Report on implementation of the project on monitoring of Internet during of pre-parliamentarian election race

The Public Fund Civil Initiative of Internet Policy (CIIP) held monitoring of Internet during the parliamentarian elections from November 20, 2007 to January 10, 2008. Under this project access to the national Internet resources both at the national level and outside the Kyrgyz Republic was analyzed.

Background of the project implementation

During the project implementation Internet resources remained an important source of information.  After appearance in “forums and chats” of criticizing articles and utterances against the acting politicians, the National Security Agency has distributed a request to all informational services to provide all IP addresses of “forums and chats” users.  Therefore the information agencies turned to our organization for assistance how to lawfully refuse to provide IP addresses of Internet users.  The lawyers of our organization have prepared legal grounds for refusal to provide IP addresses to the national security agencies.  Based on the developed legal rationale the information services denied the request of the related law enforcement bodies.  However, the law enforcement bodies have developed a draft normative act that would allow to make it compulsory to introduce the information sites over IP addresses of users.  The public fund has held many consultations with government representatives explaining the negative consequences of change of the legislation with regard to Internet resources.  I.e. such change could constrain development of Internet which during the parliamentary elections was the main source of information.

As a result of consultations it was agreed to arrange joint activity of CIIP and other NGO with the government to consider issues of Internet regulation taking into account the international standards of regulation of Internet.  Currently the government initiative to regulate Internet is suspended.
The Government made a new proposal which is to introduce control over the mobile communication users and censorship in Internet.  Our organization formed working groups to assess these normative acts.  The working groups included telecommunications operators, government representatives and representatives of non-government organizations.  For these purposes our organization continues discussing the methods and ways of information struggle against such initiatives.

In November the National Security Agency has held meetings with managers of communication operators, including Internet providers to discuss issues of introduction of filtration.  Communication operators have denied such request.  Similar meetings were held with heads of information agencies which have forums and chats.

Description of the implemented monitoring of Internet

The project activity was held in two main directions:

1. Technical survey
2. Analysis and distribution of the results (PR)

Technical survey

Technical survey has been the basis of activity throughout the project.

CIIP developed a list of pubic and political sites which are regularly imposed to various attacks and blockings, as well as the sites prone to blockings.  Such sites include not only the sites in the .kg zone, but also those on servers of other countries containing the important information for citizens of our country.

The list of resources to be tested was made based on the following principle:

• Web-sites of opposition trends (political parties, Internet – newspapers and resources having been created in support of the Kyrgyz opposition)
• web-sites of NGO and international organizations
• web-sites of information agencies and news agencies.
• web-sites of television and radio stations
• web-site of the central election committee and President of the KR

Monitoring of the national Internet was held using Internet services available for every common user.  In course of monitoring the above mentioned 8 Internet providers were selected, since they are national providers, having own channels to access the global network Internet.  For the purpose of survey we connected one computer to each ISP separately. This equipment was set in such a way that continuously (every equal time intervals) automatic requests were sent to certain lists of sites which could be blocked or access to which could be limited (whether artificially or naturally the channel is loaded).

To check filtration of resources a hardware-software complex (HSC) was created to check “censorship” of resources, with use of various technologies of access.  The software used the created list of Internet resources and checked whether one of URL or web-sites from Internet segment from which checking was carried out is blocked or not.  In general, the following technologies of access to the selected resources were used for testing:

• Proxy-servers
• Dial-up access
• Clusterization and task assignment
• Dedicated servers and links

Local technical specialists have studied the possibility of filtration and general practice using the international developments in this area.  In order to obtain a reliable result by the project participants the following was done:

• Topography of basis ISP and their connection with the higher providers was studied;
• Probable (ways and) methods of filtration were identified;
• The software implementing the check with use of various technologies of access to Internet was created, installed and customized;

International technical experts participated in monitoring in order to test the results of monitoring on own special unique equipment.

Analysis and distribution of the results

Based on obtained statistical data the analysis was held the result of which gave answers to questions: by the following criteria:

• What is the total number of the blocked sites?
• Who is the owner of these sites?
• Who implements filtration?
• How filtration is implemented?
• Reason for which filtration was implemented.

