Further internet cuts target Sudan’s pro-democracy movement with nationwide impact

Posted on

New network data show that internet connectivity has been further restricted across Sudan as of 6 June 2019, adding to mobile telecommunications infrastructure blackouts observed through Monday morning and over the weekend.

The latest outages come as new reports emerge that over a hundred sit-in participants and demonstrators have been killed by paramilitary groups in Khartoum, amid arbitrary violence and predatory attacks targeting pro-democracy demonstrators attending sit-ins to demand a civilian-led government.

Further, analysis of internet traffic shows that some networks appearing to remain nominally available have are now also been disabled, causing a near-total restriction on the flow of information in and out of Sudan for a significant portion of the population.

Data show that more restrictions are now in place targeting all internet providers, affecting Sudan’s fixed-line connectivity as well as mobile access. Internet measurements show a markedly different, and more severe, mechanism of internet censorship than those during the rule of ousted president Omar al-Bashir.

While charts show nationwide IP connectivity has fallen to 80%, NetBlocks researchers have found that overall impact is more severe because the impacted 20% include major gateways for carrier-grade network (CGNAT) routes used to connect the majority of Sudan’s citizens.

Even where telecoms infrastructure is powered on, the loss of seasonality in the chart since 3 June shows most Sudanese are no longer able to access the internet

The scale of the outage can also be observed indirectly from the loss of Sudan’s diurnal pattern, resembling an ECG heartbeat pattern in the visualization. The flattening line since 3 June shows that even where technical infrastructure is powered on, users are no longer able to go online.

Web probe data show those users still able to connect experienced brief periods of high latency, or the slowing of internet access, sometimes called “throttling”

Meanwhile, NetBlocks web probe data taken by network scans from vantage points across Sudan during the same period show latency peaks around the times of each disconnection event, sometimes called “throttling.” This slowing of connectivity appears to be associated with total disconnection incidents including that on the evening of 3 June.

Hence, the peaks with average latencies in excess of ~5s may represent either the purposeful slowing of internet access but could equally be a technical symptom of the wider blackouts. Ironically, aside from those periods of high latency, internet performance appears to have improved with round-trip times falling to ~1.8s due to the loss of users across Sudan and the commensurate drop in contention rates.

The latest analysis shows that parts of Sudan started going on 31 May, prior to the more severe and widely reported disruptions on 3 June and 5 June. Each of these disruption phases have have had a concurrent and cumulative effect.

Edge of network targeted

No clear statement has been provided about the telecommunications blackouts, which currently constitute a near-total blockade on information in and out of Sudan. Emerging reports suggest that citizens have struggled to stay informed, reach safety and monitor extrajudicial killings, gender based violence and other human rights violations allegedly perpetrated in recent days.

The new outages target the “edge” of the network rather than core infrastructure or specific websites, manifesting in to a total disconnection that cannot be circumvented by internet users. Sudan’s internet backbone remains connected and there are continued indications that some connectivity has been preserved by authorities, possibly for use by security forces or state officials.

On Wednesday 5 June, connectivity with fixed line provider Canar (Kanartel, AS33788) dropped to 40%, knocking out most subscriber connections:

Broadband and LTE provider Canar Telecom experienced a new drop in connectivity at 9:00 AM UTC on Wednesday

The new disruptions come in addition to the ongoing blackout affecting mobile providers MTN, Mobiltel (ZAIN), parts of the national Sudan Telecom Sudatel / Sudani network, and education and research network SUDREN reported by NetBlocks on Monday.

Internet interference a hallmark of Sudan’s uprising

Through December to April, Sudanese ISPs disrupted social media, censored media and frequently disabled nationwide connectivity as protesters took to the streets to drive president Omar al-Bashir out of power.

Access to Twitter, Periscope, Facebook, Instagram, and WhatsApp were restored in Sudan on Thursday 11 April 2019 as the leader stepped down following months of intense demonstrations, as show in network measurement data collected by the NetBlocks internet observatory.

During the longest disruption, Sudan cut social media for 68 consecutive days, with Facebook, Twitter, Instagram and WhatsApp outages beginning 10 AM 21 December 2018 and lasting until February 26 2019, according to NetBlocks internet measurements.

Civil society and technical groups including the Internet Society have called for the restoration of connectivity in Sudan. The availability of unfiltered internet access and an end to political censorship remain essential for a successful transition to a civilian-led government.

Methodology

Internet performance and service reachability are determined via NetBlocks web probe privacy-preserving analytics. Each measurement consists of latency round trip time, outage type and autonomous system number aggregated in real-time to assess service availability and latency in a given country. Network providers and locations are enumerated as vantage point pairs. The root cause of a service outage may be additionally corroborated by means of traffic analysis and manual testing as detailed in the report.

NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages may have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.

NetBlocks is an internet monitor working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives to deliver a fair and inclusive digital future for all.

[ press | contact ] Graphics and visualizations are provided for fair use in unaltered form reflecting the meaning and intent in which they were published, with clear credit and source attribution to NetBlocks. Intellectual property rights are protected including but not limited to key findings, facts and figures, trademarks, copyrights, and original reporting, are held by NetBlocks. Citation and source attribution are required at the point of use.