The Tech Companies Behind Internet Shutdowns: Allot Ltd.

Israeli deep packet inspection manufacturer has commercial relationships with 14 ISPs who have implemented internet shutdowns in 21 countries.
Samuel Woodhams
Christine O'Donnell
Samuel Woodhams & Christine O'Donnell

Key Findings

  • Israeli telecom firm Allot Ltd. markets products that allow ISPs to “selectively block applications such as VPNs or social media”
  • They have commercial relationships with 14 ISPs that have implemented internet restrictions in 21 countries since 2018
  • ISPs in India, Nigeria & Myanmar may all have used their technology to restrict access to social media platforms
  • The company says it can monitor the use of almost 70 VPN apps, thus allowing ISPs to block the anti-censorship tools typically used to bypass social media restrictions

Introduction

Internet shutdowns cause economic disruption, stifle citizens’ capacity to access vital information, and undermine freedom of expression. Despite this, they remain a common tool used by governments during protests, elections, and conflict.

Internet Service Providers (ISPs) have very little power to refuse when governments order them to restrict their services. However, little is known about the technology ISPs use to block social media platforms and other content.

We believe that an open, free and accessible internet is vital to protect human rights. For this reason, we decided to unearth the companies responsible for providing ISPs with technology that enables repressive internet restrictions.

Allot Ltd. is an Israeli telecommunication company that produces and sells a range of products, including Deep Packet Inspection (DPI) technology. While DPI can be used for legitimate purposes, such as restricting access to inappropriate content for children, it can also be used to monitor and block access to social media platforms, political content, and censorship circumvention technologies such as VPN apps.

This report focuses on social media shutdowns and other content blocks because internet blackouts do not normally require the use of DPI technology.

One of Allot’s webpages promotes its ability to provide communication service providers with “granular, big data visibility into network, user and application behavior,” and its SmartSentinel product can reportedly help providers “selectively block applications such as VPNs or social media to protect public safety.”

In 2020, the company made between $135 and $140 million in revenue and it reportedly has relationships with over 500 mobile, fixed and cloud services providers.

View the list of sources, which compiles links to every Allot document and report cited in this investigation

Demand for VPN applications often surges during internet restrictions as they provide a means for citizens’ to bypass blocks on specific content. However, authorities frequently retaliate by blocking access to these services.

Allot boasts that it can monitor the traffic of 70 VPNs, which by extension allows its customers, such as ISPs, to block them. On one page, the company says: “As use of VPN apps escalate, prudent operators will seek to ensure that they can observe and keep track of their use.” On another, the company claims that “Anonymizers/VPN tunnels are typically used to hide a user’s identity and are in use by some to access illegal content or purchase illegal goods, such as drugs.”

Analysis of the company’s investor documents and news reports shows that Allot has commercial relationships with 14 ISPs that have conducted internet disruptions in 21 countries since 2018.

It is nearly impossible to conclusively prove that Allot’s technology was used during a specific shutdown because ISPs often purchase similar technology from a variety of companies. However, the existence of these commercial relationships indicates that it’s likely that their technology has been used in ways that undermines citizens’ fundamental rights.

Attribution is made more difficult by the complex and often murky relationship between multinational ISPs and their local subsidiaries. In this report, we have included subsidiaries even if they are not expressly referenced in Allot’s documentation as they may utilise technology originally purchased by their parent company.

For more detailed findings, see our “The Tech Companies Behind Internet Shutdowns: Allot Ltd.” Data Sheet

See all our research on the cost of internet shutdowns.

Summary Findings

The following table shows a list of ISPs that have commercial relationships with Allot and the countries where they have complied with government orders to restrict access to the internet. It includes local subsidiaries of multinational operators.

* These ISPs are listed as commercial partners in Allot’s documentation. However, it remains unconfirmed whether they definitively purchased the specific technology required to implement internet restrictions.

Country Analysis

View the list of sources, which compiles links to every Allot document and report cited in this investigation

Nigeria

Nigeria imposed an indefinite Twitter ban on 5 June 2021 after a post by President Muhammadu Buhari was removed from the social media platform for breaching the platform’s rules.

