In today's digital society, internet access is essential in everyday life: from conducting business and financial transactions to communicating with others and learning online. When access to the internet is restricted - as has been the case in some South and Southeast Asian countries during times of social unrest - people's lives are significantly disrupted.

What is an internet shutdown, and what happens when the government or other perpetrators impose them? There's more to the definition than cutting off internet access entirely. Internet shutdowns can range from partially blocking access to certain websites to throttling internet speeds. Understanding the various kinds of shutdowns and how they are technically implemented is crucial in civil society efforts to draw attention to these rights-infringing measures and hold perpetrators accountable.

This article explains the different kinds of internet shutdowns, how they are implemented using existing technology, and how civil society groups respond to uphold free internet access.

Myths and misconceptions

Internet shutdowns tend to be associated with complete blackouts or are taken to mean the same thing as internet censorship. A crowdsourced definition from the #KeepItOn coalition defines an internet shutdown as:

[an] intentional disruption of internet or electronic communications, rendering them inaccessible or effectively unusable, for a specific population or within a location, often to exert control over the flow of information.

This definition shows that a shutdown is more than no connectivity. Mobile service disruptions, throttling or slowing down connections, or selectively blocking certain platforms are all considered internet shutdowns.

How about internet censorship? While internet shutdowns can be considered forms of censorship (because network disruptions prevent people from posting content or expressing themselves online), not all instances of internet censorship are considered shutdowns. According to Access Now, the difference lies in the primary purpose of the blocked platforms. The definition above highlights the disruption of electronic communications; if platforms that are designed for multi-way communications, such as WhatsApp, Facebook, and Twitter are blocked, these would be considered internet shutdowns. But when platforms that primarily publish content are blocked - such as news websites - these would be considered forms of internet censorship.

Common justifications for imposing internet shutdowns

Aside from censorship and information control, state perpetrators of internet shutdowns invoke various justifications for imposing these network disruptions. Deniz Duru Aydin, a former Policy Fellow at Access Now, lists some of the common government excuses:

• National security: This is the most common and vague justification for internet shutdowns. The irony is that people don't feel safe and secure when they have no access to information and are disconnected from their loved ones.

• Elections: Governments impose shutdowns supposedly to stop the spread of election-related disinformation. In reality, however, shutdowns hinder election monitoring and communications for journalists and poll watchdogs.

• Protests: Shutdowns are used during protests supposedly to maintain law and order, but these network disruptions block people from knowing the real situation.

• School exams: Implemented in an attempt to stop cheating, shutdowns disproportionately affect millions instead of the intended few.

• Visits by government officials: To keep government officials or foreign political leaders safe, governments opt to impose shutdowns, interfering with people's rights to access information.

In recent years, these excuses have been invoked by governments in several South and Southeast Asian countries. The two regions are home to some of the top offenders in internet shutdowns, according to a report from Access Now. In 2021, 128 shutdowns were recorded in Afghanistan, Bangladesh, India, Indonesia, Myanmar, and Pakistan, although the true figures are likely higher.

India has consistently topped internet shutdown rankings, recording at least 665 internet shutdowns since 2012. Myanmar is also one of the top offenders, imposing at least 15 shutdowns in 2021 following the military coup. Amid public protests, the junta ordered the blocking of social media and internet access and, in recent years, has moved to reintroduce a draconian measure that would regulate the use of virtual private networks.

In Indonesia, West Papua made headlines over multiple shutdowns recorded in 2019, and in 2021 a court ruled that blocking internet access amid social unrest was lawful. Internet shutdowns have also been imposed multiple times in Bangladesh to quell protests, control instability over religious tensions, and prevent rumours and propaganda in the lead-up to the national elections. Similar network disruptions have been reported in Pakistan, particularly in its restive border regions; the Philippines during the 2015 Papal visit and other festivities; and Sri Lanka during recent protests stemming from an economic crisis.

How the internet works

Before getting into the technical aspects of internet shutdowns, it's important to understand how the internet works. The Oxford Dictionary defines the internet as:

[a] global computer network providing a variety of information and communication facilities, consisting of interconnected networks using standardized communication protocols.

The internet is a computer cluster connected to a router, which is then connected to other routers managing clusters of connected computers. The internet service provider (ISP) connects these routers through wired or wireless connections. For end users to access the internet, they use web access software (internet browsers) on their computers to connect to servers, which are specialised computers that store data for webpages or apps.

When someone types a web address into their browser, several things happen in the background:

• The browser navigates to the domain name system (DNS) server and finds the internet protocol (IP) address of the server which hosts the website.

