spotted: sandvine back at it, this time, in Azerbaijan

In August, when people in Belarus took the streets across the country in protest of election results where incumbent President Lukashenka secured yet another victory in a contested presidential election, authorities deliberately cut the internet. Quickly, experts concluded DPI technology may be in use. By the end of August, it was reported that this DPI technology was produced by the Canadian company Sandvine and supplied to Belarus as part of a $2.5million contract with the Russian technology supplies Jet Infosystems.

DPI (Deep Packet Inspection) is known as digital eavesdropping that allows information extraction. More broadly as explained here, DPI “is a method of monitoring and filtering internet traffic through inspecting the contents of each packet that is transmitted through an inspection point, allowing for filtering out malware and unwanted traffic, but also real-time monitoring of communications, as well as the implementation of targeted blockings and shutdowns.” 

Canadian company Sandvine is owned by American private equity firm Francisco Partners.

 

Sandvine technology has been detected in many countries across the world, including in Ethiopia, Iran, as well as Turkey, and Syria as previously reported. One other country where Sandvine technology was reportedly deployed is Azerbaijan

In Azerbaijan, the DPI deployments have been used since March 2017. This was reported in January 2019, when VirtualRoad, the secure hosting project of the Qurium – Media Foundation published a report documenting fresh attacks against Azerbaijan’s oldest opposition newspaper Azadliq’s website (azadliq.info). The report concluded: “After ten months trying to keep azadliq.info online inside Azerbaijan using our Bifrost service and bypassing multi-million dollar DPI deployments, this is one more sign of to what extent a government is committed to information control”.  

Another report released in April 2018 showed evidence of the government of Azerbaijan using Deep Packet Inspection (DPI) since March 2017. The report also found out that this specialized security equipment was purchased at a price tag of 3 million USD from an Israeli security company Allot Communications.

Now, according to this story reported by Bloomberg, Sandvine worked with Delta Telecom – Azerbaijan’s main internet provider and owned by the government to install a system to block live stream videos from YouTube, Facebook, and Instagram. “The social media blackout came last week after deadly clashes with Armenia. As a result, people in Azerbaijan couldn’t reach websites including Facebook, WhatsApp, YouTube, Instagram, TikTok, LinkedIn, Twitter, Zoom, and Skype, according to internet monitoring organization Netblocks,” wrote Bloomberg. 

Azerbaijan Internet Watch has been monitoring the situation on the ground since September 27, the day when clashes began. Together with OONI, Azerbaijan Internet Watch reported that access to several social media applications and websites was blocked. 

Access to the Internet remains throttled in Azerbaijan as of writing this post. Many of the social media applications remain accessible only through a VPN provider. As a result, authorities have resorted to other means in order to prevent users from using VPN services. From banks to ISPs encouraging users not to use VPN services, this account on Facebook made a list of VPNs alleging they were of Armenian origin in order to discourage users.

country-wide internet disruptions reported in Azerbaijan [updated]

[UPDATE] On November 12, access to the Internet was finally restored across the country in Azerbaijan. This was shared in an announcement shared by the Ministry of Communication, Transportation and High Technologies on November 11. In a statement, the Ministry said:

The temporary restriction on Internet access imposed in our country in order to prevent large-scale provocations and cyber incidents committed by the Republic of Armenia will be lifted on November 12, 2020, with the exception of the territories liberated from occupation and former frontier zones.

The Ministry expresses gratitude to millions of Azerbaijani Internet users for their understanding in connection with the restriction on Internet access over the past period.

It should be noted that the Ministry of Transport, Communications and High Technologies imposed restrictions on the provision of Internet in the country on September 27, 2020.

ABC.az, a local online news platform, reported that restrictions remained in territories liberated from occupation and territories that previously belonged to the frontline zone.

November 11, the Cabinet of Ministers said it had no information about the lifting of restrictions on Internet access in the country while addressing Turan News Agency. Meanwhile, the head of an opposition Popular Front party Ali Karimli called for an immediate end to restrictions imposed on Internet access and to social media platforms. Unlike Karimli, the head of Azerbaijan Internet Forum, Osman Gunduz, sees gradual transition as an alternative. “Although the military operations are over, keeping restrictions imposed on social media platforms is needed.” Gunduz suggested keeping restrictions on WhatsApp and YouTube as these were two of the most popular platforms where false information about the fighting made rounds. In contrast, the head of the Internet Forum, it would be suitable to lift the ban on Twitter because this platform is widely used to disseminate information about the war to an international audience. Gunduz said similar restrictions are common practice across countries including in Europe and the UK where governments restricted internet access during mass protests. “In the UK, during acts of terrorism, the government restricted access to social media platforms.” Azerbaijan Internet Watch, could not verify this statement. Unlike Azerbaijan, the UK is ranked “free” in Freedom on the Net ranking by Freedom House. Similarly, most of the European countries, are categorized under “little or no censorship, and surveillance” countries.   

As of November 7, access to the Internet remained limited with users of state operators Baktelecom and Aztelekom remaining largely disconnected or with slower than usual internet speed. The rest of the providers worked in a limited capacity while access to social media platforms remained blocked. 

