute significantly. The contribution from the
ionization of valence electrons ($n$=5) is neglected because it is subdominant
in region of interest compared to the ones from M- and N-shell electrons, and
the calculation of it has large uncertainty since the assumption of isolated
atom is used for LXe Ibe  _et al._ (2018). An illustration of MIGD and BREM is
given in Fig. 1. The radiation from MIGD is typically 3-4 orders of magnitude
more likely to occur than BREM. Although only a very small fraction (about
3$\times 10^{-8}$ and 8$\times 10^{-6}$ for DM masses of 0.1 and 1.0 GeV/c2,
respectively) of NRs accompanies MIGD radiations, the larger energy and ER
nature make them easier to be detected than the pure NRs.

Figure 1: Illustration of the ER signal production from BREM (green) and MIGD
processes (pink) after elastic scattering between DM ($\chi$) and a xenon
nucleus. The electrons illustrated in pink represent those involved in
ionization, de-excitation, and Auger electron emission during a MIGD process.

The data used in previous analyses Aprile  _et al._ (2018) consists of two
science runs with a livetime of 32.1 days (SR0) and 246.7 days (SR1),
respectively. The two runs were taken under slightly different detector
conditions. To maximize the amount of data acquired under stable detector
conditions we decided to use SR1 only. The same event selection, fiducial
mass, correction, and background models as described in Aprile  _et al._
(2018) are used for the SR1 data, which we refer to as the S1-S2 data in later
text. The exposure of the S1-S2 data is about 320 tonne-days. The
interpretation of such S1-S2 analysis is based on the corrected S1 (cS1)
signal and the corrected S2 signal from the PMTs at the bottom of the TPC
(cS2b).

Figure 2: Median effective exposures of ER signals after event selections as a
function of recoil energy for the S1-S2 data (black line) and S2-only data
(red line). The 68% credible regions of the effective exposures are also shown
as the shaded regions. The expected event rate of DM-nucleus scattering from
MIGD/BREM for DM masses of 0.1 and 1.0 GeV/c2 are overlaid as well, in
magenta/green dashed and solid lines, respectively, assuming a spin-
independent DM-nucleon interaction cross section of 10-35 cm2.

The region of interest in the S1-S2 data is from 3 to 70 photoelectrons (PEs)
in cS1, which corresponds to median ER energies from 1.4 to 10.6 keV in the
1.3-tonne fiducial volume (FV) of XENON1T. The lower value is dictated by the
requirement of the 3-fold PMT coincidence for defining a valid S1 signal
Aprile  _et al._ (2019a). A detailed signal response model Aprile  _et al._
(2019b) is used to derive the influence of various detector features,
including the requirement of the 3-fold PMT coincidence, on the reconstructed
signals. The effective exposure, which is defined as exposure times detection
efficiency, and its uncertainty as a function of deposited ER energy for the
S1-S2 data are shown in Fig. 2, with the signal spectra from MIGD and BREM
induced by 0.1 GeV/c2 and 1 GeV/c2 DM masses overlaid. The (cS2b, cS1)
distribution of S1-S2 data are shown in Fig. 3. The rise of the event rate at
around 0.85 keV for DM mass of 1.0 GeV/c2 is contributed by the ionization of
M-shell electrons Ibe  _et al._ (2018); Kouvaris and Pradler (2017). In our
signal models, deposited energy below 1 keV, at which the median detection
efficiency in 1.3-tonne FV is 10%, from MIGD and BREM is neglected for the
S1-S2 data in the following analysis. There are only two sub-keV measurement
of ionization yield for ER in LXe Akerib  _et al._ (2017); Boulton  _et al._
(2017).

Figure 3: Comparison of cS1 and cS2b spectra between the S1-S2 data and the
signal response model Aprile  _et al._ (2019b). In the upper panel (I), the
distribution of the S1-S2 data in (cS2b, cS1) space is shown as light blue
dots, along with the best-fit ER background model (black shaded region). The
contours containing 90% of the expected signals from MIGD for 0.3, 0.5, and 1
GeV/c2 DM are shown in red dotted, dashed, and solid lines, respectively. Gray
lines show isoenergy contours in ER energy. The events having lower cS2b than
what we expect for ER are mostly surface backgrounds Aprile  _et al._ (2018),
which have minimal impact to the results of this study. The lower panel (II)
shows the projected cS1 distribution of the S1-S2 data, where cS2b is within
the 2$\sigma$ contour of ER model shown in panel (I). For comparision, the 68%
credible region of cS1 distribution from ER background model (blue shadow) is
shown, which is mainly attributed to the systematic uncertainties of the
model. The cS1 distributions of the expected signals from MIGD for 0.3, 0.5,
and 1 GeV/c2 DM with assumed spin-independent DM-nucleon cross sections of
2$\times$10-28, 10-36, and 10-38 cm2, respectively, are shown as well. The
vertical dashed lines indicate the region of interest (3-70 PE). The inset,
panel (III) shows the cS2b distribution, with cS1 in (3, 10) PE, compared with
the 68% credible region of the cS2b spectra from the ER background model (blue
shadow).

The S1-S2 data selections Aprile  _et al._ (2019a) provide excellent rejection
of noise and backgrounds, and are characterized as well by the well-
established background models Aprile  _et al._ (2019b) and a fully blind
analysis Aprile  _et al._ (2018). However they also limit the detection
efficiency of $\mathcal{O}$(1) keV energy depositions. We therefore consider
also the events with no specific requirement on S1 (S2-only data) in this
work. Although the reduction of available information in the S2-only data
implies less background discrimination, the increased detection efficiency in
the $<$ 1 keV ER energy region, shown in Fig. 2, enables a more sensitive
search for LDM-nucleus interactions through MIGD and BREM. The interpretation
of such S2-only data is based on the uncorrected S2 signal, combining both
signals from top and bottom PMT arrays.

We analyze the S2-only data as in Aprile  _et al._ (2019c), using the LDM
signal models appropriate for MIGD and BREM. As detailed in Aprile  _et al._
(2019c), 30% of the data was used for choosing regions of interest (ROIs) in
S2 and event selections. A different S2 ROI is chosen for each dark matter
model and mass to maximize the signal-to-noise ratio, based on the training
data. The event selections used for this work are the same as in Aprile  _et
al._ (2019c), and mainly based on the width of each S2 waveform, reconstructed
radius, and PMT hit-pattern of the S2. Fig. 4 shows the observed S2 spectra
for the S2-only data, along with the expected DM signal distributions by MIGD
with masses of 0.1, 0.5, and 1.0 GeV/c2, respectively. The S2 ROIs for these
three DM models shown in Fig. 4 are indicated by the colored arrows.
Conservative estimates of the background from 214Pb-induced $\beta$ decays,
solar-neutrino induced NRs, and surface backgrounds from the cathode electrode
are used in the inference Aprile  _et al._ (2019c). The background model is
shown in Fig. 4 as shaded gray region.

