#EgyptCensors: Evidence of recent censorship events in Egypt

Country: Egypt

OONI tests: Web Connectivity, HTTP Header Field Manipulation, HTTP Invalid Request Line, HTTP Host, Vanilla Tor.

Probed ISPs: Link Egypt (AS24863), Vodafone Egypt (AS36935), Telecom Egypt (AS8452).

Analysis period: 23rd May 2017 to 17th June 2017.

Censorship method: Deep Packet Inspection (DPI) used to RESET connections.

Starting on May 24th, the Egyptian government ordered ISPs to block at least 21 news websites on the grounds of “supporting terrorism and spreading lies”. In an attempt to understand which sites were blocked and how, OONI Probe network measurement software - designed to examine internet censorship - was run in three local vantage points in the country.

So far, we have been able to identify and confirm the blocking of ten news websites, including madamasr.com, aljazeera.net, and eight others. It remains unclear to us though if all ten sites have been blocked under the Egyptian government’s recent order.

Unfortunately, we also found access to censorship circumvention software to be blocked as well. Link Egypt appears to be blocking access to the Tor network, though it appears to currently be accessible from the Telecom Egypt (TE) and Vodafone networks. We also found torproject.org, the Tor bridges website, and even our own site (which enables users to measure internet censorship) to be blocked in some networks.

Through the collection and analysis of network measurement data we were able to determine that Egyptian ISPs are using Deep Packet Inspection (DPI) technology to RESET connections to sites.

Mada Masr blocked

Mada Masr is an independent Cairo-based media organization that publishes stories of critical interest to the public. Such stories range from politics, culture and the economy, and even cover the ongoing crackdown of human rights activists. Two years ago, Mada Masr won an award for courageous journalism and for “trying to document facts rather than presenting populist arguments”.

Recently, Mada Masr announced that its site was blocked in Egypt. Network measurement data collected from OONI Probe users in Egypt confirms the blocking of madamasr.com in three networks, as illustrated through the table below.

Interestingly enough, TE (AS8452) has only been blocking the HTTP version of madamasr.com, enabling users to circumvent the censorship by accessing the site over HTTPS. Vodafone Egypt (AS36935) and Link Egypt (AS24863), on the other hand, have been blocking both the HTTP and HTTPS versions of the site, rendering censorship harder to circumvent.

Based on the network measurement data collected, we can confirm that Vodafone Egypt has been blocking access to madamasr.com from 24th May 2017 (when the ban was first announced) to this date. The blocking of the site by Link Egypt can be confirmed as of 25th May 2017, when OONI Probe users started testing the site in that network.

It’s worth noting that the HTTP version of madamasr.com was accessible in the TE network until 30th May 2017 and that it only started getting blocked on 31st May 2017.

All three ISPs are continuing to block access to madamasr.com, according to recent measurements.

Aljazeera blocked

Recent censorship events in Egypt are not limited to national news outlets. Network measurement data collected from OONI Probe users in Egypt confirms the blocking of aljazeera.net in three networks, as illustrated through the table below.

Based on the most recent network measurement data, the HTTP version of aljazeera.net is currently blocked by Link Egypt, Vodafone Egypt and TE. Both Vodafone Egypt and Link Egypt started blocking access to the site on 24th May 2017, when the ban was officially announced. The data we have shows that TE blocked access to aljazeera.net as of 5th May 2017, though the block may have been implemented at an earlier date (this is something that we cannot corroborate, since the testing of this site in this network started on 5th May).

Similarly to the blocking of madamasr.com, Vodafone Egypt was found to be blocking both the HTTP and HTTPS versions of aljazeera.net. However, as the HTTPS version of the site was only tested in that network on 24th May 2017, it remains unclear if it is still being censored. Given the fact though that recent measurements show that Vodafone Egypt is still blocking both the HTTP and HTTPS versions of madamasr.com, it’s likely that they are continuing to block the HTTPS version of aljazeera.net as well.

As the HTTPS version of aljazeera.net has not been tested recently in the Link Egypt and TE networks, we do not have data that can show whether it is blocked or not.

Interestingly enough, TE temporarily unblocked access to aljazeera.net/portal and to midan.aljazeera.net on 30th and 31st May 2017, while continuing to block access to aljazeera.net. However, they resumed the blocking on 1st June 2017.

More news websites blocked

We also found the following 8 media websites to be blocked by Vodafone based on recent measurements. It remains unclear though if these news outlets were blocked under the Egyptian government’s recent order.

The table above illustrates that all eight news outlets were found to recently be blocked by Vodafone Egypt, which appears to be using DPI technology to RESET connections to these sites. We are currently unable though to confirm whether these sites are in fact blocked in the TE and Link Egypt networks as well.

