{"id":4566,"date":"2019-05-08T12:38:10","date_gmt":"2019-05-08T19:38:10","guid":{"rendered":"https:\/\/blog.caida.org\/best_available_data\/?p=4566"},"modified":"2019-09-06T13:23:51","modified_gmt":"2019-09-06T20:23:51","slug":"benin-social-media-blocking-and-internet-blackout-amid-2019-elections","status":"publish","type":"post","link":"https:\/\/blog.caida.org\/best_available_data\/2019\/05\/08\/benin-social-media-blocking-and-internet-blackout-amid-2019-elections\/","title":{"rendered":"Benin: Social media blocking and Internet blackout amid 2019 elections"},"content":{"rendered":"

In late April 2019, social media was reportedly blocked<\/a> and access to the Internet was shutdown in Benin during its 2019 parliamentary elections.<\/p>\n

In this report, the Open Observatory of Network Interference (OONI)<\/a> and the Center for Applied Internet Data Analysis (CAIDA)<\/a> teams share OONI<\/a>, IODA<\/a>, and RIPE Atlas<\/a> network measurement data that corroborate and provide insight into these recent censorship events in Benin.
\n<\/p>\n

Background<\/h2>\n

On 28th April 2019, the West African country Republic of Benin<\/a>, although known as one of Africa\u2019s most stable democracies<\/a> since 1990, had parliamentary elections with no opposition candidates<\/a>.<\/p>\n

Last month, the electoral authorities, namely the Autonomous National Electoral Commission (CENA<\/a>), ruled<\/a> that only two parties out of seven (Le Bloc Republicain – BR – and Union Progressiste – UP) were eligible – both loyal to President Talon. Despite several attempts for dialogue<\/a>, a crackdown on protests (followed by a wave of arrests)<\/a> and calls to stop the electoral process<\/a>, electoral authorities moved forward (with the support of the government<\/a> and that of the presidents of local institutions<\/a>) and Benin voters went to the polls in an election with only one choice.<\/a><\/p>\n

In the early hours of the election day, on 28th April 2019, access to social media was reportedly<\/a> blocked in the country. A few hours later, there was reportedly<\/a> a complete Internet blackout. Benin thus joined the group of African countries in which the Internet was reportedly shutdown on an election day<\/a> (such as Uganda<\/a> and The Gambia<\/a>).<\/p>\n

In the following sections of this report, we share OONI<\/a> and IODA<\/a> network measurement data on the blocking of social media in Benin and the subsequent Internet outage. We augment these timely results with those of publicly available RIPE Atlas<\/a> measurements launched during the first hours of the election day and continuously conducted by RIPE Atlas probes previously hosted in local networks.<\/p>\n

Social media blocking<\/h2>\n

OONI measurements<\/h3>\n

OONI measurements<\/a>, testing the accessibility of websites and apps, have been collected from multiple networks in Benin since 2017. OONI\u2019s Web Connectivity test<\/a> is designed to measure the TCP\/IP, HTTP, and DNS blocking of websites, while OONI\u2019s WhatsApp<\/a>, Facebook Messenger<\/a>, and Telegram<\/a>\u00a0tests are designed to measure the reachability of those apps from local vantage points.<\/p>\n

The following chart, based on OONI data collected from Benin<\/a>, illustrates the blocking of social media sites on 28th April 2019, amid Benin\u2019s 2019 parliamentary elections.<\/p>\n

\"Figure<\/a><\/p>\n

Figure 1: <\/strong>Blocking of social media in Benin, Open Observatory of Network Interference (OONI) measurements, Benin: https:\/\/explorer.ooni.io\/country\/BJ<\/a><\/p>\n

Most measurements were collected from the mobile operator Spacetel (AS37424)<\/a>, locally known as MTN Benin, and consistently showed that the testing of the following social media sites presented HTTP failures: facebook.com<\/a>, whatsapp.com<\/a>, telegram.org<\/a>, twitter.com<\/a>, instagram.com<\/a>, skype.com<\/a>, snapchat.com<\/a>, imo.im<\/a>, hangouts.google.com<\/a>, web.wechat.com<\/a>. Youtube though remained accessible<\/a>\u00a0throughout the elections.<\/p>\n

The blocking of WhatsApp was also detected through OONI\u2019s WhatsApp test<\/a>, which attempts to perform an HTTP GET request, TCP connection, and DNS lookup to WhatsApp\u2019s endpoints, registration service, and web version over the vantage point of the user.<\/p>\n

The following chart illustrates the blocking of WhatsApp on MTN (AS37424) in Benin.<\/p>\n

\"<\/a>Figure 2: <\/strong>WhatsApp blocking in Benin, Open Observatory of Network Interference (OONI) measurements, Benin: https:\/\/explorer.ooni.io\/country\/BJ<\/a><\/p>\n

