spotted: sandvine back at it, this time, in Azerbaijan

In August, when people in Belarus took the streets across the country in protest of election results where incumbent President Lukashenka secured yet another victory in a contested presidential election, authorities deliberately cut the internet. Quickly, experts concluded DPI technology may be in use. By the end of August, it was reported that this DPI technology was produced by the Canadian company Sandvine and supplied to Belarus as part of a $2.5million contract with the Russian technology supplies Jet Infosystems.

DPI (Deep Packet Inspection) is known as digital eavesdropping that allows information extraction. More broadly as explained here, DPI “is a method of monitoring and filtering internet traffic through inspecting the contents of each packet that is transmitted through an inspection point, allowing for filtering out malware and unwanted traffic, but also real-time monitoring of communications, as well as the implementation of targeted blockings and shutdowns.” 

Canadian company Sandvine is owned by American private equity firm Francisco Partners.

 

Sandvine technology has been detected in many countries across the world, including in Ethiopia, Iran, as well as Turkey, and Syria as previously reported. One other country where Sandvine technology was reportedly deployed is Azerbaijan

In Azerbaijan, the DPI deployments have been used since March 2017. This was reported in January 2019, when VirtualRoad, the secure hosting project of the Qurium – Media Foundation published a report documenting fresh attacks against Azerbaijan’s oldest opposition newspaper Azadliq’s website (azadliq.info). The report concluded: “After ten months trying to keep azadliq.info online inside Azerbaijan using our Bifrost service and bypassing multi-million dollar DPI deployments, this is one more sign of to what extent a government is committed to information control”.  

Another report released in April 2018 showed evidence of the government of Azerbaijan using Deep Packet Inspection (DPI) since March 2017. The report also found out that this specialized security equipment was purchased at a price tag of 3 million USD from an Israeli security company Allot Communications.

Now, according to this story reported by Bloomberg, Sandvine worked with Delta Telecom – Azerbaijan’s main internet provider and owned by the government to install a system to block live stream videos from YouTube, Facebook, and Instagram. “The social media blackout came last week after deadly clashes with Armenia. As a result, people in Azerbaijan couldn’t reach websites including Facebook, WhatsApp, YouTube, Instagram, TikTok, LinkedIn, Twitter, Zoom, and Skype, according to internet monitoring organization Netblocks,” wrote Bloomberg. 

Azerbaijan Internet Watch has been monitoring the situation on the ground since September 27, the day when clashes began. Together with OONI, Azerbaijan Internet Watch reported that access to several social media applications and websites was blocked. 

Access to the Internet remains throttled in Azerbaijan as of writing this post. Many of the social media applications remain accessible only through a VPN provider. As a result, authorities have resorted to other means in order to prevent users from using VPN services. From banks to ISPs encouraging users not to use VPN services, this account on Facebook made a list of VPNs alleging they were of Armenian origin in order to discourage users.

country-wide internet disruptions reported in Azerbaijan [updated]

[UPDATE] On November 12, access to the Internet was finally restored across the country in Azerbaijan. This was shared in an announcement shared by the Ministry of Communication, Transportation and High Technologies on November 11. In a statement, the Ministry said:

The temporary restriction on Internet access imposed in our country in order to prevent large-scale provocations and cyber incidents committed by the Republic of Armenia will be lifted on November 12, 2020, with the exception of the territories liberated from occupation and former frontier zones.

The Ministry expresses gratitude to millions of Azerbaijani Internet users for their understanding in connection with the restriction on Internet access over the past period.

It should be noted that the Ministry of Transport, Communications and High Technologies imposed restrictions on the provision of Internet in the country on September 27, 2020.

As of November 7, access to the Internet remained limited with users of state operators Baktelecom and Aztelekom remaining largely disconnected or with slower than usual internet speed. The rest of the providers worked in a limited capacity while access to social media platforms remained blocked. 

October 20, State Security Service encouraged Azerbaijani citizens to refrain from using VPN providers when trying to access social media platforms that have been inaccessible as a result of the restrictions imposed by the government. It warned that some of the VPN providers such as SkyVPN is not trusted and can steal persona information. To its credit, the SSS is correct about the poor quality of this specific VPN service.

