The counterfeit lawsuits that scoop up hundreds of Chinese Amazon sellers at once

Sun Qunming had no idea that the word “airbag” could be trademarked. 

Sun, who owns an e-commerce company of 13 people in Shenzhen, China, has been selling phone cases to Amazon buyers in Europe and the US since 2016. But last year, her business ground to a halt. One of her products has air-filled bumper cushions at the edges to protect the phone. When she listed it on Amazon in November 2021, she named it—in the typical e-commerce fashion of piling up keywords to attract search traffic—“Samsung Flip 3 Case, Galaxy Flip 3 Case with Ring, Built-in Airbag Protective Case for Samsung Galaxy Z Flip 3 5G 2021, Black.”

What she didn’t know was that in the same month, the word “airbag” when used in the context of electronic device accessories had been trademarked by another phone case vendor, PopSockets. A few months later, the company sued Sun and more than 160 other online sellers for trademark infringement. Sun’s two Amazon seller accounts were restricted and her account balances, totaling $60,000 at the time, were frozen. 

Over the next three months, Sun says, she spent $20,000 in legal fees to respond to the lawsuit. The account suspension was dropped in June 2022, but the damage to her business was done: a new phone case typically sells well for about a year until the next-generation phone comes out, and she missed the window. 

“I had plans for my life, like how my career would grow in a few years,” Sun says. “But when they did that to me, I felt like my whole plan had been disrupted. And I didn’t know what to do.”

What Sun experienced was not an accident, but a relatively recent development in the world of cross-border e-commerce. 

US law firms, particularly a handful based in Chicago, have been putting together mass intellectual-property cases like this one, suing hundreds of sellers on Amazon or other platforms at the same time for selling counterfeit goods. It’s a new form of lawsuit—so new that it doesn’t have an official name yet. One thing they have in common is that multiple defendants are sued at once, and the defendants’ identities are kept hidden.

These cases are designed to protect IP holders from counterfeiters, who are much harder to trace and hold accountable in the era of e-commerce.

But in the US, these lawsuits have also become a lucrative business for the plaintiffs and their law firms. Lumping so many defendants together saves plaintiffs time and money when filing cases in federal courts. The approach is so streamlined and structured, lawyers told MIT Technology Review, that firms can mass-produce the lawsuits, reusing filing templates and suing batch after batch of sellers. These practices are not unlawful, but some lawyers and academics believe they amount to taking advantage of the IP protection system.

Chinese sellers now make up the majority of third-party sellers on Amazon. But as their businesses bloom, they are also learning hard lessons about adjusting to a different cultural and legal system. Sellers like Sun feel the lawsuits are designed to take advantage of people who lack experience with the American justice system and face a language barrier.

“It started as a normal way to defend intellectual-property rights,” says Ning Zhang, an attorney in the US who has represented Sun and other sellers in similar situations. But over the years, Zhang says, she has witnessed the IP violation claims getting increasingly baseless. “It doesn’t matter if [the claims] have any merits—you can just sue [the sellers], freeze their accounts, and force them to negotiate with you to take their money back.”

Staking trademark violation claims

Chinese products have long been associated with counterfeiting and intellectual-property theft. This is not without cause. In 2022, 60% of the counterfeit goods seized at US borders, by value, came from China. 

But IP rights and counterfeiting have become much blurrier concepts in the age of third-party e-commerce markets. Traditionally, counterfeit goods profit off established brand names by riding on their name recognition. Not all trademarks are recognizable names, though; some just look like descriptive terms.

In November 2020, PopSockets, a US company that designs phone cases and other accessories, applied to trademark the term “airbag” under the category of “hand grips, stands, mounts, and cases adapted for handheld electronic devices.” The company has products that use air-filled components, but examples of the word’s use to describe similar features also existed before the trademark. The application was approved a year later, on November 9, 2021. 

Sun Qunming says she had used the word “airbag” before to describe other phone cases she sold without causing any trouble. And she admits she didn’t check whether it was trademarked this time. “If it’s an uncommon word, we will look it up in the trademark database to see whether it’s registered. But in terms of ‘airbag,’ the reason why I didn’t look it up was because I thought it was just a descriptive term. You see it everywhere,” she says. 

The plaintiff, however, claimed in the lawsuit that defendants like Sun “deceive unknowing consumers by using the POPSOCKETS Trademarks without authorization … to attract various search engines crawling the Internet looking for websites relevant to consumer searches for PopSockets Products.” PopSockets declined to comment for this story.