Figure 4:  Observed S2 spectra for the S2-only data after the optimized
selection described in Aprile  _et al._ (2019c). The expected spectra of ER
signals induced by MIGD for DM with mass of 0.1, 0.5, and 1.0 GeV/c2 are shown
in green, blue, and red solid lines, respectively, assuming the spin-
independent DM-nucleon interaction cross section of 1.2$\times$10-37,
1.5$\times$10-39, and 2.0$\times$10-39 cm2 for 0.1, 0.5, and 1.0 GeV/c2 DM,
respectively. The gray shaded region shows the conservative background model
used in analysis of S2-only data. The arrows indicate the S2 ROIs that are
later used in inference for the three DM signals above-mentioned. The S2
threshold used for the S2-only data is denoted in the dashed black line.

The detector response to ERs from MIGD and BREM in (cS2b, cS1) space (for the
S1-S2 data) and in reconstructed number of electrons (for the S2-only data) is
derived using the signal response model described in Aprile  _et al._ (2019b).
Note that the ionization yield used for the S2-only data is more conservative
than the Noble Element Simulation Technique (NEST) v2 model Szydagis  _et al._
(2018). Fig. 3 shows the comparison between the expectation from our signal
response model and the S1-S2 data, as well as the (cS2b, cS1) distribution of
ERs from MIGD. Signal contours for different DM masses are similar since the
energy spectra from MIGD and BREM are not sensitive to incident dark matter
velocity as long as it is kinematically allowed. We have ignored the
contribution of NRs in the signal model of MIGD and BREM, since it is small
compared with ERs from MIGD and BREM in this analysis and there is no
measurement of scintillation and ionization yields in LXe for simultaneous ER
and NR energy depositions. We use the inference only for DM mass below 2
GeV/c2, above which the contribution of an NR in the signal rate becomes
comparable with or exceeds the signal model uncertainty.

Figure 5:  Limits on the SI (upper panel), SD proton-only (middle panel), and
SD neutron-only (lower panel) DM-nucleon interaction cross-sections at 90%
C.L. using signal models from MIGD and BREM in the XENON1T experiment with the
S1-S2 data (blue contours and lines) and S2-only data (black contours and
lines). The solid and dashed (dotted) lines represent the lower boundaries
(also referred to as upper limits) and MIGD (BREM) upper boundaries of the
excluded parameter regions. Green and yellow shaded regions give the 1 and 2
$\sigma$ sensitivity contours for upper limits derived using the S1-S2 data,
respectively. The upper limits on the SI DM-nucleon interaction cross sections
from LUX Akerib  _et al._ (2019), EDELWEISS Armengaud  _et al._ (2019), CDEX
Liu  _et al._ (2019), CRESST-III Abdelhameed  _et al._ (2017), NEWS-G Arnaud
_et al._ (2018), CDMSLite-II Agnese  _et al._ (2016), and DarkSide-50 Agnes
_et al._ (2018), and upper limits on the SD DM-nucleon interaction cross
sections from CRESST Abdelhameed  _et al._ (2017, 2019) and CDMSLite Agnese
_et al._ (2018) are also shown. Note that the limits derived using the S1-S2
and S2-only data are inferred using unbinned profile likelihood method Aprile
_et al._ (2019a) and simple Poisson statistics with the optimized event
selection Aprile  _et al._ (2019c), respectively. The sensitivity contours for
the S2-only data is not given since the background models used in the S2-only
data are conservative Aprile  _et al._ (2019c).

The S1-S2 data are interpreted using an unbinned profile likelihood ratio as
the test statistic, as detailed in Aprile  _et al._ (2019b). The unbinned
profile likelihood is calculated using background models defined in cS2b, cS1,
and spatial coordinates. The uncertainties from the scintillation and
ionization yields of ER backgrounds, along with the uncertainties in the
estimated rates of each background component, are taken into account in the
inference Aprile  _et al._ (2019b). The inference procedure for the S2-only
data is detailed in Aprile  _et al._ (2019c), which is based on simple Poisson
statistics using the number of events in the S2 ROI. The event rates of spin-
independent (SI) and -dependent (SD) DM-nucleon elastic scattering are
calculated following the approaches described in Lewin and Smith (1996);
Aprile  _et al._ (2018) and Aprile  _et al._ (2019d), respectively.

The results are also interpreted in a scenario where LDM interacts with the
nucleon through a scalar force mediator $\phi$ with equal effective couplings
to the proton and neutron as in the SI DM-nucleon elastic scattering. In this
scenario, the differential event rates are corrected by
${m_{\phi}}^{4}/({m_{\phi}}^{2}+q^{2}/c^{2})^{2}$ Del Nobile  _et al._ (2015);
Ren  _et al._ (2018), where $q=\sqrt{2m_{N}E_{R}}$ and $m_{N}$ are the
momentum transfer and the nuclear mass, respectively. We take the light
mediator (LM) regime where the momentum transfer is much larger than
${m_{\phi}}$ and thus the interaction cross section scales with
$m_{\phi}^{4}$. In this regime, the contribution of NRs is largely suppressed
compared with SI DM-nucleon elastic scattering due to the long-range nature of
the interaction. Therefore, the results are interpreted for DM mass up to 5
GeV/c2 for SI-LM DM-nucleon elastic scattering.

In addition, we also take into account the fact that DM particle may be
stopped or scatter multiple times when passing through Earth’s atmosphere,
mantle, and core before reaching the detector (Earth-shielding effect) Emken
and Kouvaris (2018); Mahdawi and Farrar (2017); Emken and Kouvaris (2017). If
the DM-matter interaction is sufficiently strong, the sensitivity for
detecting such DM particles in terrestrial detectors, especially in
underground laboratory, can be reduced or even lost totally. Following
Armengaud  _et al._ (2019), verne code Kavanagh (2017) is used to calculate
the Earth-shielding effect for SI DM-nucleon interaction. A modification of
the verne code based on the methodology in Kavanagh (2018) is applied for the
calculations of SD and SD-LM DM-nucleon interactions. To account for the
Earth-shielding effect for SD DM-nucleon interaction, 14N in the atmosphere
and 29Si in Earth’s mantle and core are considered, and their spin expectation
values, $\langle S_{n}\rangle$ and $\langle S_{p}\rangle$, are taken from
Hooper and McDermott (2018). Both the lower and upper boundaries of excluded
parameter space are reported in this work. The lower boundaries are
conventionally referred to as upper limits in later context, and are the
primary interest of this work. The upper boundaries are dominated by the
overburden configuration of the Gran Sasso laboratory which hosts the
detector.

