Syria’s Throwing of the Internet Kill Switch Raises Lots of Questions

At least five networks operating outside Syria, but still operating within Syrian-registered IP address spaces, are still working, and are apparently controlled by India’s Tata Communications. These same networks, Renesys says, have some servers running on them that were implicated in an attempt to deliver Trojans and other malware to Syrian activists.

Cloudflare has also been monitoring the situation in Syria and has made a few interesting observations.

First, pretty much all Internet access in the country is funneled through one point: The state-run, state-controlled Syrian Telecommunications Establishment. The companies that provide this capacity running into the country are PCCW and Turk Telekom as the primary providers, with Telecom Italia and Tata providing additional capacity. There are, Cloudflare notes, four physical cables that bring Internet connectivity into Syria. Three of them are undersea cables that land in the coastal city of Tartus. A fourth comes in from Turkey to the north. Cloudflare’s Matt Prince says it’s unlikely that the cables were physically cut.

You might ask – why now? Clearly, the Syrian regime is under more pressure than ever before. Previously, it tended to view the country’s Internet as a tool to not only get its own word out to the wider world, but also to try and spy on and monitor the activities of the rebels and activists. With fighting intensifying in and around the capital and the commercial city of Aleppo, the decision to throw the kill switch might indicate a decision to try to disrupt enemy communications. Or it might mask a seriously aggressive military action that it wants to keep as secret as possible.