{"id":27096,"date":"2020-08-11T10:31:36","date_gmt":"2020-08-11T07:31:36","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=27096"},"modified":"2025-08-26T18:45:47","modified_gmt":"2025-08-26T15:45:47","slug":"ddos-attacks-or-national-internet-isolation-what-is-happening-to-belaruss-internet","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/ddos-attacks-or-national-internet-isolation-what-is-happening-to-belaruss-internet\/","title":{"rendered":"DDoS Attacks or National Internet Isolation: What Is Happening to Belarus&#8217;s Internet"},"content":{"rendered":"<p>On August 9, the main day of voting in Belarus&#8217;s presidential election, internet outages were reported across the country from early on. Since then, the internet in the country has never fully recovered.<\/p>\n<div class=\"wp-block-text-wrappers-keypoints article_keypoints\">\n<ul class=\"wp-block-list\">\n<li>Belarusian authorities attributed the internet problems to interference from abroad and DDoS attacks. Experts say the traffic was throttled by state monopolies \u2014 Beltelecom and NCOT.<\/li>\n<li>The outages may have been caused by the use of DPI equipment. It was also installed in Russia to implement the \u201csovereign Runet.\u201d<\/li>\n<li>For communication and accessing websites, Belarusians used the Psiphon anonymizer and Telegram.<\/li>\n<\/ul>\n<\/div>\n<p><!--more--><\/p>\n<blockquote class=\"wp-block-quote twitter-tweet is-layout-flow wp-block-quote-is-layout-flow\">\n<p dir=\"ltr\" lang=\"ru\">Connectivity disappeared across the country about three hours ago. Then links began to restore, but very selectively.<\/p>\n<p>All of this looks very bad. <a href=\"https:\/\/t.co\/NhWb4LpKBf\">pic.twitter.com\/NhWb4LpKBf<\/a><\/p>\n<p>\u2014 Internet Protection Society (@safe_runet) <a href=\"https:\/\/twitter.com\/safe_runet\/status\/1292401753615458311?ref_src=twsrc%5Etfw\">August 9, 2020<\/a><\/p>\n<\/blockquote>\n<p><script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Throughout the election day, Belarusians experienced problems logging onto websites, using messaging apps and mobile networks. By evening, the situation had deteriorated.<\/p>\n<blockquote class=\"wp-block-quote twitter-tweet is-layout-flow wp-block-quote-is-layout-flow\">\n<p dir=\"ltr\" lang=\"en\">Update: Multiple Internet providers in <a href=\"https:\/\/twitter.com\/hashtag\/Belarus?src=hash&#038;ref_src=twsrc%5Etfw\">#Belarus<\/a> have lost routing as polling stations start to close from 8:00 p.m.; geolocated network data confirm the new disruption has nation-scale impact further limiting visibility of events <a href=\"https:\/\/twitter.com\/hashtag\/Belarus2020?src=hash&#038;ref_src=twsrc%5Etfw\">#Belarus2020<\/a><\/p>\n<p>? <a href=\"https:\/\/t.co\/JcBhvhgVcR\">https:\/\/t.co\/JcBhvhgVcR<\/a> <a href=\"https:\/\/t.co\/EANVovMoWH\">pic.twitter.com\/EANVovMoWH<\/a><\/p>\n<p>\u2014 NetBlocks.org (@netblocks) <a href=\"https:\/\/twitter.com\/netblocks\/status\/1292534647491112962?ref_src=twsrc%5Etfw\">August 9, 2020<\/a><\/p>\n<\/blockquote>\n<p><script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On August 10, the Internet was still working poorly, but with some improvements.<\/p>\n<p>The problems were not limited to Belarus \u2014 local sites did not work in other countries.<\/p>\n<p>The incumbent president, Alexander Lukashenko, attributed the connectivity problems to interference from abroad.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abSomeone is itching to cause trouble; they are urging people to take to the streets. Even from abroad they disconnect the Internet to provoke public discontent. Our specialists are now examining where this blockage is coming from. Therefore, if the Internet is not working well, it is not our initiative, it is from abroad,\u00bb \u2014 Lukashenko is quoted by <a href=\"https:\/\/www.belta.by\/president\/view\/lukashenko-internet-v-belarusi-otkljuchajut-iz-za-granitsy-eto-ne-initsiativa-vlasti-402299-2020\/\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">BELTA<\/span><\/a>.<\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">The country\u2019s main operator Beltelecom<\/span> <a href=\"https:\/\/tech.onliner.by\/2020\/08\/09\/belorusy-zhaluyutsya-na-problemy-s-dostupom-v-internet\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">stated<\/span><\/a><span style=\"font-weight: 400;\"> that outages were caused \u201cby foreign traffic in large volumes.\u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The National Computer Incident Response Centre <\/span><a href=\"https:\/\/cert.by\/?p=1722\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">reported<\/span><\/a><span style=\"font-weight: 400;\"> DDoS attacks on the BY-NET infrastructure. According to the centre, the attacks used UDP Flooding, UDP Fragment, UDP0 Flooding, DNS Flooding, ICMP Misuse and NTP Flooding.