Today, Internet connectivity is significantly more ubiquitous, faster and less expensive (in most places), and generally reliable. With increased Internet availability and usage, however, disruptions become more noticeable, and impact a significantly larger population of users. In August, we observed Internet disruptions around the world due to power outages, national exams, and network issues. Several government-directed disruptions were widely reported as well, but were not easily observable in monitoring tools.

Power Outages

On Sunday, August 4, a significant power outage occurred in Indonesia at midday local time (05:00 GMT), lasting approximately 12 hours. The power outage impacted tens of millions of people in Indonesia’s capital Jakarta, and nearby provinces and cities, as well as affecting mobile phone networks.

The figures below illustrate the impact of the power outage at a country level. Both the Oracle Internet Intelligence and CAIDA IODA graphs show a decline in successful active probing measurements concurrent with the start of the power outage, recovering about 12 hours later. Fluctuations in DNS traffic (Oracle) and darknet sources (CAIDA) can also be seen in the respective graphs. BGPStream reported outages across several Indonesian autonomous systems around the time the blackout started, but these networks appeared to recover quickly, as the changes seen in the BGP graphs were minimal and short-lived.

At a more local level, the impact of the power outage is also visible in CAIDA IODA graphs for the provinces of Jakarta Raya and Jawa Barat, as shown in the figures below.

Early in the evening local time on August 22, a multi-hour Internet disruption was observed in Gibraltar, impacting both active and traffic measurements, as seen in the figures below.

The disruption was apparently caused by a widespread power outage, as the Gibraltar Electricity Authority apologized on their Facebook page later that day for the disruption in service and the inconvenience it caused.

National Exams

Continuing with the set of exam-related disruptions experienced at the end of July, Syria saw an another five disruptions during the first week of August. The figures below show that these were nearly complete outages, with active probing and traffic-related measurements dropping to nearly zero during the exam periods. Additionally, the spikes seen in DNS traffic in the Oracle Internet Intelligence graphs indicates that the outage was asymmetrical — DNS traffic could apparently get out of the country, but there were no routes available for traffic to return to those resolvers.

During the last week of the month, several exam-related disruptions were observed in Iraq. However, in contrast to Syria, these disruptions were more limited in severity, as illustrated in the figures below – none of the metrics experienced near-complete outages.

The Iraqi Ministry of Education is also apparently experimenting (successfully) with sending questions to exam centers electronically, in an effort to eliminate the opportunity for test questions to leak.

“The Information Office stated that the committee provided some exam centers with internet-enabled devices that withdraw and reproduce questions within one minute. In order to eliminate the leakage of questions, indicating that the experience was applied in the Directorate General of Education Baghdad Rusafa second and the General Directorate of Education Wasit and proved successful (100%).“

http://www.moedu.gov.iq/index.php?name=News&file=article&sid=5407 (via Google Translate)

Network Issues

On August 9, Fing Internet Alert’s @outagedetect Twitter account posted an alert about a major outage detected on TekSavvy, a network provider in Ontario, impacting a number of cities in the Canadian province. TekSavvy acknowledged the outage on the company’s network status Twitter account:

The impact of the outage was barely visible in country-level graphs, with just slight perturbations seen in the CAIDA IODA graph for Canada shown below.

As expected, however, the disruption is clearly evident in a CAIDA IODA graph for TekSavvy’s autonomous system, with the graph below showing a marked drop in the Active Probing and Darknet metrics.

Published reports indicated that Canadian network service provider Rogers also experienced an outage at the same time, and a Tweet from TekSavvy suggested that the two issues were related, noting that all “Third Party Internet Access” networks were impacted, including their connection to Rogers, their upstream provider.

Customers of network service provider du in Dubai experienced an hour-long disruption to their Internet service on August 20. Although the disruption only had a nominal impact at a country level, as shown in the United Arab Emirates figure below, it was significantly more visible in the graphs shown below for AS15082, du’s autonomous system.

A published report highlighted the multiple customer complaints sent to the company via Twitter (@dutweets), with responses noting that the problem was being addressed. Although the company did not provide a root cause for the outage in these responses, the published report quoted a company statement claiming that the problem occurred with its fixed line broadband service.

Three days later, on August 23, Fing Internet Alert’s @outagedetect Twitter account highlighted an Internet disruption taking place in Iowa:

Fing’s monitoring, shown in the figure below, provides a localized view of the disruption, showing that it impacted multiple cities in Iowa for approximately three hours. The disruption was also visible in the CAIDA IODA graph for AS209 (labeled as Qwest Communications, which merged with CenturyLink in 2011) shown below. While hard to see, the disruption caused a slight decline in successful active probing between approximately 15:00 to 18:00 GMT.

