How Pakistan blocked news outlets, social media sites, and IM apps amidst protests

Last weekend, a number of social media sites and news outlets were blocked in Pakistan during Islamist protests. Protesters gathered in Islamabad alleged that Mr. Zahid Hamid, the Federal Law Minister, should be removed from his position because he omitted a reference to the Prophet Muhammad in a parliamentary bill. On Saturday, 25th November 2017, law enforcement agencies initiated an operation to disperse the sit-in at the Faizabad Interchange linking Islamabad and Rawalpindi.

As information about the government operation was reported by the media, protests spread across the country, literally jamming roads and closing businesses. The Pakistan Electronic Media Regulatory Authority (PEMRA) prohibited live coverage of the operation at Faizabad, leading to governmental blocking of social media sites and online news channels.

In this post, we provide technical evidence of observed censorship events. We share OONI network measurement data collected from Pakistan, confirming the DNS-based blocking of Facebook, YouTube, Twitter, and Instagram. We confirm the DNS blocking of 14 news websites, as well as the censorship of applications including Facebook Messenger, Telegram, and WhatsApp’s web interface. All of these censorship events were temporarily implemented last weekend, and are no longer in place.

• Blocking of social media sites

• Blocking of instant messaging apps

  • Facebook Messenger

  • WhatsApp

  • Telegram

• Blocking of news websites

• Circumventing censorship

• Reproducing this study

Blocking of social media sites

Facebook, Twitter, YouTube, and Instagram were reportedly blocked in Pakistan last Saturday, 25th November, and Sunday, 26th November 2017.

To confirm these reports and examine how the blocks were implemented, we analyzed OONI network measurement data collected from Pakistan. OONI Probe is free and open source software designed to measure internet censorship, including the blocking of websites. Community members in Pakistan have been running OONI Probe on a daily basis for more than a year, providing data on the changing availability of websites.

Our analysis confirms the DNS-based blocking of Facebook, Twitter, YouTube, and Instagram, as summarized in the table below.

All four sites presented DNS lookup errors, strongly suggesting that they were blocked by means of DNS tampering. This is also supported by the fact that, according to OONI measurements, these sites were accessible before and after last weekend. In other words, DNS lookup errors for these sites only showed up in OONI measurements on the 25th and 26th of November.

This is not the first time these sites have been interfered with in Pakistan. In our recently published research report in collaboration with Bytes For All, Pakistan, we analyze network measurements in the country from between 2014 to 2017. This study confirms observations of blocking the HTTP versions of certain YouTube, Facebook, and Twitter webpages hosting content related to the controversial “Draw Muhammad Day” (these webpages remain blocked today). This indicated that Pakistani ISPs applied “smart filters”, with targeted censorship of specific webpages.

Last weekend, however, these sites were entirely blocked. This was also reported in a press release by the Digital Rights Foundation (DRF) and NetBlocks. Rather than filtering specific webpages, ISPs blocked access to the encrypted HTTPS versions of facebook.com, twitter.com, youtube.com, and instagram.com by means of DNS tampering, rendering them inaccessible.

Blocking of instant messaging apps

Analysis of OONI measurements indicates that last weekend’s censorship wasn’t limited to news outlets and social media sites; several instant messaging apps were interfered with as well.

Facebook Messenger and WhatsApp’s web interface were temporarily blocked on Sunday, 26th November 2017, while Telegram has possibly suffered a longer outage.

Facebook Messenger

OONI’s Facebook Messenger test attempts to perform a TCP connection and DNS lookup to Facebook’s endpoints. If the TCP connection fails and/or DNS lookups don’t resolve to IP addresses allocated to Facebook, then Facebook Messenger is likely blocked. This test has been run on an almost daily basis from multiple vantage points in Pakistan over the last year.

OONI measurements usually show that Facebook Messenger is accessible in Pakistan. However, last Sunday we noticed DNS lookup errors from two different ISPs, suggesting that Facebook Messenger was temporarily blocked.