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The National Traffic Exchange Centre (NCOT) spoke of \u201cobserved DDoS attacks.\u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Nevertheless, experts believe that foreign intervention is unlikely to be responsible for the disruption of Belarus&#8217;s Internet, and the DDoS explanation could be plausible if context is ignored.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abThe incoming traffic within the attack could overload Beltelecom&#8217;s not-very-wide channels into the country, causing internet performance to degrade for all users. But we understand the context \u2014 the authorities have motivation to shut down the Internet, and there is no motive to attack government resources,\u00bb said <a href=\"https:\/\/zona.media\/online\/2020\/08\/09\/vybary-online\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">Meduza<\/span><\/a><span style=\"font-weight: 400;\"> founder Vladislav Zdolnikov.<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">He <a href=\"https:\/\/t.me\/itsorm\/1897\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">called<\/span><\/a><span style=\"font-weight: 400;\"> in his Telegram channel reports of DDoS attacks on state resources \u201cvery funny news.\u201d In Zdolnikov&#8217;s view, Belarus is \u201ctinkering with BGP connectivity \u2014 i.e., disconnecting links to certain Internet segments.\u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">NetBlocks founder Alt Tokar <a href=\"https:\/\/netblocks.org\/reports\/internet-disruption-hits-belarus-on-election-day-YAE2jKB3\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">stated<\/span><\/a><span style=\"font-weight: 400;\"> that various Internet platforms were taken offline at different times:<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abAt the moment when some social networks and sites are blocked, access to others remains open. This appears to be a game in a specific Internet segment, where someone is trying to limit one platform\u2019s operation while taking other services offline. We are dealing, apparently, with a very costly and crude approach to restrictions\u00bb.<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">Lockouts in Belarus can operate effectively because the country maintains a monopoly on international Internet exit, according to independent ForkLog expert Alexander Isavin.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abAnd if there\u2019s one hole, you simply close it,\u00bb<\/span> he <a href=\"https:\/\/t.me\/itsorm\/1897\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"font-weight: 400;\">added<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">The monopolists are Beltelecom and NCOT. All cross-border data transmission by other providers and operators is tied to these companies, said Mikhail Klimarev, executive director of the Internet Protection Society.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">According to experts, Internet problems could stem from authorities&#8217; use of deep packet inspection (DPI) equipment for blocking.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abWhat happened resembles clumsy experiments with DPI usage. At NCOT they tried to build a blocking system for disfavored sites and apps in a single day,\u00bb said ForkLog&#8217;s chief technical officer of RosKomSvoboda, Stanislav Shakirov.<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">There is information that as far back as 2018 NCOT planned to buy similar equipment.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If DPI was indeed used to block disfavored resources, it was not fully successful, but many areas of activity were affected.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In addition to many sites and messaging apps, problems began with cashless payments and navigation services.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abWhen you try to jam all unidentified traffic that might be VPN, Tor or other anonymity tools, you inevitably run into the blocking of critical infrastructure. Including financial infrastructure,\u00bb<\/span> said Stanislav Shakirov.<\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">Many VPN services were nonetheless blocked, as were most popular messaging apps.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abSince yesterday our platform has been blocked in Belarus, our users cannot communicate with their friends and family, and we cannot even reach our own staff through the app,\u00bb<\/span> said Viber&#8217;s chief executive <span style=\"font-weight: 400;\">\u0414\u0436\u0430\u043c\u0435\u043b \u0410\u0433\u0430\u0443\u0430<\/span>.