Both WhatsApp\u2019s web version (web.whatsapp.com) and the registration server used by WhatsApp\u2019s mobile app appear to have been blocked on MTN Benin by midnight, 28th April 2019 (local time). Throughout the day, all measurements<\/a> collected from this network consistently showed that attempts to establish TCP connections to WhatsApp\u2019s registration service failed, while HTTP requests to web.whatsapp.com rendered HTTP failures, with connections being reset. MTN Benin though did not block access to the addresses used by the WhatsApp application, but limited the block to merely the registration service.<\/p>\n

It\u2019s worth noting though that WhatsApp was accessible on two other networks: ISOCEL (AS37090)<\/a> and OPT Benin (AS28683)<\/a>, known as Benin Telecom. Some measurements collected from Benin Telecom (AS28683) suggest \u201cendpoint blocking\u201d, but those are false positives due to DNS based load balancing<\/a>\u00a0(for example, 169.54.55.206<\/code> belongs to WhatsApp Inc.<\/code>).<\/p>\n

Unlike WhatsApp, Facebook Messenger appears to have been accessible<\/a> on MTN Benin (AS37424) on 28th April 2019, even though access to facebook.com was blocked<\/a>.<\/p>\n

The following chart shows that Facebook Messenger was accessible in Benin<\/a>\u00a0on three different networks during the elections.<\/p>\n

\"Figure<\/a>Figure 3: <\/strong>Facebook Messenger testing in Benin, Open Observatory of Network Interference (OONI) measurements, Benin: https:\/\/explorer.ooni.io\/country\/BJ<\/a><\/p>\n

All measurements show that TCP connections to Facebook\u2019s endpoints succeeded (the few DNS anomalies<\/a>\u00a0were false positives), suggesting that Facebook Messenger worked while facebook.com was blocked.<\/p>\n

Quite similarly, measurements collected through OONI\u2019s Telegram test<\/a> show that MTN Benin blocked telegram.org<\/a>, but they did not block access to the Telegram mobile app<\/a>. This is illustrated through the following chart, which also shows that Telegram\u2019s web version seemed mostly accessible on other networks.<\/p>\n

\"Figure<\/a>Figure 4: <\/strong>Telegram blocking in Benin, Open Observatory of Network Interference (OONI) measurements, Benin: https:\/\/explorer.ooni.io\/country\/BJ<\/a><\/p>\n

Several circumvention tool sites, such as purevpn.fr<\/a>, betternet.co<\/a>, and tigervpn.com<\/a>, presented HTTP failures. However, these failures are likely false positives, particularly given the fact that more popular circumvention tool sites, such as psiphon.ca, were accessible<\/a>. The testing of openvpn.com presented an anomaly<\/a>, but this was triggered by a cloudflare captcha page (i.e., the site was accessible in Benin during the elections).<\/p>\n

RIPE Atlas measurements<\/h3>\n

As of 29th April 2019, the RIPE Atlas measurements platform<\/a> contains 10,458 probes<\/a> deployed worldwide for the purpose of measuring the Internet. The RIPE Atlas probes<\/a> can run pings, traceroutes, DNS, HTTP, SSL measurements, etc. Five of them were previously deployed within local networks in Benin. Among them, two were online on 28th April 2019, hosted in JENY-SAS-AS (AS328098)<\/a>(whose provider is Spacetel, AS37424<\/a>) and ISOCEL Telecom (AS37090)<\/a>.<\/p>\n

Since HTTP queries are only enabled on RIPE Atlas anchors (none of which are hosted in Benin), we launched traceroutes from all online RIPE Atlas probes in the country towards the landing webpages of social media, such as whatsapp.com<\/a>, instagram.com<\/a>, wechat.com<\/a>, messenger.com<\/a>, facebook.com<\/a>. The measurements cover the period April 28, 2019 at 07:04 UTC to April 30, 2019 at 05:19 UTC. The results of these measurements reflect the connectivity on the IP\/network layer (and not on the application layer) from the host Autonomous System (AS).<\/p>\n

Figures 5, 6, 7, 8, and 9 display for each probe the evolution of the RTT from the source IP to their different destination IPs (y-axis) over the period of the measurements campaign (x-axis). Figure 10, 11, and 12 present not only the RTTs to the destination IPs, but also the inferred AS paths at key moments of the said campaign. We analyze and compare those figures in the next paragraphs, highlighting the insights they provide.<\/p>\n

For whatsapp.com, we could not collect any successful measurement outputs from Probe 32381 (top graph in Figure 5) until the end of that period (name resolution failed on the node). By contrast, the results from Probe 11944, hosted in AS37090<\/a>, were successful (with a median of 113.45 ms) from April 28, 2019 at 7:12 to 10:11 UTC but stopped reaching the target from 10:11 UTC to 12:04 UTC, suggesting that the blocking affected the network layer.<\/p>\n

Then followed a period (12:04 UTC to 15:13 UTC) during which RTTs to the same destination gradually decreased from 107.72 ms to 0 ms, indicating that during a short period packets could be transmitted. From April 28, 2019 at 15:13 UTC to April 29, 2019 at 05: 04 UTC, the probe could not reach the destination IP or was fully disconnected again on the IP layer. This corresponds to the biggest period of the blackout (presented in the following Internet blackout section). Traceroutes were only successful again starting from April 29, 2019 at 05:04 UTC.<\/p>\n