WhatsApp

Similarly, WhatsApp’s web interface (web.whatsapp.com) appears to have temporarily been blocked on the 26th of November.

OONI’s WhatsApp test performs an HTTP GET request, TCP connection, and DNS lookup to WhatsApp’s endpoints, registration service, and web version over the vantage point of the user. In doing so, this test measures the reachability of both WhatsApp’s app and web interface. While web.whatsapp.com was likely blocked across three ISPs on 26th November (as illustrated in the table above), the WhatsApp app was accessible throughout the weekend in all vantage points where tests were run.

Telegram

Telegram’s website was blocked last weekend in Pakistan, as illustrated through the table below.

But Telegram may have been blocked in Pakistan for a while.

OONI’s Telegram test is designed to measure the blocking of Telegram’s app and web version (web.telegram.org) by attempting to perform an HTTP POST request, establish a TCP connection to Telegram’s access points, and an HTTP GET request to Telegram’s web interface over the vantage point of the user. Measurements collected from this test indicate that Telegram’s app and web interface (web.telegram.org) may have been blocked in Pakistan since at least 20th November 2017.

While the testing of Telegram’s web interface constantly presents DNS lookup and timeout errors (strongly suggesting that it’s blocked), the testing of Telegram’s endpoints is less conclusive. Therefore, it remains unclear if the Telegram app is being blocked, or if the TCP failures are false positives.

Blocking of news websites

On Saturday, the Pakistan Electronic Media Regulatory Authority (PEMRA) prohibited live coverage of the operation at Faizabad, Islamabad, explaining why a number of online news channels were reportedly blocked.

Testing confirmed the DNS-based blocking of the following news websites on Saturday, 25th November 2017.

A subset remained blocked on Sunday, 26th November 2017.

It remains unclear if the other news outlets blocked on the 25th of November were also blocked on the 26th of November - we do not have testing data.

This is the first time that we have observed censorship of news websites in Pakistan. Our previous study, involving the analysis of thousands of network measurements collected between 2014 to 2017, only allowed us to confirm the blocking of sites expressing religious criticism and minority sites.

Circumventing censorship

The following software tools can be used for censorship circumvention:

• Tor: Free and open source anonymity network which hides its users’ real IP addresses, enabling them to bypass internet censorship and online tracking.

• Psiphon: Centrally managed censorship circumvention tool (ad-supported).

• Lantern: Peer-to-peer (yet centrally managed) censorship circumvention tool.

• VPN mode of Orbot: Enables mobile apps to run over the Tor network, circumventing censorship.

• Paid VPN services: Criteria for selecting a VPN that’s right for you.

Reproducing this study

In the event that censorship events re-emerge (in Pakistan or elsewhere), we provide information on how to reproduce this study. Monitoring internet censorship on an ongoing basis (regardless of whether censorship events are known to be happening or not) can be useful to track censorship events when/if they occur.

To reproduce this study:

1. Install the OONI Probe mobile app (Android, F-Droid, iOS)

2. Add the sites that you want to test to OONI Run and generate a link

3. Click on your OONI Run link and open it with your OONI Probe mobile app

4. Tap “Run”

To view the results:

1. Tap on the menu icon on the top left corner in the OONI Probe mobile app

2. Tap on “Past Tests”

3. Tap on “View” next to “Web Connectivity”

To view the details of each measurement, tap on “View” next to each tested site. If the site you selected is red, the measurement page will provide you the following information:

• How the site is blocked (e.g. DNS tampering, HTTP or TCP/IP blocking);

• How the specific censorship can be circumvented;

• Network measurement information serving as evidence of the blocking (available towards the end of each measurement page).

To run more OONI Probe tests and to schedule daily testing, consider running OONI Probe on Linux, macOS, or on a Raspberry Pi. All network measurement data will be published on OONI Explorer and on the OONI API, increasing transparency of internet censorship.