<\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">Belarusians use the Psiphon anonymizer and Telegram to access services.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abPeople could still communicate with each other in some way. It\u2019s important that Telegram was able to work under such conditions when almost nothing else was functioning,\u00bb<\/span> emphasized Mikhail Klimarev.<\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">Telegram founder Pavel Durov said the messenger had enabled anti-censorship tools for Belarusian users, but noted that the Internet in the country \u201cis sometimes completely down.\u201d<\/span><\/p>\n<blockquote class=\"wp-block-quote twitter-tweet is-layout-flow wp-block-quote-is-layout-flow\">\n<p dir=\"ltr\" lang=\"en\">We enabled our anti-censorship tools in Belarus so that Telegram remained available for most users there. However, the connection is still very unstable as Internet is at times shut off completely in the country. <a href=\"https:\/\/t.co\/eA4S6Zz36H\">https:\/\/t.co\/eA4S6Zz36H<\/a><\/p>\n<p>\u2014 Pavel Durov (@durov) <a href=\"https:\/\/twitter.com\/durov\/status\/1292912756233048064?ref_src=twsrc%5Etfw\">August 10, 2020<\/a><\/p>\n<\/blockquote>\n<p><script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Rights advocates describe the situation as a \u201cstate Internet shutdown\u201d and an assault on freedom of expression. More than 30 organisations have written an urgent appeal to the UN Special Rapporteurs on freedom of expression, peaceful assembly and human rights in Belarus.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u00abThe Belarusian state operator Beltelecom and the National Traffic Exchange Centre said this was a DDoS attack. We interpret the situation as an attempt to isolate the national Internet segment,\u00bb the letter said.<\/p>\n<\/blockquote>\n<p><a style=\"text-decoration: underline;\" title=\"View Internet disruptionin Belarus on Scribd\" href=\"https:\/\/www.scribd.com\/document\/472079790\/Internet-disruptionin-Belarus#from_embed\">Internet disruptionin Belarus<\/a> by <a style=\"text-decoration: underline;\" title=\"View ForkLog's profile on Scribd\" href=\"https:\/\/www.scribd.com\/user\/456422024\/ForkLog#from_embed\">ForkLog<\/a> on Scribd<\/p>\n<p><iframe loading=\"lazy\" id=\"doc_96614\" class=\"scribd_iframe_embed\" title=\"Internet disruptionin Belarus\" src=\"https:\/\/www.scribd.com\/embeds\/472079790\/content?start_page=1&#038;view_mode=scroll&#038;access_key=key-k5loQQiOzosx9qnt5cFt\" scrolling=\"no\" data-auto-height=\"false\" data-aspect-ratio=\"0.7068965517241379\" width=\"100%\" height=\"600\" frameborder=\"0\"><\/iframe><\/p>\n<p><span style=\"font-weight: 400;\">DPI equipment for implementing the so-called sovereign Runet law was installed in Russia as well.<\/span><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><span style=\"font-weight: 400;\">\u00abThat very dream of a sovereign Runet \u2014 it was realized in Belarus. Nobody liked it,\u00bb<\/span> said Mikhail Klimarov <span style=\"font-weight: 400;\">.<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-weight: 400;\">As of writing, full Internet operation in Belarus had not yet been restored.<\/span><\/p>\n<p><em>Author: Alina Saganovskaya.<\/em><\/p>\n<p>Subscribe to ForkLog news on Telegram: <a href=\"https:\/\/t.me\/forklogfeed\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ForkLog Feed<\/a> \u2014 the full news stream, <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ForkLog<\/a> \u2014 the most important news and polls.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On August 9, the main day of voting in Belarus&#8217;s presidential election, internet outages were reported across the country from early on. Since then, the internet in the country has never fully recovered.<\/p>\n","protected":false},"author":1,"featured_media":27097,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[1144],"tags":[239,1445],"class_list":["post-27096","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-longreads","tag-belarus","tag-internet"],"aioseo_notices":[],"amp_enabled":true,"views":"33","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/27096","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=27096"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/27096\/revisions"}],"predecessor-version":[{"id":27098,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/27096\/revisions\/27098"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/27097"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=27096"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=27096"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=27096"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}