Timeline
The beginning of 2019
Before elections
19.06.2020
16.07.2020
08.08.2020
Shutdown
09.08.2020
Elections day
09.08–12.08
After elections
August
September
October

About

The report was prepared as part of the work of the Belarusian Internet Observatory, with the legal support of the human rights organization Human Constanta.

The Belarusian Internet Observatory

Is a project created to monitor blocking of sites in the Belarusian segment of the Internet.

Human Constanta

Is a human rights organization, it's one of the main areas of work is digital rights and freedoms.

The report is a chronology of shutdowns and blockings that have occurred in the Belarusian segment of the Internet since June 2020, as well as comments from technical specialists, lawyers, international organizations, providers and representatives of government agencies.

Legal comment on disabling access and shutting down the Internet

Every year We Are Social and Hootsuite prepare detailed research on the digital sector. They note that today the number of Internet users in the world is 4.54 billion people, which is 59% of the world's population. An average person spends 6 hours and 43 minutes online every day, which is 100 days a year.

Despite this high level of Internet penetration, the right to connect to the Internet is not universally recognized. Only few countries provide for this right by law: Costa Rica, Estonia, France, Greece, Spain, Finland, and Mexico.

International law

There is a body of international documents and resolutions that state that an Internet connection is a key condition for the freedom of expression and the right to information. For example, the International Covenant on Civil and Political Rights. Importantly, this document is mandatory for Belarus.

The Covenant provides for cases where the right to information is restricted. To justify the legitimacy of the restrictions, all three conditions should apply at the same time. Restrictions must:

1
Be prescribed by law: Restrictions must be formulated with sufficient precision

To enable an individual to regulate his or her conduct accordingly. Ambiguous, vague or overly broad restrictions on the rights to freedom of expression and information are therefore impermissible.

2
Pursue a legitimate aim

Legitimate aims are exhaustively enumerated in Article 19(3)(a) and (b) of the ICCPR.

3
Be necessary and proportionate

Necessity requires that there must be a pressing social need for the restriction. Proportionality requires that a restriction on expression is not overly broad and that it is appropriate to achieve its protective function. It must be shown that the restriction is no more intrusive than other instruments capable of achieving the same limited result.

Only if all conditions are met, restrictions do not violate human rights.

In 2011, UN Special Rapporteur on Freedom of Expression, Frank La Rue, in his report to the Human Rights Council noted that “disabling Internet access for users, regardless of the justification [...] given, is disproportionate and therefore violates Art. 19 (3) of the International Covenant on Civil and Political Rights”. The Special Rapporteur also called on states to maintain access to the Internet at all times, including political unrest.

In the joint declaration of the four special mandates on freedom of expression (2011), the experts stated that cutting off access to the Internet, or parts of the Internet, for whole populations or segments of the public (shutting down the Internet) can never be justified, including on public order or national security grounds. [Ibid., para. 6(b)] In their 2015 Joint Declaration on Freedom of Expression and Responses to Conflict Situations, the same four special mandates confirmed that filtering content on the Internet using communication “switches” (i.e. switching off telecommunication facilities), as well as physically taking over broadcasting stations, are measures that are unacceptable under International human rights law.

In 2016, the UN General Assembly adopted a Resolution that “Condemns unequivocally measures to intentionally prevent or disrupt access to or dissemination of information online in violation of international human rights law and calls on all States to refrain from and cease such measures”.

In a recent Resolution (A/HRC/44/L.11), the UN General Assembly, considering Internet restrictions in relation to peaceful protests, calls on states to refrain from and cease measures, when in violation of international human rights law, that are aimed at shutting down the Internet and telecommunications, or at otherwise blocking Internet users from gaining access to or disseminating information online, or from gathering in online spaces.

Thus, the practice of deliberately preventing or disrupting access to the Internet at the local or national level is now considered a violation of human rights, provided that such measures are intended to restrict the dissemination of information and to prevent free expression of opinions online. The mass and non-selective nature of the restrictions does not pass the test of necessity and proportionality, regardless of the declared legitimate aim.

National legislation

Belarusian legislation does not distinguish the right to access the Internet as a separate right of citizens. However, several national legal acts enshrine the right to access information (receive information), where access to the Internet can be considered one of the aspects.

The rules on the right to access information are contained in the following acts:

The Constitution contains criteria for restricting the right to use information:

  • by purpose (in order to protect the honour, dignity, personal and family life of citizens and the full exercise of their rights);
  • by the procedure for setting restrictions (should be provided for by law).

In comparison with international law, the Constitution does not enshrine necessity and proportionality. This can give grounds for abuse of restrictions on the rights of citizens.

In addition, restrictions on Internet access are regulated based on:

At the same time, the legislation of the Republic of Belarus does not contain any grounds that allow state bodies to block all international traffic or block Belarusian Internet resources in large numbers. This option is reserved exclusively for restricting access to certain Internet resources that violate the legislation of the Republic of Belarus.

Thus, there were no legal grounds for the mass blocking of Internet resources that took place after the elections in August 2020.

Limiting mobile internet in Belarus

Mobile Internet services are provided by operators A1, MTS, and life:). The Law of the Republic of Belarus “On Telecommunications” establishes that telecommunication operators shall comply with the requirements for organizational and technical interaction with other telecommunication operators, transmission, and routing of traffic. We believe that providers were required to limit mobile internet based on this rule.

However, the legislation does not contain grounds prevent or disrupt access to mobile Internet during public events. Even the Law of the Republic of Belarus “On the State of Emergency” does not contain any rules regarding preventing access to the Internet and mobile Internet if the state of emergency is introduced in case of riots.

