Internet disruption hits Belarus on election day

Posted on

Network telemetry from the NetBlocks internet observatory confirm that internet connectivity in Belarus has been significantly disrupted as of Sunday 9 August 2020 amid tense presidential elections. Outages increased in severity through the day producing an information vacuum as citizens struggled to establish contact with the outside world. The incident continued until Wednesday morning with a recorded duration of 61 hours.

Real-time metrics showed an initial 50% drop in connectivity affecting international routes several major network operators, first briefly at midnight UTC with high impact to Minsk, then starting again in the morning and spreading to affect most major online services by afternoon.

Several online platforms including social media, search engines and news sites also became unreachable between from morning Sunday onward, and remained so until 12 August 2020.

In addition to rolling internet blackouts, NetBlocks identified the use of Deep Packet Inspection filtering in keyword-math mode, a rarely-used facility provided by network filtering devices. In this configuration, any internet domain name with a portion matching a pre-defined list of keywords is blocked.

Attempts to access an internet address containing one of a wide range of blocked words, such as www.google.com or en.wikipedia.org are denied, giving the impression of a technical fault. Identified keywords represent generic categories, including social media, web search, email, e-commerce, gaming and entertainment, of the kind supplied by off-the-shelf internet censorship products:

Severe internet blackouts and widespread online platform filtering came into place from Sunday afternoon and continued until Wednesday morning when the first significant return of internet access was registered.

During that time, most networks were fully offline or carried reduced traffic. As connectivity returned on Wednesday, news media began to report on the emergence of hundreds of videos and photographs documenting incidents that took place during the blackout.

What’s happening in Belarus?

On Saturday, thousands of protesters took to the streets in support of the political opposition. Belarusian President Alexander Lukashenko is seeking a sixth term in office, but faces a challenging geopolitical landscape. From the early hours of Sunday, footage emerged of military convoys weaving through the streets of Minsk but the information vacuum frustrated reporting and fact-checking efforts.

On Saturday, news media had reported leaked plans to shut down internet service during Sunday’s elections. Live data appear to validate several details in the interview published by Moscow Daily Moskovskij Komsomolets, where a telecommunications company employee listed a schedule of politically motivated restrictions. National cyber-security response center Belarus CERT issued a statement claiming the internet restrictions were a counter-measure to block incoming cyber-attacks.

 

Further incidents and updates

On Thursday 13 August 2020, a day after the blackout ended, DPI/SNI filtering tests identified a transition from keyword-based filtering to exact-match filtering. Blocked sites included the Belarusian Association of Journalists, a variety of local news platforms, opposition election websites, webmail and VPN services. As opposed to the keyword-based filtering in previous days, these restrictions follow a more precise scheme of exact domain matching:

On Friday, 14 August 2020, a localized, hour-long internet disruption was registered in central Minsk, corroborating reports of a cellular outage amid protests at Independence Square. The disruption is distinct from and has smaller scale than previously reported network incidents:

On Monday, 17 August 2020 following a nation-scale internet disruption of approximately 15 minutes was observed, coinciding with a pro-Lukashenko rally where factory workers appeared to drown out the incumbent leader’s speech:

On the evening of Sunday 23 August 2020, cellular network MTS and AI fell offline in Minsk as protesters approached the presidential palace.

Following significant international pressure on Austria-based A1 Telekom to end its complicity, network operator A1 declared that service quality had been reduced at the request of government agencies to “ensure national security.” MTS also announced the incident, but continued to put the disruption down to external providers. The disruptions extended to other networks and had a duration of a little over 3 hours:

On Wednesday 26 August 2020, authorities again restricted mobile and some fixed-line internet access in Minsk upon state orders, restored after approximately one hour:

Internet restrictions have continued with further instances recorded on 13 September 2020 and on the 20th during the Justice March public assembly.

Data show a reduction in observability, potentially caused by changes made to the mechanism of restriction. This results in a divergence between y axis metrics and known impact levels for a nationwide incident, while the x axis remains faithful to reported incident timings. Connectivity metrics in the 98th percentile have previously been used to corroborate a localized internet blackout during protests in Moscow.

On Sunday 27 September 2020, NetBlocks data confirmed the imposition of internet restrictions for a period of five hours as over 100,000 demonstrators took to the streets of Minsk and other cities, marking 50 days of protests.

Time series data below are visualized on dual axes, each scaled and aligned for comparison of timings on a single chart, accounting for recent reductions in network observability detailed in the previous update:

Following the pattern documented in previous weeks, NetBlocks data confirm that Internet disruptions were again imposed on Sunday, 4 October 2020 as protesters called for the release of political prisoners:

On Sunday, 8 November 2020 NetBlocks metrics show that internet service was restricted from 10 a.m. local time for a period of seven hours, as thousands of demonstrators participated in in the thirteenth consecutive week of protests over irregularities in the August 2020 Belarusian presidential election, with many calling out to U.S. President-elect Joe Biden for recognition. The telecommunications restrictions follow a similar pattern as observed during previous Sunday protests, though starting somewhat earlier in the day and lasting longer in this instance.

On Sunday, 6 December 2020, connectivity data show a period of unusually widespread outages lasting some 20 minutes, impacting most networks outside of the national gateway. The cause of the blackout, which may be indicative of a reconfiguration event or a targeted information control, remains under investigation.

Further reading:

Methodology

This report follows the NetBlocks Election Pathfinder Rapid Response methodology which defines a set of core principles, workflows and benchmarks for network measurement and evaluation during elections and referenda.

Internet performance and service reachability are determined via NetBlocks web probe privacy-preserving analytics. Each measurement consists of latency round trip time, outage type and autonomous system number aggregated in real-time to assess service availability and latency in a given country. Network providers and locations are enumerated as vantage point pairs. The root cause of a service outage may be additionally corroborated by means of traffic analysis and manual testing as detailed in the report.

NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages may have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.

A summary of data visualizations used in this report:

  • Network Connectivity (National): Internet providers and networks serving the affected region are visualized in a stacked time-series histogram to identify the start and end times of an internet outage event. Scales on the y-axis are adjusted to match localized maxima while minima indicate periods when networks became unreachable. The x-axis represents Universal Coordinated time (GMT+0).
    • Standard: Connectivity levels on the y-axis correspond directly to the observed number of reachable connections, as with National Connectivity charts.

NetBlocks is an internet monitor working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives to deliver a fair and inclusive digital future for all.

[ press | contact ] Graphics and visualizations are provided for fair use in unaltered form reflecting the meaning and intent in which they were published, with clear credit and source attribution to NetBlocks. Intellectual property rights are protected including but not limited to key findings, facts and figures, trademarks, copyrights, and original reporting, are held by NetBlocks. Citation and source attribution are required at the point of use.