Tag: TikTok

Azerbaijan temporarily suspends access to TikTok [updated October 31, 2023]

Posted on by aiw_admin

[Update] Access to TikTok was restored as of October 31, according to reports. The access was restored together with a call from the Cyber Security Service asking users to comply with the requirements of the legislation of the Republic of Azerbaijan and the rules and conditions set by social network administrators when sharing on social networks. 

On September 19, following reports that access to social media platform TikTok was unavailable, the Cyber Security Service under the  Ministry of Transport, Communication and Information Technologies confirmed to BBC Azerbaijan service, that TikTok was suspended as a result of an “anti-terrorist operation” in Karabakh. 

Previously authorities blocked access to the platform in September 2022. Then, the State Security Service said the measure was necessary in order to contain disinformation during the military offensive on the border between Azerbaijan and Armenia on September 14, 2022. 

Access to the Google Play store and Apple Appstore was also reportedly blocked.

Separately, at least two anti-war activists, Amrah Tahmazov and Javid Amhadov were called in for questioning by the State Security Service, over their social media posts reported OC Media.

Meanwhile, the State Agency for Media Development warned journalists and media platforms to refrain from sharing unverified information about the start of what the Azerbaijani Ministry of Defense referred to as “local anti-terrorist measures,” which Azerbaijan launched on September 19.

The measures were taken following a mine explosion that killed 14 Azerbaijani citizens.

The last time the country imposed country-wide internet throttling, was in 2020 during the 44-day war.

In a separate appeal, the General Prosecutor’s Office issued a statement describing the rules of reporting on anti-terrorism operations:

“According to the Law of the Republic of Azerbaijan “On Combating Terrorism”, information about terrorist acts is provided to the public in the form and volume determined by the head of the operational headquarters or the representative responsible for public relations of the operational headquarters.

The following information is prohibited from distribution:

  • the tactics and technical methods of conducting anti-terrorist operations; 
  • the information that endangers the life and health of people in the zone of anti-terrorist operations or outside the limits of this zone and hinders the conduct of anti-terrorist operations;
  • information that justifies terrorism or serves to promote it;
  • information about the persons participating in the anti-terrorist operations, as well as those who help in carrying out these operations.

Placing prohibited information on the Internet is considered an administrative offense (Article 388-1 of the Code of Administrative Offenses) and anyone sharing this information is subject to an administrative fine ranging from 500AZN to 2000AZN as well as an administrative arrest for up to 1 month.”

OONI measurements show ongoing internet censorship in Azerbaijan

Posted on by aiw_admin

Azerbaijan is known to block access to independent news media websites – we previously reported on this in July 2021. At the time, we analyzed OONI measurements collected from Azerbaijan between January 2020 to May 2021 and found that ISPs in Azerbaijan were blocking access to several independent news media and circumvention tool sites. We also found that amid the 2020 Nagorno-Karabakh war, ISPs in Azerbaijan temporarily blocked access to social media services, and attempted to block access to Tor and Psiphon.

But how has Azerbaijan’s internet censorship landscape changed (if at all) over the last year?

We attempt to address this question as part of this report. Specifically, we analyzed OONI data collected from Azerbaijan between January 2022 to February 2023 with the goal of evaluating which tested services presented signs of blocking, and whether new blocks had emerged over the past year (in comparison to our previous report). 

Key Findings

As part of our analysis of OONI measurements collected from Azerbaijan between January 2022 to February 2023, we found:

  • Blocking of news media websites. Azerbaijan continues to block access to several independent news media websites. OONI data also suggests that some ISPs in Azerbaijan may have started blocking access to the Guardian on 25th December 2022.
  • Azerbaijan and Russia block each other’s news media. In early June 2022, Azerbaijan started blocking access to Russia’s state-run RIA Novosti media website. Since (at least) 7th June 2022, Russian ISPs have been blocking access to Azerbaijani news media websites (`haqqin.az`, `minval.az`, `oxu.az`, `ru.oxu.az`, `ru.baku.ws`). These blocks remain ongoing.
  • Temporary blocking of TikTok amid border clashes with Armenia. During the September 2022 border clashes, both Azerbaijan and Armenia blocked access to TikTok. While the TikTok block was lifted in Armenia by 21st September 2022 (only lasting about a week), the TikTok block remained in place in Azerbaijan until November 2022 (lasting about 2 months). 
  • Blocking of circumvention tool sites. Azerbaijan continues to block access to numerous circumvention tool websites, potentially limiting the ability to circumvent internet censorship in Azerbaijan. However, most OONI measurements suggest that tested circumvention tools (Tor and Psiphon) appear to be reachable.
  • Variance of censorship across networks. While most ISPs in Azerbaijan appear to adopt similar censorship techniques (as we continued to observe connection timeouts in most anomalous measurements across ASNs), different ISPs block access to different websites over time.

Methods

Since 2012, OONI has developed free and open source software, called OONI Probe, designed to measure various forms of internet censorship. OONI Probe is run by volunteers in around 160 countries every month, and their test results are automatically published by OONI as open data in real-time. More than a billion network measurements have been collected and published from 25 thousand networks in 241 countries and territories over the last decade.

To examine internet censorship in Azerbaijan, we analyzed OONI measurements collected from Azerbaijan between January 2022 to February 2023. The goal of our analysis was to identify which websites and apps presented signs of blocking (“anomalies”) in Azerbaijan during the analysis period, particularly in comparison to blocks previously identified as part of our past research.   

Specifically, we analyzed measurements collected from OONI’s Web Connectivity test, which is designed to measure the blocking of websites (these websites are publicly hosted on the Citizen Lab test list Github repository). This test measures the accessibility of websites by attempting to perform a DNS lookup, TCP/IP connection, and HTTP GET request from two vantage points: (1) the local vantage point of the user and (2) a control network (non-censored network). The results from both networks are automatically compared and if they match, the tested URL is annotated as “accessible” (if the testing succeeds from the control vantage point). If the results differ, the tested URL is annotated as “anomalous”, which may provide a signal of potential blocking.

Depending on why the anomaly emerges, the anomalous measurement is automatically annotated as a DNS, TCP/IP, HTTP diff, or HTTP failure anomaly. For example, if the DNS lookup resolves to an IP address which differs from that resolved from the control vantage point, the measurement is annotated as a “DNS anomaly”, which may be a sign of DNS tampering.