Figure 6: Limits on the SI-LM DM-nucleon interaction cross-sections at 90%
C.L. using signal models from MIGD and BREM in the XENON1T experiment with the
S1-S2 data (blue contours and lines) and S2-only data (black contours and
lines). The figure description is the same as in Fig. 5. The upper limits on
the SI DM-nucleon interaction cross sections from LUX Akerib  _et al._ (2019)
and XENON1T S2-only (elastic NR results) Aprile  _et al._ (2019c) are also
shown.

No significant excess is observed above the background expectation in the
search using the S1-S2 data. Fig. 5 shows the 90% confidence-level (C.L.)
limits on the SI and SD (proton-only and neutron-only cases) DM-nucleon
interaction cross-section using signal models from MIGD and BREM with masses
from about 85 MeV/c2 to 2 GeV/c2, and Fig. 6 shows the 90% C.L. limits on the
SI-LM DM-nucleon interaction cross-section with masses from about 100 MeV/c2
to 5 GeV/c2. The sensitivity contours for the results derived using S2-only
data are not shown because of the conservativeness of the background model.
The upper limits derived using the S1-S2 data deviate from the median
sensitivity by about 1-2 $\sigma$ due to the under-fluctuation of the ER
background in the low energy region. As described in Aprile  _et al._ (2019c),
the jumps in the S2-only limits are originating from the changes in the
observed number of events due to the mass-dependent S2 ROIs. The results, by
searching for ER signals induced by MIGD, give the best lower exclusion
boundaries on SI, SD proton-only, SD neutron-only, and SI-LM DM-nucleon
interaction cross-section for mass below about 1.8, 2.0, 2.0, and 4.0 GeV/c2,
respectively as compared to previous experiments Akerib  _et al._ (2019);
Armengaud  _et al._ (2019); Liu  _et al._ (2019); Abdelhameed  _et al._
(2017); Arnaud  _et al._ (2018); Agnese  _et al._ (2016); Agnes  _et al._
(2018); Abdelhameed  _et al._ (2019); Agnese  _et al._ (2018). The upper
limits derived from the S1-S2 data become comparable with those from the
S2-only data at $\sim$ GeV/c2 since the efficiency of the S1-S2 data to DM
signals with mass of $\sim$ GeV/c2 becomes sufficiently high. However, the
upper limits derived from the S1-S2 data do not provide significantly better
constraints than those from the S2-only data for DM masses larger than 1
GeV/c2, because both data are dominated by the ER background, which is very
similar to the expected DM signal.

In summary, we performed a search for LDM by probing ER signals induced by
MIGD and BREM, using data from the XENON1T experiment. These new detection
channels significantly enhance the sensitivity of LXe experiments to masses
unreachable in the standard NR searches. We set the most stringent upper
limits on the SI and SD DM-nucleon interaction cross-sections for masses below
1.8 GeV/c2 and 2 GeV/c2, respectively. Together with the standard NR search
Aprile  _et al._ (2018), XENON1T results have reached unprecedented
sensitivities to both low-mass (sub-GeV/c2) and high-mass (GeV/c2 \- TeV/c2)
DM. With the upgrade to XENONnT, we expect to further improve the sensitivity
to DM with masses ranging from about 85 MeV/c2 to beyond a TeV/c2.

The authors would like to thank Masahiro Ibe and Yutaro Shoji for helpful
discussions on MIGD and for providing us with the code for calculating the
rate of MIGD radiation in xenon. We would like to thank Bradley Kavanagh for
helpful discussion on the Earth-shielding effect. We gratefully acknowledge
support from the National Science Foundation, Swiss National Science
Foundation, German Ministry for Education and Research, Max Planck
Gesellschaft, Deutsche Forschungsgemeinschaft, Netherlands Organisation for
Scientific Research (NWO), Netherlands eScience Center (NLeSC) with the
support of the SURF Cooperative, Weizmann Institute of Science, Israeli
Centers Of Research Excellence (I-CORE), Pazy-Vatat, Fundacao para a Ciencia e
a Tecnologia, Region des Pays de la Loire, Knut and Alice Wallenberg
Foundation, Kavli Foundation, and Istituto Nazionale di Fisica Nucleare. This
project has received funding or support from the European Union’s Horizon 2020
research and innovation programme under the Marie Sklodowska-Curie Grant
Agreements No. 690575 and No. 674896, respectively. Data processing is
performed using infrastructures from the Open Science Grid and European Grid
Initiative. We are grateful to Laboratori Nazionali del Gran Sasso for hosting
and supporting the XENON project.