Restricting access to certain Internet resources and services

In addition to restricting access to the Internet, access to a significant number of Internet resources and services was blocked in Belarus after August 9. Among them:

  • media websites (both national and regional),
  • websites of public movements and initiatives (Belarusian Association of Journalists, the unregistered human rights centre “Viasna”, such platforms as “Golos” and “Zubr”, etc.);
  • websites of various political movements,
  • a range of VPN services.

Internet resources in Belarus can be blocked out of court by a decision of the Ministry of information. The procedure is governed by the Law of the Republic of Belarus “On the Mass Media” and the Regulation on the Procedure for Restricting (Resuming) Access to an Internet Resource, approved by the resolution of the Operative Analytical Centre under the President of the Republic of Belarus, the Ministry of Communications and Informatization of the Republic of Belarus, the Ministry of Information of the Republic of Belarus of 03.10.2018 N 8/10/6.

Aforementioned Internet resources and services were blocked on the basis provided by 1.2 of clause 1 of Art. 51-1 of the Law “On Mass Media” (dissemination through Internet resources, online publication of information, prohibited for dissemination in accordance with this law and other legislative acts of the Republic of Belarus or court decisions that have entered into legal force).

Prohibited information includes, inter alia, information aimed at propaganda of war, extremist activity or containing calls for such actions, pornography, violence and cruelty, including propaganda or incitement to suicide, other information which could harm national interests of the Republic of Belarus or information prohibited by this law, other legislative acts of the Republic of Belarus.

From the legal point of view the process of blocking an Internet resource is as follows:

1

The Ministry of Information sends a copy of the decision to the State Inspection of the Republic of Belarus for Telecommunications of the Ministry of Communications and Informatization to include the corresponding identifier of the Internet resource in the restricted access list. Another copy is sent to the owner of the Internet resource, the access to which is limited (as long as this Internet resource is located in the national segment of the Internet). This is done within 3 working days from the date of the restricted access decision.

2

On the day when it receives a copy of the decision of the Ministry of Information, the State Inspection includes the identifier of the Internet resource in the restricted access list.

3

Internet service providers are obliged to restrict access to the Internet resource within 24 hours since it was included in the list.

It should be noted that the decisions, sent by the Ministry of Information to the owners of Internet resources in August 2020, did not specify the grounds for blocking (specific publications, images, other information prohibited by law). This complicates the process of eliminating violations and appealing the decision about blocking.

Thus, we can say that the extrajudicial process of blocking Internet resources violates the rights of both the owners of Internet resources and services (the right to distribute information) and the rights of users (the right to receive information).

Bypassing Internet blocking

Starting from 8 a.m. on August 9th and until 7 a.m. on August 12th, VPN solutions based on standard protocols — OpenVPN, IPSEC, PPTP were blocked, which means that almost all commercial, corporate, and personal VPN servers stopped working.

From August 9 to 12, there were significant Internet failures in Belarus. Users faced faulty work of:

  • social networks such as Facebook, Twitter, YouTube, etc., as well as partial malfunctions in case of Telegram
  • independent Belarusian media: TUT.by, KYKY, Nasha Niva, etc.
  • platforms “Golos” and “Zubr"
  • a number of VPN services
  • Western and Russian sites and services: Yandex, CNN, Amazon, etc.
YouTube traffic Drop in Belarus. Source: Лiга.tech

On August 9, total Internet traffic from Belarus fell 10 times compared to the average. On that day, its speed was 20 GB/s.

The country was "cut off from the Internet", and later in addition Belarus faced mobile Internet blocking.

Meanwhile, despite the shutdown, Belarusians managed to go online. So according to the official information of the Psiphon team, a provider of an application for bypassing internet censorship, on August 11, 1.8 million users from Belarus used the application, that is, almost ⅓ of all Internet users in the country.

Graph of users from Belarus who used Psyphon to access the Internet. Source: Psyphon, official website

How did Belarusians go online in a complete shutdown?

The access to the Internet was limited, and solutions had to be found very quickly, primarily, using various Telegram channels, expert's advice, etc. On August 10, the telegram channel “Za BYnet” was created, which accumulated data on working solutions, related news and the latest updates. The channel grew from the “Digital observers” chat [Cyfrovyje nabliudateli], which was created to monitor the health of mobile networks and blocking by OONI and Network Cell Info Lite tools, but on August 9-11, it raise popularity in particular for spreading information about ways to surpass censorship and blocking.

As in other countries where the Internet was blocked, users went online through VPN and various proxy servers that helped bypass the bans.

VPN or Virtual Private Network is a technology that allows to establish a connection over another network. In other words, VPN protects user data and actions from both intruders and Internet service providers and allows to bypass the blocking set by providers. The latter lose the ability to control user traffic.

The telegram channel “Za BYnet” tested and suggested to the users in Belarus the following solutions:

1

Psiphon, a specialized solution to circumvent censorship. It has become the most popular service for bypassing Internet blocking in Belarus. Thanks to a sophisticated encryption system, Psiphon could efficiently "hide" from the DPI filtering system that was used for the shutdown.

2

Tachyon, a distributed system, emulates three different protocols that allow DPI blocking

3

X-VPN, which has nine different protocols, some of which continued to function during the blocking

4

Lantern, a specialized tool for accessing blocked sites, one of the few solutions that had an installer for Mac OS.

5

HotSpot Shield, which is built on Catapult Hydra's own proprietary protocol Catapult Hydra.

7

Tor using Bridge mode

Among the alternative VPN solutions, Shadowsocks, Wireguard and SOCKS5 tunnels functioned via SSH (some users complained that the ip-address: the port bundle was blocked, so they had to be periodically changed), but due to the complexity of the configuration they were not widely used by the mass user.