However, false positives can occur, which is why we look at anomalous measurements in aggregate in order to determine if a tested URL consistently presents a large volume of anomalous measurements (in comparison to successful measurements) on a tested network. If a tested URL presents a large volume of anomalies, it may provide a stronger signal of potential blocking. If the types of anomalies are consistent (for example, always presenting DNS anomalies on a tested network), they offer an even stronger signal of potential censorship (since they suggest the use of a specific censorship technique, such as DNS hijacking). But beyond aggregating anomalous measurements, we also analyze the raw data pertaining to anomalous measurements in order to identify the specific errors that occurred as part of the testing, offering insight into how a tested URL is potentially blocked.

Based on our current heuristics, we automatically confirm the blocking of websites when a block page is served and we have added the fingerprint of that blockpage to our database. We also automatically confirm the blocking of websites based on DNS answers containing IP addresses that are known to be associated with implementing internet censorship. For other forms of censorship, we analyze OONI data in order to aggregate anomalous measurements and identify why and how those anomalies occur, offering insight into additional cases of potential blocking.

Acknowledgement of limitations

The findings of this study present several limitations, including:

  • Date range of analysis. The findings are limited to OONI measurements collected from Azerbaijan between January 2022 to February 2023. As a result, findings from measurements collected in different date ranges are excluded from this study.
  • Type of measurements. As part of this study, we primarily focus on OONI Web Connectivity measurements which pertain to the testing of websites for censorship. This focus was selected due to known website censorship in the country, while aggregate views of OONI measurements from other OONI Probe experiments did not present an important volume of anomalies that would have warranted more dedicated analysis.
  • Tested websites. OONI Probe website testing in Azerbaijan is primarily limited to URLs included in 2 Citizen Lab test lists: the global list (including internationally-relevant URLs) and the Azerbaijan list (only including URLs relevant to Azerbaijan). As these lists are tested by OONI Probe users and there are bandwidth constraints, they are generally limited to around 1,000 URLs. As a result, the lists may exclude other websites which are blocked in Azerbaijan, and the findings are limited to the testing of the URLs included in these lists. Given that the lists are community-curated, we acknowledge the bias in terms of which URLs are added to the lists. 
  • Testing coverage of websites. Not all URLs included in test lists are measured equally across Azerbaijan over time. Whether OONI data is available for a particular website depends on whether, on which networks, and when an OONI Probe user in Azerbaijan tested it. As a result, tested websites received different testing coverage throughout the analysis period, which impacts the findings.  
  • Tested ASNs. The availability of OONI measurements depends on which networks OONI Probe users were connected to when performing tests. As a result, the measurement coverage varies across ASNs throughout the analysis period, impacting the findings. 
  • Measurement volume. OONI measurement coverage from Azerbaijan has been rather limited over the years (in comparison to other countries), limiting our findings and confidence in confirming censorship events. The availability of OONI data depends entirely on volunteers running OONI Probe locally in Azerbaijan, which can be challenging in light of the political environment, potential risks involved with running OONI Probe, and the relatively limited digital rights community engagement opportunities in Azerbaijan. That said, we observe an important spike in the overall measurement volume from 14th September 2022 onwards (which has subsequently remained relatively stable), increasing our ability to detect censorship events thereafter. This is visible through the following chart. 

Chart: OONI Probe Web Connectivity testing in Azerbaijan between 1st January 2022 to 23rd February 2023 (source: OONI data). 

Background

In its latest Freedom on the Net report by Freedom House, Azerbaijan was ranked “not free” among 70 countries assessed for the report. Internet freedoms have been on an overall decline in the country for a number of years, however, the situation escalated during the 2020 war between Armenia and Azerbaijan. Since then, while blocking of social media platforms, and internet throttling have reduced, the state continues to implement various forms of digital surveillance combined with offline measures targeting civil society representatives on a regular basis. 

News websites critical of the authorities remain blocked, while the Law on Media enacted in February 2022 is yet another measure imposed by the state to restrict not only media freedom, and freedom of speech but also access to independent and opposition news. 

Journalists across the country remain concerned about the new law. Most recently they have joined in calls to abolish a new media registry introduced in the Media Law. 

Meanwhile, civic activists continue to face online targeting. Az-Net Watch in its December 2022 report, shared some of the findings of such attacks, identifying persistent trends of phishing attacks, questioning by the law-enforcement bodies over criticism voiced online, interference with personal data and devices, hacking attempts and installed spyware programs.

Findings

As part of our analysis of OONI measurements collected from Azerbaijan (between January 2022 to February 2023), we found a number of independent news media websites and circumvention tool websites blocked throughout the analysis period. Many of these blocks have been in place since at least 2020. Amid border clashes in September 2022, access to TikTok was blocked in both Azerbaijan and Armenia. We share further details in the sections below.

Blocking of news media websites

Several news media websites (which have been blocked over the last few years) continue to be blocked in Azerbaijan, according to recent OONI data analysis. 

The domains that presented the largest volume of anomalies (and overall testing coverage), thereby presenting the strongest signals of blocking in our analysis period, include:

  1. `azerbaycansaati.tv`
  2. `www.24saat.org`
  3. `www.abzas.net` 
  4. `www.azadliq.info` 
  5. `www.azadliq.org`
  6. `www.meydan.tv`
  7. `www.rferl.org`
  8. `www.gununsesi.org`
  9. `ria.ru`
  10. `www.theguardian.com`

While most of the above domains have been blocked in Azerbaijan over the last few years, the testing of `www.theguardian.com` only started to present anomalies (on several networks) in late December 2022 onwards (we discuss this case in more detail in the next section of this report). Meanwhile, Azerbaijan reportedly started blocking access to RIA Novosti (Russian state-owned news media) in early June 2022 over the publication of slanderous materials against Azerbaijan. At the time, RIA Novosti’s website (`ria.ru`) was only included in other countries’ test lists; we therefore added it to the Global test list to ensure that it gets tested by OONI Probe users in Azerbaijan and around the world. This is why OONI measurement coverage of `ria.ru` in Azerbaijan only begins in June 2022.  

