Pulling the Plug: A Technical Review of the Internet Shutdown in Burma

To view this bulletin as a pdf, click here

Executive Summary

This bulletin examines the role of information technology, citizen journalists, and bloggers in Burma and presents a technical analysis of the abrupt shutdown of Internet connectivity by the Burmese government on September 29, 2007, following its violent crackdown on protesters there.  Completely cutting international Internet links is rare.  Nepal, which severed all international Internet connections when the King declared martial law in February 2005, is the only other state to take such drastic action. Although extreme, the measures taken by the Burmese government to limit citizens’ use of the Internet during this crisis are consistent with previous OpenNet Initiative (ONI) findings in Kyrgyzstan, Belarus, and Tajikistan, where authorities controlled access to communication technologies as a way to limit social mobilization around key political events.  What makes the Burmese junta stand out, however, is its apparent goal of also preventing information from reaching a wider international audience.

The shutdown of Internet connectivity was precipitated by its use by citizens to send photographs, updates and videos that documented the violent suppression of protests in Burma, information that contributed to widespread international condemnation of the Burmese military rulers’ gross violations of human rights.

We examine the impact of communication technology in shaping these key political events in Burma, the limitations of these tools, and the prospects for the next round of information wars.

Introduction

A sudden sharp increase in fuel prices in Burma precipitated rallies in Rangoon on August 19,  2007. Burmese spend up to 70 percent of their monthly income on food alone,(1) making the fuel price hikes amidst chronic inflation untenable. Over the next month, leadership of the protests passed from former student leaders and a number of female activists to Buddhist monks,(2) with participation swelling to an estimated crowd of 100,000 protesters on September 23. Throughout the crisis, citizen journalists and bloggers continued to feed raw, graphic footage and witness accounts to the outside world via the Internet, even through the first days of a violent crackdown beginning on September 26 that left up to 200 dead.(3) These citizen journalists have been described invariably as ‘tech-savvy’ university students and youth.(4) However, through ‘trusted-contact blogging’, multiple generations of Burmese became involved in circulating valuable information not obtainable by traditional means to the rest of the world. Photographs and videos taken with cell phones and digital cameras were dispatched outside the country by way of the Internet and assembled into a patchwork of powerful images.

On September 29, 2007, the Burmese military junta, governing as the State Peace and Development Council (SPDC), raised the stakes of this information warfare by employing a tactic much cruder and more drastic than a firewall. The SPDC made use of its complete control over the country’s Internet gateways to shut down Internet access altogether, and reportedly terminated the majority of cell phone services.(5) It has yet to publicly acknowledge these acts. This was the government’s attempt to immobilize and disarm the essential communication tools used by citizen journalists: cell phones and the Internet.

This bulletin presents the results of ONI monitoring research as well as a technical investigation into the role of bloggers and the Internet during the ‘saffron revolution’ and the ensuing violent crackdown in Burma in September and October 2007.

The Internet, and correspondingly, information technology, has been credited as the transformative platform that sets the ‘saffron revolution’ apart from the ‘8.8.88’ movement. In 1988, a student-led democratic movement was met with a brutal crackdown in which 3,000 Burmese were killed.(6)   However, in the recent events of 2007, a relatively small group of Burmese citizens achieved a disproportionate impact on the global awareness and understanding of this current crisis, despite operating in a very limited online space where information is severely controlled. As a result, the extraordinary applications of technology over the past few months have quickly become a target for expanded government surveillance,(7) so that future protests may take place in a much more constrained context.

Figure 1. Timeline of Events, Aug. 19-Oct. 13, 2007

Internet in Burma

“People from Burma are always asking for information as well as requesting for help and assistance from [the] outside world but very little of their voices reach the world and most are lost in the endless state of the government vacuum.” — Burmese blogger

By the time the protests began, the SPDC had already established one of the world’s most restrictive systems of information control, and had been extending its reach into the Internet despite less than 1 percent of the population having online access.(8) ONI testing conducted in late 2006 demonstrated that the two Burmese Internet service providers (ISPs), Myanmar Posts and Telecom (MPT) and BaganNet/Myanmar Teleport (formerly Bagan Cybertech), filtered extensively. They focused overwhelmingly on independent media, political reform, and human rights sites relating to domestic issues.(9) This confirms filtering trends first documented by ONI in 2005, finding that the state heavily filters political opposition sites, human rights organizations, and e-mail service providers.(10)

Until it shut down Internet access on September 29, the Burmese government did not take an entirely systematic approach to filtering. Of the sites found to be blocked, less than a third were blocked on both ISPs. The remaining blocked sites were blocked on one ISP or the other, but not both.(11) Other significant variations among the ISPs, including the inconsistent blocking of pornography and gambling sites, suggested that distinct filtering methods were being used.