CenturyLink ultimately noted that the Internet disruption was due to a fiber cut:

And in a rare bit of good news, Greenland’s TELE-POST noted on August 22 that the repair saga for the Greenland Connect cable had finally came to a conclusion. As reported in May’s Internet Disruption Report, the cable initially suffered damage in December 2018. Some repairs were done in early May, but progress was slow because of unfavorable weather conditions. TELE-POST’s Technology and IT Director Jonas Hasselriis stated:

“The repair of the submarine cable is now over, and we have done everything we can to minimize the impact on our customers. We are now reopening the connections, and we are all reminded how important it is that we all take good care of the search cables. We thank the customers many times for their patience and regret that this was necessary.”
https://telepost.gl/da/nyheder/reparationerne-af-soekablet-er-nu-slut-tele-post-genaabner-forbindelserne-i-sydgroenland via Google Translate

Government Directed

While many government directed disruptions have a nation-wide impact on Internet connectivity, making them easily observable in publicly available monitoring tools, there can often be issues with detecting/observing sub-national disruptions with these tools. This may be due to a targeted shutdown of mobile services and/or use of Carrier-Grade Network Address Translation (known as CGN) by the impacted providers — which means there is limited IP address space being tested through active measurements, resulting in a shutdown being largely invisible to tools that employ such techniques, such as Oracle’s Internet Intelligence or CAIDA IODA. However, loss of signaling from within the impacted networks can indicate a disruption — Fing’s OutageDetect measurement tool uses this approach. However, their visibility is ultimately limited by the footprint of their Fingbox deployment. (Depending on the size of the user population impacted by the shutdown, the disruption may be visible in tools that show Web traffic levels, such as Google’s Transparency Report.) In August, three such government-directed Internet disruptions were in the news, but not evident in monitoring tools.

A post on the Russian-language Internet Protection Society Web site covered an Internet shutdown that occurred at the direction of the authorities in Moscow on August 3. The post notes that in order to prevent demonstrators at a rally taking place that day from coordinating actions, law enforcement agencies ordered mobile operators to disable mobile data services. While the shutdown was reportedly supposed to last ten hours, local measurements cited in the post indicate that the duration may have been just a few hours.

On August 4, the Indian government effectively shut down all telecommunications within the Jammu and Kashmir region, including cutting off all Internet connectivity, mobile service, and even land lines. This was done as the government moved to revoke Kashmir’s autonomy, which was granted under Article 370 of India’s Constitution. While this shutdown was obviously newsworthy, it was not the first time it has happened in the region – tracker internetshutdowns.in counts 54 previous shutdowns in the region in 2019 alone.

The Indonesian government was reported to have disrupted Internet services in the province of West Papua on August 22, following the deployment of additional military and police personnel to the region to help to quell ongoing protests and secure vital public facilities. Indonesia’s information ministry said that the ‘temporary’ shutdown was meant ‘to accelerate government effort to restore order’, and noted that only [mobile] data services had been disrupted, with texting and phone calls unaffected.

Conclusion

The August 2019 (U.S.) issue of Wired Magazine contained just a single Internet Service Provider advertisement (for Comcast Business), but most of the articles and advertisements involve the Internet in some way, showing just how ubiquitous it has become over the last quarter century. However, as we see on a regular basis, Internet access and access to content, applications, and services, are frequently disrupted by weather, power outages, infrastructure failure or damage, and government direction. Impacts of the former three can potentially be mitigated, at least in part, through redundant systems and infrastructure, but it is the government directed Internet disruptions that are arguably the greatest threat. More and more of these disruptions are occurring at the sub-national level, escaping the visibility of publicly available tools. While tools such as NetBlocks and Monash University’s IP Observatory have some visibility into these disruptions, they currently lack both a public interface and public disclosure of their measurement methodologies.

National Exams

After ending June with regional Internet disruptions reportedly intended to prevent student cheating on national Physics exams in Iraq, there were six additional nationwide disruptions observed over the first half of July, as seen in the figures below. Multi-hour disruptions took place on July 1, 4, 7, 10, 13, and 15. Published reports indicate that the Internet was again disrupted at the request of the education ministry in an effort to prevent student cheating. Iraq has been implementing such tactics since 2015.

After five exam-related Internet disruptions were observed in Syria during the first three weeks of June, another four were observed across the last days of July, as seen in the figures below. The impact is shown at a country level, as well as for AS29256 (Syrian Telecom), the state-affiliated telecommunications provider. Although no specific documentation of these disruptions being related to national exams could be found online (either in published reports or on the Syrian education ministry Web site), their frequency and duration closely resembles similar verified disruptions seen in the past. As such, they are being categorized as exam-related.

Power Outage

In its first major power outage since March, Venezuela suffered a massive blackout on July 22, plunging more than half of Venezuela’s 23 states into darkness. The figures below show that power failed around 20:00 GMT, ultimately disrupting Internet connectivity for more than a day. As illustrated in the Oracle Internet Intelligence and CAIDA IODA graphs, the active measurements (traceroute & ping) dropped immediately and took a significant amount of time to recover; the passive (user traffic) measurements (DNS, darknet, Google Web search) exhibited the same behavior. However, only minor churn is evident in Oracle’s and CAIDA’s BGP-based metrics, indicating that the routes to networks within the country remained available, even if endpoints on those networks were unreachable.