These sorts of lawsuits first appeared on the radar of Eric Goldman, a law professor at Santa Clara University School of Law and co-director of the High Tech Law Institute, in 2021. A German company that owns and licenses the word “emoji,” he discovered, had sued an estimated total of more than 10,000 e-commerce sellers from 2020 to 2021. Some of the parties sued had simply used the word to describe a product that actually included the image of an emoji. But the court decisions are working in its favor. In one of the dozens of cases, the judge found the copyright claim too expansive but nevertheless awarded the owner $25,000 in statutory damages from each of the 231 sellers being sued. 

Goldman, in a paper published in March, calls this type of lawsuit a “Schedule A Defendants Scheme” (or “SAD Scheme”). When these cases are filed, the names of defendants are put into a document, Schedule A, that is often immediately made confidential at the request of the plaintiff. As a result, the cases can involve hundreds of sellers at the same time, yet the sellers don’t know who else is being sued, and they usually don’t know they are being sued themselves until the court orders Amazon to freeze their accounts.

After Goldman looked into the emoji cases, he kept thinking about them. IP trolling lawsuits have existed for decades, but the way the cases were filed struck him as taking advantage of the current court mechanisms to a unique degree. “I just spent hours and hours peeling the layers in the end, and I kept getting more and more upset, realizing that there was a problem here that was systemic,” Goldman says.

China targets

Not all Schedule A lawsuit defendants are from China, but attorneys who spoke to MIT Technology Review say it’s Chinese sellers who seem to be targeted the most often. Travis Stockman, a New York–based attorney who has represented e-commerce sellers in these cases, says about 70% of his Schedule A defense clients are from China, while fewer than 10% are based in the United States. 

Justin Gaudio, an attorney at the Chicago-based law firm Greer, Burns & Crain (GBC) and the lead counsel for the plaintiff in the airbag lawsuit, told MIT Technology Review in an email that the reason so many Chinese sellers are sued in such cases is that counterfeiting is largely a Chinese problem. 

“These cases focus on China-based defendants since the bulk of counterfeit products sent to the United States come from China and its dependent territories,” he said, citing a report from the Buy Safe America Coalition. He declined to comment on the airbag case specifically, and GBC declined to comment on claims that the practice abuses the system.

What’s more certain is that it’s rarer to see Chinese defendants appear in court and fight the claims, Zhang says. There are ways to push back on the IP infringement claims and to argue that due process is missing, she says, but sellers are seldom willing to try. They often aren’t able to afford the legal fees or the lengthy time it takes for a case to resolve. 

Instead of fighting back, the defendants may either settle with the plaintiff or abandon their Amazon account and the cash in it. Making a decision usually comes down to which one costs more. Zhang says the proposed settlement amount is often about 60% of the frozen account’s balance.

If sellers have just small amounts of money trapped in their Amazon account, they may well decide not to respond at all. The court eventually makes a default judgment, awarding whatever’s frozen in the account to the plaintiffs. Goldman estimates that 70% of all Schedule A cases end in such default judgments.

The assembly line of IP lawsuits 

IP lawsuits with large groups of e-commerce sellers as defendants first appeared in the early 2010s. The numbers of such cases have grown significantly in recent years, yet very few people are aware of their impact. According to Docket Alarm, a legal database, the number of Schedule A cases filed in the US rose from 105 in 2016 to 938 in 2022. Goldman estimates that more than 600,000 defendants may have been sued in this manner over the last decade.

!function(){“use strict”;window.addEventListener(“message”,(function(a){if(void 0!==a.data[“datawrapper-height”]){var e=document.querySelectorAll(“iframe”);for(var t in a.data[“datawrapper-height”])for(var r=0;r<e.length;r++)if(e[r].contentWindow===a.source){var i=a.data["datawrapper-height"][t]+"px";e[r].style.height=i}}}))}();

An entire Schedule A case can unfold in the matter of a few days. In the airbag case, after GBC filed the case on behalf of PopSockets on February 17, 2022, and sealed Schedule A, the legal team asked the judge to issue a temporary restraining order (TRO) the next day requiring Amazon, AliExpress, and Wish to freeze all 163 defendants’ accounts. 

Five days later, the judge granted the motion. Sun learned about it eight days later because her account was suspended by Amazon. It would take her until April to find an attorney.

There are legitimate reasons why the plaintiff may sue hundreds of sellers at the same time and conceal their names. One is to stop guilty defendants from transferring their assets to other accounts and even out of Amazon. But Goldman believes the method has been overused. 