October 13, on the 16th day of escalated tensions between Armenia and Azerbaijan, Internet access remains throttled in Azerbaijan. The Ministry of Transportation, Communication and High Technologies claims throttling is in line with government orders given the active state of military operations. But not to everyone. Independent media and journalists complain they have had issues posting news since the start of the recent conflict on September 27 on their websites and social media accounts. In addition to slowing down the Internet, on October 8, a story reported by Bloomberg identified the use of Deep Packet Inspection (DPI) technology in Azerbaijan to effectively block access to many of the social media platforms in the country as well. However, this is not the case for government news outlets and government institutions. The latter’s access to uninterrupted and undisrupted Internet highlights the inequality of access to information both by those who produce independent news as well as the audience of these platforms. Experts say that blocking specific content may align with the existing legal framework, however, throttling access to the Internet altogether is a violation of user rights.

October 1, Government in Azerbaijan continues to pose limitations to Internet access as tensions continue on the front line. Joining them are internet providers and telecom companies. According to Azerbaijan Press Agency (APA), Azerfon mobile company (with alleged ties to the ruling family) told its users, that its website and the mobile application won’t be accessible for users, using VPN. At the time of writing this update, the website was inaccessible from abroad, without a VPN.  

September 30, according to the most recent reports Internet access remains throttled in Azerbaijan. Users report: 

  • Bakinternet (ISP)- not working
  • Access to social media platforms not possible without a VPN;
  • Whatsapp app and its web extension are not working (without a VPN); 
  • WiFi connections are down for some; 
  • Internet speed is slow; 
  • Gmail is accessible without a VPN; 
  • Some banks [ex. Rabitabank] has informed its customers their mobile app won’t be accessible if users have VPN active; 
  • Bakcell [mobile operator] and Kapitalbank mobile apps are not accessible when VPN is used;

 

On its website, Bakinternet (an ISP for Bak Telecom) shared a similar statement seen earlier on the website of the Ministry of Transportation, Communication and High Technologies: “In order to prevent provocations from Armenia, access to the Internet has been limited.” 

Translation: 

Employees are asked to delete VPN apps at the workplaces;
They are told using VPN is dangerous;
AzerTac (state news agency) published articles and aired TV shows discussing the dangers of VPN;

According to the VPN service Surfshark website, the sale of VPN in Azerbaijan witnessed a sharp increase as the country moved to block social media platforms starting September 27. “An increased number of Azerbaijanis are turning to Surfshark VPN, leading to an ongoing spike in sales. As a VPN service, Surfshark allows users to overcome government blockades. It doesn’t matter if the new restrictions are imposed via a relatively simple DNS-level block or a sophisticated deep packet inspection, a VPN can open access to blocked media.” 


September 29, as clashes on the front line continued on the third day, Internet access in Azerbaijan remained spotty. Users continued reporting difficulties accessing social media platforms. Access to government websites remained spotty. The Ministry of Transportation, Communication and High Technologies did not share any further updates on how much longer the situation will last. 


September 28, according to the most recent reports from Azerbaijan, users continued to face difficulties accessing social media platforms unless using VPN services. 

Government websites that were mostly inaccessible yesterday were restored.

The Ministry of Transportation, Communication and High Technologies (MCHT) has not made any further statements about the duration of currently imposed throttling. 

Instead, MCHT did issue a warning to users of VPN services in the country with the caveat they were unsafe, collecting private user information, and also capable of infecting devices with malware. The Ministry failed to mention the amount of surveillance technology used by other government institutions against citizens in Azerbaijan. 

***

Based on OONI Measurement results it was possible to confirm that the following applications were blocked in Azerbaijan:

According to measurements, the Facebook messenger app was reachable

Similarly, according to measurements access to the Telegram app was available on some networks. 


As tensions between Armenia and Azerbaijan escalated on the front line on September 27, Internet users in Azerbaijan began reporting issues accessing the Internet, social media platforms (Facebook, Instagram, YouTube, and others), and communication apps (WhatsApp, Telegram).

Translation: Looks like they are only limiting access to social media platforms. There are no problems when accessing the Internet [sites]. It is possible to access other websites. 

Issues accessing the internet began already a day before.

Azərbaycandakı internet istifadəçiləri ölkədəki internetin surətindən şikayət edirlər. Bir çoxu xeyli yavaşladığını, foto və videoların açılmadığını deyirlər. Sizdə vəziyyət necədir?

Posted by Hebib Müntezir on Saturday, September 26, 2020

Translation: In Azerbaijan, internet users are complaining about internet speed. Many are saying its slowed down, having difficulties loading videos and images. What is the situation on your end?

