A Brief History of Notable Internet Disruptions

While pondering the implications of the government-initiated Internet outages in Egypt and Libya over the last few months, I decided to do a bit of digging on past Internet disruptions. This article summarizes what I found. Interestingly, the frequency of these events seems to suggest an interval of roughly two years (excluding the politically motivated outages). I also worry that with Egypt and Libya apparently having set the precedent of severing Internet access in the face of revolution, other countries in the region and around the world might respond the same way in the future.

Below my own summary of each incident I've included references for anyone interested in learning more.

December 2004: TTnet

Turkish ISP TTnet (AS 9121) mistakenly begins advertising over 100,000 routes for other networks with itself as the destination. A misconfigured peering with an upstream AS allows these advertisements to be propagated throughout the global Internet, affecting just about everyone. Various portions of the Internet become unavailable for different organizations around the world for several hours.

• NANOG34 presentation by Renesys (PDF)
• Renesys: Internet-Wide Catastrophe Last Year

January 2006: Con Edison

Con Edison Communications, since acquired by RCN, begins originating routes for a number of prefixes which are not its own. Some belong to its customers, while others are entirely unaffiliated. The invalid advertisements persist for several hours.

• Renesys: Con Edison

February 2008: Pakistan Telecom and YouTube

Pakistan Telecom (AS 17557) begins announcing part of YouTube's address space. This was intended to be done internally as part of an effort to block access to YouTube from within Pakistan, but was propagated to the global Internet as well. Because the prefix advertised by Pakistan is more specific than the legitimate YouTube route, it is preferred by all autonomous systems which received it. Throughout much of the world, traffic destined for YouTube is routed toward Pakistan, where it is discarded.

YouTube responds first by advertising its own /24 route for the affected prefix, equivalent to the route announced by Pakistan Telecom, and then by splitting the route into two /25 prefixes. It is not until PCCW Global (AS 3491), Pakistan Telecom's upstream provider, withdraws all routes originating from AS 17557 that normal connectivity to YouTube from the rest of the world is restored.

• Case study by RIPE NCC

April 2010: China Telecom

AS 23724, which belongs to China Telecom, begins announcing around 37,000 routes from the global table. The event is widely reported as having lasted no more than 18 minutes. However, concern regarding the event is raised that November in a report generated by the US-China Economic and Security Review Commission. Although technical analysis of the event revealed that it was unlikely an intentional attack on US interests, the theory was of course exaggerated by media coverage. That said, the Chinese government has adamantly denied that the incident occured.

• BGPmon: Chinese ISP Hijacks the Internet
• Renesys: China's 18-Minute Mystery

January 2011: Revolution in Egypt

In response to civilian uprising and wide-spread protest, the Egyptian government moves to block in-country access to several prominent social network sites. Days later, virtually all Internet access from within the country is severed. This is believed to be the first ever example of an entire country intentionally isolating itself from the global Internet. The outage lasted from January 27th to February 2nd.

• BGPmon: Internet in Egypt Offline

February 2011: Revolution in Libya

Spurred by uprising in neighboring Egypt, protests break out in Libya. In a manner similar to Egypt, the Libyan government responds by severing Internet access. Although the initial outage lasted for only a few hours, the coming weeks would see repeated interruptions to Libyan Internet access.

• Renesys: Libyan Disconnect