VPN demand soared by 1,409%, as citizens attempted to bypass the block.

Among the ISPs that complied with the government order were Globacom Nigeria (also known as Glo) and MTN. Both companies have commercial relationships with Allot as shown in the DPI supplier’s 2017 and 2020 investor presentations, respectively.

While Glo appears to have purchased Allot’s security products, MTN is shown to have purchased Allot’s ‘Smart’ products which includes DPI as a “core technology.” One of the solutions included also references “regulatory compliance,” which may refer to the technology’s ability to block specific websites in line with government orders.

Allot Smart product range

Screengrab from Allot’s May 2020 Investor Presentation displaying the company’s “Smart” product range capabilities.

India

The internet blackout in the disputed Kashmir region started in August 2019 and was the longest ever imposed in a democracy, spanning a total of 7 months. Services were cut following the controversial decision by Prime Minster Nerendra Modi to strip Jammu & Kashmir of its autonomy. When restrictions were lifted in March 2020, authorities continued to severely throttle internet speeds to 2G levels.

In addition to throttling, Kashmiris continued to face heavy restrictions as only 301 websites were made accessible following the shutdown. A large number of local publications and social media platforms were left off of this list and remained inaccessible.

The largest ISP operating in the area, Reliance Jio, has purchased Allot’s Service Gateway product. The product is advertised as giving ISPs “Powerful Policy Control,” which can “include any combination of access, priority, bandwidth allocations, shaping, steering, and blocking actions to be applied to application and subscriber traffic.”

Reliance deployment of Allot Service Gateway

Screengrab from Allot’s Actionable Intelligence Brochure showing Reliance Jio’s purchase of the DPI provider’s Service Gateway product.

In 2019, Jio was also reported to have blocked several VPN apps after the government ordered operators to restrict access to pornographic content.

In another investor document, Jio is listed as one of the customers of Allot’s ‘Smart’ product package. The group of tools include SmartSentinel which has capabilities that appear to correlate with the types of blocking Jio has carried out in India.

Allot SmartSentinel content filtering capabilities

Screengrab from Allot’s SmartSentinel Solution Brochure showing application & content filtering capabilities.

Myanmar

Myanmar suffered over 70 consecutive nights of near-total internet shutdowns after a military coup in February 2021. The cyclic curfew-style restrictions were only lifted on 27 April and was characterized by nightly shutdowns, followed by social media blocks during the day.

The coup and violent crackdown on peaceful protestors has drawn international condemnation, with the rolling death toll now thought to be over 700.

Mytel was among the major ISPs that partook in the blocking of social media platforms during this period. While the connection between Mytel and the Myanmar military is well established, 49% of Mytel is actually owned by Viettel Global JSC.

Viettel has bought Allot’s Smart Technology range according to the DPI provider’s company documents. The range of products includes DPI technology and provides ISPs with “Network Intelligence” and “Intelligent Traffic Management.”

In a revealing report by campaign group Justice For Myanmar, it is alleged that “[o]fficials from Vietnam military conglomerate Viettel operate and maintain secret military infrastructure, transfer military and dual use technology and operate in Myanmar military bases that are off-limits to the civilian government.”

While Mytel is a seperate entity to Viettel, it is possible Viettel provided technology originally acquired from Allot to Mytel in order to restrict access to social media services in Myanmar.

Christopher Sidoti, a former member of the UN Human Rights Council Independent International Fact-Finding Mission on Myanmar, told The Guardian: “The facts establish that Mytel plays a vital role for the military and that Viettel makes Mytel possible.”

ISP Analysis

View the list of sources, which compiles links to every Allot document and report cited in this investigation

Orange

In an investor presentation published in May 2021, Orange are listed as one of Allot’s customers. Orange’s logo appears on a page titled, ‘Telecom Customers – Visibility & Control,’ and they appear to have purchased Allot’s ‘Smart’ product, which lists DPI as a “core technology.”

Orange use of Allot Smart Product

Screengrab from Allot’s May 2021 Investor Presentation that shows Orange is a user of the Allot “Smart” technology range.