All the main popular protocols used by VPN services were cut off, and they were useless. I had two VPN services installed, and they did not manage to help me even once during the shutdown. Psiphon worked perfectly, however, many users said it stopped on the second day. Another important factor is that Psiphon is a multi-platform solution: it is available for Windows, Android and iOS, there is no version only for macOS. There are far fewer good, working solutions for iPhone than for Android.

Yana Goncharova
representative of Human Constanta. Source: VC.RU

In addition to Psiphon, Telegram proved to be an important communication tool during the protests. With the Internet blocked, Telegram has become the most popular messenger and social network in the country. Even before the election, the company offered its own Internal MTProxy built into the Telegram app. But on August 9-11, due to the high load, most users could only exchange messages, videos and sometimes even images would not load.

As access to most independent media was blocked, major media outlets completely switched to posting news on Telegram, they used it as a full-fledged resource to broadcast news. During the shutdown, the NEXTA. Telegram channel became the second most popular after TUT.BY and the largest channel in Telegram. In August-September, it had about 2 million subscribers. Later this channel was declared extremist.

Alternative distribution methods for bypassing blocking applications

Access to foreign resources was blocked, thus, users were not able to obtain applications using official sites, the Apple App Store and Android Play Market.

1

Applications for bypassing blocking were distributed through the so-called file hosting - websites, the links were sent via SMS or dictated over the phone. There were cases when such ads were placed at the entrances. File sharing sites were created by advanced activists in Belarus and abroad. As of August 12, the installation files from their servers were downloaded about 1.3 million times for 7.4 terabytes of traffic. 60% came from Android, 20% from Windows.

2

Telegram channel “Za Bynet” (https://t.me/zabynet) gained 3000 users on August 11 (the second day of existence), and on August 12 gained another 1000 of users. The main goal of the channel was to spread information about blocking and ways to restore the functionality of the Internet, as well as to share current updates.

3

Distribution of installers via Telegram. Telegram was functioning if the user could get a link to a functioning MTProxy. A number of users have subscribed to channels where new proxies were published, for example https://t.me/ProxyMTProto, or bots, for example https://mtpro.xyz

3

Files were distributed “hand-to-hand” by rewriting them via USB flash drives and transferring via Bluetooth. This is a real ad at the building entrance in Minsk, it hit the Internet on August 12.

Example of hand-to-hand VPN distribution. At the entrance of one of the houses. Source: telegram channel "Za Bynet"
At the entrance of one of the houses, detailed instructions on downloading VPN. Source: "Palchys" Telegram channel
5

Due to the peculiarities of iOS, it was impossible to install the application from the App Store without Internet access, so users of Apple mobile phones first got access to the network on their computers, installed Proxy servers for PC, and having connected to them from their phones, they got access to the App Store, from which the apps were installed to bypass blocking.

Thus, we can say that the Internet blocking contributed to the solidarity — people helped each other find mirror and file sharing sites, transferred information and files from the VPN. The shutdown has also set the role of Telegram in the protest movement. This messenger has become the main communication platform and source of information about the protest.

After August 12, problems with the Internet access remained. The authorities continued to disable mobile Internet during peaceful protests. In response, the #openwifi initiative was launched, inviting residents of apartments on the ground floor to open guest Wi-Fi so that journalists and protesters could quickly exchange information. It was suggested to create a new guest network with the name and password BELARUS2020. In addition, there were cases when people posted their Wi-Fi password on their balconies.

Blocking mobile Internet during the protests. A poster with Wi-Fi access on the balcony of a residential building. Source: @plakatypratestu

Internet in Belarus

Overall rating of Belarus. GSMA Mobile Connectivity Index evaluates 163 countries in the world against infrastructure, affordability, consumer readiness, content and services availability and relevance.

Share of Internet traffic consumption in Belarus (latest available statistics — 2014)

How Belarus is connected to the rest of the world

The fewer communication providers there are, the lower is the connectivity index, that is, the pairwise connection of providers to each other.

Belarus is connected to the external Internet via two communication channels:

1

State enterprise "Beltelecom" (a monopolist until 2010) — the largest Internet provider in the country, works for both individuals and legal entities.

2

State organization National Traffic Exchange Centre (NTEC) — was created in 2010 to launch and develop a unified national data transmission network and to join the Internet of foreign countries.

In Belarus, a traffic exchange point becomes a bottleneck for the Internet. All external channels are not only controlled by the state, but they are also originally limited in their capacity. This is a deliberately done to be able to control traffic, in addition, no independent players are allowed to create such traffic exchange points.

The diagram below shows a logical connection between the autonomous networks of Belarusian providers and the outside world. World — the circle at the bottom — represents Internet providers outside Belarus. Source: tech.liga.net

Using DPI (Deep Packet Inspection) solutions to block "unwanted" traffic

Deep Packet Inspection (DPI) is an advanced method for checking and managing network traffic. DPI is used to filter traffic. It is more effective than conventional firewalls. DPI is more efficient as it evaluates the data part and the header of a packet. It is important to note that this technology is able to detect and block malware. The dark side of DPI is that it can block any information that does not meet the specified criteria. This means that DPI can be used for political or repressive purposes. DPI technology is reportedly used in China, Iran, partly in Egypt, etc.to censor Internet traffic.

This solution inspects traffic packets using a flexible set of rules and determines what to do with each packet.

DPI can be used for several purposes:

1

Ensuring the quality of service. For example, to increase the priority of VOIP voice traffic packets, because low latency is very important in case of voice conversations, and there is usually little of such traffic. Http / https traffic has an average priority to ensure comfortable browsing, while torrent traffic is determined as a residual.

2

Blocking viruses, preventing distribution of pirated and other illegal content.

3

Interception and transmission of traffic in police operations.

Analysis shows that DPI software and hardware complexes are deployed by the National Traffic Exchange Center (NTEC) and Beltelecom – two state monopolists that connect Belarusian Internet with the outside world.