Independent Azerbaijani media websites (such as `azadliq.info` and `meydan.tv`) have reportedly been blocked since early 2017 for “posing a threat” to Azerbaijan’s national security. The state prosecutor reportedly accused these websites of sharing content that promotes violence, hatred, extremism, violates privacy and constitutes slander. However, the blocking of these media outlets may have been politically motivated. Azadliq, for example, reported on the business dealings of Vice President Mehriban Aliyeva’s private foundation, while the website of Gunun Sesi (which has reportedly been blocked since August 2018) is operated by Parviz Hashimli, a former political prisoner. The blocking of the RFE/RFL website (`www.rferl.org`) also reportedly began in 2017 following an Azerbaijani court order.

The following chart aggregates OONI measurement coverage (from 26 ASNs) for the news media domains that presented the strongest signals of blocking in Azerbaijan between January 2022 to February 2023.

Chart: Blocked news media websites in Azerbaijan between January 2022 to February 2023 (source: OONI data).

Most OONI measurements from the testing of these media websites (excluding `www.theguardian.com`, which is discussed in the next section) presented anomalies throughout the testing period, providing a signal of blocking. In contrast, most of the other URLs tested from the Citizen Lab test lists during this period were found accessible (on the same networks in Azerbaijan).

What is evident from the above chart is that the vast majority of anomalous measurements presented connection timeouts (for sites hosted on both HTTP and HTTPS). A consistent failure type can offer a strong signal of blocking, since it suggests the use of specific censorship techniques. In this case, the connection timeouts may indicate the use of Deep Packet Inspection (DPI) technology for the implementation of blocks, given that the timeout only happens after the TLS ClientHello message. The fact that we observe the prevalence of connection timeouts across anomalous measurements aggregated across tested ASNs further suggests that most ISPs in Azerbaijan adopt similar censorship techniques.

This is further evident when viewing a per-ASN breakdown of the specific failures in the measurement of each of the blocked news media sites. The following chart, for example, presents the specific failures that occurred when `www.24saat.org` was tested on multiple ASNs in Azerbaijan during our analysis period. 

Chart: Measurement results (`OK` and specific failures) from the testing of `www.24saat.org` on multiple ASNs in Azerbaijan (source: OONI data). 

From the above chart we can see that most failures (across most tested ASNs) involve timeout errors (annotated in red). But we also observe some successful measurements (annotated as `OK` in green) on some of those networks too. To understand why those measurements were successful, we provide a further breakdown by testing targets. The following chart only presents measurement results (including specific failures observed in anomalous measurements) for the testing of the HTTPS version of the site (`https://www.24saat.org/`) across networks.  

Chart: Measurement results (`OK` and specific failures) from the testing of `https://www.24saat.org/` on multiple ASNs in Azerbaijan (source: OONI data). 

As we can see, the testing of the HTTPS version of the site was entirely successful on some networks, and presented consistent signs of blocking (consistently presenting connection timeouts) on others. In contrast, the testing of the HTTP version of the site (shared in the next chart below) shows that it presented signs of blocking on all of these tested networks.

Chart: Measurement results (`OK` and specific failures) from the testing of `http://www.24saat.org/` on multiple ASNs in Azerbaijan (source: OONI data). 

The fact that we observe more prevalent blocking of the HTTP version of the site (even though it supports HTTPS) suggests that the block is not implemented properly on certain networks.

Similarly, we observe the prevalence of connection timeouts in the testing of many other news media websites across ASNs. The following chart provides a per-ASN breakdown of the measurement results from the testing of `azerbaycansaati.tv`, showing that none of the measurements were successful, and that most presented connection timeouts.

Chart: Measurement results (including specific failures for anomalous measurements) from the testing of `azerbaycansaati.tv` on multiple ASNs in Azerbaijan (source: OONI data). 

The fact that the testing of `azerbaycansaati.tv` was not successful on any of the networks which received the largest volume of testing coverage, and that it consistently presented connection timeouts on most networks, provides a strong signal of blocking. 

Similarly, we observe that the testing of `www.azadliq.org`, `www.meydan.tv`, and `www.rferl.org` mostly presented connection timeouts on tested networks, as illustrated through the following charts.   


Chart: Measurement results (including specific failures for anomalous measurements) from the testing of `www.azadliq.org` on multiple ASNs in Azerbaijan (source: OONI data). 

Chart: Measurement results (including specific failures for anomalous measurements) from the testing of `www.meydan.tv` on multiple ASNs in Azerbaijan (source: OONI data). 


Chart: Measurement results (including specific failures for anomalous measurements) from the testing of `www.rferl.org` on multiple ASNs in Azerbaijan (source: OONI data).

OONI data also suggests that the site (www.occrp.org) of the Organized Crime and Corruption Reporting Project (OCCRP) is blocked in Azerbaijan as well. The blocking of the OCCRP site reportedly began in September 2017, following the publication of a major investigation (“Azerbaijani Laundromat”) into corruption, bribery, and money laundering in which powerful figures were allegedly involved. The following chart provides a per-ASN breakdown of the measurement results from the testing of `www.occrp.org`, showing that (similarly to the aforementioned blocked media sites) it presented connection timeouts on most networks.

Chart: Measurement results (including specific failures for anomalous measurements) from the testing of `www.occrp.org` on multiple ASNs in Azerbaijan (source: OONI data).

Overall, the prevalence of connection timeouts (observed for different websites measured on many different networks in Azerbaijan) provides a strong signal of blocking. These blocks appear to have been implemented several years ago, and remain ongoing. 

Blocking of the Guardian?

On 25th December 2022, the testing of `www.theguardian.com` started to present anomalies in Azerbaijan. The following chart aggregates OONI measurement coverage from the testing of `www.theguardian.com` on 10 ASNs in Azerbaijan between 1st October 2022 to 24th February 2023.

Chart: OONI Probe testing of the Guardian (`www.theguardian.com`) on 10 ASNs in Azerbaijan between 1st October 2022 to 24th February 2023 (source: OONI data). 

However, these anomalies were not observed on all tested networks in Azerbaijan. To better understand the anomalies, we provide a breakdown of the specific failures observed in anomalous measurements on networks that received the largest testing coverage (through the following chart).

