Burundi blocks social media amid 2020 general election
Yesterday, access to social media was reportedly blocked in Burundi amid its 2020 general election.
The lead-up to the election was marred by violence and unrest, as seven candidates vied to replace Incumbent President Nkurunziza, who has been in power over the last 15 years. Despite widespread deadly protests and a coup attempt, President Nkurunziza won a third term in 2015 following disputed elections. While President Nkurunziza reportedly announced that he would not contest the next elections, he is set to become a “supreme guide to patriotism” as he steps down now in 2020.
Burundi’s 2020 general election has not only been questioned in terms of being free and fair, but it has also been criticized for taking place during the COVID-19 pandemic without adequate safeguards. Meanwhile, Access Now reported that social media platforms were blocked in Burundi on election day, starting in the morning of 20th May 2020.
In this report, we share OONI network measurement data on the blocking of social media in Burundi amid its 2020 general election.
OONI Probe is free and open source software designed to measure internet censorship and other forms of network interference. The OONI Probe app (available for both mobile and desktop platforms) includes tests designed to measure the blocking of websites and instant messaging apps (WhatsApp, Facebook Messenger, and Telegram).
More specifically, the OONI Probe Web Connectivity test is designed to measure the blocking of websites by attempting to perform a DNS lookup, TCP connection, and HTTP request (to the URLs included in the Citizen Lab test lists) from both a control vantage point and the local vantage point of the user. The measurements collected from both vantage points are automatically compared and if they differ, the result is flagged as “anomalous”. Depending on the type of anomaly detected (DNS, TCP/IP, HTTP), we can infer the type of blocking. The OONI Probe WhatsApp, Facebook Messenger, and Telegram tests are designed to measure the blocking of these apps through DNS lookups and by attempting to establish TCP connections to the app endpoints.
Unless an OONI Probe user opts-out, their test results are automatically sent to OONI’s servers, processed, and openly published. Since April 2016, hundreds of thousands of OONI Probe tests have been run in Burundi from 9 local networks.
As part of this study, we examined recent OONI measurements collected over the last months from Burundi in an attempt to corroborate reports on the blocking of social media with network measurement data. As most OONI measurements were collected on Econet (AS37336) over the last few days, our findings are primarily limited to this network.
Blocking of social media websites
Numerous social media websites were found to be blocked in Burundi on 20th May 2020, amid the 2020 general election.
The following chart illustrates the social media websites that we found to be blocked in Burundi on Econet (AS37336) on 20th May 2020.
Source: OONI measurements collected from Burundi, https://explorer.ooni.org/search?until=2020-05-22&probe_cc=BI&test_name=web_connectivity
What is evident from the above chart is that all of the tested social media websites consistently presented network anomalies every time they were tested on 20th May 2020. The fact that each of these sites was tested multiple times on that day on Econet (AS37336), and that their testing always presented anomalies, provides a strong signal of potential blocking. When looking into the details of these anomalous measurements, we observe that the HTTP requests consistently fail with a connection reset error.
Furthermore, when comparing the anomalous measurements of 20th May 2020 with all the other OONI Probe measurements collected from the testing of those sites in Burundi (prior to 20th May 2020), we observe that those social media sites were previously accessible in the country. OONI measurements show that many of these sites were consistently accessible every time they were tested over the last years, and that they only started to present anomalies on 20th May 2020. This sudden change – which is evident in the measurements of many social media platforms – strongly suggests that the blocking of these social media websites in Burundi started at around the time of the 2020 general election.
More specifically, OONI measurements show that these social media websites were blocked from the morning of the election day, at least from 09:37 UTC on 20th May 2020. The absence of relevant OONI measurements from 19th May 2020 limits our ability to determine if the blocking started before the elections, though all measurements from 18th May 2020 show that these social media sites were accessible at the time.
The fact that the interference towards these websites only occurs when we attempt to establish an HTTPS connection, as opposed to the IPs being blocked or the DNS queries being interfered with, is a strong indication of some form of Deep Packet Inspection (DPI) technology being used, perhaps targeting the SNI field of the TLS connection.
As no previous OONI measurements (before 20th May 2020) were collected
tieba.baidu.com, we are unable to compare
their testing in Burundi over time.
The following table shares the relevant OONI measurements for each of the blocked social media sites, as well as all other OONI measurements collected from the testing of each site in Burundi.
Blocking of instant messaging apps
Both WhatsApp and Telegram were blocked in Burundi on election day, as suggested by relevant OONI measurements.
