The State of Internet Censorship in Egypt

Date : Monday, 2 July, 2018

Methodology: Measuring internet censorship in Egypt

To measure internet censorship in Egypt, we ran OONI’s network measurement software (called OONI Probe) on a daily basis across multiple local vantage points. OONI Probe is free and open source software designed to measure various forms of network interference.

The main OONI Probe tests that we ran as part of this study include:

Given that the Egyptian government ordered the blocking of 21 news websites, running OONI’s Web Connectivity test was core to this research to collect network measurement data that shows which websites are blocked, how they are blocked, and which ISPs implement the blocks.

OONI’s Web Connectivity test is designed to measure whether websites are blocked by means of DNS tampering, TCP/IP blocking, or by an HTTP transparent proxy. This test is automatically performed both over the vantage point of the user and from a non-censored control vantage point. If the results from both vantage points match, then the tested website is most likely accessible. If the results however differ, then the measurement is flagged as anomalous. OONI’s current methodology only confirms the blocking of a website if a blockpage is served. In cases where ISPs do not serve blockpages, the relevant network measurements are analyzed over time, examining whether the specific types of failures persist and what causes these failures (i.e. ruling out false positives).

The testing was mostly limited to the URLs included in the Citizen Lab’s global and Egyptian test lists. These lists consist of a variety of different types of URLs that fall under 30 categories and that are tested for censorship by network measurement projects like OONI. Throughout the course of this research, we updated the Egyptian test list several times to ensure that reportedly blocked sites were being tested. Overall, 1,808 URLs, included in both the Citizen Lab’s global and Egyptian test lists, were measured as part of this study.

In an attempt to identify which equipment was used to implement internet censorship in Egypt, we ran OONI’s HTTP Invalid Request Line and HTTP Header Field Manipulation tests. Both tests are designed to measure networks with the aim of identifying the presence of middleboxes. OONI’s HTTP Invalid Request Line does this by sending an invalid HTTP request line to an echo server listening on the standard HTTP port. If a middlebox is present, the invalid HTTP request line will be intercepted by the middlebox, potentially triggering an error that will be sent back to OONI servers. In the past, this has enabled the identification of censorship equipment in various countries around the world. OONI’s HTTP Header Field Manipulation test, on the other hand, attempts to identify middleboxes by sending HTTP requests with non-canonical HTTP headers. If a middlebox is present, it will likely normalize the headers or add extra headers, enabling the identification of its presence in the network. In addition to OONI Probe tests, we also performed latency tests and other network measurement tests via Raspberry Pi deployments in Egypt.

To monitor the accessibility of popular instant messaging platforms over time, we ran OONI’s WhatsApp, Facebook Messenger, and Telegram tests. These tests are designed to measure the reachability of the WhatsApp, Facebook Messenger, and Telegram apps and web interfaces through DNS lookups and by attempting to establish TCP connections to their endpoints.

In light of increased censorship events over the last year, we decided to monitor the accessibility of censorship circumvention tools as well. Many circumvention tool sites were included in the Citizen Lab’s global test list, which we measured via OONI’s Web Connectivity test. But we also ran OONI’s Vanilla Tor and Tor Bridge Reachability tests, which are designed to measure the blocking of the Tor network and Tor bridges.

Once network measurement data was collected from all of these tests, OONI data was subsequently processed and analyzed based on a standardized set of heuristics for detecting internet censorship and traffic manipulation. We analyzed all OONI Probe network measurements collected from Egypt between January 2017 to May 2018.

Acknowledgement of limitations

The findings of this study present limitations.

The first limitation is associated with the testing period. This study includes an analysis of hundreds of thousands of network measurements collected from networks in Egypt between January 2017 to May 2018. Censorship events that may have occurred before and/or after the analysis period are not examined as part of this study.

Another limitation to this study is associated to the amount and types of URLs that were tested for censorship. OONI’s Web Connectivity test was run to measure the accessibility of 685 URLs that are more relevant to the Egyptian context and 1,123 internationally relevant sites. All of these URLs were selected and categorized in collaboration with community members over the last years. We acknowledge that some URLs might potentially be mis-categorized, the selection of the URLs may have been biased, and that the testing sample of URLs might exclude many other sites that are blocked in Egypt. We therefore encourage researchers and community members to continue reviewing and contributing to these test lists to help improve future research and analysis.

Finally, while network measurements were collected from multiple local vantage points in Egypt, OONI’s software tests were not run consistently across all networks. We therefore limited most of our analysis to the networks where measurements were collected from the most (allowing for more accurate data analysis over time): Vodafone Egypt (AS36935), Link Egypt (AS24863), Telecom Egypt (AS8452) and Noor (AS20928).