Internet Performance Delivered right to your inbox

What Libya Learned from Egypt


Libya’s nationwide Internet blackout is entering its second full day. From a technical standpoint, it’s clear that this is a very different strategy than the one used by Egypt in the last days of the Mubarak regime. The ultimate outcome is probably going to be the same. Let’s take a few minutes to compare the two, and think about the implications for future Internet engagements in the Jasmine Revolution.


First, the facts as we know them. We observed nearly every host inside Libya becoming unresponsive on the afternoon of Thursday, March 2nd. You could attempt to “ping” them, send a traceroute along the path to them, try to retrieve pages, try to look up domain names … but in nearly every case, there was no response. Simultaneously, we heard reports that all of the classic Internet communication services like Skype were down, and external websites were unreachable. To top it off, the Google Transparency Report showed query traffic from within Libya flatlining, and not recovering.

So far, these symptoms match what was experienced during the Egyptian Internet blackout pretty closely. But the underlying technical implementation couldn’t have been more different. Look very closely at that Google plot again, and observe the floor. It’s not perfectly flat, is it? That’s because the Libyan Internet is actually still alive, even though almost all traffic is blocked from traversing it. The BGP routes to Libya are still intact, which means that the Libyan ISP’s border routers are powered on and the fiberoptics are lit. In fact, we’ve identified a handful of isolated live IP addresses inside Libya, responding to ping and traceroute, and presumably passing traffic just fine. Someone in Libya is still watching YouTube, even though the rest of the country is dark.

Libya vs Egypt: A Different Strategy

Why did Libya put its Internet in ‘warm standby mode’ instead of just taking it down, as Egypt did? Perhaps because they’re learning from Mubarak’s experience. Cutting off the Internet at the routing level (powering down the Internet exchange point, going after the remaining providers with secret police to enact a low-level shutdown) was a technically unsophisticated desperation move on Egypt’s part. It signalled to the world that the Egyptian government considered itself out of options, ready to cut off internal communications and external dialogue, looking for a last chance to turn off all the cameras and clean out the Square.

We expected to see something similar happen in Libya as the crisis came to a head, and on Thursday afternoon, the government appears to have taken action ahead of Friday’s Day of Rage. Implementation was straightforward because of centralized control of the Internet economy: Libya doesn’t have five independent Internet Service Providers with international connectivity, as Egypt did. They have just one, Libya Telecom and Technology (LT&T). Founded in 1997 and run by the Gaddafi family, LTT was folded into the state-owned GPTC (General Post and Telecommunications Company) in 2004. Each Internet route to Libya, and therefore all of the traffic to Libya, flows through this one provider’s infrastructure. So on Thursday afternoon, like turning off a tap, the stream of traffic was slowed to a trickle, and then to a few drips.

This tactic makes all kinds of sense from the government’s perspective. The Internet is a valuable wartime resource, like a critical bridge over which supplies can flow. As long as you can deny it to your enemy, you don’t blow it up — you keep it intact for your own use.

Throttling the Internet to the point of uselessness, instead of killing it outright, also delayed International recognition of the fact that the Internet was down during the most critical period. Most international media didn’t clue into the fact that the Libyan Internet had gone silent until after the sun had gone down in Tripoli on Friday. By taking a softer route to shutdown, the government deprived the opposition of much of the international “flash crowd” of attention and outrage that an unambiguous “kill switch” tactic might have garnered.


Using denial of Internet access as a political weapon during crisis events is all about timing and messaging. Mubarak waited too long to implement his blackout, and then let it run past the point where the damage to the Egyptian economy and the cost of international outrage exceeded the dwindling benefits to the regime. In the end, all the Egyptian government accomplished was to attract the sort of sympathetic attention and message support from the Internet community that is pure oxygen to a democratic opposition movement. You can’t buy that kind of press!

Libya faced this same decision in the runup to civil war, and each time, perhaps learning from the Egyptian example, they backed down from implementing a multiday all-routes blackout. On 19 and 20 February there were two consecutive nights of routing-based blackout, but in each case, service was restored the next morning, at reduced levels. Through the course of the following week, traffic continued to grow, not only from Tripoli, but from eastern provinces where the government was no longer in control.

That message couldn’t go unanswered. The current blackout, which probably signals the onset of the endgame, comes too late to contain the message. Together with restrictions on journalist movement, it will provide temporary cover for some of the endgame brutality, and for that reason, it’s deeply sad.

When some future government faces this decision, backed into a corner by a popular uprising supported by Internet communication, they will probably reach the same conclusions that Libya and Egypt did: reestablish control over national communications at any cost, and pick up the pieces later. That’s why the Internet is too vital to be left in the hands of centralized authority, and it’s why you should press for more diverse Internet connectivity wherever you happen to live.

Share Now

Whois: Jim Cowie

Jim Cowie was the Chief Scientist at Dyn. Previously, Jim was the founder and CTO of Renesys, the Internet Intelligence Authority, which Dyn acquired in 2014.

To current Dyn Customers and visitors considering our Dynamic DNS product: Oracle acquired Dyn and its subsidiaries in November 2016. After June 29th, 2020, visitors to will be redirected here where you can still access your current Dyn service and purchase or start a trial of Dynamic DNS. Support for your service will continue to be available at its current site here. Sincerely, Oracle Dyn