• Now that the browser knows the actual location of the website, it sends a Hypertext Transfer Protocol (HTTP) request to the server, asking it to send the requested data to the client. This message, and all other data sent between the client and the server, are sent across the internet connection using Transmission Control Protocol (TCP)/IP.

• The server then sends a "200 OK" message and sends the website's files to the browser as a series of small chunks called data packets.

• The browser will assemble all the data packets into a complete web page to display it for the user.

As illustrated here, many components are involved when accessing a website. When an internet shutdown happens, several of these components are usually targeted. Understanding the structure of the internet and how it works is crucial to recognise at which points of the network an internet shutdown happens and how it was executed.

How internet shutdowns are technically implemented

As seen from the brief description of how the internet works, many components make up the infrastructure of the World Wide Web. Internet shutdowns can be implemented at various points of the network. Access Now, Jigsaw, and other organisations researching internet shutdowns have identified the following as some of the most common execution points:

1. International internet backbone: Underwater optical fibre cable connections provide high-speed internet connectivity. If any damage or disruption occurs at this network point, all users and services hosted in the affected country will be impacted.

2. Internet gateway: This plays a very important role in internet connectivity in a country as it connects international internet traffic to the local network.

3. National and local internet service providers: ISPs provide internet connection to certain areas. If disruptions occur at this point, all users connected to the network will be affected.

4. Single spot (single cellphone tower or specific small area): Network disruptions at this level result in a very targeted shutdown, as only the subscribers of the targeted cellphone tower will be affected.

How do perpetrators execute internet shutdowns? Is there an "on" and "off" switch for the internet?

When the government controls the internet infrastructure (through state-owned service providers), it can restrict access on its own without going through another party. Otherwise, perpetrators order ISPs to restrict network connectivity or block certain websites. Depending on the aim of the network disruption, ISPs use one of the methods listed below:

1. Fundamental infrastructure shutdown: This type of internet shutdown is caused by the failure of or damage to the physical communications infrastructure necessary for internet services. An example would be the physical destruction of a power grid or cellphone tower.

2. Routing: Manipulating network routine works by altering the route information at key points (for example, international gateways) so that network traffic is blocked and does not pass beyond the controlled infrastructure.

3. DNS manipulation: DNS is a naming system that translates human-readable domain names (like google.com) to machine-readable IP addresses (like 142.251.32.46). Manipulating DNS information can cause the shutdown of targeted services. This happens when DNS information is manipulated to direct users to either a non-existent server or a server controlled by the perpetrator.

4. Filtering: In this type of shutdown, commercial filtering appliances and transparent proxy devices are used to block access to internet services. These filtering devices analyse the metadata from network traffic and then allow or block access based on that metadata.

5. Throttling: In this type of shutdown, data flow through the network is restricted but not completely stopped. Access to the internet or particular services is slowed down to render the service or resource effectively unusable; for example, by downgrading mobile internet to 2G or capping data speeds.

6. Deep Packet Inspection: In this type of shutdown, network data is inspected and screened. If the data packet is found to be non-compliant with the criteria set by the shutdown perpetrator, the data packet is blocked from passing through the inspection point.

7. Denial of Service (DoS) attack: This attack is meant to shut down a machine or network, making it inaccessible to users. Fake traffic is sent to the targeted platform or server to keep it busy and prevent it from providing data to users.

Raising awareness on internet shutdowns

Several research institutions and civil society groups are tracking and monitoring internet shutdowns worldwide. This includes the Open Observatory of Network Interference (OONI), which developed a mobile app to measure the blocking of websites and publishes this data on the OONI Explorer. The Internet Outage Detection and Analysis (IODA) project monitors the internet to identify macroscopic internet outages affecting the edge of the network, while Censored Planet collects data in over 200 countries to determine the presence or absence of censorship. Through its Transparency Reports, Google publishes data on traffic to its products, documenting real-time access disruptions that indicate shutdowns. Several research reports and resources have also been released to document internet shutdown incidents worldwide, published by groups such as OONI, Access Now, and EngageMedia.

This work of monitoring and documenting internet shutdowns is crucial to raise public awareness and pressure authorities to hold perpetrators accountable for these rights violations. While governments justify internet shutdowns as necessary for national security and public order, these broad measures smother freedom of expression, hinder journalists and activists from doing their jobs, and have many economic, political, and social costs.

By documenting internet shutdowns and increasing public knowledge and awareness on circumventing and reporting access restrictions, digital rights advocates and civil society can more effectively strengthen ongoing efforts to resist this form of digital authoritarianism.

It has been produced by EngageMedia as part of the Greater Internet Freedom Program. Read the report titled "Opening up the Technical Aspects of Internet Shutdowns: Spotlight on South and Southeast Asia Cases".