The Tech Companies Behind Internet Shutdowns: Allot Ltd.
Israeli deep packet inspection manufacturer has commercial relationships with 14 Internet Service Providers who have restricted internet access in 21 countries.
- Israeli telecom firm Allot Ltd. markets products that allow Internet Service Providers (ISPs) to “selectively block applications such as VPNs or social media”
- Allot has commercial relationships with 14 ISPs (ISPs) that have implemented internet restrictions in 21 countries since 2018
- ISPs in India, Nigeria & Myanmar all may have used their technology to restrict access to social media platforms
- The telecom company says it can monitor the use of almost 70 VPN apps, thus allowing ISPs to block the anti-censorship tools typically used to bypass social media restrictions
The Role of Deep Packet Inspection in Internet Shutdowns
Internet shutdowns cause economic disruption, stifle citizens’ capacity to access vital online information, and undermine freedom of expression. Despite this, deliberate internet outages remain a common tool used by governments during protests, elections, and conflict.
Internet Service Providers (ISPs) have very little power to refuse when governments order them to restrict their services. However, little is known about the technology ISPs use to block social media platforms and other content.
We believe that an open, free and accessible internet is vital to protect human rights. We have therefore decided to investigate the companies responsible for providing ISPs with technology that enables repressive internet restrictions.
Allot Ltd. is an Israeli telecommunications company that produces and sells a range of products, including Deep Packet Inspection (DPI) technology. While DPI can be used for legitimate purposes, such as restricting access to inappropriate content for children, it can also be used to monitor and block access to social media platforms, political content, and censorship circumvention technologies such as Virtual Private Networks (VPNs).
This report focuses on social media shutdowns and other online content blocks because full internet blackouts do not normally require the use of DPI technology.
One of Allot’s webpages promotes its ability to provide communication service providers with “granular, big data visibility into network, user and application behavior,” and its SmartSentinel product can reportedly help providers “selectively block applications such as VPNs or social media to protect public safety.”
In 2020, the company made between $135 and $140 million in revenue and it reportedly has relationships with over 500 mobile, fixed line and cloud services providers.[1]
View our list of sources, which compiles links to every Allot document and report cited in this investigation
Demand for VPNs often surges during internet restrictions as they provide a means for citizens’ to bypass blocks on specific content. However, authorities frequently retaliate by blocking access to these services.
Allot boasts that it can monitor the traffic of 70 VPNs, which by extension allows its customers, such as ISPs, to block them. On one page of its website, the company says, “As use of VPN apps escalate, prudent operators will seek to ensure that they can observe and keep track of their use.”[2]
On another webpage, the company claims that “Anonymizers/VPN tunnels are typically used to hide a user’s identity and are in use by some to access illegal content or purchase illegal goods, such as drugs.”[3]
Analysis of the company’s investor documents and news reports shows that Allot has commercial relationships with 14 ISPs that have conducted internet disruptions in 21 countries since 2018.
It is nearly impossible to conclusively prove that Allot’s technology was used during a specific shutdown because ISPs often purchase similar technology from a variety of companies. However, the existence of these commercial relationships indicates that it’s likely that their technology has been used in ways that undermines citizens’ fundamental digital rights.
Attribution is made more difficult by the complex and often murky relationship between multinational ISPs and their local subsidiaries. In this report, we have included subsidiaries even if they are not expressly referenced in Allot’s documentation as they may utilize technology originally purchased by their parent company.
For more detailed findings, see our “The Tech Companies Behind Internet Shutdowns: Allot Ltd.” Data Sheet
Allot's Commercial Relationships with ISPs
The following table shows a list of ISPs that have commercial relationships with Allot and the countries where they have complied with government orders to restrict access to the internet. It includes local subsidiaries of multinational operators.
* These ISPs are listed as commercial partners in Allot’s documentation. However, it remains unconfirmed whether they definitively purchased the specific technology required to implement internet restrictions.
Deep Packet Inspection Explained
Deep Packet Inspection (DPI) is a sophisticated form of computer network packet filtering that examines both the header and the data part of a packet as it passes through an inspection point. This technology is often used for various legitimate purposes, however it is particularly effective in the censorship of internet content.
How Deep Packet Inspection Works in Internet Censorship
Content Analysis: DPI delves into the data within a packet, going beyond just header inspection. In the context of censorship, this means analyzing the content for banned or restricted information.