The @outagedetect Twitter account, associated with Internet connection and connected device monitoring company Fing, also observed the disruption within its monitoring of subscriber devices on CANTV, Venezuela’s state-run Internet service provider and posted the Tweet below:

Government Directed

Also on July 22, a fire broke out at the Kondengui Central Prison in Cameroon’s capital city of Yaounde after detainees held a protest in the overcrowded detention facility. A published report noted “The internet was shut down while a drone was flown over the prison.” This shutdown is likely the root cause of the Internet disruptions shown in the graphs below, for both Cameroon at a country level, as well as for AS30992 (MTN Cameroon), a major network provider within the country.

Severe Weather

While this blog generally looks at country-scale Internet disruptions, the network impact of severe weather events is much more localized, wreaking havoc and causing connectivity problems across a much smaller geographic area.

On July 23, Fing’s @outagedetect Twitter account highlighted a “considerable” outage impacting customers of network provider Optimum Online in New York & New Jersey.

Fing’s detail view showed that the disruption started at 20:45 (ET) on July 22, and lasted for nearly 10 hours. The disruption can also be seen in the CAIDA IODA graph below, with drops in the Active Probing and Darknet metrics seen for several hours, roughly aligned with the orange portion of the Fing graph. (Optimum Online is the high-speed Internet brand of Cablevision Systems.)

The disruption coincided with heavy rainstorms that hit the greater New York City area, and Optimum Online’s @OptimumHelp Twitter account confirmed that the observed outages were, in fact, storm-related.

On July 23, powerful storms hit several towns on Cape Cod in Massachusetts, spawning multiple tornadoes. At 12:12 (ET), a Boston-area weather forecaster Tweeted that the towns of South Brewster, East Harwich, and South Orleans were next up in the storm’s path. Just a few minutes later, Fing’s @outagedetect account Tweeted about an Internet outage impacting Comcast users in those towns. The associated detail view indicated that the disruption lasted for nearly 11 hours.

Fiber/Cable Issues

Late in the day (GMT) on July 7, the Gambia suffered a fairly significant multi-hour Internet disruption, as seen in the figure below. The BGP metric dropped to near-zero, indicating that a few of the country’s network prefixes were still being actively routed, which accounts for the continued traceroute and DNS activity.

The next morning, Gambia Telecommunications Company (Gamtel) noted that the observed issue was related to technical issues at the gateway to the ACE (Africa Coast to Europe) submarine cable. While the country has other terrestrial international Internet connections, the ACE cable is its sole submarine connection. The impact to Gamtel’s Internet connectivity is shown in the figure below — latency spiked as traceroutes to endpoints within the country failed over to a connection through Sonatel, as paths through the other carriers became unavailable.

Earlier that same day, Swaziland also suffered an Internet disruption, as seen in the figure below. Although the traceroute and BGP metrics only showed a slight decline, the DNS query rate dropped significantly.

A significant disruption was observed at the same time at AS327765 (Swazi MTN), a Swazi telecommunications company. The figure below shows that during the disruptions, traceroutes to endpoints within the network completely stop transiting AS19711 (Swaziland PTC). The next day, @MTNSwaziland Tweeted an apology for the prior day’s disruption, noting that it was due to a fiber optic “breakdown” at Eswatini Post & Telecom Corporation – the same network noted above. (Swaziland was renamed “the Kingdom of eSwatini” in 2018.)

Unattributed Causes

In the Internet disruptions reviewed above, the root causes were discoverable thanks to news coverage of an associated event or a social media post by an impacted network service provider. However, there were a number of other disruptions observed across multiple countries in July where the root causes were unknown – no associated social media posts from impacted providers or known local events that could have had a significant impact to Internet connectivity. In addition, for many of these disruptions, the affected service providers did not respond to outreach on social media, including Twitter and Facebook.

United Kingdom

The Gambia

Togo

Congo

Gabon

Saint Barthelemy

Conclusion

Information and data on the severity, duration, and extent of Internet disruptions, both at national and local scales, is becoming increasingly available through organizations like Oracle Internet Intelligence, CAIDA IODA, Fing Internet Alert, the Google Transparency Report, Netblocks, and the Monash University IP Observatory. As such it is becoming easier to learn about and publicize such disruptions when they occur, and to hold the providers accountable for these disruptions.

As seen above and in past posts, many providers are transparent, and use social media to explain (and sometimes even apologize for) what happened. However, many providers not only fail to proactively provide information to their subscribers and the public when such events occur, but they also fail to reply to inbound requests for additional information. (Compounding the problem, some have social media presences that have been inactive for months or years.)

We call on telecommunication and network service providers to be more transparent and more active on social media with respect to providing insights into the causes of observed disruptions, and to actively monitor their social media presence for inbound requests for information. (And of course, to respond to those requests in a timely fashion).