Political strife and natural disasters have stripped millions of people of internet access over the last two weeks, with experts raising particular concern over actions taken by Turkey's government. This article explores the intentional and unintentiaional sequestering of social media communication. Last week, the Turkish government shut down access to social media sites in the Kayseri region of the country due to local anti-Syrian immigrant riots. While hundreds of governments have proven the ability to implement nationwide internet shutoffs, regional social media throttling is considered new, according to Alp Toker, director of the internet monitoring firm Netblocks.
The watchdog organization has seen versions of the tactic going back to 2019 “but the idea that subnational targeting could be practically deployed was still novel (and it still is),” he said.[1]
There are cases of local internet service providers (ISPs) filtering content in some countries but “instances where a national provider throttles social media platforms for certain users but not others based on their geolocation, to precisely target protests or some other geopolitical incident, is something that's only been observed and documented in Turkey.”
Data from researchers at Cloudflare confirms that there was a clear drop in internet traffic in the Kayseri region starting on 1 July. The researchers said this continued with daily traffic drops of around 14%, more pronounced after 8 pm local time. It dropped the most on 2 July and 3 July, with a 12% decrease at 9 pm local time and a 26% decrease at 11 pm local time, compared to the previous week.
On 4 July 2024, it continued to show a tendency to drop throughout the day compared to the previous week. Toker theorized that Turkey was a likely government to come up with the tactic because most countries see protests in their capital regions near legislative buildings. “Turkey's restive regions are outside the main population centers. Imposing nationwide social media throttling every time there was an incident in the south of the country was counterproductive, using a hammer to hit a nail,” Toker explained. “By using fine-grained internet censorship, protests can be silenced without drawing media attention or public criticism. Mostly, it will just go under the radar this way. Technologically, the measure isn't high-tech per se, but it's certainly more involved than packet filtering at the national level as it requires a higher granularity of configuration to target specific cities.”
Most internet shutdowns that limit overall connectivity are often geotargeted, while ISPs generally only have the means to filter individual platforms across their entire network. As an example, the Mauritanian government reportedly suspended mobile Internet connectivity in response to protests that erupted in the capital city Nouakchott and other parts of the country last week. Traffic dropped to near-zero on the country’s two main ISPs, according to Cloudflare.
Kenya disrupted connectivity on 25 June in the wake of a crackdown on Reject Finance Bill 2024 protestors, with traffic dropping significantly across the country as well as within regional neighbors Uganda and Burundi that rely on Kenya for internet. “Turkey's broken away from that,” Toker added. “It's difficult to say if this is a good or bad thing, but in any case, this has left one region in a bubble which is a fascinating and worrying dynamic. This measure is being successfully circumvented by VPN services just as national social media restrictions often are.”
Natural Disasters - Hurricane Beryl Example. Internet access monitors said people around the world have also had to contend with an early start to storm season. Hurricane Beryl’s trail of destruction across the Caribbean and Mexico has also included downed pole lines and ruined internet infrastructure.
Grenada and the Grenadines were the first to face issues on 1 July, with the Grenadines “experiencing a near-complete Internet outage,” according to Cloudflare. Grenada has largely recovered from the outages since July 3, but the islands of Saint Vincent and the Grenadines continue to struggle with internet access. A UN official said the island of Carriacou has been virtually “flattened” and more than 650,000 people across several other islands were in the direct path of the hurricane. Hurricane Beryl slammed into the south of Jamaica by 3 July and caused outages throughout the end of the week before making its way to Mexico’s Yucatán Peninsula.
As the storm moved to the US on the following Sunday and Monday, Netblocks reported internet connectivity in Houston down to 30% of ordinary levels due “to heavy winds and downed lines leaving over two million without power and telecoms.” At least 7 deaths have been reported across Texas and Louisiana as of 9 July, with 25 million more people at risk in the coming days across Arkansas, Indiana, Illinois and Michigan. About two million people in Texas are currently without power, cutting nearly 12% of the state’s population from the internet.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://therecord.media/internet-outages-protests-turkey-hurricane-beryl/
Comments