Crackdown on Internet use continues

The effort to bring the Internet under tight control intensified in the past few months and culminated in the complete shutdown of access on September 29. Intermittent blackouts in Internet and telephone access were reported in August amid mounting arrests of fuel hike protesters and increased harassment of journalists.(12) However, because it was focused mainly on constricting incoming political information from overseas, the government was unprepared for the outflow of information over the Internet.

After the shutdown, outside observers were likely to have more information related to the developing situation than people inside Burma.(13) According to one blogger based in Burma, the local news was unreliable and “a bit biased,” while rumors were widespread and became a source of confusion.(14) Unsurprisingly, even non-political or personal blogs have been stalled by the Internet shutdown and the additional filtering enacted by the government.

Prior to the shutdown of the Internet, the number of sites being filtered had increased, including YouTube and Blogspot,(15) which were both available (along with all search engines) at time of testing in late 2006. On October 11, 2007, during a break in the regulated outages, an Internet user in Rangoon reported that many international news sites were blocked, including CNN and Reuters. As of late 2006, Radio Free Asia and OhmyNews were the only international news sites blocked by both BaganNet and MPT. However, many of the major overseas news sites gathering the stream of images and updates as the protests escalated, including Mizzima News (www.mizzima.com), the Democratic Voice of Burma (www.dvb.no), and Irawaddy (www.irrawaddy.org) have been blocked since at least 2005.(16) Both ISPs block many other independent news sites focusing on Burmese issues.

According to ONI sources, Internet cafés in Rangoon were open on October 11 but speeds were slow. Internet speed, controlled with proxy caching servers,(17) had been slowed down to 256 Kbps, likely to prevent or diminish the uploading of videos and photos.(18)

The government is just beginning to investigate Internet users who were involved in political activities and transferring information to news agencies.(19) Along with Internet related services such as travel and Web sites, Internet cafés are still being closed and their computers confiscated, with the government claiming that they illegally used ‘freedom’ software.(20) According to another source, UN offices and other organizations based in the Traders Hotel and the Sakura tower in Rangoon were raided by military forces, as many photos were taken from the height of those buildings.(21)

The MPT has also asked ICT companies to submit letters pledging to avoid involvement in political matters and to control their employees’ Internet usage. Some companies have not signed on yet.(22)

Figure 2. Blockpage found while surfing the Internet in Burma

In search of free expression: the ‘G-lite revolution’

The Burmese government has near-complete control over broadcast and print media. All domestic radio and television stations are state-owned and controlled.(23) While more than 100 print publications are now privately-owned,(24) the Ministry of Information limits licensing to media outlets that agree to print only approved material and submit to vigorous advance censorship by its Press Scrutiny and Registration Division.(25) The Printers and Publishers Registration Law is prodigious in scope, prohibiting the printing of anything “detrimental” to the state, “any descriptions which though factually correct, are unsuitable because of the time or circumstances of their writing”, and “any criticism of a non-constructive type of the work of government departments.”(26) According to the UN Special Rapporteur on Burma, journalists seeking to write about a government ministry must name their source and obtain a letter of authorization from the ministry concerned before publication.(27)

Within this heavily controlled traditional media environment, the Internet has provided a limited means for free expression. With an upper estimate of just under 300,000 Internet users in 2005,(28) Burma is one of thirty countries that has less than 1 percent Internet penetration.(29) Nonetheless, the Internet had begun to enhance a bi-directional flow information and communication for many Burmese, especially the educated, urban elite. In recent years, Burmese have begun receiving information from overseas via basic Internet services such as blogs, chat, forums, and email. As a relatively cheap communication tool, much of the value of Internet is based on the availability of overseas Web sites and Internet services. These internationally hosted services also offer a means to communicate more securely.

