Internet Disruption Report: August 2019

The August 1994 issue of WIRED Magazine hardly hinted at the coming ubiquity of the Internet, featuring articles on CD-ROM games and reviews of the Apple Newton. Commercial Internet services were very much in their infancy at the time, with the issue containing just a few advertisements for nascent Internet Service Providers, such as the one shown below. Twenty-five years ago, Internet disruptions were more likely to be caused by overloaded modem banks or congestion at one of the few peering points available at the time.

Advertisement for Internet Service Provider "The Little Garden", scanned from the August 1994 issue of WIRED magazine.
The Little Garden was sold in 1996 to Best Internet Communications, which was acquired by Verio in 1999, which then became part of NTT in 2000.

Today, Internet connectivity is significantly more ubiquitous, faster and less expensive (in most places), and generally reliable. With increased Internet availability and usage, however, disruptions become more noticeable, and impact a significantly larger population of users. In August, we observed Internet disruptions around the world due to power outages, national exams, and network issues. Several government-directed disruptions were widely reported as well, but were not easily observable in monitoring tools.

Power Outages

On Sunday, August 4, a significant power outage occurred in Indonesia at midday local time (05:00 GMT), lasting approximately 12 hours. The power outage impacted tens of millions of people in Indonesia’s capital Jakarta, and nearby provinces and cities, as well as affecting mobile phone networks.

The figures below illustrate the impact of the power outage at a country level. Both the Oracle Internet Intelligence and CAIDA IODA graphs show a decline in successful active probing measurements concurrent with the start of the power outage, recovering about 12 hours later. Fluctuations in DNS traffic (Oracle) and darknet sources (CAIDA) can also be seen in the respective graphs. BGPStream reported outages across several Indonesian autonomous systems around the time the blackout started, but these networks appeared to recover quickly, as the changes seen in the BGP graphs were minimal and short-lived.

At a more local level, the impact of the power outage is also visible in CAIDA IODA graphs for the provinces of Jakarta Raya and Jawa Barat, as shown in the figures below.

Early in the evening local time on August 22, a multi-hour Internet disruption was observed in Gibraltar, impacting both active and traffic measurements, as seen in the figures below.

The disruption was apparently caused by a widespread power outage, as the Gibraltar Electricity Authority apologized on their Facebook page later that day for the disruption in service and the inconvenience it caused.

National Exams

Continuing with the set of exam-related disruptions experienced at the end of July, Syria saw an another five disruptions during the first week of August. The figures below show that these were nearly complete outages, with active probing and traffic-related measurements dropping to nearly zero during the exam periods. Additionally, the spikes seen in DNS traffic in the Oracle Internet Intelligence graphs indicates that the outage was asymmetrical — DNS traffic could apparently get out of the country, but there were no routes available for traffic to return to those resolvers.

Google Transparency Report traffic graph for Syria, August 1-7

During the last week of the month, several exam-related disruptions were observed in Iraq. However, in contrast to Syria, these disruptions were more limited in severity, as illustrated in the figures below – none of the metrics experienced near-complete outages.

Google Transparency Report traffic graph for Iraq, August 25-31

The Iraqi Ministry of Education is also apparently experimenting (successfully) with sending questions to exam centers electronically, in an effort to eliminate the opportunity for test questions to leak.

The Information Office stated that the committee provided some exam centers with internet-enabled devices that withdraw and reproduce questions within one minute. In order to eliminate the leakage of questions, indicating that the experience was applied in the Directorate General of Education Baghdad Rusafa second and the General Directorate of Education Wasit and proved successful (100%).

http://www.moedu.gov.iq/index.php?name=News&file=article&sid=5407 (via Google Translate)

Network Issues

On August 9, Fing Internet Alert’s @outagedetect Twitter account posted an alert about a major outage detected on TekSavvy, a network provider in Ontario, impacting a number of cities in the Canadian province. TekSavvy acknowledged the outage on the company’s network status Twitter account:

The impact of the outage was barely visible in country-level graphs, with just slight perturbations seen in the CAIDA IODA graph for Canada shown below.

CAIDA IODA graph for Canada, August 9-10

As expected, however, the disruption is clearly evident in a CAIDA IODA graph for TekSavvy’s autonomous system, with the graph below showing a marked drop in the Active Probing and Darknet metrics.

CAIDA IODA graph for AS5645 (TekSavvy Solutions), August 9-10

Published reports indicated that Canadian network service provider Rogers also experienced an outage at the same time, and a Tweet from TekSavvy suggested that the two issues were related, noting that all “Third Party Internet Access” networks were impacted, including their connection to Rogers, their upstream provider.

Customers of network service provider du in Dubai experienced an hour-long disruption to their Internet service on August 20. Although the disruption only had a nominal impact at a country level, as shown in the United Arab Emirates figure below, it was significantly more visible in the graphs shown below for AS15082, du’s autonomous system.