Torproject.org, Tor bridges, and OONI’s site blocked

Tor is free software and an open network that provides its users with online anonymity. Tor software is designed to bounce communications around a distributed network of relays run by volunteers around the world, thus hiding users’ IP addresses and circumventing online tracking and internet censorship. Tor bridges are designed to enable users to access the Tor network in countries where access to it is blocked.

Network measurement data collected from three local vantage points in Egypt show the blocking of The Tor Project’s website and of bridges.torproject.org, the subdomain that enables users to get Tor bridges to circumvent the blocking of the Tor network. But we also found our own site (ooni.org), which promotes network measurement software designed to detect internet censorship, to be blocked as well.

The table above illustrates that both the HTTP and HTTPS versions of torproject.org, bridges.torproject.org and ooni.org were found to recently be blocked by Link Egypt. Based on the collected data, Link Egypt appears to have started blocking these domains on 27th May 2017 and continues to block them to date.

Vodafone Egypt, on the other hand, was only found to be blocking the HTTP versions of torproject.org, bridges.torproject.org and ooni.org. It remains unclear, however, if the HTTPS versions of these domains are blocked as well, since they have not been tested within this network.

Based on the recent collection of network measurement data, we are unable to reach a conclusion on the accessibility of torproject.org in the TE network. Some measurements indicate that TE may have started blocking access to https://www.torproject.org on 28th May 2017, but only on its mobile network. Similarly, other measurements indicate that TE may have started blocking https://torproject.org on fixed networks on 30th May 2017. But on 4th June 2017, both domains appeared to be accessible (data here and here), indicating that if they were censored, their block was lifted.

However, access to https://torproject.org appeared to be blocked again on 8th June, while appearing to be accessible the next day. Quite similarly, OONI’s network measurements indicate that TE blocked access to the HTTPS version of www.torproject.org on 6th and 7th June, but the HTTP version of this domain appeared to be accessible during the same dates within the same network. The latest measurements, on the other hand, show that both the HTTP and HTTPS versions of www.torproject.org were accessible in the TE network. Since the collected data is not conclusive, it remains unclear whether TE intentionally blocked access to torproject.org or whether the anomalous measurements are false positives.

It also remains unclear whether TE blocked access to ooni.org. Measurements from 9th June 2017 indicate that access to our site was blocked, but measurements from previous dates, as well as more recent measurements, show that it was accessible. As such, the anomalous measurements might have been due to transient network failures.

On a positive note, bridges.torproject.org was confirmed to be accessible in the TE network, enabling users to acquire Tor bridges.

Tor network blocked by Link Egypt

OONI’s Vanilla Tor test is designed to examine the reachability of the Tor network by attempting to successfully bootstrap a connection to the Tor network. Data collected through this test indicates that the Tor network is blocked in the Link Egypt network, but likely accessible in the TE and Vodafone Egypt networks.

Tests in the Link Egypt network were run every day between 24th to 28th May, and 1st to 7th June 2017. During this period, OONI Probe was never able to establish a connection to the Tor network, strongly indicating that it may have been blocked.

Data collected from the TE network, however, is less conclusive. While OONI Probe was able to bootstrap a connection to the Tor network between 29th to 31st May, it was unable to do so on 1st and 4th June. Between 5th to 9th June 2017, some attempts were successful, while others failed. Since OONI Probe was able to establish some connections over the last weeks, it’s likely that the failed connections were caused by transient network failures.

During the last weeks, the Tor network was only tested once in the Vodafone Egypt network, and a connection to it was successfully established.

Contributing to this study

This study is part of ongoing efforts to monitor internet censorship events in Egypt and around the world. Potentially anyone can run OONI Probe, since it’s free and open source software and can be run from multiple platforms (Android, iOS, macOS, Linux, Raspberry Pis). Over the last five years, tens of thousands of OONI Probe users have measured networks across more than 190 countries with the aim of uncovering internet censorship events.

Running OONI Probe however can potentially be a risky activity. Anyone monitoring your internet activity (e.g. ISP, government, employer) will be able to know that you are running OONI Probe. And some of the sites that are tested by OONI Probe (such as pornography or online gambling) may be illegal in certain countries.

If you feel uncomfortable with the potential risks, there are other (equally important) ways that you can contribute. Ooniprobe’s censorship findings are only as interesting as the types of sites that are tested. We were likely unable to identify the blocking of all 21 news outlets if they were not included in the lists of sites that we tested for censorship. As such, reviewing and updating the lists that OONI Probe tests for censorship is an important task. Information on how to contribute to such lists can be found here.

If you’re a data analyst, you may be interested in analyzing the network measurement data collected by OONI Probe. If you’re a journalist, you may be interested in telling stories based on the data. If you’re a lawyer, you may be interested in examining the legality of censorship events based on OONI Probe network measurement data, and potentially even using it as evidence in court cases. And if you’re a human rights advocate, you may be interested in supporting Access Now’s KeepItOn campaign for a free and open internet.