October 21, President Ilham Aliyev in an interview with the Japanese Nikkei newspaper said restrictions on Internet access and on the use of social media platforms in Azerbaijan are only temporary. “Once active fighting is over we will restore all access.”  

October 20, State Security Service encouraged Azerbaijani citizens to refrain from using VPN providers when trying to access social media platforms that have been inaccessible as a result of the restrictions imposed by the government. It warned that some of the VPN providers such as SkyVPN is not trusted and can steal persona information. To its credit, the SSS is correct about the poor quality of this specific VPN service.

October 13, on the 16th day of escalated tensions between Armenia and Azerbaijan, Internet access remains throttled in Azerbaijan. The Ministry of Transportation, Communication and High Technologies claims throttling is in line with government orders given the active state of military operations. But not to everyone. Independent media and journalists complain they have had issues posting news since the start of the recent conflict on September 27 on their websites and social media accounts. In addition to slowing down the Internet, on October 8, a story reported by Bloomberg identified the use of Deep Packet Inspection (DPI) technology in Azerbaijan to effectively block access to many of the social media platforms in the country as well. However, this is not the case for government news outlets and government institutions. The latter’s access to uninterrupted and undisrupted Internet highlights the inequality of access to information both by those who produce independent news as well as the audience of these platforms. Experts say that blocking specific content may align with the existing legal framework, however, throttling access to the Internet altogether is a violation of user rights.

October 10, while the spokesperson for the Ministry of Transportation, Communication and High Technologies, Gunel Gozalova said in a statement to Report.az, that the ministry remains uncertain about the duration of the government imposed internet limitations, independent economy expert Togrul Mashalli, has raised the issue of the economic costs, the recent internet disruptions are posting. Writing through his personal Telegram channel, Mashalli wrote, “it is not just the social media platforms that are limited, but other services too. And this is happening across the whole country. According to the Netblocks Cost of Shutdown Tool, Azerbaijan’s economy is suffering from a total of 44.8millionUSD loss per day. So over the 13 days, this adds up to a 582,4million USD. Since the Internet has not fully been turned off, the total losses are probably around 200-250million USD (we should take into account that social media platforms are often an important part of local internet economy).”

October 9, Gunel Gozalova, spokesperson for the Ministry of Transportation, Communication and High Technologies, said, the government has not shut down the internet. “We have only restricted the Internet. So no one can say, there is no internet at all […] The restrictions introduced are simply to prevent unwanted, unverified, war-related content on social networks. We have taken these measures to protect Azerbaijan’s positions in cyberspace.” The spokesperson said, she does not have any information about how long these restrictions will last. Other experts as the head of Azerbaijan Internet Forum, Osman Gunduz said, the restrictions should be taken with an understanding: “it is possible that we don’t have access to certain information and we can’t analyze what is happening as a result. We think if social media platforms and the internet remained completely open to access it would have been better. But this is not the case. It is normal that given the military situation this step was taken. This is legal. However, I am for having additional measures in place especially for those wanting to fight anti-Azerbaijan propaganda online. It is necessary to set up centers and create a suitable environment for media, experts, and others who have experience working in an international environment.”

October 8, ABC.az local online news platform released a list of VPN providers claiming they were allegedly Armenian providers. The list includes the following VPN services: Express VPN, Nord VPN, VPN 360, CyberGhost VPN, HMA Vpn, Surfshark VPN. While finding the right VPN provider is often challenging, and some of the listed companies do have murky ownership presenting these services as Armenian owned is inaccurate and misleading. Instead, ABC.az could have offered this source for comparisons of numerous VPN services.  

October 3, a number of mobile operators came forward refuting claims of limiting access to users relying on VPN services from their devices.  Nar mobile said they have not introduced any additional limitations to their users relying on VPN services, adding that within the recently introduced internet restrictions and for the sake of protecting their users’ information, users of the mobile operator may face restrictions while accessing “Nar+” application and “nar.az” website. “Information on your mobile devices, as well as passwords used for other applications can be stolen by third parties when using VPN applications. We call on our subscribers to protect their security and advice against the use of VPN applications,” said the mobile operator in an interview with MediaPost. 

Another mobile operator Bakcell, said, no extra restrictions were applied by the operator. The company did however encourage its clients to resort to the Ministry of Transportation, Communication and High Technologies on rules and recommendations about the use VPN services. “Given the current environment, citizens should accept the circumstances with an understanding and follow cyber security rules. It is also important, to pay attention to the origins and trustworthiness of the applications in use.”

Azercell Telekom said it bears no responsibility over its users devices, as well as their security and that it only provides its clients with internet connection within the scope of its telecom services, which include access to social media platforms and websites. 

October 1, Government in Azerbaijan continues to pose limitations to Internet access as tensions continue on the front line. Joining them are internet providers and telecom companies. According to Azerbaijan Press Agency (APA), Azerfon mobile company (with alleged ties to the ruling family) told its users, that its website and the mobile application won’t be accessible for users, using VPN. At the time of writing this update, the website was inaccessible from abroad, without a VPN.  

