VPN services blocked in Sri Lanka as information controls tighten

Internet providers in Sri Lanka are in the vanguard of blocking access to digital security tools that allow users to work around censorship, according to new NetBlocks network measurement data.

On Sunday, Sri Lanka restricted access to social media platforms following a series of deadly attacks on churches and hotels. The new VPN restrictions appear to target users who have been circumventing censorship measures, which the government says are in place to prevent the spread of disinformation. Critics caution that the filtering measures are an impediment to independent media coverage and free expression as Sri Lanka comes to terms with the attacks.

Sri Lanka joins a handful of states that implement similar controls on VPN services and internet protocols that tunnel network traffic from point to point:

Pictured: NetBlocks connectivity data in countries with significant internet penetration that experienced restricted VPN access through the last 12 months

Virtual private networks enhance privacy and also allow users to work around internet restrictions. VPN usage is common in among journalists and in ICT, consulting and financial sectors, where they are often required for security reasons.

Data shows that one of the most prominent commercial VPN providers was blocked at 4 AM UTC Monday morning, 9:30 AM local time one day after the attacks and initial response:

United Arab Emirates-owned provider Etisalat, implicated last week in the blocking of opposition political websites during Egypt’s constitutional referendum, is blocking several VPN providers in Sri Lanka using two distinct DNS poisoning techniques. In this case, Etisalat subsidiary Tigo’s servers were found to be impersonating the blocked companies’ authoritative DNS servers:

The new NetBlocks findings, collected with assistance from volunteers across Sri Lanka, help build a timeline of Sri Lanka’s expanding censorship measures through recent days.

Technical evidence corroborates user reports of difficulty downloading, installing and connecting to various VPN services, widely used by Sri Lankans as a means to access blocked social media sites and messaging apps following Sunday’s attacks, further indicating that they have been implemented on a separate schedule to the social blocks. The restrictions come amid criticism of the government’s handling as citizens come to terms with the situation.

Sri Lanka previously blocked social media in March 2018 for a period of eight days, restricting access to a similar set of digital platforms and incurring an estimated $30m cost to the country’s GDP.


NetBlocks is a civil society group working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives for an open and inclusive digital future for all.

[ methodology handbook | press | contact ] Graphics and visualizations provided under a free and open license for reuse with clear attribution.