Access Now is deeply concerned about the ongoing crackdown on free expression in Egypt, which has included blocking news websites, the Tor Project, and the Open Observatory of Network Interference (OONI), which examines just the sort of blocking that Egypt is carrying out.
Documenting the censorship and blocking of sites like these is absolutely critical for pushing back on this interference with our fundamental rights, just as it is to fighting blanket shutdowns of internet services or applications.
Below, we share a newly published report by OONI on recent censorship events in Egypt (also published on the OONI site), to which Access Now contributed substantive input.
Please share this report, using the hashtag #EgyptCensors. Together we can help stakeholders across the globe understand what is happening in Egypt, supporting civil society on the ground in their efforts to safeguard the right to access and share information online.
———————————
Country: Egypt
OONI tests: Web Connectivity, HTTP Header Field Manipulation, HTTP Invalid Request Line, HTTP Host, Vanilla Tor.
Probed ISPs: Link Egypt (AS24863), Vodafone Egypt (AS36935), Telecom Egypt (AS8452).
Analysis period: 23rd May 2017 to 17th June 2017.
Censorship method: Deep Packet Inspection (DPI) used to RESET connections.
Starting on May 24th, the Egyptian government ordered ISPs to block at least 21 news websites on the grounds of “supporting terrorism and spreading lies”. In an attempt to understand which sites were blocked and how, ooniprobe network measurement software – designed to examine internet censorship – was run in three local vantage points in the country.
So far, we have been able to identify and confirm the blocking of ten news websites, including madamasr.com, aljazeera.net, and eight others. It remains unclear to us though if all ten sites have been blocked under the Egyptian government’s recent order.
Unfortunately, we also found access to censorship circumvention software to be blocked as well. Link Egypt appears to be blocking access to the Tor network, though it appears to currently be accessible from the Telecom Egypt (TE) and Vodafone networks. We also found torproject.org, Tor bridges, and even our own site (which enables users to measure internet censorship) to be blocked in some networks.
Through the collection and analysis of network measurement data we were able to determine that Egyptian ISPs are using Deep Packet Inspection (DPI) technology to RESET connections to sites.
Mada Masr blocked
Mada Masr is an independent Cairo-based media organization that publishes stories of critical interest to the public. Such stories range from politics, culture and the economy, and even cover the ongoing crackdown of human rights activists. Two years ago, Mada Masr won an award for courageous journalism and for “trying to document facts rather than presenting populist arguments”.
Recently, Mada Masr announced that its site was blocked in Egypt. Network measurement data collected from ooniprobeusers in Egypt confirms the blocking of madamasr.com in three networks, as illustrated through the table below.
| Websites | Link Egypt (AS24863) | Vodafone Egypt (AS36935) | TE (AS8452) |
|---|---|---|---|
| http://www.madamasr.com/ | BLOCKED | BLOCKED | BLOCKED |
| https://www.madamasr.com/ | BLOCKED | BLOCKED | ACCESSIBLE |
Interestingly enough, TE (AS8452) has only been blocking the HTTP version of madamasr.com, enabling users to circumvent the censorship by accessing the site over HTTPS. Vodafone Egypt (AS36935) and Link Egypt (AS24863), on the other hand, have been blocking both the HTTP and HTTPS versions of the site, rendering censorship harder to circumvent.
Based on the network measurement data collected, we can confirm that Vodafone Egypt has been blocking access to madamasr.com from 24th May 2017 (when the ban was first announced) to this date. The blocking of the site by Link Egypt can be confirmed as of 25th May 2017, when ooniprobe users started testing the site in that network.
It’s worth noting that the HTTP version of madamasr.com was accessible in the TE network until 30th May 2017 and that it only started getting blocked on 31st May 2017.
All three ISPs are continuing to block access to madamasr.com, according to recent measurements.