September 30, according to the most recent reports Internet access remains throttled in Azerbaijan. Users report: 

  • Bakinternet (ISP)- not working
  • Access to social media platforms not possible without a VPN;
  • Whatsapp app and its web extension are not working (without a VPN); 
  • WiFi connections are down for some; 
  • Internet speed is slow; 
  • Gmail is accessible without a VPN; 
  • Some banks [ex. Rabitabank] has informed its customers their mobile app won’t be accessible if users have VPN active; 
  • Bakcell [mobile operator] and Kapitalbank mobile apps are not accessible when VPN is used;

On its website, Bakinternet (an ISP for Bak Telecom) shared a similar statement seen earlier on the website of the Ministry of Transportation, Communication and High Technologies: “In order to prevent provocations from Armenia, access to the Internet has been limited.” 

Translation: 

Employees are asked to delete VPN apps at the workplaces;
They are told using VPN is dangerous;
AzerTac (state news agency) published articles and aired TV shows discussing the dangers of VPN;

According to the VPN service Surfshark website, the sale of VPN in Azerbaijan witnessed a sharp increase as the country moved to block social media platforms starting September 27. “An increased number of Azerbaijanis are turning to Surfshark VPN, leading to an ongoing spike in sales. As a VPN service, Surfshark allows users to overcome government blockades. It doesn’t matter if the new restrictions are imposed via a relatively simple DNS-level block or a sophisticated deep packet inspection, a VPN can open access to blocked media.”

As users in Azerbaijan began increasingly reliant on VPN providers rumors of imposed fines against those who are accessing the blocked content began circulating online. However, the Ministry of Transportation, Communication and High Technologies said, this was not true and that the government body, cannot impose fines. There is also no such legislation in Azerbaijan on the use of VPNs. Instead, the ministry representative encouraged Azerbaijani users, to rely on government media, and stop looking for news on social networks.  


September 29, as clashes on the front line continued on the third day, Internet access in Azerbaijan remained spotty. Users continued reporting difficulties accessing social media platforms. Access to government websites remained spotty. The Ministry of Transportation, Communication and High Technologies did not share any further updates on how much longer the situation will last. 


September 28, according to the most recent reports from Azerbaijan, users continued to face difficulties accessing social media platforms unless using VPN services. 

Government websites that were mostly inaccessible yesterday were restored.

The Ministry of Transportation, Communication and High Technologies (MCHT) has not made any further statements about the duration of currently imposed throttling. 

Instead, MCHT did issue a warning to users of VPN services in the country with the caveat they were unsafe, collecting private user information, and also capable of infecting devices with malware. The Ministry failed to mention the amount of surveillance technology used by other government institutions against citizens in Azerbaijan. 

***

Based on OONI Measurement results it was possible to confirm that the following applications were blocked in Azerbaijan:

According to measurements, the Facebook messenger app was reachable

Similarly, according to measurements access to the Telegram app was available on some networks. 


As tensions between Armenia and Azerbaijan escalated on the front line on September 27, Internet users in Azerbaijan began reporting issues accessing the Internet, social media platforms (Facebook, Instagram, YouTube, and others), and communication apps (WhatsApp, Telegram).

Translation: Looks like they are only limiting access to social media platforms. There are no problems when accessing the Internet [sites]. It is possible to access other websites. 

Issues accessing the internet began already a day before.

Azərbaycandakı internet istifadəçiləri ölkədəki internetin surətindən şikayət edirlər. Bir çoxu xeyli yavaşladığını, foto və videoların açılmadığını deyirlər. Sizdə vəziyyət necədir?

Posted by Hebib Müntezir on Saturday, September 26, 2020

Translation: In Azerbaijan, internet users are complaining about internet speed. Many are saying its slowed down, having difficulties loading videos and images. What is the situation on your end?

Throughout the day, users continued reporting issues with access, speed and lack of information on how much longer the limits on access will continue.

At around 10 AM local time, the Ministry of Transportation, Communication, and High Technologies issued a statement in which it claimed the Ministry was behind internet disruptions.

Ministry of Transportation, Communication and High Technologies Screenshot

At some point, all websites with gov.az extension were down.

All .gov.az also websites are down including https://t.co/DbfCTYL84y and https://t.co/WJUKYKdrQR https://t.co/N20cYTu7c4

— Cavid ⛧ (@cavidaga) September 27, 2020

According to a global #KeepItOn campaign, “Public safety, national security, or stopping fake news are commonly used to justify shutdowns.” Looking at data collected as a result of the campaign there is a significant annual growth in the number of shutdowns reported across the world. Last year alone, 1706 days of internet access were disrupted by 213 internet shutdowns across 33 countries according to #KeepItOn campaign. 

Internet disruptions of various forms and scale in Azerbaijan are not new. Since April, a leader of an opposition party has had his internet cut off. Sometimes they are reportedly caused as a result of technical incidents. In other cases, access to internet is intentionally slowed down especially around political events. 

While some users online commented on internet disruptions as necessary measure to prevent spread of unconfirmed information, others argued the decision to simply throttle the connection was an easy solution especially when there is no way, the authorities can control social media platforms. 

Azerbaijan Internet Watch continues to monitor developments on the ground.