Orange operates globally and is the tenth largest mobile operator in the world with over 200 million subscribers, according to a recent financial report. They have also complied with government orders to restrict access to the internet multiple times since 2018. Below is a description of three recent occasions where Orange and its local subsidiaries may have used Allot’s products to block content.

In total, our analysis shows Orange has blocked content in 6 countries since 2018. Note however, that the total number of deliberate internet disruptions the company has been involved in over that period is likely to be higher. This is because we excluded full internet blackouts, which do not require DPI technology, from that analysis.

Egypt

In April 2019, Egypt blocked access to 34,000 websites in response to the Void campaign, which sought to oppose constitutional reforms that could allow the President to remain in power until 2034. The campaign’s petitions were repeatedly taken offline by the government.

According to Netblocks, “The findings suggest that the Egyptian government may have incurred significant collateral damage as it seeks to restrict online content relating to the campaign, which uses the slogan Void.”

Technology startups, self-help, and NGO websites were all blocked on Orange, Raya and Telecom Egypt networks. Orange Egypt has over 30 million subscribers.

Cameroon

In Cameroon, social media platforms were throttled by major ISPs, including Orange, in 2018 as citizens waited for the results of a contested election to be announced.

The restrictions followed widespread restrictions in the Anglophone region of the country. The shutdown was, at the time, the longest in the world. Only to be surpassed by the internet restrictions in Kashmir.

In response to calls from civil society organizations to restore services, Orange wrote: “Our Group operates in Cameroon through a subsidiary Orange Cameroon which complies with the local legislation and therefore obeys to any national security instruction received from the authorities in accordance with its Telecommunications License.”

Guinea

In March 2020, authorities in Guinea ordered ISPs to restrict access to social media platforms, including Twitter, Facebook, Instagram, and Facebook Messenger. According to Netblocks, both MTN and Orange were affected by the restrictions.

The shutdown lasted for almost 40 hours and affected services while parliamentary elections and a constitutional referendum were taking place.

MTN

MTN is listed as one of Allot’s customers on a page titled “Allot Smart Technology Heritage” in the company’s May 2021 Investor Presentation. The Allot ‘Smart’ product range includes DPI as a “core technology” which appears to have been supplied to MTN.

MTN is a multinational mobile telecommunications company, operating predominantly in Asia and Africa. According to a 2020 quarterly report, the company recorded 273.44 million subscribers, making it the ninth largest mobile network provider in the world.

In total, our research found that MTN has complied with government orders to restrict access to the internet in 8 countries since 2018. Below is a description of three recent occasions where MTN and its local subsidiaries may have used Allot’s products to restrict access to digital content.

Iran

Iran has a long history of imposing internet restrictions, particualrly surrounding politically sensitive events. MTN Irancell has complied with government orders to shutdown the internet on several occasions, including during the November 2019 protests which erupted following the spike in fuel prices by 50%.

MTN Irancell also blocked the Farsi edition of Wikipedia in March 2020 during the height of Coronavirus fears. The blocks appear to be consistent with Allot’s DPI technology. Moreover, a January 2018 survey by Netblocks recorded extensive censorship of services such as Telegram, Facebook, Whatsapp, Twitter and news sites to dampen months-long protests that began in late 2017.

MTN Irancell is a seperate entity to MTN and may not have access to the same tools MTN have purchased. In 2011, EFF claimed “Allot Communications Ltd. clandestinely sold its product NetEnforcer to Iran by way of Denmark.” However, the company was later cleared by the Israeli Ministry of Defense who concluded the company “was unaware that the internet monitoring equipment it sold to a distributor ended up in Iranian hands.”

Uganda

Social media applications were blocked before and after an internet blackout in Uganda that occured between 13th and 18th January 2021.

The restrictions affected Twitter, Facebook, WhatsApp, Instagram, Skype, Viber, and some Telegram servers. Furthermore, AFP found that additional orders to restrict access to around 100 VPNs were issued, a number that is difficult to carry out through network measurement alone.

Network measurements taken by Netblocks showed that MTN complied with government orders during the restrictions.

Allot VPN and Anonymizer control

Screengrab from Allot’s SmartSentinel: Digital Enforcement for Governments booklet displaying the product’s VPN & Anonymizer control functions.

