Network telemetry from the NetBlocks internet observatory confirm that internet connectivity in Belarus has been significantly disrupted as of Sunday 9 August 2020 amid tense presidential elections. Outages increased in severity through the day producing an information vacuum as citizens struggled to establish contact with the outside world. The incident continued until Wednesday morning with a recorded duration of 61 hours.
Update: Internet has returned to most of #Belarus as of Wednesday morning, election blackout day 4, with cellular and fixed-line now operational although monitoring continues; incident duration 61 hours 📈
— NetBlocks.org (@netblocks) August 12, 2020
Real-time metrics showed an initial 50% drop in connectivity affecting international routes several major network operators, first briefly at midnight UTC with high impact to Minsk, then starting again in the morning and spreading to affect most major online services by afternoon.
Several online platforms including social media, search engines and news sites also became unreachable between from morning Sunday onward, and remained so until 12 August 2020.
ICYMI: #Belarus is in the midst of nation-scale internet disruption affecting fixed-line and cellular operators; chart shows progressive disconnection of various online platforms, with public DNS services first to go from midnight, then social media 📉
— NetBlocks.org (@netblocks) August 9, 2020
In addition to rolling internet blackouts, NetBlocks identified the use of Deep Packet Inspection filtering in keyword-math mode, a rarely-used facility provided by network filtering devices. In this configuration, any internet domain name with a portion matching a pre-defined list of keywords is blocked.
Attempts to access an internet address containing one of a wide range of blocked words, such as www.google.com or en.wikipedia.org are denied, giving the impression of a technical fault. Identified keywords represent generic categories, including social media, web search, email, e-commerce, gaming and entertainment, of the kind supplied by off-the-shelf internet censorship products:
Update: Application layer outages in #Belarus are in part due to DPI keyword filtering.
Blocked words included names of social media and news sites, but also brands like Walmart, Samsung and Disney, giving the impression of a wider technical failure.
— NetBlocks.org (@netblocks) August 11, 2020
Severe internet blackouts and widespread online platform filtering came into place from Sunday afternoon and continued until Wednesday morning when the first significant return of internet access was registered.
During that time, most networks were fully offline or carried reduced traffic. As connectivity returned on Wednesday, news media began to report on the emergence of hundreds of videos and photographs documenting incidents that took place during the blackout.
Update: Multiple internet providers in #Belarus have lost routing as polling stations start to close from 8:00 p.m; geolocated network data confirm the new disruption has nation-scale impact further limiting visibility of events 📵 #Belarus2020
— NetBlocks.org (@netblocks) August 9, 2020
What’s happening in Belarus?
On Saturday, thousands of protesters took to the streets in support of the political opposition. Belarusian President Alexander Lukashenko is seeking a sixth term in office, but faces a challenging geopolitical landscape. From the early hours of Sunday, footage emerged of military convoys weaving through the streets of Minsk but the information vacuum frustrated reporting and fact-checking efforts.
Update: It has been almost 24 hours since #Belarus fell largely offline after a series of worsening internet disruptions during Sunday's elections.
Real-time network data confirm the incident is ongoing, limiting freedom of expression and assembly 📉
— NetBlocks.org (@netblocks) August 10, 2020
On Saturday, news media had reported leaked plans to shut down internet service during Sunday’s elections. Live data appear to validate several details in the interview published by Moscow Daily Moskovskij Komsomolets, where a telecommunications company employee listed a schedule of politically motivated restrictions. National cyber-security response center Belarus CERT issued a statement claiming the internet restrictions were a counter-measure to block incoming cyber-attacks.
Further incidents and updates
On Thursday 13 August 2020, a day after the blackout ended, DPI/SNI filtering tests identified a transition from keyword-based filtering to exact-match filtering. Blocked sites included the Belarusian Association of Journalists, a variety of local news platforms, opposition election websites, webmail and VPN services. As opposed to the keyword-based filtering in previous days, these restrictions follow a more precise scheme of exact domain matching:
On Friday, 14 August 2020, a localized, hour-long internet disruption was registered in central Minsk, corroborating reports of a cellular outage amid protests at Independence Square. The disruption is distinct from and has smaller scale than previously reported network incidents:
⚠️ Alert: Real-time network data show a drop in cellular internet connectivity in #Minsk from 5:45 p.m. amid reports security forces have been dispatched to meet protesters at Independence Square #Belarus; developing incident 📵
— NetBlocks.org (@netblocks) August 14, 2020
On Monday, 17 August 2020 following a nation-scale internet disruption of approximately 15 minutes was observed, coinciding with a pro-Lukashenko rally where factory workers appeared to drown out the incumbent leader’s speech:
Confirmed: Nation-scale internet disruption currently registered in #Belarus affecting almost all networks in the country; incident duration ~15 minutes, with signs of some ongoing impact 📉
— NetBlocks.org (@netblocks) August 17, 2020
On the evening of Sunday 23 August 2020, cellular network MTS and AI fell offline in Minsk as protesters approached the presidential palace.
Following significant international pressure on Austria-based A1 Telekom to end its complicity, network operator A1 declared that service quality had been reduced at the request of government agencies to “ensure national security.” MTS also announced the incident, but continued to put the disruption down to external providers. The disruptions extended to other networks and had a duration of a little over 3 hours:
Update: Internet service has been restored in #Minsk following a disruption impacting MTS, A1 and others described by operators as a national security measure at the request of government agencies; incident duration ~3:20h 📉📈 #Belarus
— NetBlocks.org (@netblocks) August 23, 2020
On Wednesday 26 August 2020, authorities again restricted mobile and some fixed-line internet access in Minsk upon state orders, restored after approximately one hour:
Confirmed: City-scale internet disruption registered in #Minsk affecting network operator MTS from 8:40 p.m. local time amid protests; operator A1 also disrupted and discloses shutdown was ordered by #Belarus authorities 📉
— NetBlocks.org (@netblocks) August 26, 2020
Internet restrictions have continued with further instances recorded on 13 September 2020 and on the 20th during the Justice March public assembly.