In the case of the airbag lawsuit, the plaintiff claimed that the 164 defendants were interconnected. “​​E-commerce store operators like Defendants are in constant communication with each other … regarding tactics for operating multiple accounts, evading detection, pending litigation, and potential new lawsuits,” the filing reads. 

“Many sophisticated online counterfeiters operate under different seller aliases on multiple platforms,” Gaudio says. Even if the defendants aren’t explicitly communicating with each other, they can still be considered one group because they “understand that their ability to profit through anonymous internet stores is enhanced as their numbers increase,” he says. 

It’s true that some Chinese sellers own multiple accounts on Amazon, even though the platform forbids it, says Moira Weigel, a professor of communication studies at Northeastern University who has been studying Amazon third-party sellers for the past few years. But in her research, she’s found that the Chinese sellers often do it for mundane reasons, like to keep their products competitive on the platforms. “I’m always inclined to believe that accounts of criminality are overblown,” Weigel says.

Lumping defendants together gives the plaintiff a practical advantage: it can reduce court filing fees by as much as 98%. Keeping the Schedule A sealed also gives the plaintiff the benefit of maintaining an information asymmetry, says Goldman. If someone decides to fight back, the plaintiff can drop that defendant from the lawsuit in order to prevent adversarial evidence from reaching other defendants or the judges.

In all, bringing such suits is so easy and inexpensive that some law firms are putting them out one after another. “It’s a procedural assembly line. It’s just a repeated process, and it’s just growing by mass numbers,” says Stockman. Sometimes even when one lawsuit is being appealed, the plaintiffs are still filing new ones, with the same IP infringement claim, against hundreds more sellers. 

Trouble from Chicago

Among many Chinese e-commerce sellers, there is a shared wisdom: beware of purchases from Chicago. Lawyers sometimes order the product in question as part of diligence before they file a case. For years, most Schedule A cases have come from Chicago-based law firms filing in the US District Court for the Northern District of Illinois. Of the 938 Schedule A cases filed in 2022, nearly 85% (794) were filed in Chicago. A purchase order from Chicago could be a sign of trouble to come. 

It’s unclear why Chicago has become a hot spot for these cases, but the federal court there orders much higher compensation amounts than courts in other jurisdictions, says Stockman—sometimes more than three times as much.

Goldman even found a template on the website of the Chicago court for lawyers to use in filing these Schedule A cases. “Basically the judge is saying: Here are the arguments that will work for me, so all you gotta do is plug in your name and wherever I’ve asked for a few facts,” he says. “The judge has basically systematized not making particularized allegations against defendants.”

Some judges have started to question the practice. According to Bloomberg, one judge at the Chicago court asked in January, while presiding over such a case, “Have we been too easy and not skeptical enough on this practice? Are we getting taken advantage of by the plaintiffs’ bar in bringing these cases?”

Among Chinese sellers, GBC is the first and best-known law firm that engages in this IP violation litigation: it filed nearly one-third of all Schedule A lawsuits nationally last year. But its methods have become a convenient template for making e-commerce IP claims at scale, and plaintiff companies and law firms are catching on.

“Four years ago, there were probably three plaintiff law firms, the same in every case,” says Stockman. “Fast-forward four years to today: same venue, same jurisdiction, but every time I get hit with one of these cases, it’s a new law firm I’ve never heard of. [It] means everybody’s catching wind.”

Amazon’s role

Once e-commerce websites are notified by the court to take action against these sellers, they have to comply. But sellers say that Amazon is the platform most accommodating to plaintiffs’ requests. It will immediately freeze the seller’s account without any internal investigation, and sellers say it’s hard for them to plead their case. 

“Amazon is very strict when it comes to counterfeit sales,” says Stockman. That’s because it doesn’t want the stigma of being flooded with low-priced counterfeit products, often associated with platforms like Wish or AliExpress. Once the “magic word” counterfeit appears in a lawsuit, “[Amazon] will participate as needed to get them off the platform,” he says.

An Amazon spokesperson declined to comment for this story.

The emergence of e-commerce platforms like Amazon has decentralized and democratized access to marketing, and Amazon has always portrayed itself as the platform of small mom-and-pop sellers, says Weigel. But at the same time, she says, with the traditional IP protection regime failing to adapt to the new and more muddied e-commerce environment, Amazon is leaving these small brands to fight for themselves. 

