#EgyptCensors: Evidence of recent censorship events in Egypt
OONI tests: Web Connectivity,
HTTP Header Field Manipulation,
HTTP Invalid Request Line,
HTTP Host, Vanilla Tor.
Probed ISPs: Link Egypt (AS24863), Vodafone Egypt (AS36935), Telecom
Analysis period: 23rd May 2017 to 17th June 2017.
Censorship method: Deep Packet Inspection (DPI) used to RESET
Starting on May 24th, the Egyptian government ordered ISPs to block at least 21 news websites
on the grounds of “supporting terrorism and spreading lies”. In an
attempt to understand which sites were blocked and how, OONI Probe network measurement software - designed to
examine internet censorship - was run in three local vantage points in
So far, we have been able to identify and confirm the blocking of ten
news websites, including madamasr.com, aljazeera.net, and eight others.
It remains unclear to us though if all ten sites have been blocked under
the Egyptian government’s recent order.
Unfortunately, we also found access to censorship circumvention software
to be blocked as well. Link Egypt appears to be
access to the Tor network, though it
appears to currently be accessible from the Telecom Egypt (TE) and
Vodafone networks. We also found torproject.org, the Tor bridges website, and even our own site (which enables users to measure
internet censorship) to be blocked in some networks.
Through the collection and analysis of network measurement data we
were able to determine that Egyptian ISPs are using Deep Packet
Inspection (DPI) technology to RESET connections to sites.
Mada Masr blocked
Mada Masr is an independent Cairo-based media organization that
publishes stories of critical interest to
the public. Such stories range from politics, culture and the economy,
and even cover the ongoing crackdown of
human rights activists. Two years ago, Mada Masr won an award
for courageous journalism and for “trying to document facts rather than
presenting populist arguments”.
Recently, Mada Masr
that its site was blocked in Egypt. Network measurement data collected from
OONI Probe users in Egypt
confirms the blocking of madamasr.com in three networks, as illustrated
through the table below.
Interestingly enough, TE (AS8452) has only been blocking the HTTP
version of madamasr.com, enabling users to circumvent the censorship by
accessing the site over HTTPS. Vodafone Egypt (AS36935) and Link Egypt
(AS24863), on the other hand, have been blocking both the HTTP and HTTPS
versions of the site, rendering censorship harder to circumvent.
Based on the network measurement data collected, we
can confirm that Vodafone Egypt has been blocking access to madamasr.com from 24th May 2017
(when the ban was first announced) to this date. The blocking of the
site by Link Egypt can be confirmed as of 25th May 2017,
when OONI Probe users started testing the site in that network.
It’s worth noting that the HTTP version of madamasr.com was accessible in the TE network until 30th May 2017
and that it only started getting blocked on 31st May 2017.
All three ISPs are continuing to block access to madamasr.com, according
to recent measurements.
Recent censorship events in Egypt are not limited to national news
outlets. Network measurement data collected from
OONI Probe users in Egypt confirms the blocking of aljazeera.net in three
networks, as illustrated through the table below.
|Websites||Link Egypt (AS24863)||Vodafone Egypt (AS36935)||TE (AS8452)|
|Unknown (N/A)||BLOCKED||Unknown (N/A)|
Based on the most recent network measurement data, the HTTP
version of aljazeera.net is currently blocked by Link Egypt, Vodafone
Egypt and TE. Both Vodafone Egypt
and Link Egypt
started blocking access to the site on 24th May 2017, when the ban was
officially announced. The data we have shows that TE blocked access to aljazeera.net as of 5th May 2017,
though the block may have been implemented at an earlier date (this is
something that we cannot corroborate, since the testing of this site in
this network started on 5th May).
Similarly to the blocking of madamasr.com, Vodafone Egypt was found to
be blocking both the
versions of aljazeera.net. However, as the HTTPS version of the site was
only tested in that network on 24th May 2017,
it remains unclear if it is still being censored. Given the fact though
that recent measurements show that Vodafone Egypt is still blocking both the HTTP
versions of madamasr.com, it’s likely that they are continuing to block
the HTTPS version of aljazeera.net as well.
As the HTTPS version of aljazeera.net has not been tested recently in
the Link Egypt and TE networks, we do not have data that can show
whether it is blocked or not.
Interestingly enough, TE temporarily unblocked access to aljazeera.net/portal
on 30th and 31st May 2017, while continuing to block access to aljazeera.net.
However, they resumed the blocking
on 1st June 2017.
More news websites blocked
We also found the following 8 media websites to be blocked by Vodafone
based on recent measurements. It remains unclear though if these news
outlets were blocked under the Egyptian government’s recent order.
The table above illustrates that all eight news outlets were found to
recently be blocked by Vodafone Egypt, which appears to be using DPI
technology to RESET connections to these sites. We are currently unable
though to confirm whether these sites are in fact blocked in the TE and
Link Egypt networks as well.