Throughout the day, users continued reporting issues with access, speed and lack of information on how much longer the limits on access will continue.

At around 10 AM local time, the Ministry of Transportation, Communication, and High Technologies issued a statement in which it claimed the Ministry was behind internet disruptions.

Ministry of Transportation, Communication and High Technologies Screenshot

At some point, all websites with gov.az extension were down.

All .gov.az also websites are down including https://t.co/DbfCTYL84y and https://t.co/WJUKYKdrQR https://t.co/N20cYTu7c4

— Cavid ⛧ (@cavidaga) September 27, 2020

According to a global #KeepItOn campaign, “Public safety, national security, or stopping fake news are commonly used to justify shutdowns.” Looking at data collected as a result of the campaign there is a significant annual growth in the number of shutdowns reported across the world. Last year alone, 1706 days of internet access were disrupted by 213 internet shutdowns across 33 countries according to #KeepItOn campaign. 

Internet disruptions of various forms and scale in Azerbaijan are not new. Since April, a leader of an opposition party has had his internet cut off. Sometimes they are reportedly caused as a result of technical incidents. In other cases, access to internet is intentionally slowed down especially around political events. 

While some users online commented on internet disruptions as necessary measure to prevent spread of unconfirmed information, others argued the decision to simply throttle the connection was an easy solution especially when there is no way, the authorities can control social media platforms. 

Azerbaijan Internet Watch continues to monitor developments on the ground.

parliament in Azerbaijan is discussing law on hate speech

Parliament in Azerbaijan is set to discuss a draft law on hate speech. While independent critics say there is no need for a separate law, given the existing legal framework that does offer context on hate speech, there is suspicion it is another law with an intention to harm independent voices. 

On September 17, Zahid Oruc, member of the parliament and the head of the Human Rights Committee at the National Parliament, suggested parliament adopts a new law on hate speech. Oruc said the main goal of the law would be to prevent hate speech in information space. While promising, the draft law will be released for public discussion before it goes to the parliament during the fall session, the MP also added the draft law, may consider including social media platforms as part of the information space.

Azerbaijan Internet Watch talked to Elesger Memmedli, a media law expert in Azerbaijan about the draft law. Memmedli thinks there is no need for a separate law on hate speech because Azerbaijan already has plenty of laws that can be amended to regulate hate speech. “What is worrying is the intention. At the moment, the draft law is aimed at political speeches and other instances. But the likelihood of this law to be used as a limiting norm is high.”

The tradition of using existing legal framework or laws against opposition or independent voices goes back to the case of the then opposition journalist Eynulla Fatullayev, explained to Azerbaijan Internet Watch, lawyer Khaled Aghaly. At the time of the sentence [in 20o7] Fatullayev was accused of terrorism, defamation, and incitement to racial hatred. Like Memmedli, Agahly agrees there is no need for a new law when Azerbaijan has Article 283 of the Criminal Code – on Excitation of national, racial, social, or religious hate and hostility.

During the height of the pandemic in Azerbaijan, the parliament introduced a series of amendments to existing laws that were then used to prosecute activists explains Elesger Memmedli. “Shortly after [the amendments] scores of activists were rounded up, including members of [opposition] Popular Front. Some were taken straight from their homes and sentenced to lengthy administrative detention,” recalls Memmedli [some of these arrests were captured here]. 

In 2017, when changes were made to the law on religious terrorism, two prominent members of the Popular Front were arrested relying on the existing legislation, even though it was clear, it was a setup, as neither of the activists had any religious affiliation or background explains Memmedli. 

  • In July, a court convicted Faig Amirli, an APFP member and financial director of the now-closed pro-opposition Azadlig newspaper, on bogus charges of inciting religious hatred and tax-evasion. He received a suspended sentence.
  • In January 2017, a Baku court convicted senior APFP member Fuad Gahramanli to 10 years’ imprisonment for inciting religious and ethnic hatred; he posted criticisms of the government on Facebook.

 

So while hate speech may be a legitimate concern the existing examples tell a different story says Memmedli. 

Meanwhile, Zahid Oruc, vowed the drat law, would not limit the freedom of speech. 

facebook page affiliated with opposition hacked, again

On September 10, the Facebook page that belongs to an online news website bastainfo.com was hacked. Bastainfo.com is affiliated with the opposition party Musavat and is known for often running into problems with the authorities. Its editor was handed a five year suspended sentence in February 2019. The website bastainfo.com remains blocked for access in Azerbaijan. 

