Last week, several news websites reported that the entire West African country of Liberia had been taken offline by a botnet attack. Journalists hypothesized that the attack was similar to an attack on DNS servers operated by Dyn, an internet infrastructure company, and on the website of Brian Krebs, an independent cyber security journalist. Those attacks leveraged malware-infected devices to send tremendous amounts of internet traffic to overwhelm networks. With the U.S. presidential elections taking place, journalists also speculated that the attack on Liberia might be a test-case for a similar attack during the U.S. elections.
Soon, however, security researchers and officials inside Liberia debunked these reports and speculations. Liberian officials said there was no such massive outage, and Dyn, Akamai (another internet infrastructure company), and journalist Krebs chimed in, casting doubt on whether the attack actually happened at all. Concerned about a possible internet shutdown, we also sought independent confirmation from our civil society partners in the area, and they told us that there was no effective decline in internet connectivity. As of this writing, there is no reliable information about the attack, if it in fact took place.
But here’s the important part of the news. Regardless of whether the attack happened as reported, we should all be concerned about the vulnerability of networks like the one in Liberia. The country’s internet is served primarily by a single submarine cable, like many countries situated along the West coast of Africa. A solitary link to the global internet is a vulnerable chokepoint, and an attractive target for malicious actors. It may be easier to shut down. A 2012 study by Dyn — which does important work in this space — ranks countries based on their vulnerability to shutdowns. The more distributed and diverse the internet infrastructure, in general, the more resilient the country’s internet would be to an attack. Dyn ranks Liberia as having a significant risk of a shutdown, compared to “severe,” “low,” or “resistant.”
Internet resilience is important when we think about connectivity and human rights. Governments are rapidly moving to connect more than 1.5 billion people to the internet through a number of ambitious projects, some of which are loosely coordinated by the Global Connect Initiative. Access Now’s Human Rights Principles for Connectivity and Development (PDF) help ensure that these projects respect human rights. What the Liberia shutdown story shows us is that infrastructure resilience may also be an important factor for protecting rights. If we want to make sure that countries are able to defend themselves from attack — and from shutdowns of all kinds — it makes sense to prioritize establishing additional international gateways, internet exchange points, and other links to the global internet.
A more resilient internet is an internet that will better safeguard free expression and human rights. A distributed network protects all users of the open internet, allowing them to embrace its promise, communicate, build businesses, create, and express themselves. Such networks may also be more difficult to censor.
Building a more resilient internet will require engaging with the United Nations and other global institutions like the World Bank and International Monetary Fund, to ensure that human rights are baked in to internet development. But fighting censorship will also demand engagement by civil society and other stakeholders — whether in the form of protesting against internet shutdowns, like the #KeepitOn campaign — or through other advocacy that protects rights. For example, the Freedom Online Coalition, a group of 29 governments supporting internet freedom, issued a strong statement in March condemning the use of “malicious code” to “incapacitate civil society websites hosted abroad,” including Distributed Denial of Service (DDoS) attacks. The statement is geared towards governments employing these methods but underscores the serious threat of botnet and malware attacks to free expression. The Internet Society has also called for specific technical measures to strengthen the open internet.
Liberia may not have been taken offline, but the story still carries an important lesson: we need to make it harder to shut down the internet. Despite the dismissive tone of some of the coverage of the Liberia incident — identifying it as a “little known African country” — Liberia has already shown great strength. Its health system quickly mobilized to eradicate the Ebola virus. The U.S. government is pitching in by funding a project to enhance the country’s internet infrastructure and improve its policies, a positive step that more financial stakeholders should emulate. Liberia can rise to the challenge of making its internet more resilient, while at the same time protecting human rights, increasing opportunities for its users, and developing its economy.