DPI is also used by Belarusian mobile operators, for example, to prioritise and price traffic. With the growing popularity of flat rate tariffs such solutions allow to use the radio resource more efficiently and avoid overloading it with heavy content. For example, for the "flat rate" tariff plans, operators can limit heavy content, streaming video, or torrents transfer speed.

MTS announced the commercial launch of such a system back on September 22, 2011.

A1 and life:) also use similar solutions for separate billing of traffic. For example, they provide unlimited access to certain social media, music services, and messengers.

Several sources report, that to filter traffic Beltelecom and NTEC use equipment produced by:

1

Sandvine (Sandvine DPI is used in NTEC) According to Bloomberg, the technology firm demonstrated its equipment to a government security team in Belarus in May 2020, and later shipped the equipment, via a contractor, “Infosystems Jet”.

2

Huawei DPI – in Beltelecom.

In 2018 the National Traffic Exchange Center announced a tender for the purchase of the DPI software and hardware complex ($2.5 million) According to the National Center for Marketing and Price Study, the purchase did not take place.

Belarusian Officials Shut Down Internet With Technology Made by U.S. Firm

U.S. Company Faces Backlash After Belarus Uses Its Tech to Block Internet

Comments by technical experts

Since August 9, the Internet has been blocked in Belarus for several days. According to the NetBlocks Cost of Shutdown Tool (COST), one day of the shutdown cost the country 56 million USD. The losses relate to disruptions in work of digital banking, taxi services, maps, online shopping, etc.

The state has not yet admitted that the outages were deliberately caused by specialized services and two monopolist providers.

However, experts from within and outside Belarus believe that the shutdown was planned by the authorities in advance.

August 10, comments by Denis Otvalko, Technical Director of one of the largest non-state hosting providers in Belarus and the largest registrar and technical administrator of national domain zones .BY/. BEL.

In addition to rolling internet blackouts, NetBlocks identified the use of Deep Packet Inspection filtering in keyword-math mode, a rarely-used facility provided by network filtering devices. [...] Blocked words included names of social media and news sites, but also brands like Walmart, Samsung and Disney, giving the impression of a wider technical failure.

The official versions of the Belarusian authorities about the reasons for the outages are untenable. "How can the Belarusian Internet be cut off from abroad? It would require that all countries with connections with Belarus agreed and cut these connections off. As for DDoS attacks, there are a lot of anti-DDoS technologies that successfully repel attacks and certainly will prevent a shutdown in a country. In addition, operators usually fight severe DDoS attacks together, and to do this, they need to show some measurement data and logs. Any idiot can just say I was hacked”, says Mikhail Klimarev, Executive Director of the Internet Protection Society.

Recommendations to the special rapporteurs by human rights activists:

  • request information about the drop in connectivity from the government of Belarus;
  • request information on how violations of international law and human rights specified in the request will be eliminated from the government;
  • recommend that the government to refrain from arbitrary interference with the right to freedom of expression on the Internet and comply with the international legal ban on arbitrary cutting off access to the Internet.

Appeal of international human rights organizations to the UN special rapporteurs on August 10, 2020 (Rus)

The data we have on the Internet outages that occurred in Belarus last Sunday, taken together with other reports that have circulated since, point to large scale disruption across a number of networks that would have had a real impact on Internet users in the country.

In the current situation in Belarus, where more and more people are relying on the Internet for communication, with the growing amounts of ingress and off-ramp traffic, cutting or restricting the bandwidth would almost certainly shut down large portions of the BY-net, amplifying collateral damage up to a denial-of-service state.

An article in vice.com with comments from Alp Toker, Director of the NetBlocks group, where he says that the cause of the incident is DPI, not a failure

An interview with Tema Gavrichenkov from Qrator Labs, analysis of the situation around Internet blackaouts in Belarus on August 9-12

A report by Psiphon.ca, block bypass service, August 20 (Eng)

Government agencies and mobile operators comment on internet outages

There are regular internet disruptions in Belarus, moreover, from August 9 to 12, the country faced a shutdown.

By the way, this is not the first attempt by the authorities to restrict internet access. Residents of Belarus regularly face internet censorship during presidential elections: in 2001, 2006, and 2010, independent websites, primarily the media, were blocked during the elections. In 2010, the SSL port used for setting up encrypted connections with social networks was stopped for several hours.

However, in 2020, the internet was shut down for several days in Belarus, moreover, in the following days, the authorities regularly turned off the internet in mass protest locations.

We can say that this is the largest, most massive and severe internet outage in the history of Belarus.

Yana Hancharova
Human Constanta

The non-governmental organization NetBlocks believes that the blackouts were deliberately produced by the state. However, the Belarusian authorities themselves refuse to acknowledge this.

Official comments on why the foreign internet was cut off on August 9-12

Belarusian officials, state and private providers did not admit that there was no access to foreign resources due to deliberate actions of security services and the backbone providers. They did not acknowledge this neither when the foreign segment of the internet was unavailable, nor in the following days. Commercial operators pointed that the service by higher-level providers was incorrect and did not comment on the details.

9 August

National Computer Incident Response Center of the Republic of Belarus: National Traffic Exchange Center (NTEC) reports Dos attacks:

Belarusian National computer emergency response center (CERT.BY)at about 22: 00 on 8 August 2020 recorded a large wave of DDoS attacks on the BY-NET network infrastructure. < ... > Providers' technical protection solutions (Anti-DDoS) repelled these attacks, but they reportedly caused problems with the equipment.

Mobile operator A1 shifts responsibility to a higher-level provider, primarily to the National Traffic Exchange Center (NTEC):

Our network is working correctly. At the same time, we, like all other providers, get access to international internet traffic from authorized operators – Beltelecom and the National Traffic Exchange Center.

