How Pakistan blocked news outlets, social media sites, and IM apps amidst protests
Maria Xynou (OONI), Arturo Filastò (OONI), Shahzad Ahmad (Bytes for All Pakistan), Abdul Salam (Bytes for All Pakistan)
Last weekend, a number of social media sites and news outlets were
in Pakistan during Islamist protests.
Protesters gathered in Islamabad alleged that Mr. Zahid Hamid, the
Federal Law Minister, should be removed from his position because he
omitted a reference to the Prophet Muhammad in a parliamentary bill. On
Saturday, 25th November 2017, law enforcement agencies initiated an
operation to disperse the sit-in at the Faizabad Interchange linking
Islamabad and Rawalpindi.
As information about the government operation was reported by the media,
protests spread across the country, literally jamming roads and closing
businesses. The Pakistan Electronic Media Regulatory Authority (PEMRA)
live coverage of the operation at Faizabad, leading to governmental
blocking of social media sites
and online news channels.
In this post, we provide technical evidence of observed censorship
events. We share OONI network measurement data collected from Pakistan,
confirming the DNS-based blocking of Facebook, YouTube, Twitter, and
Instagram. We confirm the DNS blocking of 14 news websites, as well as
the censorship of applications including Facebook Messenger, Telegram,
and WhatsApp’s web interface. All of these censorship events were
temporarily implemented last weekend, and are no longer in place.
Facebook, Twitter, YouTube, and Instagram were reportedly blocked
in Pakistan last Saturday, 25th November, and Sunday, 26th November
To confirm these reports and examine how the blocks were implemented, we
analyzed OONI network measurement data collected from Pakistan.
OONI Probe is free and open source software designed
to measure internet censorship, including the blocking of websites.
Community members in Pakistan have been running OONI Probe on a daily
basis for more than a year, providing data on the changing availability
Our analysis confirms the DNS-based blocking of Facebook, Twitter,
YouTube, and Instagram, as summarized in the table below.
All four sites presented DNS lookup errors, strongly suggesting that
they were blocked by means of DNS tampering. This is also supported by
the fact that, according to OONI measurements, these sites
were accessible before and after last weekend. In other words, DNS
lookup errors for these sites only showed up in OONI measurements on the
25th and 26th of November.
This is not the first time these sites have been interfered with in
Pakistan. In our recently published research report
in collaboration with Bytes For All, Pakistan, we analyze network
measurements in the country from between 2014 to 2017. This study
confirms observations of blocking the HTTP versions of certain YouTube,
Facebook, and Twitter webpages hosting content related to the
controversial “Draw Muhammad Day” (these webpages remain blocked
today). This indicated that Pakistani ISPs applied “smart filters”, with
targeted censorship of specific webpages.
Last weekend, however, these sites were entirely blocked. This was also
reported in a press release by the Digital Rights Foundation (DRF) and
Rather than filtering specific webpages, ISPs blocked access to the encrypted
HTTPS versions of facebook.com, twitter.com, youtube.com, and instagram.com by
means of DNS tampering, rendering them inaccessible.
Blocking of instant messaging apps
Analysis of OONI measurements indicates that
last weekend’s censorship wasn’t limited to news outlets and social
media sites; several instant messaging apps were interfered with as
Facebook Messenger and WhatsApp’s web interface were temporarily blocked
on Sunday, 26th November 2017, while Telegram has possibly suffered a
OONI’s Facebook Messenger test
attempts to perform a TCP connection and DNS lookup to Facebook’s
endpoints. If the TCP connection fails and/or DNS lookups don’t resolve
to IP addresses allocated to Facebook, then Facebook Messenger is likely
blocked. This test has been run on an almost daily basis from multiple
vantage points in Pakistan over the last year.