Benin

In April 2019 the government of Benin limited access to Facebook, Twitter, Instagram and communications applications such as Whatsapp, Telegram and Viber. The government later ordered ISPs to completely disable internet connectivity during the election. Several VPNs such as Tunnelbear, Hola, TigerVPN and PureVPN were also found to be inaccessible before the total blackout came into place.

Netblocks reported “that the initial blocks were implemented at the ISP level, with leading network operator Spacetel most impacted.” According to OONI, Spacetel is “locally known as MTN Benin.”

Appendix - Signatures List

The following list of VPN services are listed on Allot’s webpage titled, ‘Supported Protocols.’

In an 2018 update, the company wrote: “Effective visibility, security and control of network traffic requires constant monitoring of new and updated applications and the inclusion of their signatures in our protocol pack. In order to manage bandwidth use so that quality of service and quality of experience is optimized, it’s necessary to ensure that the traffic from the widest range of sources is identified.”

  • SkyVPN ICMP
  • Ultimate VPN
  • Sky VPN
  • Betternet Free VPN
  • Signal Lab VPN
  • Snap Master VPN
  • Aura VPNs (Terminals group)
  • VPN Proxy Master (Terminals group)
  • VPN Proxy Master Lite (Terminals group)
  • Melon VPN
  • VPN Robot
  • Melon VPN (Terminals group)
  • VPN360 (Terminals group)
  • FreeVPN Group
  • SkyVPN
  • Hotspot VPN – Super Free VPN Unlimited Proxy
  • Secure VPN – Free VPN Proxy, Best & Fast Shield
  • Free VPN Unlimited Proxy – Proxy Master
  • Free VPN Proxy – Secure Tunnel, Super VPN Shield
  • Easy VPN – Free VPN proxy, super VPN shield
  • VPN – Master Proxy for iPhone – Super Best VPN & WiFi Security
  • VPN – Proxy Master Unlimited – 360 Hotspot Security Shield (iOS)
  • IPSec VPN
  • VPN 365 – Terminals
  • Vypr VPN
  • SecureVPN
  • VPN Master
  • DroidVPN
  • AnonyTun
  • AirVPN – Terminal
  • Browsec VPN
  • Betternet Free VPN
  • Hotspot Shield VPN
  • Windscribe VPN—Terminals
  • Opera VPN—Terminals
  • YourFreedom VPN
  • Browsec VPN (IOS, Android, PC)
  • Super VPN (PC)
  • YourFreedom VPN (Android)
  • Snap VPN (Android)
  • Touch VPN (iOS, Android)
  • VPN Robot (Android)
  • Ultrasurf (Android, PC)
  • Turbo VPN (Android, iOS, PC, Mac)
  • Express VPN (iOS, Android, PC, MAC)
  • IPVanish VPN (iOS, Android, PC, MAC)
  • Private Internet Access VPN (iOS, Android, PC, MAC)
  • TunnelGuru (PC)
  • Vypr VPN (iOS, Android, PC, MAC)
  • Zero VPN (Android)
  • Cloud VPN (Android)
  • Ark VPN (Android, iOS)
  • TunnelBear (Android)
  • VPN Master (Android)
  • TunnelBear (iPhone)
  • Hotspot Shield (Android, iPhone)
  • Freegate
  • Open VPN (open source VPN application for PCs)
  • DroidVPN
  • TroitVPN
  • Hola! VPN
  • Psiphon
  • VPNbook (for all browsers on PC, Android, iOS)
  • VPN Unlimited (on MS Windows, MAC OS, Android, and iOS)
  • OpenVPN (an open source VPN application for PCs)
  • Psiphon Proxy Server
  • Psiphon CDN (Meek mode)

Methodology

We analyzed Allot’s public documents to discern their commercial relationships with various ISPs. We then cross-referenced this information with publicly available information about internet shutdowns that have occured since 2018.

Access the “The Tech Companies Behind Internet Shutdowns: Allot Ltd.” raw data on this Google Sheet.

Main image: A man reads a newspaper at a newsstand in Abuja, Nigeria June 5, 2021. Credit: REUTERS / Afolabi Sotunde

The authors of all our investigations abide by the journalists’ code of conduct.