Chart: Measurement results (including specific failures for anomalous measurements) from ASNs in Azerbaijan where the testing of `www.theguardian.com` presented anomalies between November 2022 to February 2023 (source: OONI data).

As is evident from the above chart, all anomalous measurements presented connection timeout errors (for both the HTTP and HTTPS versions of the site). The prevalence of connection timeouts, coupled with the fact that it is the same failure that we also observe in the blocking of other news media websites (discussed previously), provides a signal of blocking. 

While the data suggests that access to `www.theguardian.com` may be blocked on a few networks in Azerbaijan (particularly on AS29049 where we observe the largest volume of anomalies, which is consistent from 25th December 2022 onwards), it’s worth noting that it’s accessible on other networks (such as AS28787, where almost all measurements are successful). As we didn’t come across any news articles reporting the recent blocking of the Guardian in Azerbaijan (which could have helped corroborate the anomalous data), and the overall measurement volume is quite low, our confidence in confirming this potential block is rather limited.  

Azerbaijani news media websites blocked in Russia

Following the blocking of Russia’s state-run RIA Novosti media website in Azerbaijan in early June 2022, we were informed that certain Azerbaijani news media websites (`haqqin.az`, `minval.az`, `oxu.az`, `ru.oxu.az`, `ru.baku.ws`) were reportedly blocked in Russia. On 7th June 2022, we added these URLs to the Russian test list so that these websites could get tested by OONI Probe users in Russia. 

OONI data confirms that these Azerbaijani websites have been blocked in Russia since at least 7th June 2022, and that these blocks remain ongoing (as illustrated below).

Chart: OONI data on the blocking of Azerbaijani news media websites in Russia between 7th June 2022 to 24th February 2023 (source: OONI data).

The above chart aggregates OONI measurement coverage from numerous networks in Russia, showing that at least 5 Azerbaijani news media domains were blocked in Russia between June 2022 to February 2023. Throughout this period, we observe that almost all measurements are anomalous, suggesting that access to these Azerbaijani media sites is blocked on most tested networks in Russia. Russian ISPs adopt a variety of censorship techniques and, on some networks, we are able to automatically confirm the blocking of these Azerbaijani news websites based on fingerprints (as IPs known to be associated with censorship are returned as part of DNS resolution).

Temporary blocking of TikTok in Azerbaijan and Armenia amid border clashes

On 12th September 2022, fighting erupted between Azerbaijani and Armenian troops along their border. The next day (13th September 2022), both Azerbaijan and Armenia started blocking access to TikTok amid the border clashes. 

On 14th September 2022, Azerbaijan’s state security services announced the temporary suspension of TikTok. According to the statement, the content circulating on the social media platform was revealing military secrets and forming wrong opinions in society. As a result, the State Security Service decided to temporarily block access to the platform. Similarly, OONI data shows that the testing of TikTok also started to present signs of blocking in Armenia from 13th September 2022 onwards.

At the time, we published a report documenting the block in both countries based on OONI data. Specifically, we found that Azerbaijan blocked access to the main TikTok website (`www.tiktok.com`) and several endpoints essential to its functionality on at least 3 networks (AS29049, AS41997, AS31721). On all networks where we identified blocking, it seemed to be implemented by means of TLS level interference by dropping packets after noticing a disallowed server_name. We also observed some level of inconsistency, as ISPs in Azerbaijan blocked TikTok based on different lists of TikTok endpoint domains.

In Armenia, TikTok was blocked on at least two networks (AS44395, AS43733). Not all tested networks in Armenia implemented the TikTok block and censorship techniques varied from network to network. TikTok interference was observed at the DNS level by returning an NXDOMAIN error, an IP address associated with www.google.com, or a set of unrelated IP addresses which offer an invalid TLS certificate (it’s an expired certificate for `it.domain.name`). Several endpoints used by the TikTok app and website were also blocked on at least one network in Armenia.

By comparing aggregate OONI measurements from the testing of TikTok’s website (`www.tiktok.com`) in Azerbaijan and Armenia between 1st September 2022 to 24th February 2023, we can see that both countries started blocking access to TikTok amid the September 2022 border clashes, but that the block remained in place in Azerbaijan for much longer than in Armenia. 

Chart: OONI Probe testing of TikTok (`www.tiktok.com`) in Armenia and Azerbaijan between 1st September 2022 to 24th February 2023 (source: OONI data).

Specifically, we observe (through the above chart) that the TikTok block was lifted in Armenia by 21st September 2022 (only lasting about a week), while the TikTok block remained in place in Azerbaijan until November 2022 (lasting about 2 months).

Similarly to the testing of `www.tiktok.com`, OONI data suggests that Azerbaijan blocked numerous TikTok endpoints as well during the same period (between mid-September 2022 to mid-November 2022), as illustrated through the following two charts.  

Chart: OONI Probe testing of TikTok endpoints in Azerbaijan between 1st September 2022 to 30th November 2022 (source: OONI data).Chart: OONI Probe testing of TikTok endpoints in Azerbaijan between 1st September 2022 to 30th November 2022 (source: OONI data).

The fact that TikTok’s website (`www.tiktok.com`) and numerous TikTok endpoints presented anomalies on multiple tested networks in Azerbaijan during the same period provides a strong signal of blocking. 

Between September to November 2022, the anomalous measurements from the testing of TikTok in Azerbaijan show that many of them time out when attempting to establish a TLS handshake to the target endpoint. While many such measurements are annotated (on OONI Explorer) as presenting DNS inconsistency, we were able to exclude that by validating that the returned IPs are able to complete a TLS handshake with a valid certificate for the target domain name. Moreover, when issuing an HTTP request with the appropriate headers, the response payload is consistent with the response from an endpoint served to a user in Europe. By inspecting the response header and server certificate, it seems to be an Akamai cache.  

Blocking of circumvention tool websites

Circumventing internet censorship in Azerbaijan can potentially be challenging, as numerous circumvention tool websites have been blocked in Azerbaijan over the past years. Our latest analysis shows that these blocks remain ongoing.

The following chart aggregates OONI measurement coverage for popular circumvention tool websites that presented a large volume of anomalies throughout the testing period in Azerbaijan.