Most users access the Internet at Internet cafés,(30) which have witnessed an “explosion of usage,” especially in Rangoon.(31) Anecdotally, it appears that nearly all Internet cafés have installed foreign-hosted proxy sites or servers and other circumvention tools.(32) The ‘G-lite revolution’, one of the names for the incipient movement of citizen journalists feeding information overseas, is coined after a proxy site for accessing Gmail (glite.sayni.net) that is reportedly ubiquitous in Burmese cyber cafés and “resides” on hundreds of servers inside Burma.(33) Citizen journalists and bloggers were actively uploading images and updates in the approximately 200 Internet cafés still open in the days before the Internet was shut down completely.(34)

The ‘G-lite revolution’ depended on small-scale technologies in order for Burmese to be able to circumvent the firewall and gain access to the most basic of Internet services. ONI confirmed that both Burmese ISPs have blocked many of the more prominent circumvention tools, including Proxify, Guardster, and Anonymizer.(35) Gmail, Yahoo! Mail, Hushmail, and mail2web were blocked by both ISPs, while MPT took the precaution of blocking thirteen additional e-mail sites, including Hotmail and Fastmail.

A growing role for bloggers and citizen journalists

Nearly all Burmese bloggers, both local and overseas, are users of Google’s Blogspot. A significant number of bloggers posted about the fuel hike protests, with lively commentary and discussions. According to ONI sources, some political blogs have been banned since mid-2007 and rumors circulated that the rest would be banned if this trend continued, spurring many local bloggers to self-monitor their postings in the hope that their blogs would not be added to the blacklist.(36)

Until the Internet shutdown on September 29, citizen journalists inside Burma maintained contact with overseas bloggers through the use of email, chat, proxies, and free hosting pages.(37) These bloggers were often organized in small networks of less than a dozen individuals, including both local and overseas bloggers. Overseas Burmese bloggers sent back local proxy server links and other tools via email and chats.(38) Through this form of ‘trusted contact blogging,’ photos, updates and news links were transmitted to an overseas web of Burmese who were able to post them to the wider world.

The profile of Burmese bloggers varied considerably across locations, interests, and experience. During the protests, a few new blogs emerged to become among the most active of Burmese blogs, including ko-htike.blogspot.com, myochitmyanmar.blogspot.com and drlunswe.blogspot.com. Other established blogs previously serving as personal journals with a non-political focus turned their attention to providing news and updates, including the Rangoon-based bloggers Dathana (dathana.blogspot.com) and Dawn (www.xanga.com/dawn_1o9). Bloggers with a dedicated focus to political issues, including Niknayman (niknayman.blogspot.com), continue to update regularly.

While those who could use the Internet had access to blogs and overseas sites, most Burmese continued to get their news from satellite TV (e.g. CAN) and overseas radio broadcasts (e.g. BBC and VOA). The state mouthpiece, through television and newspapers, directly addressed this fact when it blamed international news organizations for the unrest, labeling foreign media as “destructionists” and “spies.”(39)

At the same time, many more Burmese began looking to blogs and other online information sources during the crisis.(40) Along with the overseas dissident news sites and international news agency sites, CBoxes (or comment boxes) were an important source of news.(41) Burmese bloggers overseas have noted a marked increase in blog traffic, particularly as older Burmese around the world became aware of the importance of blogs and their usage. For one blogger who wrote in Burmese, linking to news sites nearly doubled traffic,(42) while others blogging in English were picked up frequently by international news outlets.

Emerging technical details of the Internet shutdown

On September 27 and 28, 2007, reports emerged that the Internet had been completely shut down in Burma. ONI researchers have documented the details of the outage. Control over the Internet in Burma is facilitated by the fact that the only two ISPs in Burma are both state-controlled. State-owned telecom Myanmar Posts and Telecom (MPT) is currently the only source of new Internet services.(43) BaganNet/Myanmar Teleport (BaganNet) services most individual users in Burma.

- Shutdown times

ONI researchers were able to determine the outage periods using router paths advertised by the Autonomous Systems (AS) corresponding to these ISPs, recorded by Border Gateway Protocol (BGP) monitors of the RIPE project.(44) The times reported here are in local Burma time.