Inspection Points: DPI can be implemented at various strategic points in a network, such as at internet service provider (ISP) nodes. This allows for a broad scope of surveillance and censorship across the network.
Real-time Filtering: DPI systems can filter content in real-time, enabling immediate blocking or redirection of packets containing censored material.
Pattern and Keyword Recognition: DPI tools are equipped to recognize specific keywords, phrases, or patterns indicative of prohibited content. This could range from political content to social media platforms or specific websites.
Applications of Deep Packet Inspection in Internet Censorship
Blocking Websites and Services: Governments or ISPs use DPI to block access to specific websites or online services, often for political, cultural, or religious reasons.
Suppressing Communication: DPI can be used to monitor and restrict communications on messaging platforms, social media, or emails, especially during political unrest.
Enforcing National Firewalls: Countries like China, with its Great Firewall, use DPI to enforce large-scale internet censorship, controlling the flow of information into and out of the country.
Control Over Information: DPI enables authorities to maintain tight control over what kind of information is accessible to the public, often under the guise of maintaining public order or national security.
Other Applications of Deep Packet Inspection
Network Security: DPI is crucial in identifying and mitigating cyber threats. It can detect malware, viruses, and intrusion attempts by analyzing the content of packets for known malicious signatures.
Data Management and Prioritization: In bandwidth management, DPI helps identify types of traffic (like streaming video, P2P file sharing) and apply policies to prioritize or limit certain types of data, ensuring optimal network performance.
Regulatory Compliance: Certain regulations require the monitoring and filtering of data. DPI assists in ensuring compliance by inspecting data for sensitive information or non-compliant activities.
Policy Enforcement: Enterprises use DPI to enforce policies, like blocking access to specific websites or services and ensuring network resources are used as intended.
Traffic Analysis: DPI provides detailed insights into network usage patterns, helping in capacity planning, network design, and understanding user behavior.
Country Analysis
View the list of sources, which compiles links to every Allot document and report cited in this investigation
Nigeria
Nigeria imposed an indefinite Twitter ban on 5 June 2021 after a post by President Muhammadu Buhari was removed from the social media platform for breaching its rules.
VPN demand soared by over 1,400%, as citizens attempted to bypass the block.
Among the ISPs that complied with the government order were Globacom Nigeria (also known as Glo) and MTN. Both companies have commercial relationships with Allot as shown in the DPI supplier’s 2017 and 2020 investor presentations, respectively.[4][5]
While Glo appears to have purchased Allot’s security products, MTN is shown to have purchased Allot’s “Smart” products which includes DPI as a “core technology”. One of the solutions included also references “regulatory compliance”, which may refer to the technology’s ability to block specific websites in line with government orders.
Screengrab from Allot’s May 2020 Investor Presentation displaying the company’s “Smart” product range capabilities.
India
The internet blackout in the disputed Kashmir region started in August 2019 and was the longest ever imposed in a democracy, spanning a total of 7 months. When internet access was restored in March 2020, authorities continued to severely throttle internet speeds to 2G levels.
In addition to throttling, local residents continued to face heavy restrictions of internet content, as only 301 websites were made accessible. A large number of local online publications and social media platforms remained inaccessible.
The largest ISP operating in the area, Reliance Jio, has purchased Allot’s Service Gateway product.[6] The DPI-based hardware is advertised as giving ISPs “Powerful Policy Control,” which can “include any combination of access, priority, bandwidth allocations, shaping, steering, and blocking actions to be applied to application and subscriber traffic.”
Screengrab from Allot’s Actionable Intelligence Brochure showing Reliance Jio’s purchase of the DPI provider’s Service Gateway product.
In 2019, Jio was also reported to have blocked several VPNs after the government ordered operators to restrict access to pornographic content.[7]
In another investor document, Jio is listed as one of the customers of Allot’s “Smart” product package.[8] The group of tools include SmartSentinel which has internet content filtering capabilities that appear to correlate with the types of content blocking Jio has carried out in India.
Screengrab from Allot’s SmartSentinel Solution Brochure showing application & content filtering capabilities.
Myanmar
Internet shutdowns were imposed in Myanmar for over 70 consecutive nights following a military coup in February 2021. The rolling curfew-style internet restrictions were characterized by nightly internet outages, followed by social media blocks during the day, and endured until 27 April.