As a result, Amazon sellers are simultaneously struggling to protect their IP and to avoid falling victim to IP trolling lawsuits. But Amazon has mostly shielded itself from the legal conundrum it creates. “When there’s a new regulation, ultimately it’s passed on to sellers, because Amazon ultimately is insulated from liability by the platform model, Section 230, by most existing liability laws, and so on,” says Weigel.

Fighting back

Of the 163 sellers sued by PopSockets in the airbag case, only six hired attorneys to defend themselves. Sun was the first. She decided from the beginning that she wouldn’t just pay for the settlement deal. 

“I felt like someone slapped me in the face, and why should I cry, hand over my money, and say: ‘That’s a good slap. Please be gentle on me next?’” she says. The attorney she hired told her that defending herself and countersuing PopSockets could cost her as much as $60,000—almost the entire amount frozen in the Amazon account. “But I made up my mind. I told myself: I would not give up and hand this money over to the [plaintiff],” Sun says. 

After she spent $20,000 and two months filing a countersuit, the plaintiff agreed to dismiss the restraining order on her Amazon accounts. A lengthy legal process followed in which each side needed to find evidence to support or deny the validity of the “airbag” trademark. They eventually settled at the end of May for an undisclosed amount. 

When Sun decided to appear in court, she tried to find other defendants to join her case and share the legal costs, but most of them chose to settle or abandon their accounts. “Not many people are like me,” she says. “If we could have stood up against these things together, they would know that we Chinese people are not so easy to take advantage of. And then they wouldn’t bully us so much.”

Correction: We updated the number of total Schedule A cases filed in the US in 2016 from 67 to 105.

Big Tech could help Iranian protesters by using an old tool

After the Iranian government took extreme measures to limit internet use in response to the pro-democracy protests that have filled Iranian streets since mid-September, Western tech companies scrambled to help restore access to Iranian citizens. 

Signal asked its users to help run proxy servers with support from the company. Google offered credits to help Iranians get online using Outline, the company’s own VPN. And in response to a post by US Secretary of State Antony Blinken on Iran’s censorship, Elon Musk quickly tweeted: “Activating Starlink …

But these workarounds aren’t enough. Though the first Starlink satellites have been smuggled into Iran, restoring the internet will likely require several thousand more. Signal tells MIT Technology Review that it has been vexed by “Iranian telecommunications providers preventing some SMS validation codes from being delivered.” And Iran has already detected and shut down Google’s VPN, which is what happens when any single VPN grows too popular (plus, unlike most VPNs, Outline costs money).

What’s more, “there’s no reliable mechanism for Iranian users to find these proxies,” Nima Fatemi, head of global cybersecurity nonprofit Kandoo, points out. They’re being promoted on social media networks that are themselves banned in Iran. “While I appreciate their effort,” he adds, “it feels half-baked and half-assed.”

There is something more that Big Tech could do, according to some pro-democracy activists and experts on digital freedom. But it has received little attention—even though it’s something several major service providers offered until just a few years ago.

“One thing people don’t talk about is domain fronting,” says Mahsa Alimardani, an internet researcher at the University of Oxford and Article19, a human rights organization focused on freedom of expression and information. It’s a technique developers used for years to skirt internet restrictions like those that have made it incredibly difficult for Iranians to communicate safely. In essence, domain fronting allows apps to disguise traffic directed toward them; for instance, when someone types a site into a web browser, this technique steps into that bit of browser-to-site communication and can scramble what the computer sees on the back end to disguise the end site’s true identity.

In the days of domain fronting, “cloud platforms were used for circumvention,” Alimardani explains. From 2016 to 2018, secure messaging apps like Telegram and Signal used the cloud hosting infrastructure of Google, Amazon, and Microsoft—which most of the web runs on—to disguise user traffic and successfully thwart bans and surveillance in Russia and across the Middle East.

But Google and Amazon discontinued the practice in 2018, following pushback from the Russian government and citing security concerns about how it could be abused by hackers. Now activists who work at the intersection of human rights and technology say reinstating the technique, with some tweaks, is a tool Big Tech could use to quickly get Iranians back online.

Domain fronting “is a good place to start” if tech giants really want to help, Alimardani says. “They need to be investing in helping with circumvention technology, and having stamped out domain fronting is really not a good look.”

Domain fronting could be a critical tool to help protesters and activists stay in touch with each other for planning and safety purposes, and to allow them to update worried family and friends during a dangerous period. “We recognize the possibility that we might not come back home every time we go out,” says Elmira, an Iranian woman in her 30s who asked to be identified only by her first name for security reasons.