## References

  * Clowe  _et al._ (2004) D. Clowe, A. Gonzalez, and M. Markevitch, ApJ 604, 596 (2004).
  * Rubin  _et al._ (1980) V. C. Rubin, W. K. Ford Jr, and N. Thonnard, ApJ 238, 471 (1980).
  * Aghanim  _et al._ (2018) N. Aghanim _et al._ (Planck), arXiv:1807.06209 (2018).
  * Jungman  _et al._ (1996) G. Jungman, M. Kamionkowski, and K. Griest, Phys. Rept. 267, 195 (1996).
  * Lee and Weinberg (1977) B. W. Lee and S. Weinberg, Phys. Rev. Lett. 39, 165 (1977).
  * Akerib  _et al._ (2016) D. S. Akerib _et al._ (LUX), Phys. Rev. Lett. 116, 161302 (2016).
  * Cui  _et al._ (2017) X. Cui _et al._ (PandaX-II), Phys. Rev. Lett. 119, 181302 (2017).
  * Aprile  _et al._ (2018) E. Aprile _et al._ (XENON), Phys. Rev. Lett. 121, 111302 (2018).
  * Battaglieri  _et al._ (2017) M. Battaglieri _et al._ , arXiv:1707.04591 (2017).
  * Boehm  _et al._ (2004) C. Boehm, T. Ensslin, and J. Silk, Journal of Physics G: Nuclear and Particle Physics 30, 279 (2004).
  * Boehm and Fayet (2004) C. Boehm and P. Fayet, Nuclear Physics B 683, 219 (2004).
  * Kouvaris and Pradler (2017) C. Kouvaris and J. Pradler, Phys. Rev. Lett. 118, 031803 (2017).
  * Migdal (1941) A. Migdal, J. Phys.(USSR) 4, 449 (1941).
  * Ibe  _et al._ (2018) M. Ibe, W. Nakano, Y. Shoji, and K. Suzuki, JHEP 03, 194 (2018).
  * Aprile  _et al._ (2017a) E. Aprile _et al._ (XENON), Eur. Phys. J. C 77, 881 (2017a).
  * Aprile  _et al._ (2015) E. Aprile _et al._ (XENON), Eur. Phys. J. C 75, 546 (2015).
  * Aprile  _et al._ (2017b) E. Aprile _et al._ (XENON), JINST 12, no. 01, P01024 (2017b).
  * Aprile  _et al._ (2019a) E. Aprile _et al._ (XENON), Phys. Rev. D 100, 052014 (2019a).
  * Aprile  _et al._ (2019b) E. Aprile _et al._ (XENON), Phys. Rev. D 99, 112009 (2019b).
  * Lindhard  _et al._ (1963) J. Lindhard, V. Nielsen, M. Scharff, and P. Thomsen, Kgl. Danske Videnskab., Selskab. Mat. Fys. Medd. 33 (1963).
  * Akerib  _et al._ (2017) D. S. Akerib _et al._ (LUX), Phys. Rev. D 96, 112011 (2017).
  * Boulton  _et al._ (2017) E. Boulton, E. Bernard, N. Destefano, B. Edwards, M. Gai, S. Hertel, M. Horn, N. Larsen, B. Tennyson, C. Wahl, _et al._ , Journal of Instrumentation 12, P08004 (2017).
  * Aprile  _et al._ (2019c) E. Aprile _et al._ (XENON), arXiv: 1907.11485 (2019c).
  * Szydagis  _et al._ (2018) M. Szydagis _et al._ , “Noble element simulation technique v2.0,”  (2018).
  * Akerib  _et al._ (2019) D. S. Akerib _et al._ (LUX), Phys. Rev. Lett. 122, 131301 (2019).
  * Armengaud  _et al._ (2019) E. Armengaud _et al._ (EDELWEISS), Phys. Rev. D 99, 082003 (2019).
  * Liu  _et al._ (2019) Z. Liu _et al._ , Phys. Rev. Lett. 123, 161301 (2019).
  * Abdelhameed  _et al._ (2017) A. Abdelhameed _et al._ (CRESST), arXiv:1904.00498 (2017).
  * Arnaud  _et al._ (2018) Q. Arnaud _et al._ (NEWS-G), Astropart. Phys. 97, 54 (2018).
  * Agnese  _et al._ (2016) R. Agnese _et al._ (SuperCDMS), Phys. Rev. Lett. 116, 071301 (2016).
  * Agnes  _et al._ (2018) P. Agnes _et al._ (DarkSide), Phys. Rev. Lett. 121, 081307 (2018).
  * Abdelhameed  _et al._ (2019) A. Abdelhameed _et al._ (CRESST), Eur. Phys. J. C 79, 630 (2019).
  * Agnese  _et al._ (2018) R. Agnese _et al._ (CDMS), Phys. Rev. D 97, 022002 (2018).
  * Lewin and Smith (1996) J. Lewin and P. Smith, Astropart. Phys. 6, 87 (1996).
  * Aprile  _et al._ (2019d) E. Aprile _et al._ (XENON), Phys. Rev. Lett. 122, 141301 (2019d).
  * Del Nobile  _et al._ (2015) E. Del Nobile, M. Kaplinghat, and H. B. Yu, JCAP 10, 055 (2015).
  * Ren  _et al._ (2018) X. Ren _et al._ (PandaX-II), Phys. Rev. Lett. 121, 021304 (2018).
  * Emken and Kouvaris (2018) T. Emken and C. Kouvaris, Phys. Rev. D 97, 115047 (2018).
  * Mahdawi and Farrar (2017) M. S. Mahdawi and G. R. Farrar, arXiv:1712.01170 (2017).
  * Emken and Kouvaris (2017) T. Emken and C. Kouvaris, JCAP 10, 031 (2017).
  * Kavanagh (2017) B. J. Kavanagh, “bradkav/verne: Release,”  (2017).
  * Kavanagh (2018) B. J. Kavanagh, Phys. Rev. D 97, 123013 (2018).
  * Hooper and McDermott (2018) D. Hooper and S. D. McDermott, Phy. Rev. D 97, 115006 (2018).


# Censors’ Delay in Blocking Circumvention Proxies

David Fifield
University of California, Berkeley Authors are listed in alphabetical order.
Lynn Tsai
University of California, Berkeley

### Abstract

Censors of the Internet must continually discover and block new circumvention
proxy servers. We seek to understand this process; specifically, the length of
the delay between when a proxy first becomes discoverable and when it is
actually blocked. We measure this delay in the case of obfuscated Tor bridges,
by testing their reachability before and after their introduction into Tor
Browser. We test from sites in the U.S., China, and Iran, over a period of
five months. China’s national firewall blocked new bridges after a varying
delay of between 2 and 36 days. Blocking occurred only after end-user software
releases, despite bridges being potentially discoverable earlier through other
channels. While the firewall eventually discovered the bridges of Tor Browser,
those that appeared only in Orbot, a version of Tor for mobile devices,
remained unblocked. Our findings highlight the fact that censors can behave in
ways that defy intuition, presenting difficulties for threat modeling but also
opportunities for evasion.

##  1 Introduction

Censors of the Internet must seek out and block proxy servers that can be used
to evade their information controls. Here we explore the mechanics of this
process as it applies to the blocking of default Tor bridges after they are
published in Tor Browser. It is known that these default bridges are
eventually blocked; what is not known is exactly how long it takes. We measure
the “delay” or “lag” of proxy blocking, by testing the reachability of bridges
before and after their first public disclosure from sites in the U.S., China,
and Iran.

There is prior work on distribution strategies that prevent the censor from
discovering secret proxy addresses in the first place; examples are Proximax
[10] and rBridge [17]. Our work is different: we study how censors block
proxies that are not secret, but are (in principle) easily discoverable by
anyone. In typical censorship threat models, such unprotected proxies would be
considered to be immediately blocked. That they are not, in practice, shows
that practical considerations may prevent censors from exercising all their
assumed capabilities.

Zhu et al. [19] in 2013 explored a related idea. They measured how long it
took for posts to be censored on the Chinese microblogging service Sina Weibo.
They found that 30% of posts are deleted within 30 minutes and 90% are deleted
within 24 hours, though some posts survived for weeks or months. They used
their results to hypothesize about the reasons for and mechanisms of microblog
censorship.