Mytel was among the major ISPs involved in the blocking of social media platforms during this period. While the connection between Mytel and the Myanmar military is well established, 49% of Mytel is actually owned by Viettel Global JSC.[9]
Viettel has bought Allot’s Smart Technology range according to the DPI provider’s company documents. The range of products includes DPI technology and provides ISPs with “Network Intelligence” and “Intelligent Traffic Management.”[10]
In a revealing report by campaign group Justice For Myanmar, it is alleged that “[o]fficials from Vietnam military conglomerate Viettel operate and maintain secret military infrastructure, transfer military and dual use technology and operate in Myanmar military bases that are off-limits to the civilian government.”[11]
While Mytel is a separate entity to Viettel, it is possible Viettel provided technology originally acquired from Allot to Mytel in order to restrict access to social media services in Myanmar.
Christopher Sidoti, a former member of the UN Human Rights Council Independent International Fact-Finding Mission on Myanmar, said, “The facts establish that Mytel plays a vital role for the military and that Viettel makes Mytel possible.”[12]
ISP Analysis
View the list of sources, which compiles links to every Allot document and report cited in this investigation
Orange
French multinational telco Orange is listed as one of Allot’s customers in an investor presentation published in May 2021. Orange’s logo appears on a page titled “Telecom Customers – Visibility & Control” and the company appears to have purchased Allot’s “Smart” product, which lists DPI as a “core technology.”[13]
Screengrab from Allot’s May 2021 Investor Presentation that shows Orange is a user of the Allot “Smart” technology range.
Orange operates globally and is the tenth largest mobile operator in the world with over 200 million subscribers, according to the corporation’s own recent financial reports.[14] It has also complied with government orders to restrict access to the internet multiple times since 2018. Below is a description of three recent occasions where Orange and its local subsidiaries may have used Allot’s products to block content.
Our analysis shows Orange has blocked online content in six countries in total since 2018. Note however, that the total number of deliberate internet disruptions the company has been involved in over that period is likely to be higher. This is because we excluded full internet blackouts, which do not require DPI technology, from that analysis.
Egypt Website Blocks
Egyptian authorities blocked access to 34,000 websites in April 2019 in response to the Void campaign, which sought to oppose constitutional reforms that could allow the President to remain in power until 2034. The campaign’s petitions were repeatedly taken offline by the government.
“The findings suggest that the Egyptian government may have incurred significant collateral damage as it seeks to restrict online content relating to the campaign, which uses the slogan Void,” Netblocks reported.[15]
Technology startups, self-help and NGO websites were all blocked on Orange, Raya and Telecom Egypt networks. Orange Egypt has over 30 million subscribers.
Cameroon Social Media Throttling
Access to social media platforms was throttled in Cameroon by major ISPs, including Orange, in 2018 as citizens waited for the results of a contested election to be announced.
In response to calls from civil society organizations to restore services, Orange wrote, “Our Group operates in Cameroon through a subsidiary Orange Cameroon which complies with the local legislation and therefore obeys to any national security instruction received from the authorities in accordance with its Telecommunications License.”[16]
Guinea Social Media Blocks
Authorities in Guinea ordered ISPs in March 2020 to restrict access to social media platforms, including Twitter, Facebook, Instagram, and Facebook Messenger. According to Netblocks, both MTN and Orange were affected by the restrictions.[17]
The internet restrictions lasted for almost 40 hours and affected services while parliamentary elections and a constitutional referendum were taking place.
MTN
MTN is listed as one of Allot’s customers on a page titled “Allot Smart Technology Heritage” in the company’s May 2021 Investor Presentation. The Allot “Smart” product range includes DPI as a “core technology” which appears to have been supplied to MTN.
MTN is a multinational mobile telecommunications company, operating predominantly in Asia and Africa. The company recorded 273.44 million subscribers, making it the ninth largest mobile network provider in the world, according to its own recent financial reports.[18]
Our research found that MTN has complied with government orders to restrict access to the internet in 8 countries in total since 2018. Below is a description of three recent occasions where MTN and its local subsidiaries may have used Allot’s products to restrict access to digital content.
Iran Internet Shutdown
Iran has a long history of imposing internet restrictions, particularly surrounding politically sensitive events. MTN Irancell has complied with government orders to shutdown the internet on several occasions, including during the November 2019 protests over fuel prices.