Still, no major companies have publicly said they will consider launching or restoring the anti-censorship tool. Two of the three major service providers that previously allowed domain fronting, Google and Microsoft, could not be reached for comment. The third, Amazon, directed MIT Technology Review to a 2019 blog post in which a product manager described steps the company has taken to minimize the “abusive use of domain fronting practices.”

“A cat-and-mouse game”

By now, Iranian citizens largely expect that their digital communications and searches are being combed through by the powers of the state. “They listen and control almost all communications in order to counter demonstrations,” says Elmira. “It’s like we’re being suffocated.”

This isn’t, broadly speaking, a new phenomenon in the country. But it’s reached a crisis point over the past two months, during a growing swell of anti-government protests sparked by the death of 22-year-old Mahsa Amini on September 16 after Iran’s Guidance Patrol—more commonly known as the morality police—arrested her for wearing her hijab improperly.

“The world realized that the matter of hijab, which I myself believe is a personal choice, could become an incident over which a young girl can lose her life,” Elmira says. 

According to rights groups, over 300 people, including at least 41 children, have been killed since protests began. The crackdown has been especially brutal in largely Kurdish western Iran, where Amini was from and Elmira now lives. Severely restricting internet access has been a way for the regime to further crush dissent. “This is not the first time that the internet services have been disrupted in Iran,” Elmira says. “The reason for this action is the government’s fear, because there is no freedom of speech here.”

The seeds of today’s digital repression trace back to 2006, when Iran announced plans to craft its own intranet—an exclusive, national network designed to keep Iranians off the World Wide Web. 

“This is really hard to do,” says Kian Vesteinsson, a senior analyst for the global democracy nonprofit Freedom House. That’s because it requires replicating global infrastructure with domestic resources while pruning global web access.

The payoff is “digital spaces that are easier to monitor and to control,” Vesteinsson says. Of the seven countries trying to isolate themselves from the global internet, Iran is the furthest along today.

Iran debuted its National Information Network in 2019, when authorities hit a national kill switch on the global web amid protests over gas prices. During a week when the country was electronically cut off from the rest of the world, the regime killed 1,500 people. The Iranian economy, which relies on broader connectivity to do business, lost over a billion US dollars during the bloody week. 

While recently Iran has intermittently cut access to the entire global internet in some regions, it hasn’t instituted another total global web shutdown. Instead, it is largely pursuing censorship strategies designed to crush dissent while sparing the economy. Rolling “digital curfews” are in place from about 4 p.m. into the early morning hours—ensuring that the web becomes incredibly difficult to access during the period when most protests occur.

The government has blocked most popular apps, including Twitter, Instagram, Facebook, and WhatsApp, in favor of local copycat apps where no message or search is private.

“The messaging apps we use, like WhatsApp, have a certain level of protection embedded in their coding,” Elmira says. “We feel more comfortable using them. [The government] cannot have control over them, and as a result, they restrict access.”

The Iranian regime is also aggressively shutting down VPNs, which were a lifeline for many Iranians and the country’s most popular censorship workaround. About 80% of Iranians use tools to bypass censorship and use apps they prefer. “Even my grandpa knows how to install a VPN app,” an Iranian woman who requested anonymity for safety reasons tells me. 

To crush VPN use, Iran’s government has invested heavily in “deep packet inspection,” a technology that peers into the fine print of internet traffic and can recognize and shut down nearly any VPN with time.

That’s created a “cat-and-mouse game,” says Alimardani, the internet researcher. “You need to be offering, like, thousands of VPNs,” she says, so that some will remain available as Iran diligently recognizes and blocks others. Without enough VPNs, activists aren’t left with many secure communication options, making it much harder for Iranians to coordinate protests and communicate with the outside world as death tolls climb.

Domain fronting to beat censors

Domain fronting works by concealing the app or website a user ultimately wants to reach. It’s sort of like putting a correctly addressed postcard in an envelope with a different, innocuous destination—then having someone at the fake-out address hand-deliver it.

The technique is attractive because it’s implemented by service providers rather than individuals, who may or may not be tech savvy. It also makes censorship more painful for governments to pursue. The only way to ban a domain-fronted app is to shut down the entire web hosting provider the app uses—bringing an avalanche of other apps and sites down with it. And since Microsoft, Amazon, and Google provide hosting services for most of the digital world, domain fronting by those companies would force countries to crash much of the internet in order to deny access to an undesired app.