OONI measurements usually
show that Facebook Messenger is accessible in Pakistan. However, last
Sunday we noticed DNS lookup errors from two different ISPs, suggesting
that Facebook Messenger was temporarily blocked.
|Probed ASNs||Date of measurement||Tested app||Result|
|AS23674||2017-11-26||Facebook Messenger||DNS blocking|
|AS45595||2017-11-26||Facebook Messenger||DNS blocking|
Similarly, WhatsApp’s web interface (web.whatsapp.com) appears to have
temporarily been blocked on the 26th of November.
|Probed ASNs||Date of measurement||Tested URL||Result|
OONI’s WhatsApp test
performs an HTTP GET request, TCP connection, and DNS lookup to
WhatsApp’s endpoints, registration service, and web version over the
vantage point of the user. In doing so, this test measures the
reachability of both WhatsApp’s app and web interface. While
web.whatsapp.com was likely blocked across three ISPs on 26th November
(as illustrated in the table above), the WhatsApp app was
throughout the weekend in all vantage points where tests were run.
Telegram’s website was blocked last weekend in Pakistan, as illustrated
through the table below.
|Probed ASNs||Date of measurement||Tested URL||Result|
But Telegram may have been blocked in Pakistan for a while.
OONI’s Telegram test
is designed to measure the blocking of Telegram’s app and web version
(web.telegram.org) by attempting to perform an HTTP POST request,
establish a TCP connection to Telegram’s access points, and an HTTP GET
request to Telegram’s web interface over the vantage point of the user.
Measurements collected from this test indicate that Telegram’s app and
web interface (web.telegram.org) may have been blocked in Pakistan since
at least 20th November 2017.
While the testing of Telegram’s web interface constantly presents DNS
lookup and timeout errors (strongly suggesting that it’s blocked), the
testing of Telegram’s endpoints is less conclusive. Therefore, it
remains unclear if the Telegram app is being blocked, or if the TCP
failures are false positives.
Blocking of news websites
On Saturday, the Pakistan Electronic Media Regulatory Authority (PEMRA)
live coverage of the operation at Faizabad, Islamabad, explaining why a
number of online news channels were reportedly blocked.
Testing confirmed the DNS-based blocking of the following news websites
on Saturday, 25th November 2017.
A subset remained blocked on Sunday, 26th November 2017.
|Probed ASN||Date of measurement||Tested URL||Result|
It remains unclear if the other news outlets blocked on the 25th of
November were also blocked on the 26th of November - we do not have
This is the first time that we have observed censorship of news websites
in Pakistan. Our previous study,
involving the analysis of thousands of network measurements collected
between 2014 to 2017, only allowed us to confirm the blocking of sites
expressing religious criticism and minority sites.
The following software tools can be used for censorship circumvention:
Tor: Free and open source anonymity network which
hides its users’ real IP addresses, enabling them to bypass internet censorship
and online tracking.
Psiphon: Centrally managed censorship circumvention tool
Lantern: Peer-to-peer (yet centrally managed)
censorship circumvention tool.
VPN mode of Orbot: Enables
mobile apps to run over the Tor network,
Paid VPN services: Criteria for
selecting a VPN that’s right for you.
Reproducing this study
In the event that censorship events re-emerge (in Pakistan or
elsewhere), we provide information on how to reproduce this study.
Monitoring internet censorship on an ongoing basis (regardless of
whether censorship events are known to be happening or not) can be
useful to track censorship events when/if they occur.
To reproduce this study:
Install the OONI Probe
mobile app (Android, F-Droid, iOS)
Add the sites that you want to test to OONI Run and generate a link
Click on your OONI Run link and open it with your OONI Probe mobile
To view the results:
Tap on the menu icon on the top left corner in the OONI Probe mobile
Tap on “Past Tests”
Tap on “View” next to “Web Connectivity”
To view the details of each measurement, tap on “View” next to each
tested site. If the site you selected is red, the measurement page will
provide you the following information:
How the site is blocked (e.g. DNS tampering, HTTP or TCP/IP blocking);
How the specific censorship can be circumvented;
Network measurement information serving as evidence of the blocking (available
towards the end of each measurement page).
To run more OONI Probe tests and to schedule daily testing, consider
running OONI Probe on
macOS, or on a
Raspberry Pi. All
network measurement data will be published on OONI Explorer and on the OONI API, increasing transparency of internet censorship.