In January 2020, Azerbaijan Internet Watch reported how several Musavat party social media accounts were targeted. According to preliminary reports five Facebook pages, one Facebook group, and one website were targeted. 

Bastainfo.com page was targeted then as well. The page lost followers. During last week’s attack, bastainfo.com page lost some 5k followers, and content that was shared since 2017. 

Hacking and compromising Facebook, Instagram, and YouTube accounts (because these are popular platforms used by journalists and activists) is common in Azerbaijan and isn’t new. The online harassment of prominent accounts began several years ago at first, mostly on the level of government-sponsored trolls. Over the years, as the ruling government developed an interest in spyware technology, the types of attacks became more sophisticated while state-sponsored trolling and reliance on automated bots even though still used, became secondary. In each of these cases, finding the perpetrators have not been possible. And in cases when it was clear the attacker was an automated bot/state-sponsored troll the platform took no action. We finally know why. A former Facebook employee, Sophie Zhang, wrote a memo after getting fired from her job at the company revealing how the company dealt with fake accounts and bots. Among the countries, she has worked on and analyzed was Azerbaijan. “Ms. Zhang discovered that the ruling political party in Azerbaijan was also using false accounts to harass opposition figures. She flagged the activity over a year ago, she said, but Facebook’s investigation remains open and officials have not yet taken action over the accounts.” 

government in Azerbaijan threatens activists with interpol, again [update September 14]

On September 8, seven Azerbaijani dissidents who now live in various cities across Europe were targeted by the government of Azerbaijan. In addition to being formally charged with a crime in their absence and arrest warrants issued, the authorities have vowed to ask Interpol for their extradition.

The story goes back to last year when an Azerbaijani blogger, Elvin Isayev was extradited to Azerbaijan from Ukraine. Isayev lived in Russia since 1998 and was known for his critical views of the government. He acquired Russian citizenship in 2001. 19 years later, a court in St. Petersburg ruled to strip him of Russian citizenship and expel him. The following month Isayev moved to Ukraine, after an interim measure of the European Court of Human Rights called “Rule 39” suspended his deportation. Three months later he went missing only to appear in Azerbaijan where the Azerbaijan State Migration Service claimed Isayev was deported, a statement that was later refuted by Ukraine’s State Migration Service which said it never ordered Isayev’s deportation.

Few days after his “arrival” in Azerbaijan, Isayev was charged with calling for mass riots and public incitement against the ruling government. Now, the Prosecutor General office is seeking the deportation of seven men accusing them of the same crimes.

Ordukhan Babirov, Gurban Mammadov, Orkhan Agayev, Rafel Piriyev, Ali Hasanaliyev, Tural Sadigli, and Suleyman Suleymanli have been now charged in their absence. Many of these men are known for their online media activism, managing popular opposition YouTube channels, and for organizing street protests across European capitals in support of political prisoners in Azerbaijan, highlighting human rights violations and other advocacy engagements. One of the targeted men, popular activist, Ordukhan Babirov (known as Ordukhan Temirkhan Babirov) wrote in a Facebook post “[…] how many more times are they are going to give my name to Interpol”.

In an interview with OC-Media Tural Sadigli, activist and editor of Azad Soz [Free Speech] online news platform, said he faced a criminal case in 2019. “I was slighly surprised. They can’t reach us, they cannot stop our activities, so they use such forms of pressure,” Sadigli told OC Media.  

This is not the first time, the government in Azerbaijan is resorting to Interpol. But according to Interpol, “[it] cannot compel the law enforcement authorities in any country to arrest someone who is the subject of a Red Notice. Each member country decides what legal value it gives to a Red Notice and the authority of their law enforcement officers to make arrests.

The persecution against activists at home and abroad is on-going. For years, the ruling Baku tried silencing dissident voices both inside the country through threats, intimidation, and arrests and abroad through public shaming campaigns, and targeting of remaining family members. 

A week ago, a court in Baku sentenced veteran dissident Tofig Yagublu to four years and three months in jail on bogus charges. A campaign calling for his freedom #FreeTofigYagublu and #TofiqYaqubluyaAzadliq was launched and many of the targeted activists mentioned in this story have been rallying behind the campaign. Similarly, a youth activist who is among the organizers of the September 9 rally in support of Yagublu, was also targeted online and blackmailed. 

police “visits” writer’s home during his live stream

Writer Keramet Boyukchol was briefly taken to the police for questioning after an alleged complaint to the police made by his neighbors. Police claimed neighbors complained he was making too much noise. 