In 2014, developers of OONI, the Open Observatory of Network Interference, a
censorship measurement platform, implemented a new test to check the
reachability of Tor bridges and prepared visualizations [8]. The tests have
not run continually since then. In 2015, a one-off calculation [7] based on
user reports found loose time bounds for the delay of a single bridge-blocking
event in China: somewhere between 15 and 76 days.

Knowing the proxy blocking delay gives insight into how censors work: where
they look for new bridges, and whether their blacklist updates are automatic
or manual. It advances our understanding the operational costs incurred by
censors, and therefore their potential weaknesses. We think of censors as
complex systems, consisting of interacting human and machine components, whose
goals and motivations are sometimes in conflict.

##  2 Background

Tor [5] is an anonymity network that is also widely used to circumvent
censorship. In its natural form, Tor is poorly suited to circumvention. Its
nodes’ IP addresses are public, and the protocol itself is fairly distinctive.
But Tor combined with _bridges_ and _pluggable transports_ is much harder to
block. Bridges are special, unlisted nodes whose addresses are not easily
discoverable in bulk—users must acquire a few at a time through an online
database called BridgeDB [13]. Pluggable transports are obfuscation protocols
that encapsulate the Tor protocol, making it difficult to detect. A censored
user uses a pluggable transport in order to reach a secret bridge, foiling
both deep packet inspection and IP address blacklisting.

Tor Browser [11] is a modified version of Firefox that features a built-in
always-on Tor client. It is the recommended way of accessing the Tor network
for most users. The browser has a graphical interface for the configuration of
bridges and pluggable transports. The intended use case has users acquiring a
bridge address through a side channel, such as email or word of mouth, and
pasting it into the configuration interface. However, in practice,
circumvention is often even easier, requiring no out-of-band information. For
many users, it suffices to select a pluggable transport name from a menu,
causing Tor to connect to one of a handful of built-in, _default_ bridges
included with the browser.

The concept of a default bridge needs some explanation. Bridges are supposed
to be secret, so including them with the browser seems to be self-defeating.
The default bridges are in fact open to the world in the Tor Browser source
code—the file housing them is called bridge_prefs.js [15]. Any censor that can
block Tor ought to be able to block the default bridges as well, but the
strange truth of the matter is that many simply do not. We can only guess as
to why: it could be that censors are negligent or incompetent; perhaps Tor
traffic is, from their point of view, too inconsequential to bother with; or
maybe they set more stock in deep packet inspection and dynamic protocol
detection than in static IP address blacklists. Whatever the reason, Tor
Browser continues to ship default bridges for the simple reason that they work
for many people. In fact, the Great Firewall of China is the only state censor
we are aware of that makes some effort to block Tor’s default bridges. This is
what we study in this work: the time delay in blocking a bridge after it is
first made public in a Tor Browser release.

###  2.1 Tor Browser releases

Tor Browser releases follow two tracks: stable and alpha. The stable track
changes slowly, its minor releases typically including only bugfixes. The
alpha track has new and experimental features. The alpha track matures until
it becomes the basis of the next major release of the stable track. (There are
also special “hardened” releases that track the alphas—we do not consider them
separately.) In addition to formal major and minor releases, there are nightly
builds that have the latest of everything.

The primary driver of Tor Browser releases is upstream security fixes in
Firefox. When there is a new version of Firefox that fixes a security
vulnerability, Tor Browser developers must hurry to build a new minor release
of Tor Browser with the fix. For this reason, new stable and alpha releases
usually appear at about the same time, because both are usually equally
affected by Firefox bugs. Alpha releases are distinguished by a letter “a” in
the version number; for example, the stable release 5.5.5 appeared at about
the same time as the alpha release 6.0a5. During the roughly five-month period
of our experiments, there were ten stable releases (two major, eight minor),
and seven alpha releases (one major, six minor) [14]. Each releases was an
opportunity to deploy and measure new bridges.

###  2.2 The process of releasing a new bridge

There is no single moment when a new bridge becomes public. The process of
adding a bridge involves multiple stages, each of which potentially reveals
it, depending on how closely the censor pays attention.

  1. 1.

Ticket filed. New default bridges are proposed for inclusion by the filing of
a ticket in Tor’s online bug tracker. A censor paying attention to the bug
tracker would learn of bridges at this stage.

  2. 2.

Ticket merged. When the ticket is merged, the new bridge is added to Tor
Browser’s source code. From there, it will automatically be incorporated into
nightly builds. This is the first time that the code containing the new bridge
is available in executable form. A censor paying attention to the source code
repository, or following nightly builds, would learn of bridges at this stage.

  3. 3.

Testing release. When it is time for a new release, Tor Browser developers
prepare candidate packages and send them to a quality assurance mailing list
for testing. A censor paying attention to the mailing list would learn of
bridges at this stage.

  4. 4.

Public release. After testing, new packages are announced on the Tor blog, and
already installed Tor Browsers will automatically update themselves. This is
the stage at which the new bridge will start to be used by real users. A
censor paying attention to the blog, or black-box testing an auto-updating
installation, would learn of bridges at this stage.

From ticket filing to public release, the process usually takes a few weeks.
Sometimes the testing release stage is skipped if the new version only fixes a
small error in the previous version, like a packaging or localization bug. The
releases of the stable and alpha tracks are separate; they are, however,
usually close in time.

New default bridges are sometimes discussed in private mailing lists even
before a ticket is filed. A censor could conceivably infiltrate an internal
mailing list and learn about new bridges very early. We have assumed that this
does not happen, that censors must use the same public channels as everyone
else.

###  2.3 The special properties of obfs4

Figure 1:  Timeline of Tor Browser default bridge blocking, as measured from
one probe site in China. Black vertical lines indicate releases. All new
bridges within a release are blocked within a few days or weeks. The “timed
out” and “connection refused” results for the control bridges on port 1984
were the result of temporary misconfigurations, not blocking. The vertical
stripe on May 20 shows when the probe site changed its IP address.  Figure 2:
Comparison of reachability of selected bridges across our three experimental
sites. We detected no blocking from our Iran site. In China, blocking
manifested as timed-out connections. Blocking in our two China sites was the
same, except for the curious diurnal semi-blocking pattern, which affected
different bridges at each site.