As soon as our higher-level provider ensures correct service, access to our internet service will be restored automatically.

10 August

Beltelecom says that the reason for no access to foreign resources is cyber-attacks from abroad:

Beltelecom has been noticing a significant increase in traffic coming from external IP networks from outside the Republic of Belarus since August 8 this year. Over the past 24 hours, the company's systems have recorded multiple cyber-attacks on the websites of government agencies and Beltelecom resources. This led to an overload of channels, failures of telecommunications equipment and, as a result, difficulties with access to certain resources and services on the internet.

Lukashenka claims that the internet is cut off from outside Belarus:

Someone keeps calling people to the streets. They even turn out internet from abroad to cause discontent among the population. Now our experts are looking into where this blockage is coming from. So, if the internet doesn't work well, it's not our initiative, it's from abroad.

12 August

NTEC reports there are less DDoS attacks on infrastructure and the access to foreign networks is restored:

As of 12 August 2020, there has been a significant decrease in massive DDoS attacks on the infrastructure of Belarusian operators’ networks and on the websites of state bodies and organizations. Emergency recovery work has been completed on the networks of partners located on the territory of neighboring countries.

The National Traffic Exchange Center managed to restore almost full access to internet resources.

NTEC specialists together with other Belarusian telecommunication operators continue fixing the equipment and restoring access to the internet. This work will soon be completed.

We apologize for any inconvenience and hope for your understanding.

Disabling internet access in mobile operators’ networks

In addition to the permanent blocking of access to foreign resources at the level of backbone providers Beltelecom and NCOT, Belarusian users for the first time in history faced another type of blocking — a complete internet shutdown in the networks of mobile operators. For three days, from 9 to 12 August, in the evening, subscribers of all three mobile operators - A1, MTS, life:) completely lost access to the network.

None of the operators, A1, MTS and life:), admitted that they turned off the internet following the instructions of law enforcement agencies.

On 12 August at 10:54 the official A1 account on onliner.by posted a message that the clients will get compensations for the time when the internet was unavailable. In their statements, A1 do not take responsibility for turning out mobile internet in their network, they point to higher-level providers Beltelecom and NTEC as sources of interruptions.

Reaction to outages after the shutdown

On August 23, during the New Belarus March the speed of mobile internet was reduced in the A1 network. MTS (at 18: 30) and life:) mobile internet was also turned off in Minsk and other regions during the protests.

On this day, A1 for the first time published an official comment, where the operator reports that the internet is blocked by the requirements of state agencies.

A1 press service reported the following:

We regret to inform you that at the request of state bodies due to national security reasons, the capacity of the A1 3G network in some districts of Minsk has been significantly reduced. This requirement causes deterioration in the quality of the data transfer service.

You will be notified about restoring correct access to the service. We apologize and hope that the service will be restored soon.

On 24 August, MTS and life:) published a similar official comment, also mentioning that due to the high density of people, the network was overloaded.

The Operational Analytical Center under the President of the Republic of Belarus (OAC) reported that they are not aware of the outages.

We inform that in accordance with the legislative acts, the OAC regulates and controls activities to ensure technical and cryptographic protection of information, determines priority areas for such protection, acts as an independent regulator in the field of information and communication technologies, as well as a specially authorized state body in the field of security of the national segment of the internet. We also inform that the OAC does not have information about the requirements to reduce the network capacity of mobile operators in the Republic of Belarus. OAC.

The A1 operator in its official Twitter announced “deterioration in the quality of data transmission service or temporary unavailability of services” on August 9, 23, 26 and 30, as well as on September 6 and 13.

Source: Twitter A1

In addition, on 16 September, in a chat with users, A1 reports that internet disruptions are on the side of a higher-level operator.

Photo source: @zabynet

16 September

On 16 September, the European Telecommunications Network Operators' Association (ETNO) issued a statement on internet shutdowns in Belarus, including the service of mobile operators on 9-11 August:

A1 Belarus is not able to provide communication services without monopolized services provided by the State. Both national/international, voice/data interconnectivity is under full control of state-owned institutions. Liberalization of these gateways has been escalated numerous times, without success. Moreover, WTO's accession priorities towards Belarus includes liberalization of gateways.

In October, A1 published a report for the third quarter of 2020, which indicates that the profit decreased by 13.6% (if counted in euros). At the same time, if counted in Belarusian rubles the company still shows profit. The “unstable political situation” and the devaluation of the Belarusian ruble are to blame.

The report also states the following (source @zabynet):

  • A1 is the first operator to publicly report internet outages occurred due to state-owned providers, which are the only ones with access to the “external” internet.
  • All operators are ordered to reduce the speed of the mobile network. A1 continues to speak openly about all such decisions of the Belarusian government.
  • Despite the decision to compensate subscribers for the lack of internet, there are more complaints and dissatisfied customers.
  • SMS is regularly used as a “government channel” to spread information about “national security violations”.

On 30 October A1 responded about internet outages

The #KeepItOn international coalition, which fights internet outages around the world, has written an open letter calling on telecommunications service providers in Belarus to be transparent and counteract internet outages.

A1 passed the response through Tut.by.

A1 stated they support transparency and non-interference in the work of the internet, nevertheless, they have to comply with the country's legislation. In addition, the operator specifies that their services are completely dependent on the “higher-level provider”:

A1 Belarus cannot provide communication services without access to state-monopolized services. National and international, voice communication and the internet - all this is under the full control of government agencies.

A1 believes that even if they do not comply with the orders to disable the internet, the state has the ability to cause more serious consequences, for example, to disable the wired internet too.

According to @zabynet, in October alone, mobile internet blackout lasted 19 hours and 27 minutes.