Al Jazeera site blocked
Recent censorship events in Egypt are not limited to national news outlets. Network measurement data collected from ooniprobe users in Egypt confirms the blocking of aljazeera.net in three networks, as illustrated through the table below.
| Websites | Link Egypt (AS24863) | Vodafone Egypt (AS36935) | TE (AS8452) |
|---|---|---|---|
| http://www.aljazeera.net/ | BLOCKED | BLOCKED | BLOCKED |
| https://www.aljazeera.net/ | Unknown (N/A) | BLOCKED | Unknown (N/A) |
Based on the most recent network measurement data, the HTTP version of aljazeera.net is currently blocked by Link Egypt, Vodafone Egypt and TE. Both Vodafone Egypt and Link Egypt started blocking access to the site on 24th May 2017, when the ban was officially announced. The data we have shows that TE blocked access to aljazeera.net as of 5th May 2017, though the block may have been implemented at an earlier date (this is something that we cannot corroborate, since the testing of this site in this network started on 5th May).
Similarly to the blocking of madamasr.com, Vodafone Egypt was found to be blocking both the HTTP and HTTPS versions of aljazeera.net. However, as the HTTPS version of the site was only tested in that network on 24th May 2017, it remains unclear if it is still being censored. Given the fact though that recent measurements show that Vodafone Egypt is still blocking both the HTTP and HTTPS versions of madamasr.com, it’s likely that they are continuing to block the HTTPS version of aljazeera.net as well.
As the HTTPS version of aljazeera.net has not been tested recently in the Link Egypt and TE networks, we do not have data that can show whether it is blocked or not.
Interestingly enough, TE temporarily unblocked access to aljazeera.net/portal and to midan.aljazeera.net on 30th and 31st May 2017, while continuing to block access to aljazeera.net. However, they resumed the blocking on 1st June 2017.
More news websites blocked
We also found the following 8 media websites to be blocked by Vodafone based on recent measurements. It remains unclear though if these news outlets were blocked under the Egyptian government’s recent order.
| Websites | Link Egypt (AS24863) | Vodafone Egypt (AS36935) | TE (AS8452) |
|---|---|---|---|
| http://horriapost.net/ | Likely blocked | BLOCKED | Likely blocked |
| http://www.al-watan.com/ | Unknown (N/A) | BLOCKED | Mostly accessible |
| http://www.gulf-times.com | Unknown (N/A) | BLOCKED | Likely blocked |
| http://www.masralarabia.com/ | ACCESSIBLE | BLOCKED | Likely blocked |
| http://www.moheet.com/ | Unknown (N/A) | BLOCKED | Likely blocked |
| http://www.qtv.qa/ | Unknown (N/A) | BLOCKED | Likely blocked |
| http://www.raya.com/ | Likely blocked | BLOCKED | Likely blocked |
| http://www.thepeninsulaqatar.com | Unknown (N/A) | BLOCKED | Unknown (N/A) |
The table above illustrates that all eight news outlets were found to recently be blocked by Vodafone Egypt, which appears to be using DPI technology to RESET connections to these sites. We are currently unable though to confirm whether these sites are in fact blocked in the TE and Link Egypt networks as well.
Torproject.org, Tor bridges, and OONI’s site blocked
Tor is free software and an open network that provides its users with online anonymity. Tor software is designed to bounce communications around a distributed network of relays run by volunteers around the world, thus hiding users’ IP addresses and circumventing online tracking and internet censorship. Tor bridges are designed to enable users to access the Tor network in countries where access to it is blocked.
Network measurement data collected from three local vantage points in Egypt show the blocking of The Tor Project’s website and of bridges.torproject.org, the subdomain that enables users to get Tor bridges to circumvent the blocking of the Tor network. But we also found our own site (ooni.torproject.org), which promotes network measurement software designed to detect internet censorship, to be blocked as well.
| Websites | Link Egypt (AS24863) | Vodafone Egypt (AS36935) | TE (AS8452) |
|---|---|---|---|
| http://www.torproject.org | BLOCKED | BLOCKED | Unclear |
| https://www.torproject.org | BLOCKED | Unknown (N/A) | Unclear |
| http://bridges.torproject.org | BLOCKED | BLOCKED | ACCESSIBLE |
| https://bridges.torproject.org | BLOCKED | Unknown (N/A) | ACCESSIBLE |
| http://ooni.torproject.org | BLOCKED | BLOCKED | ACCESSIBLE |
| https://ooni.torproject.org | BLOCKED | Unknown (N/A) | Unknown (N/A) |
The table above illustrates that both the HTTP and HTTPS versions of torproject.org, bridges.torproject.org and ooni.torproject.org were found to recently be blocked by Link Egypt. Based on the collected data, Link Egypt appears to have started blocking these domains on 27th May 2017 and continues to block them to date.