Chart: Blocked circumvention tool websites in Azerbaijan between January 2022 to February 2023 (source: OONI data). 

Multiple circumvention tool websites (including `www.torproject.org`, `psiphon.ca`, and `www.tunnelbear.com`) continue to show signs of blocking on some networks in Azerbaijan, as illustrated through the above chart. Specifically, OONI data shows that when these sites were tested, we frequently observed the timing out of the session after the ClientHello during the TLS handshake. It’s worth noting though that these sites are not blocked on all networks in Azerbaijan, as some measurements were successful. 

While many popular circumvention tool sites appear to be blocked in Azerbaijan, it’s worth highlighting that certain circumvention tools may work in the country. OONI Probe also includes tests designed to measure the reachability of the Psiphon, Tor, and Tor Snowflake circumvention tools. 

Between January 2022 to February 2023, OONI Probe testing of Psiphon shows that it was reachable on tested networks in Azerbaijan, as illustrated below.

Chart: OONI Probe testing of Psiphon on 29 ASNs in Azerbaijan between 1st January 2022 to 25th February 2023 (source: OONI data).

Most measurements (collected from 29 ASNs during the testing period) show that it was possible to bootstrap Psiphon and use it to fetch a webpage, suggesting that the circumvention tool worked on tested networks in Azerbaijan.

While the testing of Tor presented anomalies throughout the testing period, most measurements from September 2022 onwards (when we also observe a spike in the overall measurement volume) suggest that Tor was reachable on most tested networks in Azerbaijan. 

Chart: OONI Probe testing of Tor on 28 ASNs in Azerbaijan between 1st January 2022 to 25th February 2023 (source: OONI data).

In Tor anomalous measurements, we see that attempted connections to Tor directory authorities failed on some networks. However, we also see that most connections to both Tor directory authorities and Tor bridges were successful (on many networks), indicating that it may have been possible to use Tor in Azerbaijan. 

Quite similarly, OONI data shows that it was possible to bootstrap Tor Snowflake on most networks in Azerbaijan throughout the testing period.

Chart: OONI Probe testing of Tor Snowflake on 20 ASNs in Azerbaijan between 1st January 2022 to 25th February 2023 (source: OONI data).

This suggests that while the Psiphon and Tor Project websites appear to be blocked on some networks in Azerbaijan (as discussed previously), their tools appear to work in the country (at least on tested networks). 

Conclusion

Azerbaijan continues to limit press freedom by blocking access to several independent news media websites – the blocking of which appears to be politically motivated. OONI data also suggests that some ISPs in Azerbaijan may have started blocking access to the Guardian on 25th December 2022, but the relatively limited measurement coverage and the seeming absence of news articles reporting the block limit our confidence in confirming this. 

In early June 2022, both Azerbaijan and Russia started blocking access to each other’s news media websites. In early June 2022, Azerbaijan started blocking access to Russia’s state-run RIA Novosti media website over the publication of slanderous materials against Azerbaijan. Since (at least) 7th June 2022, Russian ISPs have been blocking access to Azerbaijani news media websites (`haqqin.az`, `minval.az`, `oxu.az`, `ru.oxu.az`, `ru.baku.ws`). 

Amid the September 2022 border clashes, both Azerbaijan and Armenia started blocking access to TikTok. However, while the TikTok block was lifted in Armenia by 21st September 2022 (only lasting about a week), the TikTok block remained in place in Azerbaijan until November 2022 (lasting about 2 months). But this was not the first time that Azerbaijan blocked access to a social media platform during the conflict. Azerbaijan previously blocked access to social media platforms during the 2020 Nagorno-Karabakh war.

Both social media blocks during times of conflict and long-term news media blocks (as those seen in Azerbaijan) generally indicate government attempts to control political narratives. While numerous circumvention tool websites appear to be blocked in Azerbaijan (potentially limiting the ability to circumvent blocks), it’s worth noting that several circumvention tools (such as Tor and Psiphon) may work in the country. 

This study was carried out through the use of open methodologies, free and open source software, and open data, enabling independent third-party verification of our research findings. We encourage researchers to expand upon this study by running OONI Probe and analyzing OONI measurements from Azerbaijan.   

Acknowledgments

We thank OONI Probe users in Azerbaijan for contributing measurements, and supporting this study.

in Azerbaijan State Security Service blocks TikTok during the most recent clashes [Updated November 7]

Posted on by aiw_admin

[Update] According to Turan News Agency reporting, the temporary ban on TikTok placed in September was removed. The decision was announced by the service for electronic safety at the Ministry of Digitial Development and Transport. 

Users of the social media platform TikTok in Azerbaijan started reporting difficulties accessing the application as early as September 13. On September 14, the State Security Service announced its decision to block access to the platform entirely on the grounds the platform was casting a shadow over the military activities, revealing military secrets, and forming wrong public opinion. 

According to testimonies of users in Azerbaijan, soldiers were sharing videos from the line of contact along the Azerbaijan-Armenia border. Some of these videos were graphic. Graphic videos also circulated on the Telegram app. OC Media reported about the first video while users said there was a second video resurfacing online.  

Other users said they experienced issues accessing WhatsApp, Telegram, and slow internet connectivity speeds. 

Azerbaijan Internet Watch together with partner organization OONI analyzed data provided by local testers on the ground and confirmed the blocking on the platform in Azerbaijan. The analysis revealed that TikTok was also blocked in Armenia. 

The blocking came at a time of renewed clashes between Armenia and Azerbaijan.

According to the collected and analyzed OONI data,

the testing of www.tiktok.com and Tiktok endpoints presented a relatively large volume of anomalies between the 13th to 15th of September 2022, following the eruption of border clashes on the 12th of September 2022. It’s worth noting though that while www.tiktok.com measurements (showing signs of blocking) were collected from Azerbaijan from 13th September onwards, TikTok endpoint measurements are only available from 14th September 2022 onwards (when they were added to the test list for Azerbaijan). 

