The rise in internet blackouts shows that the internet is becoming more centralized—and increasingly vulnerable to manipulation.
On the first day of the new year, the Democratic Republic of Congo cut internet connections and SMS services nationwide—for the second day in a row. The reason? To avoid the “chaos” that might result from its presidential election results. Not even a week later, on Jan. 7, Gabon’s government did the same after an attempted coup. On Tuesday, Zimbabwe cut off social media and internet access. The government restored much of the internet Wednesday but kept a WhatsApp ban in place. And it’s unlikely that these will be the last “internet blackouts” we hear about over the coming months. (All three of these incidents, ironically, took place after I outlined this piece.)
In fact, we’ll likely see a rise in internet blackouts in 2019, for two reasons: countries deliberately “turning off” the internet within their borders, and hackers disrupting segments of the internet with distributed denial-of-service attacks. Above all, both will force policymakers everywhere to reckon with the fact that the internet itself is increasingly becoming centralized—and therefore increasingly vulnerable to manipulation, making everyone less safe.The first method—states deliberately severing internet connections within their country—has an important history. In 2004, the Maldivian government caused an internet blackout when citizens protested the president; Nepal similarly caused a blackout shortly thereafter. In 2007, the government of Myanmar apparently damaged an underwater internet cable in order to “staunch [sic] the flow of pictures and messages from protesters reaching the outside world.” In 2011, Egypt cut most internet and cell services within its borders as the government attempted to quell protests against then-President Hosni Mubarak. Libya then did the same after its own unrest. In 2014, Syria had a major internet outage amid its civil war. In 2018, Mauritania was taken offline entirely for two days when undersea submarine internet cables were cut, which was around the same time Sierra Leone’s government may have imposed an internet blackout in the same region.
When we think about terms like cyberspace and internet, it can be tempting to associate them with vague notions of a digital world we can’t touch. And while this is perhaps useful in some contexts, this line of thinking forgets the very real wires, servers, and other hardware that form the architecture of the internet. If these physical elements cease to function, from a cut wire to a storm-damaged server farm, the internet is affected, too. More than that, if a single entity controls—or can at least access—that hardware for a region or an entire country, government-caused internet blackouts are a tempting method of censorship and social control.
Which is to say: As countries around the world tighten control of the internet within their borders, we can expect to see some governments with relatively centralized internets—particularly authoritarians or those with authoritarian leanings—literally disconnect their domestic internet networks from the rest of the globe during unrest or other incidents.
As for the second method, we can expect a rise in distributed denial of service attacks against internet infrastructure as millions of wildly insecure Internet of Things devices—from smart thermostats to water-pressure sensors—are linked online. As many studies have documented, IoT devices typically have terrible security features, such as basic passwords and minimal encryption. Put another way, they’re not hard to hack. So, by compromising these devices en masse and turning them into a “botnet” army, hackers can completely overwhelm segments of the internet, channeling traffic to a single service until it’s overwhelmed and can no longer function.
If that sounds far-fetched, recall what happened in 2016, when the Mirai botnet took over hundreds of thousands of IoT devices, spread across multiple continents, and used them to flood traffic to the servers of the American internet company Dyn. At the time, it was the largest known DDoS attack on Earth; Twitter, Spotify, SoundCloud, Reddit, and a number of other sites were temporarily unavailable as a result. In other words, Mirai effectively took down part of the American internet.
Democratic governments in the United States, Europe, and elsewhere typically don’t exert control over major internet gateways or servers. It’d therefore be quite unlikely for them to cause a partial internet blackout themselves. Add to this the fact that the internet in the United States isn’t as centralized as it is in other countries, and it becomes clear why it’s harder to control all its major gateways to the global network at once, like Egypt did in 2011.
But even if a government can’t easily disconnect its whole country from the worldwide internet, Mirai demonstrated just how effectively third-party malicious actors can take down segments of a country’s internet.
In principle, policymakers have long argued that neither of the aforementioned scenarios were possible due largely to the internet’s decentralization. More and more, though, the internet has become centralized in countries where the government has controlled the buildout of infrastructure and where there’s little market competition for internet services. Even in countries with better market competition for internet services and with less government control of infrastructure, there are still pockets that remain centralized and vulnerable—as demonstrated by the Mirai botnet attack against Dyn.
All this matters for a few reasons. For one, democratic policymakers, in particular, will have to think more about cyber norms in the context of internet manipulation (i.e., disconnecting your country from the global network), not just offensive cyberoperations (i.e., hacking into another nation’s computer systems). Several events in 2018 already made this fact clear, like when American internet traffic was once again routed through China and Russia and underscored the vulnerability of core internet functions to manipulation. A sovereign and controlled model of the internet is spreading, and democracies must effectively fight it through, among other things, norms on and around the internet.
Two, the rising threat of botnets will create more pressure within the United States to generate technical standards for smart devices. Currently, there exist virtually no consensus rules for “minimum security” on these devices, which means that many industry organizations and government agencies are using IoT systems that have terrible security; this not only poses vulnerability to connected infrastructure systems and opens wearable-wearing government personnel to real-time GPS tracking, but it also means that the IoT market is flooded with devices that can be easily hijacked in service of DDoS attacks. Building these standards will give companies and government agencies guidance in building and acquiring smart devices, which in turn will bolster their security.
Finally, countries will have to take greater international action against botnets as a cybersecurity threat. As Jason Healey and Robert K. Knake wrote in a recent Council on Foreign Relations report, DDoS attacks via scores of hijacked smart devices can “cause serious harm by allowing foreign governments to stifle free speech abroad and enabling them to shut down countries’ domestic networks or even the internet globally.” Further, explains a report from the Council to Secure the Digital Economy, these incidents undermine “fundamental confidence and trust in the digital economy”—which depends on reliable availability and performance of internet services.
So, whether national or regional, caused by governments or hackers, internet blackouts are likely going to increase in frequency over the coming months, and their harms will take many forms. But recent hacks, a history of internet disconnections around the world, and an even longer history of distributed denial of service attacks, collectively, give us a sign of what’s to come. Policymakers would be wise to pay attention.
https://slate.com/technology/2019/01/internet-blackouts-government-drc-zimbabwe-gabon.html ....
This could highlight one key reason why paper money might never disappear: consumers and businesses need an alternate currency to serve as a last resort in the event of the internet being compromised or shut down. Even a few hours lapse in electronic payment availability could be disastrous for the economy of a nation. Uptime and reliability of paper money carries a potential to rival any purported advantages people associate with a cashless society.
We've all read countless threads and posts on crypto forums posing the question: "when will bitcoin replace paper money". While mainstream bitcoin adoption could benefit many of us HODL'ers the answer to this question could be: never. Electronic currencies may never be 100% reliable or guaranteed availability around the clock. They are vulnerable to disruptions in service which could carry catastrophic consequences.
If supporters of cashless societies disagree with this base assessment, I would be curious to hear their reasons.