MTN Irancell also blocked the Farsi edition of Wikipedia in March 2020. The blocks appear to be consistent with Allot’s DPI technology. Moreover, a January 2018 survey by Netblocks recorded extensive censorship of services such as Telegram, Facebook, Whatsapp, Twitter and news sites.[19]
MTN Irancell is a seperate entity to MTN and may not have access to the same tools MTN have purchased. In 2011, EFF claimed “Allot Communications Ltd. clandestinely sold its product NetEnforcer to Iran by way of Denmark.” However, the company was later cleared by the Israeli Ministry of Defense who concluded the company “was unaware that the internet monitoring equipment it sold to a distributor ended up in Iranian hands”.[20][21]
Uganda Social Media Blocks
Social media applications were blocked before and after an internet blackout in Uganda that occurred between January 13-18 2021.
The restrictions affected Twitter, Facebook, WhatsApp, Instagram, Skype, Viber and some Telegram servers. Furthermore, AFP found that additional orders to restrict access to around 100 VPNs were issued,[22] a number that is difficult to carry out through network measurement alone.
Network measurements taken by Netblocks showed that MTN complied with government orders during the restrictions.
Screengrab from Allot’s SmartSentinel: Digital Enforcement for Governments booklet displaying the product’s VPN & Anonymizer control functions.
Benin Social Media Blocks
In April 2019 the government of Benin limited access to Facebook, Twitter, Instagram and communications applications such as Whatsapp, Telegram and Viber. The government later ordered ISPs to completely disable internet connectivity during the election. Several VPNs such as Tunnelbear, Hola, TigerVPN and PureVPN were also found to be inaccessible before the total blackout came into place.[23]
Netblocks reported “that the initial blocks were implemented at the ISP level, with leading network operator Spacetel most impacted.” According to OONI, Spacetel is “locally known as MTN Benin.”[24]
Appendix - Signatures List
The following list of VPN services are listed on Allot’s webpage titled, “Supported Protocols”.[2]
In an 2018 update, the company wrote, “Effective visibility, security and control of network traffic requires constant monitoring of new and updated applications and the inclusion of their signatures in our protocol pack. In order to manage bandwidth use so that quality of service and quality of experience is optimized, it’s necessary to ensure that the traffic from the widest range of sources is identified.”
- SkyVPN ICMP
- Ultimate VPN
- Sky VPN
- Betternet Free VPN
- Signal Lab VPN
- Snap Master VPN
- Aura VPNs (Terminals group)
- VPN Proxy Master (Terminals group)
- VPN Proxy Master Lite (Terminals group)
- Melon VPN
- VPN Robot
- Melon VPN (Terminals group)
- VPN360 (Terminals group)
- FreeVPN Group
- SkyVPN
- Hotspot VPN – Super Free VPN Unlimited Proxy
- Secure VPN – Free VPN Proxy, Best & Fast Shield
- Free VPN Unlimited Proxy – Proxy Master
- Free VPN Proxy – Secure Tunnel, Super VPN Shield
- Easy VPN – Free VPN proxy, super VPN shield
- VPN – Master Proxy for iPhone – Super Best VPN & WiFi Security
- VPN – Proxy Master Unlimited – 360 Hotspot Security Shield (iOS)
- IPSec VPN
- VPN 365 – Terminals
- Vypr VPN
- SecureVPN
- VPN Master
- DroidVPN
- AnonyTun
- AirVPN – Terminal
- Browsec VPN
- Betternet Free VPN
- Hotspot Shield VPN
- Windscribe VPN—Terminals
- Opera VPN—Terminals
- YourFreedom VPN
- Browsec VPN (IOS, Android, PC)
- Super VPN (PC)
- YourFreedom VPN (Android)
- Snap VPN (Android)
- Touch VPN (iOS, Android)
- VPN Robot (Android)
- Ultrasurf (Android, PC)
- Turbo VPN (Android, iOS, PC, Mac)
- Express VPN (iOS, Android, PC, MAC)
- IPVanish VPN (iOS, Android, PC, MAC)
- Private Internet Access VPN (iOS, Android, PC, MAC)
- TunnelGuru (PC)
- Vypr VPN (iOS, Android, PC, MAC)
- Zero VPN (Android)
- Cloud VPN (Android)
- Ark VPN (Android, iOS)
- TunnelBear (Android)
- VPN Master (Android)
- TunnelBear (iPhone)
- Hotspot Shield (Android, iPhone)
- Freegate
- Open VPN (open source VPN application for PCs)
- DroidVPN
- TroitVPN
- Hola! VPN
- Psiphon
- VPNbook (for all browsers on PC, Android, iOS)
- VPN Unlimited (on MS Windows, MAC OS, Android, and iOS)
- OpenVPN (an open source VPN application for PCs)
- Psiphon Proxy Server
- Psiphon CDN (Meek mode)
Methodology
We analyzed Allot’s public documents to determine their commercial relationships with various ISPs. We cross-referenced this information with publicly available data about internet shutdowns that have occurred since 2018.
