Belarus Cut Off the Internet and Tried to Make It Look Like an Accident

On Monday, Belarus’ President Alexandr Lukashenko, who is under fire and in the midst of unprecedented protests, claimed that ongoing internet outages were caused not by his government but by some unnamed foreign adversary.

The government-owned RUE Beltelecom said it was working to resolve the outages and restore service after "multiple cyberattacks of varying intensity.”

The country’s Community Emergency Response Team laid the blame on large distributed denial-of-service (DDoS) attacks which caused “problems with equipment.”

It turns out they were all lying.

The widespread internet blackouts, which began as voting in Sunday’s presidential election was still happening, and continued on Tuesday morning, were in fact the result of a long-planned effort to disable access to vast swathes of the internet that could really only have been conducted by the government.

That is what analysts at NetBlocks, a digital rights advocacy group who has been monitoring the outage, discovered. 

According to the group’s director, Alp Toker, the government has amassed a list of over 10,000 keywords that it used to block access to everything from social media sites like YouTube, Twitter, and Facebook, to websites belonging to brands like Walmart, Amazon, and Disney.

According to data shared with VICE News, the government is also blocking access to news sites like CNN, Al Jazeera, and Fox News, among many others.

“They're using deep packet inspection to block any internet domain that contains one of thousands of popular brand names,” Toker said. “This would give the impression of a malfunction.”

But according to the evidence Netblocks uncovered, it’s not a malfunction or a technical failure: the internet outage is the result of a well thought out plan.

READ: Belarus is trying to block parts of the internet amid historic protests

“The only reason you would do this is to simulate a technical failure [but] it would have taken serious planning,” Toker said, adding that while theoretically a foreign adversary “could conceivably limit bandwidth, for something like this you'd need to have full control of and experience with the national system.”

The “deep packet inspection” technique is the same one deployed by Beijing in its Great Firewall, and by Tehran to filter out many western sites and platforms. “The difference is only that Belarus is using it in a random configuration,” Toker said.

Last week, activists who track internet shutdowns by governments around elections predicted Lukashenko would pull the plug, sending an open letter to the government in Minsk urging them to maintain access to the internet during the election.

But as thousands of people flooded onto the streets on Sunday to protest the results of the election, the internet blackout began, with Twitter among the first platform to be impacted. The outage prevented protesters from uploading videos and images of the violent clashes with riot police. 

The government also blocked some Virtual Private Network (or VPN) services, which allowed citizens to circumvent internet blocks, but a few remain accessible on Tuesday morning, allowing some information about the protests to be shared on social media.

“VPNs that haven't been restricted by one of the various mechanisms still work, slowly, for some,” Toker said. “The situation for folks on the ground is still dire.”

Cover: Protesters carry a wounded man during clashes with police after the presidential election in Minsk, Belarus, early Monday, Aug. 10, 2020. Police and protesters clashed in Belarus' capital and the major city of Brest on Sunday after the presidential election in which the authoritarian leader who has ruled for a quarter-century sought a sixth term in office. (AP Photo)