CAIDA IODA graph for United Arab Emirates, August 19-20
CAIDA IODA graph for AS15802 (du), August 19-20

A published report highlighted the multiple customer complaints sent to the company via Twitter (@dutweets), with responses noting that the problem was being addressed. Although the company did not provide a root cause for the outage in these responses, the published report quoted a company statement claiming that the problem occurred with its fixed line broadband service.

Three days later, on August 23, Fing Internet Alert’s @outagedetect Twitter account highlighted an Internet disruption taking place in Iowa:

Fing’s monitoring, shown in the figure below, provides a localized view of the disruption, showing that it impacted multiple cities in Iowa for approximately three hours. The disruption was also visible in the CAIDA IODA graph for AS209 (labeled as Qwest Communications, which merged with CenturyLink in 2011) shown below. While hard to see, the disruption caused a slight decline in successful active probing between approximately 15:00 to 18:00 GMT.

CAIDA IODA graph for AS209 (CenturyLink), August 23

CenturyLink ultimately noted that the Internet disruption was due to a fiber cut:

And in a rare bit of good news, Greenland’s TELE-POST noted on August 22 that the repair saga for the Greenland Connect cable had finally came to a conclusion. As reported in May’s Internet Disruption Report, the cable initially suffered damage in December 2018. Some repairs were done in early May, but progress was slow because of unfavorable weather conditions. TELE-POST’s Technology and IT Director Jonas Hasselriis stated:

“The repair of the submarine cable is now over, and we have done everything we can to minimize the impact on our customers. We are now reopening the connections, and we are all reminded how important it is that we all take good care of the search cables. We thank the customers many times for their patience and regret that this was necessary.”
https://telepost.gl/da/nyheder/reparationerne-af-soekablet-er-nu-slut-tele-post-genaabner-forbindelserne-i-sydgroenland via Google Translate

Government Directed

While many government directed disruptions have a nation-wide impact on Internet connectivity, making them easily observable in publicly available monitoring tools, there can often be issues with detecting/observing sub-national disruptions with these tools. This may be due to a targeted shutdown of mobile services and/or use of Carrier-Grade Network Address Translation (known as CGN) by the impacted providers — which means there is limited IP address space being tested through active measurements, resulting in a shutdown being largely invisible to tools that employ such techniques, such as Oracle’s Internet Intelligence or CAIDA IODA. However, loss of signaling from within the impacted networks can indicate a disruption — Fing’s OutageDetect measurement tool uses this approach. However, their visibility is ultimately limited by the footprint of their Fingbox deployment. (Depending on the size of the user population impacted by the shutdown, the disruption may be visible in tools that show Web traffic levels, such as Google’s Transparency Report.) In August, three such government-directed Internet disruptions were in the news, but not evident in monitoring tools.

A post on the Russian-language Internet Protection Society Web site covered an Internet shutdown that occurred at the direction of the authorities in Moscow on August 3. The post notes that in order to prevent demonstrators at a rally taking place that day from coordinating actions, law enforcement agencies ordered mobile operators to disable mobile data services. While the shutdown was reportedly supposed to last ten hours, local measurements cited in the post indicate that the duration may have been just a few hours.

On August 4, the Indian government effectively shut down all telecommunications within the Jammu and Kashmir region, including cutting off all Internet connectivity, mobile service, and even land lines. This was done as the government moved to revoke Kashmir’s autonomy, which was granted under Article 370 of India’s Constitution. While this shutdown was obviously newsworthy, it was not the first time it has happened in the region – tracker internetshutdowns.in counts 54 previous shutdowns in the region in 2019 alone.

The Indonesian government was reported to have disrupted Internet services in the province of West Papua on August 22, following the deployment of additional military and police personnel to the region to help to quell ongoing protests and secure vital public facilities. Indonesia’s information ministry said that the ‘temporary’ shutdown was meant ‘to accelerate government effort to restore order’, and noted that only [mobile] data services had been disrupted, with texting and phone calls unaffected.

Conclusion

The August 2019 (U.S.) issue of Wired Magazine contained just a single Internet Service Provider advertisement (for Comcast Business), but most of the articles and advertisements involve the Internet in some way, showing just how ubiquitous it has become over the last quarter century. However, as we see on a regular basis, Internet access and access to content, applications, and services, are frequently disrupted by weather, power outages, infrastructure failure or damage, and government direction. Impacts of the former three can potentially be mitigated, at least in part, through redundant systems and infrastructure, but it is the government directed Internet disruptions that are arguably the greatest threat. More and more of these disruptions are occurring at the sub-national level, escaping the visibility of publicly available tools. While tools such as NetBlocks and Monash University’s IP Observatory have some visibility into these disruptions, they currently lack both a public interface and public disclosure of their measurement methodologies.

One Comment

Leave a comment