In summary, based on the analysis of 681 OONI metrics collected from 5 different networks in Azerbaijan, we conclude that:

  • The main TikTok website (www.tiktok.com) and several endpoints essential to its functionality were blocked on at least 3 different networks (AS29049, AS41997, AS31721);

  • On all networks where we identified blocking, it seems to be implemented by means of TLS level interference by dropping packets after noticing a disallowed server_name;

  • ISPs in Azerbaijan block TikTok based on different lists of TikTok endpoint domains, and there is some level of inconsistency.

Separately journalists from independent news platforms reported attempts to hack into their social media accounts during the most recent clashes due to their critical coverage. Verbal attacks were also documented as was the case two years ago. Both journalists and activists said their social media accounts were getting temporarily blocked by the platforms as a result of mass (fake) reporting. 

During the second Karabakh war, users in Azerbaijan faced internet restrictions as well. As a result, VPN usage soared during that period. In a statement issued by Access Now platform, Natalia Krapiva, Tech Legal Counsel at Access Now said, “Governments’ deep-seated drive to control the narrative — including in Central Asia and Eastern Europe — must stop.” “Whether authorities like it or not, people have the right to access the internet and to use social media, so focus on facilitating, not blocking.”

OONI measurement data confirms Azerbaijan blocked access to TikTok during September border clashes

Posted on by aiw_admin

Earlier this week, on 12th September 2022, fighting erupted between Azerbaijani and Armenian troops along their border. Over the next few days, community members in Azerbaijan reported that the TikTok app was blocked locally.

We analyzed OONI network measurement data to investigate the block. We found that TikTok has been blocked in both Azerbaijan and Armenia over the last few days.

In this report, we share our technical findings. In both Armenia and Azerbaijan, we found TLS and DNS level interference of TikTok domains and endpoints during the border clashes.

Background

On 12th September 2022, fighting erupted along the Azerbaijan-Armenia border between Azerbaijani and Armenian troops. The next day, Russia brokered a ceasefire, but it was immediately breached. Another ceasefire was announced in the evening of 14th September 2022 by the secretary of Armenia’s Security Council. Within 2 days of clashes, more than 100 Armenian and Azerbaijani soldiers were killed.

This is the latest fighting amid on-going clashes since the 44-day war Armenia and Azerbaijan fought in 2020.

In 1994, the Armenian military secured victory over Nagorno-Karabakh and the seven adjacent regions in the aftermath of the first Karabakh war. Since then, Nagorno-Karabakh has been under the control of its ethnic Armenian population as a self-declared state. The two sides often blamed each other for violating the 1994 ceasefire agreement over the years with continued fighting. These clashes culminated in September 2020 during the second Karabakh war, with Azerbaijan regaining control over the previously occupied seven regions, as well as one-third of Karabakh itself. A ceasefire agreement signed on 10th November 2020 ended the hostilities temporarily. Despite both sides pledging to make progress towards a final peace deal and a series of high level meetings taking place since the second war, no significant progress on achieving a final peace treaty has been made.  

During the 2020 Nagorno-Karabakh war, access to several social media platforms was blocked in Azerbaijan. At the time (between September 2020 to November 2020), OONI data collected from Azerbaijan showed that several social media websites (such as facebook.com and twitter.com) presented signs of blocking, while the testing of WhatsApp and Telegram presented signs of TLS level interference.

During the latest clashes over the last days, OONI data shows that these social media platforms appear to be accessible in Azerbaijan, but TikTok started to present signs of blocking. On 14th September 2022, Azerbaijan’s state security services announced the temporary suspension of social media platform TikTok. According to the statement, the content circulating on the social media platform was revealing military secrets and forming wrong opinions in society. As a result, the State Security Service decided to temporarily block access to the platform. Similarly, OONI data shows that the testing of TikTok also started to present signs of blocking in Armenia from 13th September 2022 onwards.

Methods

Since 2012, OONI has developed free and open source software (called OONI Probe) which is designed to measure various forms of internet censorship, including the blocking of websites and apps. Every month, OONI Probe is regularly run by volunteers in around 170 countries, and network measurements collected by OONI Probe users are automatically published as open data in real-time.

This study involves the analysis of OONI measurements pertaining to the testing of TikTok, collected from local networks in Azerbaijan and Armenia over the last days. In particular, we analyzed OONI Web Connectivity measurements pertaining to the testing of the TikTok homepage (https://www.tiktok.com), as well as several other web resources that are needed for the TikTok web app and mobile app to function (hereafter referred to as “TikTok endpoints”). We thank a community member who kindly shared with us a list of TikTok endpoints, which were subsequently added (to the lists of URLs measured by OONI Probe users in Azerbaijan and Armenia) for testing. OONI’s URL prioritization system ensures that once URLs are merged into the Citizen Lab test lists, they are immediately prioritized for OONI Probe testing. As a result, measurements from the testing of TikTok endpoints were collected almost immediately from both Armenia and Azerbaijan (supporting this study).

OONI’s Web Connectivity experiment is designed to measure the accessibility of URLs by performing the following steps:

  • Resolver identification
  • DNS lookup
  • TCP connect to the resolved IP address
  • TLS handshake to the resolved IP addresses
  • HTTP(s) GET request

The above steps are automatically performed from both the local network of the user, and from a control vantage point. If the results from both networks are the same, the tested URL is annotated as accessible. If the results differ, the tested URL is annotated as anomalous, and the type of anomaly is further characterized depending on the reason that caused the failure (for example, if the TCP connection fails, the measurement is annotated as a TCP/IP anomaly).

Each Web Connectivity measurement provides further network information (such as information pertaining to TLS handshakes) that helps with evaluating whether an anomalous measurement presents signs of blocking (or is a false positive). Based on our heuristics, we are able to automatically confirm the blocking of websites if a block page is served, or if DNS resolution returns an IP known to be associated with censorship (and such fingerprints have been added to our database).

In the cases of Azerbaijan and Armenia, we have never come across block pages, limiting our ability to automatically confirm cases of blocking with confidence. Instead, ISPs in both Azerbaijan and Armenia appear to adopt different censorship techniques (as discussed, for example, in our previous research examining blocks in Azerbaijan), requiring more manual analysis of measurements for the confirmation of blocks. This study focused in the case of Azerbaijan, we analyzed network measurement data provided under the network_events keys of Web Connectivity measurements, which provided insight on TLS level interference of TikTok endpoints. In the case of Armenia, we analyzed both TLS handshakes and DNS query results. Another limitation to our study is the limited OONI measurement coverage from Azerbaijan (in comparison to Armenia and other countries). Generally, the larger the relevant measurement volume, the greater our ability in identifying and confirming blocks.