The outage on MPT, the main government ISP, can be divided in two phases. Phase 1 of the outage was a complete shutdown from September 29 to October 4. The sole exception was one brief period of connectivity on October 1 for 6 hours starting at 18:35. Phase 2 consisted of a regulated outage lasting all day except during the period between approximately 22:00 and 4:00 each night from October 4 through October 12. On October 7, MPT had one extra period of connectivity from 9:40 to 15:37. In addition to Internet connectivity coinciding approximately with the curfew period,(45) we see evidence, from October 9 to October 12, that the Internet was also available from around noon (starting anywhere between 11:00 and 13:00) until approximately 16:00 of each day. As of noon on October 13, MPT appears to have resumed a stable network with few changes in routing paths.

The outage on BaganNet follows a similar pattern, with Phase 1 comprising a complete shutdown from 19:00 on September 29 until 22:24 on the evening of October 4, also with one exception (discussed in the next paragraph). Phase 2 comprises a regulated shutdown all day from October 4 until October 9, except during the curfew period from 22:00 to 4:00. As BaganNet’s Internet connectivity is established via MPT, it was also up from October 9 through October 12 during the approximate curfew period as well as for a period starting between 12:00 and 13:30 for a few hours daily. Two long periods of connectivity thereafter, the first from 22:00 on October 12 to 4:04 on the 13th and the second from 12:05 on October 13 to 22:40 on the 15th, were followed by one long outage, from 20:40 on October 15 to 9:00 on the morning of October 16.

- BaganNet users get ‘accidental’ connectivity

BaganNet, which serves only civilian users and is the smaller of the two ISPs, peers with MPT for international connectivity.(46) This gives MPT a monitoring capability on BaganNet and explains the correspondence in outages. However, a significant exception to this peering arrangement occurred during the recent Internet outage; BaganNet border routers peered with ST Teleport Pte Ltd, a Singapore-based telecom company, for a 6 hour period beginning mid-morning on October 1, allowing BaganNet users to connect to the Internet during that period even though MPT routers had been shut down for almost 36 hours by then. The ramifications of this ‘accidental’ connectivity were perhaps not lost on the Burmese authorities or BaganNet, which promptly shut down its border router that same afternoon (by 16:15 on October 1).

- Gradual shutdown

ONI also looked for signs of how the infrastructure was turned off during these outages. The Burmese Autonomous System (AS), which, like any other AS, is composed of several hierarchies of routers and provides the Internet infrastructure in-country. A switch off could therefore be conducted at the top by shutting off the border router(s), or a bottom up approach could be followed by first shutting down routers located a few hops deeper inside the AS.

A high-level traffic analysis of the logs of NTP (Network Time Protocol) servers indicates that the border routers corresponding to the two ISPs were not turned off suddenly. Rather, our analysis indicates that this was a gradual process: traffic fell to 14 percent of the previous week’s average on September 28, going down to 7 percent of the average on September 29 and zero traffic on September 30. This matches with the BGP data coming from AS 9988 and AS 18399 belonging to MPT and BaganNet respectively.

- Intranet unaffected

Although certain press reports indicated otherwise, the complete technical shutdown of both MPT and BaganNet makes it highly unlikely that MPT was providing Internet connectivity to military offices and high-level officials between September 29 and October 4.(47) Some international organizations and corporations continued to connect to the Internet via satellite, though it is unclear whether the government also had satellite access.(48) However, ONI sources maintain that even with international connectivity shut off, the Burmese Intranet remained functional.(49) Websites ending in .mm were accessible, and government networks were able to transfer data by VPN through the local network.(50) Rangoon residents also tried to communicate via telephone, mobile phone and SMS, but the government reportedly blocked local phone calls and trunks calls in that period.(51)

Figure 3. Internet Shutdown Times in Burma

Perceptions of surveillance

Multiple sources(52) identified the opportunity for improved surveillance as the rationale behind the government’s policy originally limiting Internet access to the curfew hours of 21:00 and 5:00. Not only would the late hours allotted for access significantly reduce the number of users (as most Burmese users do not have home access), but it would also make the task of identifying targeted users easier for a government without much experience in tracking and investigating Internet usage. Government email services are also believed to be under surveillance, with delays of up to 24 hours between the sending and receipt of emails.(53)

