The Psiphon network supported a peak 1.76 million daily active users during significant network interference that started August 9th, a figure that represents nearly 1 in every 3 internet users.
A large-scale disruption to international internet access was observed in Belarus, beginning during the contested presidential election on August 9th. Widespread filtering was reported across all Belarusian networks, affecting popular messaging apps including Telegram, Viber, and WhatsApp; social media platforms Facebook, Twitter, Instagram, and Youtube; major app markets including Google Play and the App Store; email providers Gmail, Mail.ru, and Yandex; maps, banking, online media, and many other services. Rolling blackouts of the mobile networks also occurred nightly between 6PM and 6AM. The majority of VPNs were reportedly blocked as a result of generalized SSL/TLS filtering. Tor direct connections were disrupted by the increased network change, while Tor bridge users reached a peak 8,000 per day during the shutdown period. Network outages were tracked by RIPE Labs, Oracle Internet Intelligence, IODA, and other network monitors.
Traceroute completions on main mobile operator MTS Belarus (AS25106) showed clear outages through 60280 and 6697 (source: Oracle)
As a backdrop to the network disruptions, Belarus had entered its largest mass demonstrations in history.
Psiphon network performance and session quality remained at or above the regional average over the days of the shutdown. While the generalized disruption of SSL at the transport layer disrupted the core functionality of many VPNs, the traffic obfuscation and multiprotocol structure used by Psiphon provides greater resilience to protocol-based blocking, with network traffic able to adapt dynamically to the very restrictive new filtering scheme.
A key observation by Qrator Labs is the high level of centralization of control over Belarusian networks. DPI equipment installed at the point of international gateways allows the upstream operators to disconnect or pass filtering rules to downstream ISPs. Researchers documented a similar network topology in Iranian ASes last year. In November 2019, Iran executed an extensive disconnection of international internet connectivity that lasted for 10 days.
Indeed, the current generation of DPI filtering technologies can be leveraged at various forms of encrypted internet traffic, increasingly deployed at national scale and at capacities approaching 1TBit/s. In these circumstances access to resilient circumvention infrastructures such as Psiphon remains crucial to the free exchange of information.
Journalists reported difficulty freely accessing and reporting information from the country, and recommended Psiphon. Internet users noted Psiphon was one of the few tools able to bypass . Even with the attempted blocking of the app stores and Psiphon sites, users acquired the software via alternate distribution channels, such as email responder and proxy. Additionally, Belarusian users distributed Psiphon binaries via Telegram channels, hosted URLs, and even on USB. Use of the Psiphon network surged to a peak 1.76 million daily active users; given a population of 9.5 million and internet penetration rate of 60%, a figure that represents 30% of internet users in Belarus. Total bandwidth transferred from Belarus via Psiphon between Aug 9-17 exceeded 2 Petabytes. Circumvention tools proved a vital infrastructure to freely access information, as well as basic communications and services.
From the Psiphon Data Engine (PDE) public dashboard (https://psix.ca/)
Psiphon network performance and session quality remained at or above the regional average over the days of the shutdown. While the generalized disruption of SSL at the transport layer disrupted the core functionality of many VPNs, the traffic obfuscation and multiprotocol structure used by Psiphon provides greater resilience to protocol-based blocking, with network traffic able to adapt dynamically to the very restrictive new filtering scheme.
Bytes per hour, Belarus. A peak 55 Terabytes / h were transferred via the Psiphon network.
Indeed, the current generation of DPI filtering technologies can be leveraged at various forms of encrypted internet traffic, increasingly deployed at national scale and at capacities approaching 1TBit/s. In these circumstances access to resilient circumvention infrastructures such as Psiphon remains crucial to the free exchange of information.