Gaps in the Record: On the Observability and Documentation of Internet Shutdowns
Simon Cheek, Zachary S. Bischof, Amanda Meng, Alberto Dainotti
https://www.petsymposium.org/foci/2026/foci-2026-0015.php
PDF
Source code and data
This paper is a comparison of two different data sets on Internet shutdowns: a curated list of detections by IODA (Internet Outage Detection and Analysis), and Access Now’s #KeepItOn Shutdown Tracker Optimization Project. The authors of the paper represent IODA. Their primary goal is to analyze the cases where the #KeepItOn data set documents an event but the IODA data set does not; these are called “unmatched” events.
IODA works by analyzing certain network signals: BGP, Active Probing, and Telescope (which are described in a 2023 paper); as well as Google Search, in some cases. Events are added to the IODA database mainly through automated alerts that detect disruptions in these signals. In contrast, the #KeepItOn data set is sourced from news reports, first-hand observations, and government orders, as well as network signals from IODA and other measurement projects. Because of these differences in methods, not all shutdowns included in the #KeepItOn appear in the IODA data set. And the discrepancy is increasing: starting in 2022, there’s a noticeable increase in the overall rate of unmatched events.
The authors seek to understand what it is about the nature of recent events that causes them to be unnoticed by IODA. Their observations are based on manual analysis of 73 unmatched events since 2022. They identify three recurring characteristics that commonly cause shutdown events to be unmatched:
- Prolonged armed conflict
- The countries with the highest rate of unmatched events (Table 3) are Palestine, Ukraine, Myanmar, and Sudan, all of which have been sites of armed conflict in recent years. Outages and shutdowns in these regions are attributable to destruction of infrastructure, seizure of data centers, and cable cuts. Recovery from damage like this is gradual, not abrupt; the change in network signals is not so clear.
- AS-targeted national shutdowns
- In some cases, #KeepItOn reports a nationwide shutdown, when in fact not all networks in a country were affected. An example is Senegal in 2023. The nationwide measurements show only a slight decrease in traffic levels. That is because the shutdown actually only affected two ISPs, AS37196 and AS37649, in which clear shutdown patterns are visible in Cloudflare Radar data.
- Application-layer blocking
- It is becoming more common for shutdowns to be implemented using application-layer layer techniques, rather than at the level of routing, and this makes them less visible to IODA. A case cited is Sudan in 2022. There were daily, countrywide application-layer shutdowns lasting a few hours each; but despite this, there was no observable change in IODA's BGP, Active Probing, and Telescope signals. The effect is clearly visible, however, in the Google Search data, as well as in Cloudflare Radar.
The paper shows some of the challenges of detecting and documenting Internet shutdowns. It concludes with some ideas for enhancing IODA’s detection: taking the natural periodic behavior of Telescope signals into account; building in knowledge of the time of day at which shutdowns commonly occur (often in the early morning); and looking for periodic (daily) repetitions of shutdown-like patterns.
Thanks to the authors for reviewing a draft of this summary.