Surveillance methods are more effective when there are fewer targets, and a possible strategy of the Burmese regime may be to keep more people offline. The government appears to be pursuing a combination of methods, including the limiting of access, increased filtering, and intimidation and harassment.(54)

Information Wars 2.0

Despite the lack of sophistication displayed by the junta in shutting down the Internet, the recent events in Burma mark a pronounced escalation in the information wars between governments and their critics. Burma provides a rare example of a government also taking extreme measures to keep information from escaping its borders. In pulling the plug on the Internet Burma became only the second country to resort to such drastic action; in 2005 King Gyanendra of Nepal declared martial law and briefly shut down the Internet, along with international telephone lines and cellular communication networks.(55)  

One of the mainstays of the Burmese government’s strategy for restricting information flows in Burma had been Internet filtering, which prevented access to information offered up outside the country.  Websites and blogs are easily blocked as they tend to occupy a distinct, persistent location on the Internet. In this case, however, the junta attempted to sever the bi-directional flow of information so that the picture of reality for people on both sides of the Burmese border would remain distorted. As a result, the targets for censorship expanded exponentially from Web sites that are critical of the junta to any individual with a camera or cell phone and direct or indirect access to the Internet. Moreover, the raw footage coming out of Burma provided a striking narrative of the unfolding events, including some “unforgivable and unforgettable photos,”(56) from views of cheering protesters and protective human chains to the fatal shooting of a Japanese journalist caught on film. This was citizen media in its simplest form, utilizing the cheap sensors and network that have helped to spawn the information revolution without the need for additional editorial input or elaborate post-production work.(57) This distributed form of reporting is, in practical terms, impossible to block completely, prompting the extreme measures taken by the Burmese regime.

Burma joins the growing list of countries that have increased Internet censorship in line with key political events.  This event-based filtering has been documented by the ONI during the March 2005 Kyrgyzstan parliamentary elections,(58) the March 2006 presidential elections in Belarus,(59) and the October 2006 Tajik presidential elections.(60) Election-time filtering has also been reported in other regions, including Uganda,(61) Yemen(62) and Bahrain.(63)

In the current climate of extreme repression, fear, and deep disillusionment,(64) as roundups(65) and abuses(66) continue, bi-directional technologies are put to many uses. Reports are emerging about information technology being used effectively to assist authorities in identifying and targeting citizens. According to the Sunday Times, security forces in Mandalay used Chinese counter-terrorist technology to check the registrations of motorcycles against numbers captured from digital images in the protests.(67) While citizens were capturing protests on video, so were security forces.

The impacts and reverberations of these events are now unfolding for those who engage in civil disobedience as well as for those who seek to suppress dissent. Many Burmese citizens who helped to document the uprising could be implicated by the electronic footprints left behind, while others will remain anonymous by virtue of the numerous existing holes in the Burmese surveillance network. It is not difficult to envision increasingly tighter controls over the Internet and communication infrastructure in Burma, with the rapid deployment of additional surveillance tools, reinforced filtering, and stronger policies to link all Internet-based communication with real identification.  Similarly, we may expect a surge of analogous restrictions in other countries that harbor fears and insecurities mirroring those displayed by the Burmese junta.

While the SPDC has exacerbated its legacy of massive human rights violations through this crackdown, many believe that the breakthrough uses of the Internet over this period have enabled some irreversible gains. Multiple generations of Burmese living locally and abroad have found linkages to each other as blogging became increasingly recognized as a valuable source of information.(68) One Burmese leader characterizes this gain as the forging of a link between the leaders of the generation that participated in 8.8.88, many of whom were jailed or exiled,(69) and the new generation of activists in Burma.(70)

Burmese netizens, operating in a constrained and challenging space in a country with especially low Internet penetration rates, have demonstrated that the tools of information technology can have a strong impact on the global coverage of events as they are unfolding, and sometimes on the events themselves. The events in Burma also provide a chilling example of the limitations of the Internet, access to which was ultimately vulnerable to the unilateral choices of a repressive regime. However, even the vast majority of Burmese without access to or knowledge of the Internet may have benefited from the enduring achievement of a small band of citizen bloggers and journalists—the uploading of vital, relevant information to the Internet was broadcast back in via television and radio and spread through personal networks and communities throughout the country.

Sources