Though Tor Browser supports several pluggable transports, we concern ourselves
only with obfs4 [3], an advanced transport offering several security features.
We rely critically on these features; they enable us to limit the means of
learning about new bridges to the ones we control. The use of obfs4 gives us
confidence that the censor learns of our bridges only in the ways we intend,
namely their inclusion in Tor Browser.

obfs4 resists deep packet inspection by re-encrypting a Tor stream so that it
appears as a stream of random bytes. More than that, obfs4 resists _active
probing_ attacks in which the censor scans suspected proxies in order to
discover what protocols they support. Every obfs4 server has a per-bridge
secret, which the client must prove knowledge of in its initial message. The
Great Firewall is known to employ active probing against the predecessor
protocols obfs2 and obfs3 [6], but the same attack is ineffective against
obfs4. The censor must have the same out-of-band information as a legitimate
client; merely knowing the IP address of a bridge is insufficient to confirm
that it is, in fact, a bridge.

In addition to its useful properties, obfs4 is relevant to real-world users.
It is marked “recommended” in Tor Browser and has the more users than any
other transport, about 20,000 concurrent on average as of June 2016 [16].
obfs4 has experimental support for obfuscating packet size and timing, but
none of the default bridges have deployed that feature, so we did not
investigate it.

##  3 Method

We established probe sites in three countries, using dedicated servers or
cloud services: one in the U.S., two in China, and one in Iran. The two sites
in China were in different autonomous systems. At each site, we ran a script
that tested the TCP reachability of a variety of destinations every 20
minutes. For each destination, the script attempted to establish a TCP
connection and then recorded the current time, IP address, port number,
status, and error message if any. We ran probes for about five months, from
December 12, 2015 to June 4, 2016. The destinations we tested, a mixture of
fresh obfs4 bridges and other control destinations, appear in Table 1.

The probe site in the U.S. was a control that enabled us to distinguish cases
of censorship from a bridge’s temporarily being down. Owing to the difficulty
of accessing network services in China and Iran, the time periods during which
we had access to each site differ, though they overlap. In one of the China
sites, we lost access to our probing host partway through the experiment;
however, before that happened we got access to another in the same autonomous
system. The data in Figure 1 and Table 2, which show the results from this
site, are spliced together from the two series.

nickname | ports
---|---
New Tor Browser default bridges
ndnop3 | 24215, 10527
ndnop5 | 13764
riemann | 443
noether | 443
Mosaddegh | 41835, 443, 80
MaBishomarim | 49868, 443, 80
JonbesheSabz | 80
Azadi | 443
GreenBelt | 60873, 80, 443
Orbot-only default bridges
Mosaddegh | 1984
MaBishomarim | 1984
JonbesheSabz | 1984
Azadi | 1984
Already existing Tor Browser default bridges
LeifEricson | 41213
Never-published bridges
ndnop4 | 27668
Non-bridge controls
github.com | 443, 444
Table 1:  The destinations, mostly obfs4 bridges, whose reachability we
tested. Bridges are identified by their “nickname,” an arbitrary label
assigned by the bridge’s operator. Each nickname represents a distinct IP
address; some bridges served obfs4 on multiple ports. In addition to the
destinations listed, we tested port 22 (SSH) on the bridges that had it open.

We were fortunate to run this experiment at a time when Tor Browser was
ramping up its obfs4 capacity, with new bridges being added in nearly every
release. In some cases these were new ports on existing IP addresses; in
others they were entirely new IP addresses. We began measurements of each new
bridge as soon as we became aware of it. In some cases we received advance
notice of a new bridge before its ticket was filed, but in others we started
measurements shortly after the ticket. We coordinated with the Tor Browser
developers to ensure that newly created bridges were not present in BridgeDB
[13], where they might have been discovered by censors and ordinary users. We
tried, as far as possible, to limit the possible avenues of discovery to bug
tracker tickets and the Tor Browser source code.

We also measured four bridges that appeared only in Orbot [12], the port of
Tor to Android. Orbot and Tor Browser have most of their default bridges in
common, but a few appear in Orbot only. They are the ones with port number
1984 in Table 1. The Orbot-only bridges remained accessible, even as the Tor
Browser bridges were blocked.

##  4 Results

We recorded over 1.5 million individual probe results over a period of
approximately five months. The results from our two China sites were the same
in most respects, with blocking occurring at the same time in both. We found
no blocking at all of the default bridges from our site in Iran. As the two
China sites were similar and the Iran site did not show any blocking, we will
mainly present the results from the China site that had more data (called
“China 1” in figures). A graphical summary of the results appears in Figure 1
and a textual timeline in Table 2. Figure 2 compares the three sites across a
subset of destinations.

Tor Browser 5.0.5/5.0.6/5.5a5: 1 new bridge
---
03 Dec |  $-$19 days |  Ticket filed ndnop3:24215
07 Dec |  $-$15 days |  Ticket merged ndnop3:24215
12 Dec |  $-$10 days |  Testing release 5.0.5 stable
14 Dec |  $-$8 days |  Testing release 5.5a5 alpha
15 Dec |  $-$7 days |  Public release 5.0.5 stable
17 Dec |  $-$5 days |  Public release 5.0.6 stable
18 Dec |  $-$4 days |  Public release 5.5a5 alpha
22 Dec |  0 days |  Blocked ndnop3:24215
Tor Browser 5.0.7/5.5a6: no new bridges
Tor Browser 5.5/6.0a1: 6 new bridges
16 Jan |  $-$13 days |  Ticket filed riemann:443
18 Jan |  $-$11 days |  Ticket merged riemann:443
18 Jan |  $-$11 days |  Ticket filed ndnop3:10527, ndnop5:13764
18 Jan |  $-$11 days |  Ticket merged ndnop3:10527, ndnop5:13764
19 Jan |  $-$10 days |  Ticket filed noether:443
19 Jan |  $-$10 days |  Ticket merged noether:443
21 Jan |  $-$8 days |  Ticket filed Mosaddegh:41835, MaBishomarim:49868
21 Jan |  $-$8 days |  Ticket merged Mosaddegh:41835, MaBishomarim:49868
22 Jan |  $-$7 days |  Testing release 5.5 stable
24 Jan |  $-$5 days |  Testing release 6.0a1 alpha
27 Jan |  $-$2 days |  Public release 5.5 stable
27 Jan |  $-$2 days |  Public release 6.0a1 alpha
29 Jan |  0 days |  Blocked ndnop3:10527, riemann:443, ndnop5:13764, noether:443, Mosaddegh:41835, MaBishomarim:49868
Tor Browser 5.5.1/5.5.2/6.0a2: 2 new bridges
24 Jan |  $-$30 days |  Ticket filed JonbesheSabz:80, Azadi:443
28 Jan |  $-$26 days |  Ticket merged JonbesheSabz:80, Azadi:443
03 Feb |  $-$20 days |  Testing release 5.5.1 stable
05 Feb |  $-$18 days |  Public release 5.5.1 stable
12 Feb |  $-$11 days |  Public release 5.5.2 stable
15 Feb |  $-$8 days |  Public release 6.0a2 alpha
23 Feb |  0 days |  Blocked JonbesheSabz:80, Azadi:443
Tor Browser 5.5.3/6.0a3: no new bridges
Tor Browser 5.5.4/6.0a4: 4 new bridges
12 Mar |  $-$17 days |  Ticket filed Mosaddegh:80, Mosaddegh:443, MaBishomarim:80, MaBishomarim:443
14 Mar |  $-$15 days |  Ticket merged Mosaddegh:80, Mosaddegh:443, MaBishomarim:80, MaBishomarim:443
18 Mar |  $-$11 days |  Public release 5.5.4 stable
18 Mar |  $-11$ days |  Public release 6.0a4 alpha
29 Mar |  0 days |  Blocked Mosaddegh:80, Mosaddegh:443, MaBishomarim:80, MaBishomarim:443
Tor Browser 5.5.5/6.0a5/6.0: 3 new bridges
05 Apr |  $-$57 days |  Ticket filed GreenBelt:60873, GreenBelt:80, GreenBelt:443
07 Apr |  $-$55 days |  Ticket merged GreenBelt:60873, GreenBelt:80, GreenBelt:443
22 Apr |  $-$40 days |  Testing release 5.5.5 stable
24 Apr |  $-$38 days |  Testing release 6.0a5 alpha
26 Apr |  $-$36 days |  Public release 5.5.5 stable
28 Apr |  $-$34 days |  Public release 6.0a5 alpha
26 May |  $-$6 days |  Testing release 6.0 stable
30 May |  $-$2 days |  Public release 6.0 stable
01 Jun |  0 days |  Blocked GreenBelt:60873, GreenBelt:80, GreenBelt:443
Table 2:  Timeline of Tor Browser releases and bridge blocking. For the
meaning of terms, see Section 2.2. Time offsets are given from the date of
bridge blocking.