Torproject.org, Tor bridges, and OONI’s site blocked
Tor is free software and an open
network that provides its users with online anonymity. Tor software is
designed to bounce communications around a distributed network of relays
run by volunteers around the world, thus hiding users’ IP addresses and
circumventing online tracking and internet censorship. Tor bridges are designed to enable users
to access the Tor network in countries where access to it is blocked.
Network measurement data collected from
three local vantage points in Egypt show the blocking of The Tor
Project’s website and of bridges.torproject.org, the subdomain that
enables users to get Tor bridges to circumvent the blocking of the Tor
network. But we also found our own site (ooni.org), which
promotes network measurement software designed to detect internet
censorship, to be blocked as well.
The table above illustrates that both the HTTP and HTTPS versions of
torproject.org, bridges.torproject.org and ooni.org were
found to recently be blocked by Link Egypt. Based on the collected data,
Link Egypt appears to have started blocking these domains on 27th May
2017 and continues to block them to date.
Vodafone Egypt, on the other hand, was only found to be blocking the
HTTP versions of torproject.org, bridges.torproject.org and
ooni.org. It remains unclear, however, if the HTTPS versions
of these domains are blocked as well, since they have not been tested
within this network.
Based on the recent collection of network measurement data, we are
unable to reach a conclusion on the accessibility of torproject.org in
the TE network. Some
indicate that TE may have started blocking access to
https://www.torproject.org on 28th May 2017, but only on its mobile
network. Similarly, other
indicate that TE may have started blocking https://torproject.org on
fixed networks on 30th May 2017. But on 4th June 2017, both domains
appeared to be accessible (data
indicating that if they were censored, their block was lifted.
However, access to
https://torproject.org appeared to be blocked again
on 8th June, while appearing to be
the next day. Quite similarly, OONI’s network measurements indicate that
TE blocked access to the HTTPS version of www.torproject.org on
June, but the HTTP version of this domain appeared to be
during the same dates within the same network. The latest measurements,
on the other hand, show that both the
versions of www.torproject.org were accessible in the TE network. Since
the collected data is not conclusive, it remains unclear whether TE
intentionally blocked access to torproject.org or whether the anomalous
measurements are false positives.
It also remains unclear whether TE blocked access to
ooni.org. Measurements from 9th June 2017 indicate that
access to our site was blocked,
but measurements from previous dates,
as well as more recent measurements,
show that it was accessible. As such, the anomalous measurements might
have been due to transient network failures.
On a positive note, bridges.torproject.org was confirmed to be
in the TE network, enabling users to acquire Tor bridges.
Tor network blocked by Link Egypt
OONI’s Vanilla Tor test is designed to
examine the reachability of the Tor network by attempting to successfully
bootstrap a connection to the Tor network.
through this test indicates that the Tor network is
in the Link Egypt network, but likely accessible in the TE and Vodafone
Tests in the Link Egypt network were run every day between 24th to 28th
May, and 1st to 7th June 2017. During this period, OONI Probe was never
able to establish a connection to the Tor network, strongly indicating
that it may have been blocked.
Data collected from the TE network, however, is less conclusive. While
OONI Probe was able to bootstrap a connection to the Tor network between
29th to 31st May, it was unable to do so on 1st and 4th June. Between
5th to 9th June 2017, some attempts were successful, while others
failed. Since OONI Probe was able to establish some connections over
the last weeks, it’s likely that the failed connections were caused by
transient network failures.
During the last weeks, the Tor network was only tested once in the
Vodafone Egypt network, and a connection to it was successfully established.
Contributing to this study
This study is part of ongoing efforts to monitor internet censorship
events in Egypt and around the world. Potentially anyone can run OONI Probe, since it’s free and open source software and
can be run from multiple platforms (Android, iOS, macOS, Linux,
Raspberry Pis). Over the last five years, tens of thousands of OONI Probe
users have measured networks across more than 190 countries with the aim of
uncovering internet censorship events.
Running OONI Probe however can potentially be a
risky activity. Anyone
monitoring your internet activity (e.g. ISP, government, employer) will
be able to know that you are running OONI Probe. And some of the sites
that are tested by OONI Probe (such as pornography or online gambling)
may be illegal in certain countries.
If you feel uncomfortable with the potential risks, there are other
(equally important) ways that you can contribute. Ooniprobe’s censorship
findings are only as interesting as the types of sites that are tested.
We were likely unable to identify the blocking of all 21 news outlets
if they were not included in the lists of sites that
we tested for censorship. As such, reviewing and updating the lists that
OONI Probe tests for censorship is an important task. Information on how
to contribute to such lists can be found
If you’re a data analyst, you may be interested in analyzing the
network measurement data
collected by OONI Probe. If you’re a journalist, you may be interested in
telling stories based on the
data. If you’re a
lawyer, you may be interested in examining the legality of censorship
events based on OONI Probe network measurement data, and potentially even
using it as evidence in court cases. And if you’re a human rights
advocate, you may be interested in supporting Access Now’s KeepItOn campaign for a free and open internet.