Articles
Legal comment on disabling access and shutting down the Internet
Bypassing Internet blocking
Internet in Belarus
Comments by technical experts
Using DPI (Deep Packet Inspection) solutions to block "unwanted" traffic
Government agencies and mobile operators comment on internet outages

Internet shutdown in Belarus

Timeline from June 2020

The presidential election in Belarus was held on August 9, 2020. It was followed by gross violations, mass detentions of candidates and members of their teams, numerous documented cases of fraud. The pre-election period showcased a significant increase in the political involvement of citizens, who held mass election pickets and rallies.

From June 2020 to the present day, there are regular interruptions in access to the Internet in Belarus, especially at protest meetings locations. The complete Internet shutdown, including mobile internet, started on the election day. The country was cut out of the World Web till the morning on August 12.

This project is dedicated to the cases of blocking the Internet in Belarus during the presidential election and subsequent protests. You can view the main events timeline, find the data about the shutdowns, legal and technical comments, and socio-political context. Our goal is to make visible the political side of the Internet shutdown and show how it was done from a technical point of view.

Before elections

The beginning of 2019

-

Belarusian goverment buys special equipment for shuting down the Internet

In 2018 Belarusian government buys special equipment known as "deep packet inspection" from an American company Sandvine through the russian supplier Jet Infosystems. Sum of the deal: 2.5 million dollars. The equipment enabled the National Traffic Exchange Center (NTEC) to blacklist up to 150 million website URLs.

Bloomberg, which conducted a media investigation regarning this fact, also admited that the equipment of the American company Sandvine was used to block websites and the Internet in Egypt, Jordan, Azerbaijan.

In September 2020, Sandvine announced that it would stop selling the equipment to Belarus, cancel maintenance and support.

Learn more about the investigation at bloomberg.com

Before elections

19.06.2020

01:23-03:00

Preparations for shuting down the Internet: testing of DPI in Belarus

On the night of June 19, from 01:23 to 03:00, Belarusian users recorded filtering of a number of protocols, including TLS, presumably on external channels of the NTEC and Beltelecom. Viber and Telegram stopped working (only via MTProxy). We observed that packets contaning TLS handshake were dropped, and the connection was terminated by a timeout. According to our information, corporate VPN tunnels that provide communication between different offices and regions have stopped working for many state and commercial providers ( for example, Belarusian railway and Gazprom).

We assume that this was a test launch of DPI technology on the equipment of NTEC and Beltelecom.

How Belarus connected to the internet?

16:00-19:00

First mobile Internet interruptions during the protests

From 4 p.m. till 7 p.m. Minsk time the mobile Internet of A1 provider got blocked on the whole territory of Belarus, the connection was restored completely only at around 8 p.m..

Press service of A1 announced that this happened because of technical problems.

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section

Before elections

16.07.2020

01:15-02:00
Downdetector service data: telegram inaccessible zone
Downdetector service data: telegram inaccessible zone

Preparation for the Internet shutdown: second testing of DPI in Belarus

From 01:15 to 02:00 on July 16, SSH, OpenVPN, and IPSEC protocols were blocked on the contry border routers, but were operational within the country. Separately, it was reported that the Telegram service was blocked, it worked only with MTProxy.

We suppose that it was the second testing of DPI on the equipment of NTEC and Beltelecom.

Nasha Niva: "According to some programmers' opinion, tonight the VPN blocking was tested, which allows to have acces to Telegram even in cases when this messenger gets blocked".

More on nashaniva.by

Before elections

08.08.2020

First rumours about the Internet shutdown in the country

According to some sources, on August 8, employees of hotels, businesses, and shops received an unspoken warning that communications would be blocked throughout the city on the day of the presidential elections: the Internet, mobile communication, and even landlines would not work.

Moskovskiy Komsomolets writes about the rumours of the Internet shutdown based on the statement of Minsk shopping center worker: "But I warn you beforehand, tomorrow the Internet and mobile communication will be shut down in the whole city, we already got the order, our bosses recommended to work according to circumstances".

More on mk.ru

Around 18:00

Gradual shutdown of the Internet

Around 18:00 UTC on August 8, eight of eight Beltelecom's IPv6 uplinks and four of the five NTEC uplinks were disabled. So, at the point of linking the Belarusian segment of the Internet to the global Internet about 80% of IPv6 protocol's connections had been turned off simultaneously - this is the modern version of the protocol used for the Internet access. Most of the users lost access to the Internet.

This IPv6 providers shutdown lasted until the 12th of August.

Shutdown

09.08.2020 –
12.08.2020
Elections day

09.08.2020

07:30

No access to YouTube

At 7:30 AM first interruptions to the Internet access were detected. Thus, the users from belarus couldn't access YouTube.

08:00

Foreign traffic shutdown

Already at 8 AM, multiple reports began to arrive that the Internet is unstable in Belarus:

  • Web resources and many other services such as Twitter, Facebook, and Instagram have became unavailable;
  • Telegram, Viber, and WhatsApp messengers stopped working.
  • Telegram worked when using MTProxy, but after some time, public proxies were also blocked.
  • VPN services based on standard protocols (OpenVPN, PPTP, L2TP) hosted abroad became no longer available.
  • TOR stopped working without enabling the bridge mode.
  • The access to Digital Ocean, Amazon Cloud, and other mass services of cloud hostings had been lost.
  • The App Store and Google Play services stopped working on mobile phones.

Google Transparency Report statistics states that Google search and Gmail had been used few times less. Youtube, Google Docs, Google Maps services were completely unavailable.