We have batched Tor Browser releases according to what new, unblocked bridges
they contained. For example, all the releases in the 5.0.5/5.0.6/5.5a5 batch
contained the same new bridge, ndnop3:24215, while the releases in the
5.5/6.0a1 batch appeared after ndnop3:24215 was blocked but added six fresh
bridges. There are five of these release batches (we omitted releases that did
not have any new bridges).

Blocking of new bridges was delayed, but abrupt. When a batch contained more
than one bridge, all were blocked at once (within our probing period of 20
minutes). Across the five batches, we observed blocking delays of 7, 2, 18,
11, and 36 days after the first public release, and up to 57 days after the
filing of the first ticket, when bridges were potentially first discoverable.
This fact suggests, to us, that new default bridges are loaded into the
firewall in groups, and are not, for example, detected and blocked one at a
time.

We found that blocking in China was keyed on both IP address and port,
consistent with an observation of Winter and Lindskog in 2012 [18]. For
example, many of the bridges happened to have port 22 (SSH) open, and it
remained accessible even as other ports on the same IP address were blocked.
(See riemann:22 in Figure 1 for an example.) Per-port blocking is what enabled
us to run multiple bridges on the same IP address.

We never saw a case of a bridge being blocked before a public release of Tor
Browser, despite their being potentially discoverable at an earlier stage. The
four bridges that were included only in Orbot, not in Tor Browser, were never
blocked. From these facts, we infer that the censors in China probably learn
of bridges not from the bug tracker (which would have revealed Orbot’s
bridges), nor from source code inspection (which might have gotten the bridges
blocked before release), but only from public releases. The 5.5.1/5.5.2/6.0a2
batch is an interesting case because there was an unusually large gap (about
10 days) between stable and alpha releases: there were stable releases 18 and
11 days, and an alpha release 8 days, before JonbesheSabz:80 and Azadi:443
were blocked. The bridge ndnop4:27668 did not appear in a release, but only in
BridgeDB, and was not blocked.

Figure 3:  Rates of reachability by time of day for two bridges from two
sites, between February 1 and March 15, 2016. There is a diurnal blocking
pattern in both China sites, though not the same bridges are affected at both
sites. China Standard Time (CST) is UTC+08:00.

There is a conspicuous on–off pattern in the reachability of certain bridges
from China, for example ndnop3:24215 in China 1 and Mosaddegh:41835 in China
2. The pattern is roughly periodic with a period of 24 hours. Figure 3
averages many 24-hours periods to show the reachability against time of day of
two bridges. The presence of the diurnal pattern appears to depend on both the
bridge and the probing site, perhaps depending on the network path, as the
same bridges do not show the pattern at both sites. The pattern can come and
go, for example in riemann:443 in China 1.

The China sites also display what are apparently temporary failures of
censorship, stretches of a few hours during which otherwise blocked bridges
were reachable. Intriguingly, one of these corresponds to a known failure of
the Great Firewall that was documented in the press [9]. On March 27, Google
services—usually blocked in China—were reachable from about 15:30 to 17:15
UTC. This time period is a subset of one in which our bridges were reachable,
which went from about 10:00 to 18:00 UTC on that day.

Batch | Date | Day | Time
---|---|---|---
5.0.5/5.0.6/5.5a5 | 22 Dec | Tue | 09:00 UTC / 17:00 CST
5.5/6.0a1 | 29 Jan | Fri | 06:00 UTC / 14:00 CST
5.5.1/5.5.2/6.0a2 | 23 Feb | Tue | 02:40 UTC / 10:40 CST
5.5.4/6.0a4 | 29 Mar | Tue | 06:00 UTC / 14:00 CST
5.5.5/6.0a5/6.0 | 01 Jun | Wed | 02:40 UTC / 10:40 CST
Table 3:  Day and time of blocking events in China. Times signify the end of
an initial period of continual or near-continual reachability of all bridges
in a batch of releases. All bridges in a batch ceased their initial
reachability within 20 minutes after the time shown.

We wondered whether blocking always occurs on the same day of the week. It
turns out not to be the case, as our five blocking events happened on Tuesday
($\times 3$), Wednesday ($\times 1$), and Friday ($\times 1$)—see Table 3.
However, there may be a pattern in the time of day. In two cases, the last
successful probe happened within the 20 minutes following 02:40 UTC, and in
another two cases, it was just after 06:00 UTC, The remaining event happened
at 09:00 UTC. It is hard to make inferences from these limited data, but they,
along with the variable delay in blocking, suggest a blocking procedure that
is part manual and part automatic: a manual process discovers bridges after an
unpredictable delay; then a periodic, automatic process causes the blocks to
take effect.