Interestingly, the patterns registered for Probe 11944 when it comes to traceroutes towards the landing webpages of instagram.com (Figure 6), wechat.com (Figure 7), www.messenger.com (Figure 8), www.google.com (Figure 9), Google DNS (Figure 10 and 11), show that the Internet outage is experienced by the source AS (ISOCEL).<\/p>\n

\"\"<\/a>\"Figure<\/a>Figure 5: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to www.whatsapp.com<\/a>, https:\/\/atlas.ripe.net\/measurements\/21083876\/<\/a>, April 28, 2019. The red pattern is registered for Probe 32381 because the probe could not resolve the URL www.whatsapp.com<\/a>.<\/p>\n

 <\/p>\n

\"Figure<\/a>Figure 6: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online \u00a0in Benin to www.instagram.com<\/a>, https:\/\/atlas.ripe.net\/measurements\/<\/a>21084196<\/a>\/<\/a>, April 28, 2019<\/p>\n

\"Figure<\/a>Figure 7: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to www.wechat.com<\/a>, https:\/\/atlas.ripe.net\/measurements\/<\/a>21084197<\/a>\/<\/a>, April 28, 2019<\/p>\n

\"Figure<\/a>Figure 8: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to www.messenger.com<\/a>, https:\/\/atlas.ripe.net\/measurements\/<\/a>21084200<\/a>\/<\/a>, April 28, 2019<\/p>\n

\"Figure<\/a>Figure 9: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to www.google.com<\/a>, https:\/\/atlas.ripe.net\/measurements\/<\/a>21083844<\/a>\/<\/a>, April 28, 2019<\/p>\n

Compared to those of Probe 32381, they are mostly consistent, except for the interval of time between ~12:00 UTC – 00:00 UTC, which is the time during which there was an Internet outage. These results are confirmed by in-depth inspection carried out on AS paths inferred\u00a0from the traceroute outputs. They suggest that ASes ISOCEL on one side, JENY-AS and Spacetel experience the shutdown differently.<\/p>\n

Measurements from Probe 11944, which are gathered from AS37090, are consistent with OONI Probe measurements in the previous section, confirming the accessibility of these services on ISOCEL Telecom.<\/p>\n

\"Figure<\/a>Figure 10: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to Google DNS (8.8.8.8), https:\/\/atlas.ripe.net\/measurements\/<\/a>21083844<\/a>\/<\/a>\u00a0(AS paths inferences before the shutdown), April 28, 2019<\/p>\n

\"Figure<\/a>Figure 11: <\/strong>RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to Google DNS (8.8.8.8), https:\/\/atlas.ripe.net\/measurements\/<\/a>21083844<\/a>\/<\/a>\u00a0(AS paths inferences during the shutdown), April 28, 2019<\/p>\n

\"Figure<\/a>Figure 12:<\/strong>\u00a0RIPE Atlas measurement, Recurring IPv4 traceroute measurement from all probes online in Benin to 9.9.9.9 (Quad9) depicting that BENIN-IX was mostly UP on election day and that the shutdown did not occur there and proving that each network implemented\/suffered from the blackout differently. \u00a0https:\/\/atlas.ripe.net\/measurements\/<\/a>21084227<\/a>\/<\/a>, April 28, 2019<\/p>\n

We can deduce the following from comparing these figures:<\/p>\n

    \n
  1. ISOCEL end-users clearly suffered a shutdown on election day, because its network did.<\/li>\n
  2. Meanwhile, the destinations of our measurements were all reachable from JENY-AS and Spacetel Benin: MTNNS-AS (AS16637), the sibling of Spacetel was reachable from both ASes on the IP layer, while landing webpages from social media were not.<\/li>\n
  3. There was a period (00:00 UTC to 06:00 UTC) during which ISOCEL was experiencing a blackout on the IP layer, while Spacetel was not.<\/li>\n
  4. Both networks have been reconnected to the Internet since early April 29, 2019 roughly at 06:00 UTC.<\/li>\n
  5. The Internet Exchange point switch was UP during the whole period of the blocking campaign (Figure 12).<\/li>\n<\/ol>\n

    Internet blackout<\/h2>\n

    IODA detected significant Internet blackouts affecting Benin on 28th and 29th April 2019. IODA\u2019s data sources further show that these blackouts were not limited to a single AS; instead, many large ASes in Benin experienced blackouts.<\/p>\n

    About IODA<\/h3>\n

    The Center for Applied Internet Data Analysis (CAIDA)<\/a> runs a project called IODA<\/a>\u00a0(short for Internet Outage Detection and Analysis), which monitors the Internet, in near-realtime, to identify macroscopic Internet outages, affecting the edge of the network (i.e. significantly impacting an AS or a large fraction of a country). IODA does so using three complementary data sources:<\/p>\n