Claims That “Terrorists” Cut The Web Fall Flat

Doug Bernard | Washington DC

Update December 3, 1330 UTC: Renesys’ Jame Cowie writes on the company blog that Internet service has been almost fully restored in Syria. Traffic began flowing into and out of Syria at 4:30pm Damascus time on Saturday afternoon:

“The restoration was achieved just as quickly and neatly as the outage: like a switch being thrown. Does that mean that we believe the government (or the opposition) threw the switch? Frankly, the data available just don’t support attribution at this point, despite all the speculation.”

At 12:26 pm, Damascus time, on Thursday afternoon, the nation of Syria disappeared from the Internet. Practically speaking, at least.

“In the global routing table, all 84 of Syria’s IP address blocks have become unreachable, effectively removing the country from the Internet,” writes James Cowie, chief technology officer at Renesys, in the company blog:

“Looking closely at the continuing Internet blackout in Syria, we can see that traceroutes into Syria are failing, exactly as one would expect for a major outage. The primary autonomous system for Syria is the Syrian Telecommunications Establishment; all of their customer networks are currently unreachable.”

The precise moment nearly all of Syria’s Internet went dark. (courtesy Renesys)

Never mind the techno-lingo. What this means is that, for the moment, computer networks outside of Syria have no paths or gates to enter and transmit data into the nation. Computers within Syria similarly have no means of ‘talking’ to the rest of the world. The only other way to cut Syria off from the Internet as effectively would be to actually sever the lines.

The government of Syria quickly blamed “terrorists” for the Internet outage, but several factors raise doubts about that claim.

First is the timing: the blackout comes amid numerous reports of increased fighting around Damascus International Airport. Second, scattered reports coming out of Syria suggest that both mobile and land line phone service have become spotty, particularly in and around the capital city. Both factors hint at what may be a government that is either concerned about its stability, or perhaps preparing for a major offensive that it would rather the rest of the world not know about.

But most suspicious is the manner of the Internet shutdown itself. As Cowie notes, presently 100% of all the Internet address paths into Syria are failing. Another firm, Akamai, that monitors Internet traffic like Renesys, has confirmed the timing and near totality of this blackout. While data is still being analyzed, it appears initially to some that the cutoff mirrors that in Egypt in January of 2011. Then, the Mubarak government was the first to try erasing itself from the web by removing BGPs, or Border Gateway Protocols, from the web – an outage that was also first picked up by Renesys. Writing then we noted:

BGPs are like maps used by service providers and traffic routers to deliver data from one computer to another as efficiently as possible.  Erase the map, and the data has no place to go.

“They raised the digital drawbridge,” says Rodney Joffe, senior technologist with the DNS service provider firm Neustar.  Speaking with New Zealand’s “Computerworld“, Joffe likened Egypt’s actions to flipping a virtual kill switch.

Terrorists, even very sophisticated ones, might be able to take down a few service providers, or create havoc at specific websites or networks. But the only entity that can effectively destroy every Internet map into and out of the nation is the national government itself.

For the moment, Renesys’ James Cowie tells VOA that he’s not yet sure about the technical reasons for Syria suddenly going dark, but it seems likely who’s to blame:

“We can’t see how they did it yet, but we can infer that the Internet was probably turned off in some central location.  That could be the result of a government decision (“flipping a switch”), or it could be a side effect of an opposition action (power outage, facility destruction).    Anything short of facilities destruction would be the ‘best case’ because it implies that the Internet could be brought back online as quickly as it was taken away.

Several outside activist groups, aligned with the Syria rebels, say they are working on building temporary bridges to the Internet for those inside Syria via land line phones, but the security of those lines has not been established.

We’ll keep you updated.