Iran Protests: OONI data confirms censorship events (Part 1)

At this point, you have probably read all about the major anti-government protests that erupted across Iran over the last week. You may have even read about how services like Telegram and Instagram were blocked, reportedly as part of a government attempt to stifle the unrest.

We publish this post to share OONI network measurement data collected from Iran between 28th December 2017 (when the protests started) to 2nd January 2018. OONI data confirms the blocking of Telegram, Instagram, and Facebook Messenger amidst Iran’s protests and reveals how blocks were implemented.

Blocking of Telegram

Telegram is extremely popular in Iran and could be viewed as an organizing tool for protests, thus motivating authorities to block access to it.

OONI’s Telegram test is designed to measure the blocking of Telegram’s app and web interface. Network measurements collected from three local vantage points in Iran show that ISPs started blocking access to Telegram’s app and web interface on New Year’s Eve, as illustrated in the table below.

DateASNweb.telegram.orgTelegram app
2018-01-02AS44244BLOCKEDTCP blocking
2018-01-02AS197207BLOCKEDTCP blocking
2018-01-02AS16322BLOCKEDTCP blocking
2018-01-01AS16322BLOCKEDTCP blocking
2018-01-01AS44244AccessibleAccessible
2018-01-01AS197207BLOCKEDTCP blocking
2017-12-31AS197207BLOCKEDTCP blocking
2017-12-31AS44244AccessibleAccessible
2017-12-30AS16322AccessibleAccessible
2017-12-29AS16322AccessibleAccessible
2017-12-28AS16322AccessibleAccessible

Irancell (AS44244) only started blocking Telegram on 2nd January 2018, while MCI (AS197207) started blocking access to the instant messaging app on 31st December 2017. Telegram was also blocked by Pars Online (AS16322) as of 1st January 2018, but it remains unclear (due to the lack of measurements) if the block started earlier.

Blocking of Instagram

OONI’s Web Connectivity test is designed to measure the DNS, HTTP, and TCP/IP blocking of websites. Network measurement data collected from this test shows the blocking of Instagram in Iran.

The table below summarizes OONI findings.

DateASNInstagram status
2018-01-02AS43754BLOCKED
2018-01-02AS48159BLOCKED
2018-01-02AS58085BLOCKED
2018-01-02AS44244BLOCKED
2018-01-02AS197207BLOCKED
2018-01-02AS16322BLOCKED
2018-01-01AS197207BLOCKED
2018-01-01AS16322BLOCKED
2018-01-01AS57218BLOCKED
2018-01-01AS44244Accessible
2017-12-31AS197207BLOCKED
2017-12-31AS16322BLOCKED
2017-12-30AS16322Accessible
2017-12-29AS16322Accessible
2017-12-28AS16322Accessible

Similarly to Telegram, OONI data shows that Iranian ISPs started blocking access to Instagram on 31st December 2017, and that Irancell (AS44244) only started blocking access on 2nd January 2018. ParsOnline Tehran (AS16322) clearly started blocking access to Instagram on 31st December 2017, while network measurements collected from 7 different ISPs in total show the blocking of the site on 1st and 2nd January 2018.

Further findings are available in Part 2 of this research. The latest findings show that Instagram was blocked through the use of Deep Packet Inspection (DPI) technology which targeted the TLS protocol.

Blocking of Facebook Messenger

Facebook Messenger has been blocked in Iran independently from the recent protests. We previously reported on the DNS blocking of Facebook Messenger in a research report that analyzed network measurements collected from Iran between 2014 to 2017. We generally measure the reachability of Facebook Messenger (in Iran and elsewhere around the world) through OONI’s Facebook Messenger test.

More recent measurements, collected during Iran’s protests, show that Facebook Messenger remains blocked in (at least) three networks.

DateASNFacebook Messenger status
2018-01-02AS44244BLOCKED
2018-01-02AS197207BLOCKED
2018-01-02AS16322BLOCKED
2018-01-01AS16322BLOCKED
2018-01-01AS44244BLOCKED
2018-01-01AS197207BLOCKED
2017-12-31AS44244BLOCKED
2017-12-31AS197207BLOCKED
2017-12-31AS16322BLOCKED
2017-12-30AS16322BLOCKED
2017-12-29AS16322BLOCKED
2017-12-28AS16322BLOCKED
2017-12-27AS16322BLOCKED
2017-12-26AS16322BLOCKED
2017-12-26AS44244BLOCKED

In contrast, WhatsApp appears to be accessible in Iran.

WhatsApp measurements table

Viber used to be the most popular instant messaging app in Iran, before it got blocked by authorities. Then millions switched over to Telegram, making it the most widely used instant messaging app in the country. Now that Telegram is blocked too (and it remains unclear if authorities plan to lift the ban), one can’t help but wonder if this will prompt a mass switch to WhatsApp - particularly given its currently accessibility in Iran.

Blocking of Tor

The Tor anonymity network is free software that allows its users to browse the web anonymously and to circumvent internet censorship. Tor Metrics (below) show a sudden spike in Tor usage on 31st December 2017, when ISPs started blocking access to Telegram and Instagram in Iran.

Tor Metrics graph

However, Tor Metrics suggest that Iranian ISPs may have started blocking access to the Tor network thereafter, as indicated by the subsequent drop in Tor usage. This is corroborated by data collected by OONI’s Vanilla Tor test, which is designed to measure the reachability of the Tor network.

OONI data from 29th & 30th December 2017 shows that Tor (without bridges) was bootstrapping properly in Iran. On 31st December 2017, when ISPs started blocking social media, Tor still appeared to be bootstrapping, but was very slow (138 seconds vs ~40 second average for the past 6 months). On 1st January 2018, the bootstrap time of Tor was even slower (273 seconds). And in some networks, Tor was blocked entirely. On 2nd January 2018, however, we found Tor to be blocked in all networks (where measurements were collected) in Iran.

Circumventing censorship

Even though the Tor network is blocked in Iran, it may be possible to connect to it through the use of Tor bridges. When configuring Tor Browser, you can connect to the Tor network by using obfs4 bridges. You can obtain obfs4 bridges by visiting https://bridges.torproject.org/ or by sending an email to bridges@torproject.org.

To circumvent the blocking of mobile applications, like Telegram or Facebook Messenger, Android users can try enabling bridges and the VPN mode of Orbot which enables all apps on their device to run through the Tor network.

Reproducible research

To measure the blocking of Telegram, Facebook Messenger, or WhatsApp, run OONI Probe on Linux, macOS, or on a Raspberry Pi.

To measure the blocking of specific websites:

  1. Install the OONI Probe mobile app

  2. Add those websites (e.g.https://www.instagram.com) to OONI Run

  3. Generate an OONI Run link to test those sites

All network measurement data based on your testing will be published via the following resources:

Acknowledgements

We thank all the anonymous volunteers in Iran who have run and continue to run OONI Probe, thus making this research possible.

This post has been updated on 14th February 2018 following the publication of further research.