work, service would have taken much
longer to restore, implying the authorities were willing to physically cut network cables if necessary.
The censorship in Libya, on the
other hand, happened through more
sophisticated means, the researchers
conclude. The Gaddafi regime did use
BGP blocking for the first hour of the
outage, which occurred on the evening
of February 19. However, the network
telescope revealed restoration of service and a second outage the next evening, during which the government
began testing a firewall to filter packets
coming in and out of Libya. The use of
packet-level blocking became apparent to the researchers through a mismatch they spotted between the BGP
data and the data from the telescope.
Specifically, the telescope showed a
disruption in traffic that the BGP data
did not. “They brought the autonomous system up again after one hour,
but Libya was still blacked out,” Dainotti explains. “That’s what makes us
think they were doing tests.” Once the
regime had successfully tested the firewall, they proceeded to use it for the final outage several days later.
Clearly, packet filtering is a better
solution for the censor. But Libya was
able to use it only because the country
had the right conditions in place. For
one thing, as journalists discovered
after the regime was overthrown, the
government possessed sophisticated Internet surveillance and control
equipment, enabling them to configure and test their own firewall. It
also helped that the country had only
two network operators, in contrast
to Egypt’s 50, making it far easier for
Libya to bring autonomous systems up
The use of multiple data sources
was one of the strengths of this research, says Edward Felten, a professor
of both computer science and public
affairs at Princeton University and the
director of Princeton’s Center for Information Technology Policy. Besides
the network telescope and the BGP
data, Dainotti’s team gathered some
data from the Archipelago Measurement Infrastructure (Ark), in which
60 machines distributed around the
world actively probe different parts of
the Internet. Ark measurements do
not offer the same level of granularity
the uCSD team
has studied large-
caused by natural
disasters to learn
about the impact
on nearby internet
and track how
seen through IBR traffic, but they are
known to be reliable, so they validated
the measurements taken by the network telescope.
Part of the value of this kind of investigation, Felten says, is being able to
see precisely how governments cut off
access. “Once you know the tools and
methods they are using to block you,
you can think about how to mitigate
the effects of the shutdown,” he says.
The study also shows how the In-
ternet is increasingly important to
activists and a threat to governments,
according to Steven Murdoch, a se-
curity researcher at the University of
Cambridge. “Cutting connections is a
crude way of controlling the Internet,”
he says, “but it could happen again,
and so care needs to be taken in any
scheme which assumes ubiquitous
Internet availability. Governments can
and do interfere with the Internet when
it suits them.” Earlier this year, for ex-
ample, the Iranian government tried to
quell antigovernment protests by cut-
ting off access to email and social me-
dia, though some Iranians were able to
circumvent these blocks through proxy
servers and VPN connections. (Predict-
ably, the government cracked down on
such users.) Of course, ongoing Inter-
net censorship is more widespread, af-
fecting citizens of China, Saudi Arabia,
and Vietnam, among other nations;
and some regimes, such as Cuba and
North Korea, are so fearful of the out-
side world that they maintain complete
control of Internet equipment.
Crovella, M. and Krishnamurthy, B.
Internet Measurement: Infrastructure,
Traffic and Applications, John Wiley & Sons,
Chichester, England, 2006.
Dainotti, A., Amman, R., Aben, E., and Claffy, K.C
Extracting benefit from harm: using
malware pollution to analyze the impact
of political and geophysical events on
the internet, ACM SIGCOMM Computer
Communication Review 42, Jan. 2012.
Dainotti, A., Squarcella, C., Aben, E., Claffy, K.C.,
Chiesa, M., Russo, M., and Pescapè, A.
Analysis of country-wide Internet
outages caused by censorship, Internet
Measurement Conference 2011, Berlin,
Germany, nov. 2–4, 2011.
Xu, X., Mao, Z. M., and Halderman, J. A.
Internet censorship in China: Where
does the filtering occur? Proceedings
of 12th Passive and Active Measurement
Conference, Atlanta, GA, March 20–22, 2011.
Based in san francisco, Marina Krakovsky is the
co-author of Secrets of the Moneylab: How Behavioral
Economics Can Improve Your Business.
© 2012 aCM 0001-0782/12/09 $15.00