Findings

OONI data shows that both Azerbaijan and Armenia started blocking access to TikTok right after clashes erupted along their border.

Blocking of TikTok in Azerbaijan

We analyzed OONI measurements collected from Azerbaijan from 13th-15th September 2022 and noticed that many of them appear to time out when attempting to establish a TLS handshake to the target endpoint.

While many such measurements are annotated (on OONI Explorer) as presenting DNS inconsistency, we were able to exclude that by validating that the returned IPs are able to complete a TLS handshake with a valid certificate for the target domain name. Moreover, when issuing an HTTP request with the appropriate headers, the response payload is consistent with the response from an endpoint served to a user in Europe. By inspecting the response header  and server certificate, it seems to be an Akamai cache.

To evaluate the extent to which the blocking is happening and establish if it’s in fact caused by an intentional block, we analyzed the values of the network_events keys of Web Connectivity measurements. These keys contain very rich information on every read and write operation performed during a TLS handshake.

In the following charts, we consider a single “datapoint” as a single network event transcript (i.e. a TLS handshake operation towards a certain IP, port, server_name tuple). When grouping the measurements by server_name, we can see that most domains fail quite consistently, yet some of them don’t fail as often as others.

Chart: OONI data on the testing of tiktok.com and TikTok endpoints in Azerbaijan between 13th-15th September 2022.

As is evident from the above chart, the testing of www.tiktok.com and Tiktok endpoints presented a relatively large volume of anomalies between 13th to 15th September 2022, following the eruption of border clashes on 12th September 2022. It’s worth noting though that while www.tiktok.com measurements (showing signs of blocking) were collected from Azerbaijan from 13th September onwards, TikTok endpoint measurements are only available from 14th September 2022 onwards (when they were added to the test list for Azerbaijan).

As a result, based on available OONI data, we can only confirm that the blocking of TikTok in Azerbaijan started the latest at the following times, on the following networks:

The OONI Probe testing of www.tiktok.com on 5 networks in Azerbaijan between 13th to 15th September 2022 can be further examined through the following chart, which shows that its testing consistently presented generic_timeout_errors on at least 3 networks by 15th September 2022.

Chart: OONI Probe testing of www.tiktok.com on 5 networks in Azerbaijan between 13th-15th September 2022.

In the above cases, we can see that attempts to connect to www.tiktok.com failed due to a connection timeout. Upon inspecting relevant network measurement data, we see that this always happened after the first write operation (the one responsible for writing the ClientHello which contains the server_name field (SNI)), which is consistent with the hypothesis that the block is some form of TLS based interference, possibly by looking at the SNI field of the ClientHello message.

The blocking looks quite consistent on a per domain basis, which is compatible with the hypothesis that it’s some sort of SNI-based TLS level block.

To additionally support this claim, we notice that several different domain names resolve to the same IP address. When looking at the TLS reachability of the same IPs on a particular network, but with a different server_name value, we can see (by reading the chart horizontally) that they are consistently reachable when a specific server_name is provided, as illustrated below.

Chart: OONI data on TLS handshake results by target IP on network AS531712 in Azerbaijan on 15th September 2022.

On the other hand, if you read the chart vertically you can see that the same IP is both reachable and unreachable depending on the domain_name value.

This strongly suggests that the block is intentional and a consequence of filtering of those particular domain names.

When looking at the subset of domain names that are not consistently blocked, we can see that they are consistently blocked within the same network, which leads us to believe that there are different filtering policies deployed across networks.

Chart: OONI data providing a per-ASN comparison on the testing of www.tiktok.com and TikTok endpoint domains in Azerbaijan between 13th-15th September 2022.

In summary, based on the analysis of 681 OONI metrics collected from 5 different networks in Azerbaijan, we conclude that:

  • The main TikTok website (www.tiktok.com) and several endpoints essential to its functionality were blocked on at least 3 different networks (AS29049, AS41997, AS31721);
  • On all networks where we identified blocking, it seems to be implemented by means of TLS level interference by dropping packets after noticing a disallowed server_name;
  • ISPs in Azerbaijan block TikTok based on different lists of TikTok endpoint domains, and there is some level of inconsistency.

Blocking of TikTok in Armenia

OONI data shows the blocking of TikTok in Armenia on 13th September 2022. Out of the 5 networks from which TikTok measurements were collected, we are able to establish that the blocking began on 2 of them on 13th September 2022. Specifically:

The following chart shares OONI data on the testing of www.tiktok.com and tiktok.com from 5 networks in Armenia between 13th-15th September 2022.

Chart: OONI data on the testing of tiktok.com and www.tiktok.com on 5 networks in Armenia between 13th-15th September 2022.

As is evident from the above charts, these ISPs in Armenia seem to employ a mix of different techniques to implement the blocking of TikTok. In the case of Ucom (AS44395), they appear to mostly return an NXDOMAIN error when the TikTok domain is queried.

In the case of MTS Armenia (AS43733), it’s interesting to note that upon querying the tiktok.com domain, the IP address 172.217.17.228 is returned, which is associated with www.google.com. It’s also worth noting that the TLS handshake timed out, which is not consistent with the behavior of the real server, which may indicate that they implement an additional TLS layer block on top of the DNS level interference.

It’s also interesting to note that the nameserver for MTS Armenia allows us to do a zone transfer for tiktok.com and through that we are able to see the tainted google IP A record:

$ dig @ns.mts.am tiktok.com axfr
; <<>> DiG 9.16.22-Debian <<>> @ns.mts.am tiktok.com axfr
; (1 server found)
;; global options: +cmd
tiktok.com.                1800        IN        SOA        ns2.mts.am. ns.mts.am. 2020101600 3600 600 1296000 3600
tiktok.com.                1800        IN        NS        ns2.mts.am.
tiktok.com.                1800        IN        NS        ns.mts.am.
tiktok.com.                1800        IN        A        172.217.17.228
tiktok.com.                1800        IN        SOA        ns2.mts.am. ns.mts.am. 2020101600 3600 600 1296000 3600
;; Query time: 95 msec
;; SERVER: 217.76.1.85#53(217.76.1.85)
;; WHEN: Thu Sep 15 23:54:58 CEST 2022
;; XFR size: 5 records (messages 1, bytes 196)

No other tested TikTok endpoints allow zone transfers from the MTS nameserver, nor any other domain which we tested. This might be due to the fact that to implement the block the zone for tiktok.com was set up quickly and they forgot to disable zone transfers on it.