First interruptions were detected while trying to access websites and services hosted in Belarus from abroad

Access to a wide range of Internet resources is blocked

In addition to restricted access to the Internet, in the period since the 9th of August the access to a significant number of the Internet resources and services in Belarus was blocked. Among them:

  • mass media websites (both regional and republican);
  • websites of social movements and initiatives (Belarusian Association of Journalists, the unregistered human rights center “Viasna”, such platforms as “Golos” and “Zubr”, etc.);
  • websites of various political movements;
  • a range of VPN services.
Morning

Spoofing of Golos platform DNS records on Belarusian providers

On the morning of August 9, the users discovered that when entering the Golos portal (belarus2020.org) website a phishing website opened at the IP address 185.117.119.68 instead of the usual page for Belarusian users. It was designed in the colors of the original website and invited users to enter their phone number due to the inoperability of Viber and Telegram. The phishing site did not have the correct SSL certificate installed, which was reported by the browser when connecting to the phishing site.

The creators of the platform claim that users' phone numbers were collected only through bots in Viber and Telegram for security purposes. They also reported that even the development team did not have access to the phone numbers database. We assume that this is how the attackers tried to collect the platform users' database.

The main concern is caused by the fact that the DNS spoofing took place among the users of Belarusian providers, which means the substitution was carried out in the networks belonging to the providers and was carried out either with their participation or by hacking.

We possess no information on the cases initiated on this violation, although the information about the DNS spoofing was widely covered by the press.

20:00

Fake "Golos" website blocking

Belarusian IT specialists contacted a hosting company serving a fake website and succeeded in blocking a new resource at about 8 p.m. on August 9.

Providers' and mobile operators' reactions to the Internet shutdown

On the 9th of August 2020 first comments from NTEC and mobile operators regarding the Internet shutdown in the country appeared.

NTEC refers to DDos attacks:

“The National Center for Response to Computer Incidents of the Republic of Belarus (CERT.BY) on 08.08.2020 at about 22:00 recorded a large wave of DDoS attacks on the infrastructure of the BY-NET network. <...> It should be noted that the technical solutions for the protection (Anti-DDoS) of providers repelled the mentioned above attacks, which, however, according to our information, resulted in the equipment problems. "

The official comment of A1:

Mobile operator A1 shifts the responsibility to a superior provider (obviously, NTEC): “Our network is working correctly. At the same time, we, like all other providers, get access to the international Internet traffic from authorized operators - Beltelecom and the National Traffic Exchange Center.

As soon as our uplink provider continues the correct service, the access to services will be restored automatically. "

The absolute majority of Belarusian and foreign experts disagree with this version. The decision of the Internet shutdown was cause by censorship and not by DDos-attack.

For more details check "Specialists' comments" section

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section

Legal comment on limiting and shutting down the Internet

After elections

09.08–12.08

09.08
20:45 – 5:00
10.08
19:30 – 06:00
11.08
18:00 – 07:00

The Internet shutdown in the whole country

During three full days, from 9th till 12th of August, in the evening the users of all three mobile operators - А1, МТS and life completely lost the Internet connection.

Disconnections occurred synchronously for all 3 operators, which raises suspicions about the centralized nature of those actions. Moreover, the mobile Internet shutdown time fully coincided with the time of protests in the streets. We assume that the operators' networks were disabled by their uplinks.

None of the operators, A1, MTS and life :) admitted that they cut off the Internet in connection with the instructions of law enforcement authorities.

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section

Legal comment on limiting and shutting down the Internet

10.08.2020

First solutions to bypass censorship appear

In the conditions of limited Internet operation, solutions were sought and found in a very short time using various telegram channels, specialists and providers. Thus, on the base of "Digital Observers" chat, a telegram channel "For BYnet" was created, where there was accumulated data on working solutions and updates on what was happening with the Internet.

For more details check "10-12 August censorship circumvention"

11.08.2020

The peak period of using VPN Psiphon in Belarus for the Internet access

By the 11th of August Psiphon Inc. company based in Toronto registered more than 1.7 million unique daily users in Belarus, which is equals one fifth of the whole population of the country.

12.08.2020
7:00

The Internet connection gets back in the whole country

12th of August, NTEC

NTEC reports on the reduction of DDoS attacks on the infrastructure and restoration of access to foreign networks:

“As of August 12 of this year, there has been a significant decrease in massive DDoS attacks on the infrastructure of Belarusian operators' networks and on the websites of governmental agencies and organizations. Emergency recovery work on the networks of partners located on the territory of neighboring states was completed.

The Republican Unitary Enterprise "National Traffic Exchange Center" managed to almost completely restore access to the Internet resources.

NTEC specialists, together with other Belarusian telecommunication operators, continue to work on the restoration of equipment and the resumption of access to the Internet. The mentioned work will be completed in the nearest future.

We apologize for the inconvenience and hope for your understanding".

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section.

For more details check "Specialists' comments" section

After
the shutdown

August

16.08.2020

Minor interruptions in the Internet during the first "Freedom march" on Sunday

There were no mobile Internet disconnections by operators themselves. Problems with mobile Internet occurred only at crowded places and were caused by network overload. At about 2 p.m., the protesters began to gather at the intersection near the stele of Minsk - the hero city, according to various estimates, between 200 and 500 thousand protesters gathered together and at about 6 p.m. moved to Independence Square.

Mobile Internet at mobile operators began to work when people moved to the coverage area of ​​other base stations that were not overloaded with an excessive number of subscribers, it was enough just to move behind the building or move away from the crowd of people by 300-400 meters.

This was the first large march, and, presumably, the special services were not ready for a massive shutdown of mobile networks, moreover the operators refused to turn off the network by verbal order and demanded a written order.

17.08.2020
11:00-11:10

Full short-term Internet shutdown on the whole territory of Belarus

21.08.2020

The access to 72 websites is blocked

"Based on the decision of the Ministry of Information of the Republic of Belarus", access is limited (in fact, blocked) to 72 websites, including Zubr.in (the platform for observers), Belarus2020.org (Golos), mass media and human rights organizations' websites.

