Another entry from the better late than never department…

The conclusion of last month’s post noted “There was a noticeable absence of government-directed Internet disruptions in April. That is not to say that there were none, but those that did occur were not significant enough to be observed through publicly available tools.” This trend, which had also been observed over the prior few months, continued into May. (Unfortunately, this is not the case for June, but that will be covered in next month’s post.)

In May, a power outage in Venezuela once again disrupted Internet connectivity across the country, and a cyclone impacted connectivity in Bhutan. Fiber and submarine cable cuts (and repairs) caused Internet disruptions across multiple countries, as did unspecified network issues.

Power Outage

On May 5, a Tweet from Internet monitoring firm Netblocks confirmed that a power outage in Venezuela had disrupted Internet connectivity across multiple states within the country. Unfortunately, such power outages are a relatively common occurrence in Venezuela, and frequently impact Internet connectivity across the country. The Oracle Internet Intelligence and CAIDA IODA country-level graphs below show that the primary impact was to the active probing and traffic metrics, but the BGP metric also saw a brief nominal drop. The aggregated state-level CAIDA graph below illustrates the impact on active probing measurements to endpoints within the listed Venezuelan states – a multi-hour Internet disruption was measured in each of them.

• 

• 

• 

Weather

Internet connectivity was disrupted in Bhutan on May 20 & 21 because of damage to Bhutan Telecom infrastructure caused by Cyclone Amphan. As shown in both the Oracle and CAIDA graphs below, the disruption began around 12:00 GMT on May 20 and lasted for approximately 24 hours, though a brief restoration of connectivity occurred between 17:40-19:40 GMT. The infrastructure damage did not cause a complete country-wide outage, but the graphs show that all three measured metrics were impacted.

• 

• 

The impact was more significant, however, at a network level. The CAIDA graphs below for AS18024 (Bhutan Telecom) and AS17660 (DrukNet/Bhutan Telecom) show complete outages for all three measured metrics.

• 

• 

Fiber/Cable Cut

Fiber optic cables cut by vandals disrupted Internet connectivity for tens of thousands of users in France on May 5 & 6. The cables that were damaged impacted connectivity for both home and business subscribers, as well as cloud provider Scaleway. The Oracle graphs below show the impact on traceroute measurements to endpoints within three French network providers. In each case, traceroutes through the network’s primary upstream provider drop to near zero, but begin reaching the target network through an alternate upstream almost immediately. Nominal increases in latency are also evident, but for these network providers, redundant connectivity meant that the overall impact was nominal.

• 

• 

• 

According to a Twitter thread from Venezuelan journalist Fran Monroy Moret, repairs to a submarine cable resulted in a multi-hour Internet disruption across multiple network providers in Venezuela on May 17. Multiple submarine cables land in Venezuela, but the thread does not mention which cable was being repaired. However, references to CenturyLink within the thread could indicate that the cable in question is either the Americas-II or the South American Crossing (SAC), as CenturyLink is listed among the owners of both.

The Twitter thread suggested that the disruption would last eight hours, from 02:00 – 10:00 local time (06:00 – 14:00 GMT). At a country level, the eight hour-disruption is most evident in the BGP metric across both the Oracle and CAIDA graphs, as the impact to the active probing and traffic-related metrics appeared to be briefer in duration. Local network provider Movistar (AS6306) also experienced a disruption for the full repair duration, as shown in the graphs below. However, local providers Inter (AS21826) and Net Uno (AS11562) appeared to experience briefer disruptions, occurring in the middle of the repair period and primarily evident in the active probing and BGP metrics.

• 

• 

• 

• 

• 

• 

• 

• 

A May 19 Tweet from Oracle Internet Intelligence highlighted Internet disruptions detected across multiple countries, and an associated Tweet pointed to the ACE submarine cable as the likely culprit. Impacted countries included Sierra Leone, Niger, Mauritania, Liberia, and the Gambia. The graphs below show that the disruptions began around 01:30 GMT, lasting approximately 90 minutes, although the impacts linger for several additional hours in Niger’s graphs.

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

On May 27, a brief Internet disruption was detected on French Polynesia starting just after 12:00 GMT and lasting for about an hour, as shown in the graphs below. The active probing, BGP, and traffic metrics were impacted across both Oracle and CAIDA measurements. The Honotua submarine cable is the island nation’s primary international Internet connection, connecting it to Hawaii, and it is likely that problems with this cable were the cause of the observed disruption. The network-level graphs below all show AS36149 (Hawaiian Telecom Services Company) as an upstream provider, and a drop was seen in the number of successful traceroutes across this network in all three graphs.

• 

• 

• 

• 

• 

Network Issues

According a May 7 post to its Facebook page, Greenland network provider TELE-POST suffered an unspecified network issue that disrupted Internet connectivity for DSL users.

Visible in the graphs below, it appears that the disruption began around 06:30 GMT, and lasted for just over six hours. However, after the issue was addressed and connectivity restored, TELE-POST customers continued to have issues with Wi-Fi connectivity, leading to a series of additional Facebook posts (1, 2, 3) that provided situational updates and guidance on resetting modems.

• 

• 

• 

The French territory of St. Pierre and Miquelon, located south of the Canadian island of Newfoundland, experienced a multi-hour Internet disruption on May 10. The graphs below show that the disruption began around 13:00 GMT, with connectivity restored about five hours later. Both the Oracle and CAIDA graphs show a significant decline in the active probing metrics, and the Oracle graph shows a similar decline in the BGP metric.

• 

• 

We're aware that customers in Harbour Breton and parts of Burin Peninsula are currently experiencing an interruption in service. We're investigating the cause and working to restore service as quickly as possible. We appreciate your patience and will update later this afternoon.

— Eastlink Support (@EastlinkSupport) May 10, 2020

The Tweet shown above from the support account of Canadian Internet provider Eastlink notes that the network was experiencing a service interruption. This interruption is evident in the Oracle graph below for AS11260 (Eastlink), and also in the graph below for AS3695 (SPM Telecom), which uses Eastlink as its primary upstream provider.

• 

• 

Thousands of TalkTalk users in the United Kingdom experienced an Internet disruption for a couple of hours during the morning of May 29. While the disruption was covered in articles published on the Web sites of the Independent and the Daily Mail, neither included any information on the root cause of the issue. TalkTalk acknowledged the problem in Tweeted replies to customer complaints, but did not provide any information on what caused the disruption.

The graphs below show that the disruption began approximately 09:00 GMT and lasted for approximately 90 minutes, which is consistent with the timeline in the published reports. The active probing metric in the CAIDA graphs shows an obvious decline, while the Darknet metric remained largely unaffected, as did the BGP metric.

• 

• 

• 

Conclusion

Over the last several month, COVID-19 lockdowns and social distancing have driven nearly everyone onto the Internet for school, work, shopping, and entertainment. Given this increased reliance on the Internet for everyday life, it is imperative that network providers do a better job of communicating about Internet shutdowns, outages, and other disruptions that impact their networks. Ideally, this communication would be proactive and public, posted on status pages/sites (and archived for future reference), as well as to associated Twitter accounts and Facebook pages. (And by acknowledging issues in a timely fashion, and communicating about them openly, providers can control the narrative around such events, preventing rumors from spreading, and even potentially buying themselves a little customer goodwill.)

At the very least, providers need to respond in a timely fashion to inquiries about Internet disruptions observed on their networks made via social media and/or e-mail. In this day and age, given the importance of Internet connectivity, ignoring these inquiries is simply unacceptable.