By focusing our attention on the Ucom network (AS44395), we can see that not all TikTok endpoints appear to be blocked.

Chart: OONI data on the testing of TikTok endpoints on Ucom (AS44395) in Azerbaijan between 13th-16th September 2022.

Interestingly, starting from today (16th September 2022), the DNS response appears to be inconsistent and returns an IP address that has an expired letsencrypt certificate. When accessed, it will direct to:

http://it-nxd-domain.com/?terms=Google%20Server%20Cloud,Free%20Host%20Server,%20Create%20an%20Ecommerce%20Website%20for%20Free,Email%20Server%20Hosting%20Services&subid1=parrz.com.

$ openssl s_client -connect 95.216.36.80:443
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 C = US, O = Let's Encrypt, CN = R3
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = it.domain.name
verify error:num=10:certificate has expired
notAfter=Jun 12 15:18:58 2021 GMT
verify return:1
depth=0 CN = it.domain.name
notAfter=Jun 12 15:18:58 2021 GMT
verify return:1
---
Certificate chain
 0 s:CN = it.domain.name
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 14 15:18:58 2021 GMT; NotAfter: Jun 12 15:18:58 2021 GMT
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Oct  7 19:21:40 2020 GMT; NotAfter: Sep 29 19:21:40 2021 GMT
---

In all other cases of blocking, we notice that the HTTPS request times out, which leads us to believe that they might be using some form of TLS level interference.

To summarize:

  • Armenia has been blocking TikTok since at least 13th September 2022 on at least two networks (AS44395, AS43733);
  • On most networks, TikTok interference was observed at the DNS level by returning an NXDOMAIN error, an IP address associated with www.google.com, or a set of unrelated IP addresses which contain an expired certificate for the server_name it.domain.name;
  • Not all tested networks in Armenia implemented the TikTok block and censorship techniques varied from network to network;
  • Several endpoints used by the TikTok app and website are also blocked on at least one network in Armenia.

Conclusion

Social media censorship often appears to be weaponized during conflicts and other moments of political turmoil around the world. By controlling the flow of information on social media platforms, governments may attempt to control the narrative surrounding political events. Over the last 6 years, OONI data has shown that access to major social media platforms is commonly blocked during elections and protests around the world. Earlier this year, Russia ramped up its censorship following the war in Ukraine.

Azerbaijan previously blocked access to social media platforms during the 2020 Nagorno-Karabakh war. In similar vein, both Azerbaijan and Armenia blocked access to TikTok during the border clashes over the last days. OONI data shows that Azerbaijan blocked TikTok by means of TLS level interference, while Armenia implemented both DNS level blocks and TLS level interference.

You can continue to monitor the reachability of TikTok (and other platforms) in Armenia and Azerbaijan through OONI data.

one man threatens to behead LGBTQI+ community members in a TikTok video

Posted on by aiw_admin

A man named Roman Mammadov, 39, in a video he shared on TikTok, threatened to behead men who behaved like women. The video that was circulated on social media, alarmed LGBTQ+ activists in Azerbaijan who demanded the Ministry of Interior take action. Eventually, Mammadov was detained. According to the officials, the investigation is ongoing.

According to reporting by Azerbaijan service for Voice of America, the video was filmed at one of the Baku subway stations. In the video, the man appeared to be holding a tool, resembling an ax wrapped in a bag.

Such threats are not surprising in a country where there is no legislation protecting the rights of the LGBTQ+ community and an environment of impunity said activists in interviews with Voice of America. The most recent example is that of Avaz Hafizli, journalist and LGBTQ+ rights activist who was personally targeted by Azerbaijani blogger Sevinj Huseynova. Huseynova openly made homophobic incitements targeting other members of LGBTQ+ community in the past but no measures were taken against the blogger despite criticism by local activists. Hafizli, was brutally murdered as a result of this targeting by a family member in February 2022.

In a Facebook comment, feminist activist Gulnara Mehdiyeva wrote she was personally told by the State Security Services that they don’t take interest in threats leveled against LGBTQ+ because there is nothing in the national legislation about them. “Maybe, the Ministry of the Interior is also going to say, that the man with an ax did not threaten anyone, because LGBTQ+ people are not considered humans.”

Speaking to Voice of America, lawyer Samad Rahimli said, “the criminal legislation of the Republic of Azerbaijan does not contain references to hatred as a separate provision in an aggravating circumstance of murder or an aggravating circumstance of harming health. Therefore, committing a crime motivated by hatred cannot be described as an aggravating circumstance in Azerbaijan.”

Javid Nabiyev, an LGBTQ+ activist from Azerbaijan, shared the video of the man making the threat on Facebook and demanded authorities take action tagging both the Ministry of the Interior and the Ombudsman office. “I came across this video on Instagram. Although it was shared today, it is unclear when it was taken. But it is certain that right now, a man with an ax in his hand, walking around the city, and threatening to behead anyone he spots who have their eyebrows done and behaves like a woman [in the video, the man swears to God he would do that]. I am out of words. To the attention of the Ministry of the Interior, you have to find this person immediately before another hate crime takes place. You were powerless to take measures against blogger Sevinj who shared the same mindset. I hope this time you won’t say, “we can’t do anything because the law doesn’t mention LGBTQ+ people.”

Voice of America reports that the man was detained and that criminal proceedings have been initiated.

According to ILGA Europe, an international non-governmental organization advocating for LGBTQ+ rights and freedoms, Azerbaijan occupies the last place among 49 countries on the organization’s Rainbow Index. The community is not only targeted by homophobic narratives of the likes of Huseynova and Mammadov but also the state itself. In recent years, the authorities too have consistently targeted LGBTQ+ community with arrests, torture, and blackmail.