On 20th May 2020, the WhatsApp app was measured on 3 local networks in Burundi: Econet (AS37336), Viettel Burundi (AS327799), and Lacell Burundi (AS327720).
Starting at 04:06 UTC on 20th May 2020, we observe the blocking of the WhatsApp app on Econet (AS37336). Similarly to the Web Connectivity results (discussed previously), we not only observe the blocking of WhatsApp’s web interface (web.whatsapp.com), but we also see that it presents the exact same connection reset errors. Furthermore, the measurements show that access to the WhatsApp mobile app was blocked as well, since HTTP requests to WhatsApp’s registration service consistently resulted in connection reset errors. As all measurements collected from this network on 20th May 2020 consistently show the same failures, they strongly suggest that WhatsApp was blocked in Burundi amid the 2020 general election.
We do not observe blocking of the WhatsApp application endpoints when doing a DNS resolution for eN.whatsapp.net or attempting to establish a TCP connection to it. This is, however, a bit of a limitation in the implementation of the OONI WhatsApp test, as it does not send or receive data from the app endpoints, which might be necessary in order to trigger the DPI based blocking. The registration service blocking is detected because, in that case, the test performs a full HTTPS request to it.
We also observe the blocking of WhatsApp on Viettel Burundi (AS327799) in the morning of 20th May 2020. Fewer measurements were collected on this network, but they show the same connection reset errors for both web.whatsapp.com and WhatsApp’s registration service. WhatsApp was only tested once on Lacell Burundi (AS327720) on 20th May 2020 (at 16:56 UTC), and that one measurement shows that the app was accessible. It remains unclear, though, if WhatsApp was blocked on this network earlier in the day.
Similarly to the testing of WhatsApp, Telegram was tested on 3 local networks in Burundi: Econet (AS37336), Viettel Burundi (AS327799), and Lacell Burundi (AS327720).
Starting from 09:42 UTC on 20th May 2020, we observe the blocking of Telegram on Econet (AS37336). More specifically, we see that HTTP requests to web.telegram.org result in connection reset errors (similarly to the Web Connectivity testing of web.telegram.org), but HTTP POST requests and TCP connections to the tested Telegram endpoints are successful. All other measurements collected from this network consistently present the same failures, strongly suggesting that Telegram was blocked in Burundi on 20th May 2020. In contrast, measurements collected from this network before 20th May 2020 show that web.telegram.org was previously accessible.
Telegram also provided signs of blocking on Viettel Burundi (AS327799), where we observe that HTTP requests to web.telegram.org result in connection reset errors. And similarly to the testing of WhatsApp, Telegram was only tested once on Lacell Burundi (AS327720) on 20th May 2020 (at 16:56 UTC) and that measurement shows that the app was accessible. It remains unclear, though, if Telegram was blocked on this network earlier in the day.
While OONI’s Web Connectivity test clearly shows the blocking of facebook.com, we only observe Facebook Messenger interference on the Lacell Burundi (AS327720) network.
OONI’s Facebook Messenger test is designed to measure the reachability of the app through DNS lookups to domains associated with Facebook and by attempting to establish TCP connections to Facebook’s endpoints. Almost all measurements collected from Burundi on 20th May 2020 consistently show that the DNS lookups and TCP connections were successful.
This is consistent with the hypothesis that Internet Service Providers (ISPs) in Burundi appear to be using DPI technology to implement the blocks (as discussed previously), which would therefore not have any effect on the DNS lookups or the establishment of a TCP connection.
As a result, the OONI Facebook Messenger test would not be able to detect this sort of blocking. But even if the Facebook Messenger app was not blocked, the blocking of facebook.com would likely result in the interference of the app.
We have a single measurement from Lacell Burundi (AS327720) which presents signs of DNS based interference. In particular, DNS resolutions for hostnames corresponding to Facebook services resolve to IP addresses in the 240.0.0.0/8 range, which is an IP space reserved for future use. We notice the same pattern of DNS based blocking for another blocked website on the same network.
It is quite likely the case that internet censorship on the Econet (AS37336) and Viettel Burundi (AS327799) networks is applied through the use of some form of Deep Packet Inspection (DPI) technology, as the block is not implemented at the DNS or IP level.
It is also interesting to note that the blocks on the Lacell Burundi (AS327720) network were implemented on a DNS level by returning an IP address in the DNS answer which is in the “reserved for future use” 240.0.0.0/8 IP space.
While the measurements clearly show a censorship change in comparison to previous measurements, there is still the need to expand the longitudinal measurement coverage in order to detect and confirm censorship cases with greater confidence.
We thank all OONI Probe users in Burundi who contributed measurements, making this study possible.