“There’s no way to just pick out Telegram. That’s the power of it,” says Erik Hunstad, a security expert and CTO of the cybersecurity company SixGen.

Nevertheless, in April 2018, Russia blocked Amazon, Google, and a host of other popular services in order to ban the secure-messaging app Telegram, which initially used domain fronting to beat censors. These disruptions made the ban broadly unpopular with average Russians, not just activists who favored the app. 

The Russian government, in turn, exerted pressure on Amazon and Google to end the practice.

In April 2018, the companies terminated support for domain fronting altogether. “Amazon and Google just completely disabled this potentially extremely useful service,” Alimardani says. 

Google made the change quietly, but soon afterwards, it described domain fronting to the Verge as a “quirk” of its software. In its own announcement, Amazon said domain fronting could help malware masquerade as standard traffic. Hackers could also abuse the technique—the Russian hacker group APT29 has used domain fronting, alongside other means, to access classified data.

Still, Signal, which began using domain fronting in 2016 to operate in several Middle Eastern countries attempting to block the app, issued a statement at the time: “The censors in these countries will have (at least temporarily) achieved their goals.”

“While domain fronting still works with domains on smaller networks, this greatly limits the current utility of the technique,” says Simon Migliano, a digital privacy expert and head of research at Top10VPN, an independent VPN review website.

(Microsoft announced a ban on domain fronting in 2021, but the cloud infrastructure that enables the technique is intact. Earlier this week, Microsoft wrote that, going forward, it will “block any HTTP request that exhibits domain fronting behavior.”)

Migliano echoes Google in describing domain fronting as “essentially a bug,” and he admits it has “very real security risks.” It is “certainly a shame” that companies are revoking it, he says, “but you can understand their position.”

But Hunstad, who also works in cybersecurity, says there are ways to minimize the cybersecurity risks of domain fronting while preserving its use as an anti-censorship tool. He explains that the way networks process user requests means Google, Amazon, or Microsoft could easily greenlight the use of domain fronting for certain apps, like WhatsApp or Telegram, while otherwise banning the tactic.

Rather than technical limitations, Hunstad says, it’s a “prisoner’s dilemma situation [for] the big providers” that is keeping them from re-enabling domain fronting—they’re stuck between pressure from authoritarian governments and an outcry from activists. He speculates that financial imperatives are part of the calculus as well. 

“If I’m hosting my website with Google, and they decide to enable this for Signal and Telegram, or maybe across the board, and multiple countries decide to remove access to all of Google because of that—then I have potentially less reach,” Hunstad says. “I’ll just go to the provider that’s not doing it, and Google is going to have a business impact.” 

The likelihood that Amazon or Google will reinstate domain fronting depends on “how cynical you are about their profit motives versus their good intentions for the world,” Hunstad adds. 

What’s next

While Fatemi, from Kandoo, argues that restoring domain fronting would be helpful for Iranian protesters, he emphasizes that it wouldn’t be a silver bullet. 

“In the short term, if they can relax domain fronting so that people, for example, can use Signal, or people can connect to VPN connections, that would be phenomenal,” he says. He adds that to move solutions along more quickly, companies like Google could collaborate with nonprofits that specialize in deploying tech in vulnerable situations. 

But Big Tech companies also need to commit a bigger slice of their resources and talent to developing technologies that can beat internet censorship, he says: “[Domain fronting is] a Band-Aid on a much larger problem. If we want to go at a much larger problem, we have to dedicate engineers.” 

Until the world finds an enduring solution to authoritarian attempts to splinter the global web, tech companies that want to help people will be left scrambling for reactive tactics. 

“There needs to be a whole toolkit of different kinds of VPNs and circumvention tools right now, because what they are doing is highly sophisticated,” Alimardani says. “Google is one of the richest and most powerful companies in the world. And offering one VPN is really not enough.”

So for now, seven weeks into Iran’s protests, internet and VPN access remain throttled, restrictions show no sign of slowing, and domain fronting remains dead. And it’s the citizens on the front lines who have to carry the biggest burden.

“The conditions are dire here,” Elmira tells me. The lack of connectivity has made massacres difficult to verify and has complicated efforts to sustain protests and other activism. 

“To counter the demonstrations, they cut off our access to the internet and social media,” she says. 

But Elmira is resolute. “I, myself, and many of my friends now go out with no fear,” she says. “We know that they might shoot us. But it is worth taking this risk and to go out and try our best instead of staying home and continuing taking this.”