Internet providers in Sri Lanka are in the vanguard of blocking access to digital security tools that allow users to work around censorship, according to new NetBlocks network measurement data.

On Sunday, Sri Lanka restricted access to social media platforms following a series of deadly attacks on churches and hotels. The new VPN restrictions appear to target users who have been circumventing censorship measures, which the government says are in place to prevent the spread of disinformation. Critics caution that the filtering measures are an impediment to independent media coverage and free expression as Sri Lanka comes to terms with the attacks.

Report: Social media and messaging apps are still blocked in #SriLanka 75 hours after restrictions were introduced. Now, data shows a new wave of VPN blocks limiting media coverage and free expression in the wake of the attacks #SriLankaBombings #KeepItOnhttps://t.co/7Kft3PfBXI pic.twitter.com/Ss72m6zbuf — NetBlocks.org (@netblocks) April 24, 2019

Sri Lanka joins a handful of states that implement similar controls on VPN services and internet protocols that tunnel network traffic from point to point:

Virtual private networks enhance privacy and also allow users to work around internet restrictions. VPN usage is common in among journalists and in ICT, consulting and financial sectors, where they are often required for security reasons.

Data shows that one of the most prominent commercial VPN providers was blocked at 4 AM UTC Monday morning, 9:30 AM local time one day after the attacks and initial response:

United Arab Emirates-owned provider Etisalat, implicated last week in the blocking of opposition political websites during Egypt’s constitutional referendum, is blocking several VPN providers in Sri Lanka using two distinct DNS poisoning techniques. In this case, Etisalat subsidiary Tigo’s servers were found to be impersonating the blocked companies’ authoritative DNS servers:

The new NetBlocks findings, collected with assistance from volunteers across Sri Lanka, help build a timeline of Sri Lanka’s expanding censorship measures through recent days.

Technical evidence corroborates user reports of difficulty downloading, installing and connecting to various VPN services, widely used by Sri Lankans as a means to access blocked social media sites and messaging apps following Sunday’s attacks, further indicating that they have been implemented on a separate schedule to the social blocks. The restrictions come amid criticism of the government’s handling as citizens come to terms with the situation.

Sri Lanka previously blocked social media in March 2018 for a period of eight days, restricting access to a similar set of digital platforms and incurring an estimated $30m cost to the country’s GDP.

Methodology

Internet performance and service reachability are determined via NetBlocks web probe privacy-preserving analytics. Each measurement consists of latency round trip time, outage type and autonomous system number aggregated in real-time to assess service availability and latency in a given country. Network providers and locations enumerated as vantage point pairs. The root cause of a service outage may be additionally corroborated by means of traffic analysis and manual testing as detailed in the report.

NetBlocks is a civil society group working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives for an open and inclusive digital future for all.