Vodafone Egypt, on the other hand, was only found to be blocking the HTTP versions of torproject.org, bridges.torproject.org and ooni.torproject.org. It remains unclear, however, if the HTTPS versions of these domains are blocked as well, since they have not been tested within this network.
Based on the recent collection of network measurement data, we are unable to reach a conclusion on the accessibility of torproject.org in the TE network. Some measurements indicate that TE may have started blocking access tohttps://www.torproject.org on 28th May 2017, but only on its mobile network. Similarly, other measurements indicate that TE may have started blocking https://torproject.org on fixed networks on 30th May 2017. But on 4th June 2017, both domains appeared to be accessible (data here and here), indicating that if they were censored, their block was lifted.
However, access to https://torproject.org appeared to be blocked again on 8th June, while appearing to be accessible the next day. Quite similarly, OONI’s network measurements indicate that TE blocked access to the HTTPS version of www.torproject.org on 6th and 7th June, but the HTTP version of this domain appeared to be accessible during the same dates within the same network. The latest measurements, on the other hand, show that both the HTTP and HTTPS versions of www.torproject.org were accessible in the TE network. Since the collected data is not conclusive, it remains unclear whether TE intentionally blocked access to torproject.org or whether the anomalous measurements are false positives.
It also remains unclear whether TE blocked access to ooni.torproject.org. Measurements from 9th June 2017 indicate thataccess to our site was blocked, but measurements from previous dates, as well as more recent measurements, show that it was accessible. As such, the anomalous measurements might have been due to transient network failures.
On a positive note, bridges.torproject.org was confirmed to be accessible in the TE network, enabling users to acquire Tor bridges.
Tor network blocked by Link Egypt
OONI’s Vanilla Tor test is designed to examine the reachability of the Tor network by attempting to successfully bootstrap a connection to the Tor network. Data collected through this test indicates that the Tor network is blocked in the Link Egypt network, but likely accessible in the TE and Vodafone Egypt networks.
Tests in the Link Egypt network were run every day between 24th to 28th May, and 1st to 7th June 2017. During this period, ooniprobe was never able to establish a connection to the Tor network, strongly indicating that it may have been blocked.
Data collected from the TE network, however, is less conclusive. While ooniprobe was able to bootstrap a connection to the Tor network between 29th to 31st May, it was unable to do so on 1st and 4th June. Between 5th to 9th June 2017, some attempts were successful, while others failed. Since ooniprobe was able to establish some connections over the last weeks, it’s likely that the failed connections were caused by transient network failures.
During the last weeks, the Tor network was only tested once in the Vodafone Egypt network, and a connection to it was successfully established.
Contributing to this study
This study is part of ongoing efforts to monitor internet censorship events in Egypt and around the world. Potentially anyone can run ooniprobe, since it’s free and open source software and can be run from multiple platforms (Android, iOS, macOS, Linux, Raspberry Pis). Over the last five years, tens of thousands of ooniprobe users have measured networks across more than 190 countries with the aim of uncovering internet censorship events.
Running ooniprobe however can potentially be a risky activity. Anyone monitoring your internet activity (e.g. ISP, government, employer) will be able to know that you are running ooniprobe. And some of the sites that are tested by ooniprobe (such as pornography or online gambling) may be illegal in certain countries.
If you feel uncomfortable with the potential risks, there are other (equally important) ways that you can contribute. Ooniprobe’s censorship findings are only as interesting as the types of sites that are tested. We were likely unable to identify the blocking of all 21 news outlets if they were not included in the lists of sites that we tested for censorship. As such, reviewing and updating the lists that ooniprobe tests for censorship is an important task. Information on how to contribute to such lists can be found here.
If you’re a data analyst, you may be interested in analyzing the network measurement data collected by ooniprobe. If you’re a journalist, you may be interested in telling stories based on the data. If you’re a lawyer, you may be interested in examining the legality of censorship events based on ooniprobe network measurement data, and potentially even using it as evidence in court cases. And if you’re a human rights advocate, you may be interested in supporting Access Now’s KeepItOn campaign for a free and open internet.