23.08.2020

Interruptions in mobile Internet during the "March of new Belarus"

Mobile Internet in A1 network was restricted. Also, MTS (at 6:30 p.m.) and life :) cut off their mobile Internet in Minsk and other regions during the protests.

For the first time, an official A1 commentary was published where the operator reports that the Internet is blocked according to the requirements of governmental authorities. On August 24, MTS and life :) gave a similar official comment, also mentioning that due to a large number of people there were overloads in the network.

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section

26.08.2020

Short-term Internet shutdown at all operators

At around 20:40 the Internet access was lost at all operators, MTS and A1 declared that it was done according to the requirements of governmental authorities. After 20 minutes the connection was restored.

Comment by mts.by

Comment by a1.by

30.08.2020

For the first time BGP-prefixes were lost

Mobile operators switched off the data exchange again according to the requirements of governmental authorities. At 3 p.m. the mobile Internet access was lost at all operators. At around 6 p.m. the connection was restored. MTS and A1 declared that it was done according to the requirements of governmental authorities

Comment by mts.by<

Comment by a1.by

September

Sandvine company breaks the equipment supply contract with the Belausian government

Under the pressure from the society and as a result of Bloomberg investigation Sandvine company announced the termination of supply and service of the equipment in Belarus, as the equipment was used to violate the human rights.

Learn more at bloomberg.com

06.09.2020

During the march the capacity of mobile Internet was decreased by the order of governmental authorities

All of the operators told journalists that the Internet is being blocked by the order of governmental authorities.

At A1 we were told that “In accordance with the order of the authorized state bodies, the capacity of the mobile internet is reduced on the territory of Minsk on September 6. Execution of this order leads to degradation of quality of data services materially or its full unavailability. The restoration of correct access to the service will be announced as soon as possible to do so. Hope for a quick service recovery".

Life :) comment: “Unfortunately, on September 6, at about 15:00, our subscribers in Minsk had limited access to mobile Internet. The reason for this was the measures taken by the authorized state bodies. We are sorry about what happened. We will inform you additionally about the restoration of correct access to the service”.

MTS operator said: “Today in Minsk at about 15.00, as part of the activities carried out by the authorized state bodies to ensure national security, access to the Internet was limited, which led to degradation of the quality of services for subscribers. We are sorry about what happened".

For more details check "The reaction of authorities and mobile operators regarding the Internet outages" section

13.09.2020

During the march the capacity of mobile Internet was decreased by the order of governmental authorities

Mobile Internet was unavailable from 14:50 till 19:10. On this day there was a traditional Sunday march.

Comment by mts.by

Comment by a1.by

14.09.2020

The petition was created on the petitions.by website

The petition №4330 about "Warning about mobile Internernet shutdowns"

16.09.2020

Users reported problems in the work of Internet at some operators

From about 11:08 a.m. till 11:40 a.m., some websites would not be opened without a VPN. Operator A1 in a chat with users reported that the problems were due to a superior provider, while there were no public statements from any of the operators. Operators sent such messages when the Internet was turned off at the level of NTEC and Beltelecom using DPI. In the evening there were reports of problems with the wired Internet in the Brest region.

20.09.2020

Another Sunday march was followed by mobile Internet shutdown

At 14:30 the mobile Internet connection was lost at all three operators. The connection was restored at 19:00. MTS and А1 reported that it was done by the order of governmental authorities.

Comment by mts.by

Comment by a1.by

21.09.2020

Access to 3 charity websites was blocked

More details at 42.tut.by

27.09.2020

During the Sunday march the mobile Internet was not working at all three operators

At 14:15 the mobile Internet connection was lost at all three operators. The connection was restored at 19:00. MTS and А1 reported that it was done by the order of governmental authorities.

Comment by mts.by

Comment by a1.by

October

01.10.2020

Subscribers of all mobile operators received SMS from the Ministry of Internal Affairs

Some mobile operators' subscribers received an SMS about the fact that they were, so it was said, "detected as lawbreakers" and their actions were recorded on photos and videos. late operators announced that it was a "social advertisement".

04.10.2020

During the Sunday march the mobile Internet was not working at all three operators

At 14:08 the mobile Internet connection was lost at all three operators. Some MTS subscribers reported that mobile Internet is working. The connection was restored at 18:00. MTS and А1 reported that it was done by the order of governmental authorities.

Comment by mts.by

Comment by a1.by

11.10.2020

During the mass protests in Minsk the interruptions in mobile Internet were reported at all three operators

At 13:55 the mobile Internet connection was lost at all three operators. Some MTS subscribers reported that mobile Internet is working. The connection was restored at 18:50.MTS and А1 reported that it was done by the order of governmental authorities.

Comment by mts.by

Comment by a1.by

15.10.2020

The Ministry of Communications and Informatization replied to the petition

Currently not provided by telecommunication legislation.

The petition №4330 about "Warning about mobile Internernet shutdowns"

About claim (PDF, 101.6кБ)

18.10.2020

Internet shutdown during the March, possibly using the DPI

At about 14:20 there were reports that external access for several providers stopped working for 10 minutes. Provider Unet sent its users a message: "Our partners are experiencing technical problems. There is a possibility of lack of the Internet access." Also, users reported the disconnection of the Internet in the following regions: Brest, Vitebsk, Grodno, and others.

Every
Sunday

-

Weekly protests continue to this day. Every Sunday, Belarusian authorities demand that operators turn off mobile data transmission in order to cut off connection during peaceful protests. In addition, we record the continued use of DPI technology in Belarus. It is repeatedly used to slow down Telegram traffic (shaping), causing disruptions in downloading and uploading media files. VPN and proxy technologies remain popular and help Belarusian users bypass internet censorship.