Boyukchol is known for his criticism of the authorities on social media and in the numerous interviews, he has done with the media. 

The day he was taken in for questioning, Boyukchol was live on Facebook, raising yet again, the issue of economic difficulties faced by the general public in the country. He was still streaming live when the doorbell rang and he got up to open the door. Seeing the police the writer asked what was the purpose of their visit, to which one of the officers responded, saying his neighbors complained he was making too much noise. 

At some point, one of the officers entered the flat, without Boyukcol’s permission and in the absence of an arrest warrant and stopped Boyukchol from filming the scene. 

According to Boyukchol’s father, in an interview with Azadliq Radio, his son was taken to the police and released the next day without any charges. 

Boyukchol was also targeted online. In June, his Facebook account was compromised. All of his posts (over the last ten years) were deleted. 

hacking alert: activists and journalists targeted online [ongoing, last update September 10]

Several activists and journalists had their Facebook accounts compromised in recent weeks in Azerbaijan. 

At the end of June, a veteran human rights lawyer, Intigam Aliyev, reported a break-in attempt into his Facebook profile. A few days later, an opposition group D18 reported their Facebook page was compromised. On July 2, journalist Aysel Umudova and activist Rustam Ismayilbeyli received messages from the Facebook platform informing them their passwords were reset. This happened despite the fact, that both users had 2FA enabled on their accounts. On July 6, journalist Fatima Movlamli’s Facebook profile was compromised. Yet again, despite 2FA and secure email service, the account was taken over by unknown users. Finally, on July 14, multiple social media users reported receiving password reset messages even though no such requests were made by the users.  

Targeting social media profiles, and pages, are common in Azerbaijan. In recent years, hacking of prominent accounts has led to mass content removal, loss of followers, and subscribers. On YouTube, account owners of popular channels report their videos are taken down by the platform due to copyright violation reports, have received strikes and in some cases, their accounts were deactivated by the platform. And yet, further investigations, indicate, that these copyright violations are indeed submitted by fake accounts and that the actual cause of the strike is nothing but a fluke.

This type of deliberate targeting limits the work of targeted account owners, whether they are human rights defenders, journalists, media platforms, or political activists. Responding to these digital attacks takes time, it also requires having the right contacts at platforms directly or vis-a-vis third parties. In addition, once the account is compromised the account owner, no longer has access to their platform for outreach, unable to share their work/updates, and face the reality of losing their audience.  

While there is some evidence pointing the attacks originate from the government-affiliated institutions, it’s been virtually impossible to prevent them from happening and keep the online community safe.

On September 10, Nigar Hezi, a political activist, said there was an attempt to compromise her Facebook account.  

member of an opposition party fined over social media post [Last update July 9]

July 6, Gachay Gafarov, member of the opposition party Popular Front, sentenced to 15 days in administrative detention according to Azadliq Radio. Gafarov is accused of disobeying police. According to party headquarters, Gafarov was detained over his social media post critical of the police that Gafarov posted on the day of the police. 

July 5, member of an opposition party Popular Front, Alikhan Rajabli, detained over social media posts say party headquarters. Rajabli was detained on July 4, in Masalli region by the local police. According to family members, Rajabli was taken from his home and taken to the police.

June 29, member of an opposition party Musavat, Jeyhun Mammadli was fined in a total amount of 200AZN. Mammadli was accused of disobeying police. However, party members believe Mammadli was fined over his posts and comments often critical of the authorities on social media. 

Mammadli was taken from his home on June 27  to the Zardab Regional Police department. At the station, police prepared a protocol, where Mammadli was accused of disobeying police according to Article 535.1 of Administrative Offenses. He was let go until the court hearing.

On June 29, Zardab Regional Court found Mammadli guilty and fined him in a total amount of 200AZN [approximately 120USD].

political activist detained over social media post

June 27, member of an opposition party Popular Front, Faig Rashidov was sentenced to ten days in administrative detention on charges of violating the Code of Administrative Offenses Article 388.1 (placing online or on information/communication networks information otherwise banned).  

Rashidov was previously subject to pressure for his activism and political views.

Popular Front members have been regularly persecuted in recent months. Currently, at least 10 party members are behind bars. All are accused of various crimes, none however are legitimate, claim the party headquarters.