Togolese investigative media “The Confidential Report” blocked by authorities

5 April 2020

On March 25th, Qurium was informed by the Committee to Protect Journalists (CPJ) that the website The Confidential Report was not reachable inside Togo since Sunday 22nd.

During two days, Qurium conducted in-country tests as well as tests outside of Togo to determined the cause of blocking.

The graph shows traffic statistics for the blocked site from 19-27 March 2020.

The first finding of the tests was that the website was reachable outside the country but not from inside Togo via AS24691 Togo Telecom.

Thanks to Doug Madory , Director of Internet Analysis at Oracle’s Internet Intelligence team, we could confirmed that AS37229 and AS328282 were routing their traffic via Togo Telecom.

  • AS37229: Atlantique Telecom Togo, also known as “Moov”
  • AS32882: Teolis ISP
Network Topology overview map of Togo (March 25th, 2020).

Furthermore, we conducted tests from inside Togo from the network Togo Telecom and AS30982 (CAFE Informatique et telecommunications) and the results were identical:

Blocking technique

After completing the initial stage of the connection (three way handshake), the browser sends the name of the website in the “Hello Client” packet. This packet triggers the blocking and the session is silently dropped.

During the tests we could confirm that this behavior took place in connections from both AS30982 (Cafe) and AS24691 (Togo Telecom), which suggests the presence of common Deep Packet Inspection hardware (DPI) or that traffic of both providers share common monitoring infrastructure.

To verify that the presence of DPI hardware, we placed requests with variations of the domain, with the following outcome:

  • theconfidentialreport.cOM : BLOCKED
  • theconfidentialreport.com123 : BLOCKED
  • 123theconfidentialreport.com : BLOCKED
  • 123theconfidentialreport.com123 : BLOCKED
  • confidentialreport.com : BLOCKED

The test suggest that the DPI has a regular expression to block the website of the form:

/theconfidentialreport.com/i

Such blocking infrastructure might be located in the Togo Internet Exchange TGIX

Architecture du TGIX

HAAC claims technical problems on server side

The High Authority for Audiovisual and Communication (HAAC) of Togo, that regulates online media, denies the existence of any blocking and points to technical problems on the webserver hosting platform.

The response of HAAC is not credible as does not explain why the site is only unreachable from inside Togo and why forensic analysis of the traffic tests strongly suggests the presence of Deep Packet Inspection hardware intercepting the “Hello Client” messages of the TLS connections to the website.

About theconfidentialreport.com

Kossi Elom Balao, founder and editor-in-chief of he Confidential Report, Togo.

Kossi Elom Balao is an award-winning investigative journalist, founder and Editor-in-Chief of the online independent and investigative newspaper The Confidential Report. Balao, based in Lome, Togo, covers science, health, business and political issues. Kossi is the president of the French-Speaking African Scientific Journalists Network (RJSAF). In 2018, Kossi was one of the winners of United Nations’ competition Voices of a Brighter Future Journalism.