##  5 Further questions

The data present interesting questions that call for additional experiments.
Orbot’s bridges were blocked only as a side effect of their being blocked in
Tor Browser—bridges exclusive to Orbot remained reachable. This suggests a
further test to see whether the censor treats stable and alpha releases
differently: include different sets of bridges in each, and see whether both
or only one of the sets gets blocked. (This idea has the privacy disadvantage
that a network eavesdropper could infer whether someone is running a stable or
an alpha release by watching the IP addresses they connect to.)

Once in possession of a software release, how does the censor extract the
bridge addresses? There are several possibilities. They may have a program
automatically parse the file containing bridges; or a person may have to read
the file and enter the bridge addresses manually. They could simply run the
browser in a black-box fashion and note what addresses it connects to. In
order to distinguish these cases, one could include commented-out or invalid
bridge addresses in the list.

Table 3 shows that our bridges got blocked only on weekdays during daylight
hours (China Standard Time). The five blocking events occurred at three
apparently discrete times of day. It will be interesting to observe more
blocking events and see whether these patterns continue to hold.

We were surprised not to find any blocking of the default bridges in Iran. The
censorship system in Iran has been documented to effect blocking through means
such as bandwidth throttling [1, 4] and blocking the IP addresses of the Tor
directory authorities [2]. Throttling would affect obfs4 users but blocking
the directory authorities would not, as bridges serve Tor directory
information in-band. Iran’s censors do not seem to rely on blocking the
default bridges, at least those we tested.

It would be useful to augment our reachability tests with traceroutes, so we
could see where all the routers are between the probe site and the bridge, and
where packets are dropped when bridges are blocked. Differences in routing
might explain why some bridges were periodically reachable from one China site
but not from the other.

The fact that proxy blocking delay is on the order of days suggests an obvious
circumvention strategy: if the censor blocks new bridges after $n$ days,
introduce new ones every $n-1$ days. This could be accomplished through more
frequent releases, or obfs4 could be modified to try different destination
ports according to some schedule that depends on the time since release. The
interesting question then becomes the meta-delay: how long does the censor
take to catch on to this new pattern?

##  6 Acknowledgments

We express our thanks to those who helped us by running bridges or providing
us with probe sites, including Percy Alpha, Nima Fatemi, Linus Nordberg, Henry
de Valence, and others who remain anonymous. We thank the developers of Tor
Browser and Orbot for their timeliness in adding new bridges. We appreciate
our discussions with censorship researchers at the University of California,
Berkeley and the International Computer Science Institute.

##  7 Availability

Our code and data are available from the supporting web page:
https://www.bamsoftware.com/proxy-probe/.

## References

  * [1] Anderson, C. Dimming the Internet: Detecting throttling as a mechanism of censorship in Iran.  Tech. rep., University of Pennsylvania, June 2013.  https://arxiv.org/pdf/1306.4361v1.
  * [2] Anderson, C. Vanilla Tor Connectivity Issues In Iran – Directory Authorities Blocked?, July 2014.  https://bugs.torproject.org/12727.
  * [3] Angel, Y., and Winter, P. obfs4 (the obfourscator), May 2014.  https://gitweb.torproject.org/pluggable-transports/obfs4.git/tree/doc/obfs4-spec.txt.
  * [4] Aryan, S., Aryan, H., and Halderman, J. A. Internet censorship in Iran: A first look.  In Free and Open Communications on the Internet (2013), USENIX.  https://www.usenix.org/conference/foci13/workshop-program/presentation/aryan.
  * [5] Dingledine, R., Mathewson, N., and Syverson, P. Tor: The second-generation onion router.  In USENIX Security Symposium (Aug. 2004), USENIX.  https://spec.torproject.org/tor-design.
  * [6] Ensafi, R., Fifield, D., Winter, P., Feamster, N., Weaver, N., and Paxson, V. Examining how the Great Firewall discovers hidden circumvention servers.  In Internet Measurement Conference (2015), ACM.  http://conferences2.sigcomm.org/imc/2015/papers/p445.pdf.
  * [7] Fifield, D. Estimating censorship lag by obfs4 blocking, Feb. 2015.  https://lists.torproject.org/pipermail/tor-dev/2015-February/008222.html.
  * [8] Filastò, A. OONI Bridge reachability study and hackfest, Nov. 2014.  https://blog.torproject.org/blog/ooni-bridge-reachability-study-and-hackfest.
  * [9] Huifeng, H. Google breaks through China’s Great Firewall … but only for just over an hour.  South China Morning Post, Mar. 2016.  http://www.scmp.com/tech/china-tech/article/1931301/google-breaks-through-chinas-great-firewall-only-just-over-hour.
  * [10] McCoy, D., Morales, J. A., and Levchenko, K. Proximax: A measurement based system for proxies dissemination.  In Financial Cryptography and Data Security (2011), Springer.  https://cseweb.ucsd.edu/~klevchen/mml-fc11.pdf.
  * [11] Perry, M., Clark, E., and Murdoch, S. The design and implementation of the Tor Browser.  Tech. rep., Tor Project, Mar. 2013.  https://www.torproject.org/projects/torbrowser/design/.
  * [12] The Guardian Project.  Orbot: Tor for Android.  https://guardianproject.info/apps/orbot/.
  * [13] The Tor Project.  BridgeDB.  https://bridges.torproject.org/.
  * [14] Tor Browser changelog, June 2016.  https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-Data/Docs/ChangeLog.txt?id=20ab1173a.
  * [15] Tor Browser default bridges, June 2016.  https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-Data/PTConfigs/bridge_prefs.js?id=20ab1173a.
  * [16] Tor Metrics.  Bridge users by transport (obfs4), June 2016.  https://metrics.torproject.org/userstats-bridge-transport.html?end=2016-06-05&transport=obfs4.
  * [17] Wang, Q., Lin, Z., Borisov, N., and Hopper, N. J. rBridge: User reputation based Tor bridge distribution with privacy preservation.  In Network and Distributed System Security (2013), The Internet Society.  https://www-users.cs.umn.edu/~hopper/rbridge_ndss13.pdf.
  * [18] Winter, P., and Lindskog, S. How the Great Firewall of China is blocking Tor.  In Free and Open Communications on the Internet (2012), USENIX.  https://www.usenix.org/conference/foci12/workshop-program/presentation/winter.
  * [19] Zhu, T., Phipps, D., Pridgen, A., Crandall, J. R., and Wallach, D. S. The velocity of censorship: High-fidelity detection of microblog post deletions.  In USENIX Security Symposium (2013), USENIX.  https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/zhu.