Access the “The Tech Companies Behind Internet Shutdowns: Allot Ltd.” full dataset on this Google Sheet.
Main image: Screenshot of Allot website showing its DPI-based SmartSentinel product used for internet censorship
The authors of all our investigations abide by the journalists’ code of conduct.
References
[1] https://investors.allot.com/news-releases/news-release-details/allot-announces-third-quarter-2020-financial-results ↩
[2] http://web.archive.org/web/20210625150707/https://www.allot.com/supported-protocols/ ↩
[3] http://web.archive.org/web/20210628083622/https://www.allot.com/wp-content/uploads/SB_Secure-Service-Gateway-Solutions.pdf ↩
[4] http://web.archive.org/web/20210628083830/https://investors.allot.com/static-files/d2f8cc23-21f1-4790-90bb-49eaca15fe81 ↩
[5] http://web.archive.org/web/20200604234545/https://investors.allot.com/static-files/094b0900-f062-455e-be42-9e548b513fb1 ↩
[6] http://web.archive.org/web/20210628083923/https://www.allot.com/resources/Actionable-Intelligence-Brochure_Aug19.pdf ↩
[7] https://www.thequint.com/tech-and-auto/tech-news/reliance-jio-not-letting-users-access-proxy-websites-to-watch-porn ↩
[8] http://web.archive.org/web/20210628083936/https://www.allot.com/resources/BR_SmartSentinel_CSP.pdf ↩
[9] https://www.theguardian.com/world/2020/dec/20/british-banks-under-pressure-over-45m-loans-to-firm-with-links-to-myanmar-military ↩
[10] http://web.archive.org/web/20200604234545/https://investors.allot.com/static-files/094b0900-f062-455e-be42-9e548b513fb1 ↩
[11] https://www.justiceformyanmar.org/stories/nodes-of-corruption-lines-of-abuse-how-mytel-viettel-and-a-global-network-of-businesses-support-the-international-crimes-of-the-myanmar-military ↩
[12] https://www.theguardian.com/world/2020/dec/20/british-banks-under-pressure-over-45m-loans-to-firm-with-links-to-myanmar-military ↩
[13] http://web.archive.org/web/20210625150858/https://investors.allot.com/static-files/73e18b7a-c91c-4bd7-886e-b323f110ed84 ↩
[14] https://www.orange.com/sites/orangecom/files/2020-10/PR_Orange_3Q_2020_EN_291020_2.pdf ↩
[15] https://netblocks.org/reports/egypt-filters-34000-domains-in-bid-to-block-opposition-campaign-platform-7eA1blBp ↩
[16] http://web.archive.org/web/20210625152527/https://www.business-humanrights.org/en/latest-news/oranges-response/ ↩
[17] https://netblocks.org/reports/guinea-blocks-social-media-on-eve-of-elections-ryb3rn87 ↩
[18] http://web.archive.org/web/20210625150858/https://investors.allot.com/static-files/73e18b7a-c91c-4bd7-886e-b323f110ed84 ↩
[19] https://netblocks.org/reports/iran-internet-survey-shows-extent-of-telegram-blocks-and-censorship-amid-protests-Pryb4A7n ↩
[20] https://www.eff.org/deeplinks/2011/12/israeli-firm-under-fire-selling-spyware-iran ↩
[21] https://en.globes.co.il/en/article-1000718874 ↩
[22] https://www.bbc.co.uk/news/world-africa-55640405 ↩
[23] https://netblocks.org/reports/internet-blocked-in-benin-on-election-day-aAwqknyM ↩
[24] https://ooni.org/post/2019-benin-social-media-blocking/ ↩