On Thursday, March 27, 2014, someone hacked the official Twitter account of Ecuador's President Rafael Correa. The next day, hackers posted personal emails from the country's spy chief Rommy Vallejo on a Google-hosted blog, which contained a classic Anonymous-like YouTube video.
Hours later, some internet users in Ecuador reported not being able to access Google and YouTube. As it turned out, the outage wasn't caused by a technical glitch, but a government censorship order, according to a leaked document from telephone giant Telefonica.
"The issues with accessing internet pages such as Google and YouTube was due to the fact that personnel at [Ecuador's internet providers' association] AEPROVI blocked access to certain internet pages by request of the national government," reads part of the document, which appears to be an internal Telefonica support ticket.
"What matters is that the government goes around blocking pages illegally."
The document was obtained by a journalistic collaboration between Associated Whistleblowing Press and its platform Ecuador Transparente, and shared with Motherboard in advance. The one page ticket doesn't clearly state how widespread the outage was, only saying it affected "several customers." After lasting 33 minutes, AEPROVI rolled back the block, according to the document.
The government of Ecuador's President Correa, has long tried to position itself as a champion of internet freedom and free speech rights, giving asylum to WikiLeaks leader Julian Assange and trying to do the same with NSA whistleblower Edward Snowden. This document shows that despite the public image Corra is trying to project abroad, the country has the technical capabilities, and the willingness, to engage in widespread internet censorship—and likely has done it for years.
"I'm not surprised by this," Pedro Noel, the editor of Ecuador Transparente, told Motherboard in an online encrypted chat. "It was to be expected given the state of freedom of speech and information in Ecuador. But now we have the first workable evidence of arbitrary blocking."
Katitza Rodriguez, the international rights director at the Electronic Frontier Foundation, echoed Noel's words.
"We've seen before how Ecuadorian officials have used foreign law firms to send copyright takedowns to remove dozens of websites, tweets, documentaries, and search results that it disapproves of," she said in an email. "But this is the first evidence of a secret internet censorship process within Ecuador itself."
"This is the first evidence of a secret internet censorship process within Ecuador itself."
Motherboard wasn't able to independently verify whether the document is legitimate. The Ecuadorian government, AEPROVI, and Telefonica Ecuador all did not respond to requests for comment. But circumstantial evidence seems to point to the fact that the document is likely genuine.
A security officer at the country's Computer Emergency Readiness Team, or EcuCERT, said in a presentation in 2014 that between January and September of that year, the Ecuadorian government "blocked internet domains to prevent them from working" in collaboration with private internet providers and the National Telecommunications Corporation (Corporacion Nacional de Telecomunicaciones), which is a member of AEPROVI.
This would suggest that the brief and apparently limited Google and YouTube outage was indeed government-mandated, according to Ecuador Transparente.
Furthermore, Ecuador has a history of blocking content online, although normally the country got the help of shady foreign companies, using copyright as an excuse for censorship. In the past, obscure firms from Mexico and Spain got paid millions to request the removal of anti-Correa posts and videos from YouTube, Facebook and other sites, sometimes using the US copyright law Digital Millennium Copyright Act, or DMCA.
It's unclear if Ecuador wanted to block the whole Google and YouTube domains, or just block the blog post and the YouTube video advertising the hacks on Correa and his spy chief Vallejo. The document, according to Noel, shows that an "incompetent" AEPROVI that "likely wanted to block specific content" ended up blocking the whole domains by mistake.
"What matters is that the government goes around blocking pages illegally," Noel told me.
The activist also accused the Ecuadorian government of acting against the Manila Principles, a non-binding set of guidelines to protect freedom of speech online, which say that content shouldn't be restricted without a court order. The leaked document makes no mention of judicial authorization.
It's entirely possible that the Ecuadorian government used the same procedure to block other sites in the past. In December of 2015, several Ecuadorian internet users complained that they couldn't see images hosted on Twitter's Content Distribution Network, or CDN. At the time, the company denied that the problems were caused by a technical glitch on its end.
In the case of the brief March 2014 outage of Google and YouTube, Noel has no doubts. And hopes this leaked document will spur a public discussion leading to more transparency and accountability for the Ecuadorian government.
"I think they didn't want this information to be public," Noel told me. "It's an assumption I have to make following an independent investigation. But if there was transparency, we could all—and not just me—find out the real reason."
This post has been updated to include Katitza Rodriguez's comment.