On July 23rd, people in the village of Duraz, Bahrain began having serious internet problems — mobile networks ground to a halt and landline connections were unusable. The outages continued for nearly three weeks, occurring from 7PM to 1AM every night, and they began just three days after residents took to the streets of Duraz in peaceful protest against the government. Bahrain's three telecoms offered no explanation for the localized blackout, saying only that they were working to fix it, but a new report suggests that it was ordered by the government, in what researchers call "a new form of information control."
The report, published today by the advocacy group Bahrain Watch, provides detailed evidence that 3G and 4G towers owned by two Bahraini telecoms were shut down between 7PM and 1AM in Duraz, and that a 2G tower sent out messages informing users that mobile internet services were down. Lead researcher Bill Marczak also found that one of the telecoms, Batelco, installed a mysterious device on its network to throttle landline connections in Duraz without affecting other areas. Given the timing of the outages and the apparent coordination among the country's ISPs, the authors conclude that "it is possible that the disruptions are a result of a Service Restriction Order (SRO) from the Bahrain government, in relation to the protests." Access Now first reported on the outages in June, citing sources on the ground, but was unable to verify it with technical evidence.
"a new form of information control"
The Duraz protests began after Bahrain's Sunni government revoked the citizenship of a prominent Shia cleric, Ayatollah Sheikh Isa Qassim, who lives in the village. The monarchy has a checkered history of human rights abuses, and has in recent years cracked down on activists, protesters, and perceived political enemies.
The regime has also retained tight control over the internet, regularly blocking websites and arresting dissidents who are outspoken on social media. Last month, an investigation from Bahrain Watch found that Bahrain's ISPs were blocking access to Telegram, the popular encrypted messaging app, apparently at the request of the government. But Bahrain Watch co-founder Al'a Shehabi says the Duraz outages are unique.
"The disruption is indicative of a new form of information control," Shehabi said in an email. "Take the disruption to landline Internet connections we identified: it's essentially the government picking out and 'muzzling,' during protest times, individual anti-government users (likely based on their address)." Such a tactic, she adds, is "not your grandfather's internet shutdown."
The tactic poses problems for researchers, as well. Whereas nationwide internet outages or interference can be identified from outside the country, more localized shutdowns require direct access to affected connections, Marczak said in an email. In the investigation published today, researchers conducted hourly scans of all Batelco's IP addresses, and found that around 12 percent of those that responded (around 2,000 addresses) experienced regular disruptions between 7PM and 1AM. Two corporate clients, Ithmaar Bank and the Al-Wasat newspaper, which is located outside of Duraz, were also affected.
After Al-Wasat reported on the outages on July 12th, Batelco appears to have adopted a more pinpoint approach, using a device on its internet backbone that disrupts traffic only if it is coming to or from the IP address of a targeted individual. Marczak says he was unable to identify the manufacturer of the device or its technical specifications, though he suspects that it's "designed to perform traffic shaping."
In the report, Bahrain Watch calls on the government and ISPs to end the disruptions, provide compensation to those who were affected by them, and to acknowledge any ordered shutdown. The organization also warns that it may be easier for Bahrain and other governments to deploy similar small-scale shutdowns, which may not be detectable to outside researchers.
"Muzzling allows a government to prevent individuals from speaking when the world needs to hear them the most, in a way that is hard for researchers to detect and attribute, all while avoiding the political consequences of large-scale Internet disruption," the report reads.