Data show a reduction in observability, potentially caused by changes made to the mechanism of restriction. This results in a divergence between y axis metrics and known impact levels for a nationwide incident, while the x axis remains faithful to reported incident timings. Connectivity metrics in the 98th percentile have previously been used to corroborate a localized internet blackout during protests in Moscow.
Confirmed: Internet disruption on in effect in #Belarus from 2:40 pm local time as protesters assemble for #JusticeMarch #BelarusProtests; restrictions confirmed by telco A1 in "accordance with the order of authorized state bodies" 📉
— NetBlocks.org (@netblocks) September 20, 2020
On Sunday 27 September 2020, NetBlocks data confirmed the imposition of internet restrictions for a period of five hours as over 100,000 demonstrators took to the streets of Minsk and other cities, marking 50 days of protests.
Time series data below are visualized on dual axes, each scaled and aligned for comparison of timings on a single chart, accounting for recent reductions in network observability detailed in the previous update:
Confirmed: Internet restricted in #Belarus during marches to mark 50th day of protests in #Minsk and other cities; network data show centralized mechanism of control impacting multiple providers; incident duration 5 hours 📉 #BelarusProtests
— NetBlocks.org (@netblocks) September 27, 2020
Following the pattern documented in previous weeks, NetBlocks data confirm that Internet disruptions were again imposed on Sunday, 4 October 2020 as protesters called for the release of political prisoners:
Confirmed: Internet restricted in #Belarus from 2:00 p.m. local time in eighth week of Sunday protests as demonstrators call for release of political prisoners; disruptions observed on multiple providers 📉 #BelarusProtests
— NetBlocks.org (@netblocks) October 4, 2020
- Belarus Shut Down the Internet to Stop a Wild Viral Video of Its President – VICE
- Belarus Has Shut Down the Internet Amid a Controversial Election – WIRED
- Belarus election: President Lukashenko faces toughest test in years – BBC
- Belarus Turned Off the Internet. Its Citizens Hot-Wired It – Gizmodo
- How much is one day without the Internet in Belarus according to international organization NetBlocks – Tut.by
- Belarusian Officials Shut Down Internet With Technology Made by U.S. Firm – Bloomberg
- Belarus Cut Off the Internet and Tried to Make It Look Like an Accident – VICE
- Belarus presidential election: Lukashenko gets 80% in preliminary results – Euronews
- Belarus experienced ‘nation-scale’ internet disruption during election, says web monitoring group – Fox News
- Belarus’ Revolution by Meme – Slate
- Belarus: data for the autocrat – Wiener Zeitung
- Global experts estimate losses from internet disconnection in Belarus – Kod
- Repercussions of the Internet Shutdown on the Belarusian IT Sector – The Jamestown Foundation
- Internet turned on in Minsk: minus $ 170 million in three days – Komsomolskaya Pravda
- Another Casualty Of The Brutal Belarus Crackdown: Minsk’s Thriving IT Sector – RFE/RL
- What’s happening with the Internet in Belarus – the opinion of technical experts – Tut.by
- Nationwide internet restrictions on election day in Belarus – Netzpolitik
- Internet in Belarus does not work for the third day – Meduza
- Belarus internet outage report – Dev.by
- Internet disconnection cost Belarus more than $ 56 million a day – Forbes
- Belarusian organizations complain of massive network disruptions – Der Spiegel
- Protests broke out over the Belarusan presidential election and the country’s internet went down – Insider
- The FP Guide to the Political Unrest in Belarus – Foreign Policy
- Main opposition candidate goes into hiding on eve of crucial presidential vote in Belarus – CNN
- Group says Belarus hit with ‘nation-scale’ internet disruption during election – New York Post
- Lukashenko expected to retain presidential post as Belarus votes – The Guardian
- Belarus election: Thousands arrested in protests Alexander Lukashenko wins 80% of vote in ‘absurd’ poll – The Times
- Internet in Belarus is partially blocked: NetBlocks – Rossaprimavera
- Internet in Belarus is jammed for the second day in a row – Finanz RU
- Tikhanovskaya expects fair elections, Tsepkalo left Belarus – RFI
- How Telegram Users Found A Way Through Belarus’s Internet Lockdown – RFE/RL
- What is Nexta — the Telegram channel reporting on Belarus’ protests? – Euronews
- How Belarus was left without the Internet – BBC Russian
- Bye bye, Bynet – Meduza
This report follows the Election Pathfinder Rapid Response methodology which defines a set of core principles, workflows and benchmarks for network measurement and evaluation during elections and referenda.
Internet performance and service reachability are determined via NetBlocks web probe privacy-preserving analytics. Each measurement consists of latency round trip time, outage type and autonomous system number aggregated in real-time to assess service availability and latency in a given country. Network providers and locations enumerated as vantage point pairs. The root cause of a service outage may be additionally corroborated by means of traffic analysis and manual testing as detailed in the report.
NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages generally have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.
A summary of data visualizations used in this report:
- Network Connectivity (National): Internet providers and networks serving the affected region are visualized in a stacked time-series histogram to identify the start and end times of an internet outage event. Scales on the y-axis are adjusted to match localized maxima while minima indicate periods when networks became unreachable. The x-axis represents Universal Coordinated time (GMT+0).
- Standard: Connectivity levels on the y-axis correspond directly to the observed number of reachable connections, as with National Connectivity charts.
NetBlocks is a civil society group working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives for an open and inclusive digital future for all.