FlagThis

Abstract

Internet censorship affects over four billion people, and every deployed circumvention system shares one structural weakness. Its endpoints are fixed and discoverable, so a patient censor eventually enumerates and blocks them. A recent class of systems instead makes infrastructure a moving target, rotating endpoints across commercial cloud address space faster than a censor can block them. These systems demonstrate that the idea works, but the field has no theory of when it works, and rotation intervals and pool sizes are chosen by intuition. We give the first formal account. We model the censor and defender interaction as a continuous-time timing game on a combinatorial (address, domain) space, generalizing FlipIt to a collateral-bounded adversary, and we prove a sustainability frontier that separates the configurations a censor can defeat from those it cannot. Our central finding is that under the Great Firewalls 2024 shift to blocking QUIC and TLS by domain, raw rotation speed is not the binding constraint. Whether rotation wins is governed by a single dimensionless quantity, the domain burn rate = $\lambda_{disc} / \lambda_{intro}$, the ratio of how fast the censor blocks the defenders domains to how fast the defender mints fresh ones. We derive a closed-form availability law, prove that address rotation alone ($\lambda > 1$) cannot sustain high availability regardless of how fast endpoints rotate, and characterize the sustainability frontier. We confirm every analytical result in an open, model-level censordefender simulator that needs no privileged access or cloud deployment, reproducing the predicted phase transition at $\lambda = 1$ under adversary profiles representative of the GFW, Russias TSPU, and Iran, and we show the frontier is robust to state-dependent discovery and bursty, provider-correlated burns. The validation is model-level, confirming that the analysis and an independent simulation agree rather than fitting a specific censor. The theory replaces the common design heuristic of rotating faster with a precise operating condition, namely keeping the domain economy ahead of the censor, and supplies an open, reproducible testbed for the censorship-resistance community.