April 5, 2020
During two days, Qurium conducted in-country tests as well as tests outside of Togo to determined the cause of blocking.
The first finding of the tests was that the website was reachable outside the country but not from inside Togo via AS24691 Togo Telecom.
Thanks to Doug Madory , Director of Internet Analysis at Oracle’s Internet Intelligence team, we could confirmed that AS37229 and AS328282 were routing their traffic via Togo Telecom.
- AS37229: Atlantique Telecom Togo, also known as “Moov”
- AS32882: Teolis ISP
Furthermore, we conducted tests from inside Togo from the network Togo Telecom and AS30982 (CAFE Informatique et telecommunications) and the results were identical:
After completing the initial stage of the connection (three way handshake), the browser sends the name of the website in the “Hello Client” packet. This packet triggers the blocking and the session is silently dropped.
During the tests we could confirm that this behavior took place in connections from both AS30982 (Cafe) and AS24691 (Togo Telecom), which suggests the presence of common Deep Packet Inspection hardware (DPI) or that traffic of both providers share common monitoring infrastructure.
To verify that the presence of DPI hardware, we placed requests with variations of the domain, with the following outcome:
- theconfidentialreport.cOM : BLOCKED
- theconfidentialreport.com123 : BLOCKED
- 123theconfidentialreport.com : BLOCKED
- 123theconfidentialreport.com123 : BLOCKED
- confidentialreport.com : BLOCKED
The test suggest that the DPI has a regular expression to block the website of the form:
Such blocking infrastructure might be located in the Togo Internet Exchange TGIX
HAAC claims technical problems on server side
The High Authority for Audiovisual and Communication (HAAC) of Togo, that regulates online media, denies the existence of any blocking and points to technical problems on the webserver hosting platform.
The response of HAAC is not credible as does not explain why the site is only unreachable from inside Togo and why forensic analysis of the traffic tests strongly suggests the presence of Deep Packet Inspection hardware intercepting the “Hello Client” messages of the TLS connections to the website.
Kossi Elom Balao is an award-winning investigative journalist, founder and Editor-in-Chief of the online independent and investigative newspaper The Confidential Report. Balao, based in Lome, Togo, covers science, health, business and political issues. Kossi is the president of the French-Speaking African Scientific Journalists Network (RJSAF). In 2018, Kossi was one of the winners of United Nations’ competition Voices of a Brighter Future Journalism.