After identification of the “problematic sites”, i.e. access to which was temporarily suspended for some technical reasons, the work was performed to find out whether it was caused by natural disruptions or by external interference into operation of this site.  Having carefully analyzed the results we received the documented data, containing the information on accessibility of resources, and identified probable reasons of inaccessibility.

Results of the survey

The results of monitoring of Internet during the 2007 elections will be published on CIIP site, and also be provided to international, human rights and political organizations.  Press conference was held for mass media in order to distribute the results to wide public.

General results of the analysis are put into a table, in per cent of accessibility of every checked resource, by time.

This table represents a consolidated report on the survey held for the period from November 20 to December 20, 2007.  The results were included in a consolidated evaluation of reports from all 8 main ISP, making 97 per cent of the Internet services market in Kyrgyzstan.  Special consideration is given to 144 web-sites, both Kyrgyz and foreign one, which content fully or partially represents the information on Kyrgyzstan (political, economic, course of pre-election campaign, results of elections and other).  Seven of the above mentioned websites had problems with access from sub-network of every ISP

• www.shailoo.kg – website of the Innovation Technologies Fund “Terra Public”.  By results of the visual analysis it is seems that the site has been created in 2004 by Artel Design company, supposedly non-existing currently; it was created by not completed; there were no regular audits of the site security module; and judging by content of the forum  (http://www.shailoo.kg/?name=forum ) – it has not been upgraded for a long time, in fact from the time of its creation.  According to the current content the last news on the site is dated 4.06.07
• www.shailoo.gov.kg – website of the Center of Election Committee.  On December 14, at about from 2 to 6 a.m. the site was cracked, and its homepage   was replaced with black background with the text “This site has been hacked by Dream of Estonian Organization XOPO Legio Denjos”.  Closer to noon time operation of the resource was recovered.  It seems that the reason for cracking was the defect of the security system of the site content management system, and possibly uncovered vulnerable areas in the server software, used to provide  operation of the resource.
• www.24.kg – website of the news agency 24.kg.  The website has a mirror of the resource placed in the GoldenTelecom company in Moscow.  In the period from December 16 to December 17, the local mirror of the website in Elcat company from time to time did not respond to requests of users, supposedly because of overload by a big number of connections to the server.  At the same time the external mirror has correctly provided the information.  The mirror content was identical.
• www.gazeta.kg – website of news and analytics, physically based in USA, on  Internet site of the Everyones Internet company.  During the whole period there were regular problems with access to the website.  There was no response of the server in 20 per cent cases.  When carefully analyzing this fact we checked accessibility to the resource from 8 different networks of Internet, located in Europe, USA, South America, Canada and Russia.  The result was similar to the result from networks of Kyrgyz providers.  The resource is not blocked by Kyrgyz Internet providers.  Technical surveys have revealed 2 reasons for poor access: the server on which the website www.gazeta.kg is located is not able to cope with the load, and the second reason is the access provider, and the system controlling load of the server is used, which filters part of requests, thereby causing disconnection.  Mainly improper operation of the resource was identified from December 15 to December 20.
• www.akipress.org – activity of forums use on this website in the pre-election race has decreased by 80 per cent as compared to activity of forums use in the beginning of autumn 2007.  Since before the pre-election race Akipress has set prohibition to place comments by anonymous users.
• www.pr.kg – activity of use of forum of this website has increased by 20 per cent as compared to beginning of autumn 2007.  The site administrator has not established any rules on limitation of users and content of comments.
• The most popular website among Internet users in the period of pre-election race was www.diesel.elcat.kg in the section Policy and 
  Society – one of the main sites for policy discussions in Kyrgyzstan.  Activity of requests for this website has increased for the period of pre-election agitation by 45 per cent.
• www.parohod.kg lost a big number of users in the period of pre-election race. www.parohod.kg did not publish news on the 15-th and 16-th.

The resources included in the table had the following per cent of connection failures:

Percentage of inaccessibility of the problematic resources from November 20 to December 20.

#	Name of the site	% inaccessibility
1.	http://www.shailoo.kg/	100
2.	http://www.gazeta.kg/	17.9
3.	http://www.24.kg/ (local mirror)	2.0
4.	http://www.24.kg/ (outer mirror)	0.2
5.	http://www.shailoo.gov.kg/	1.6
6.	http://www.kyrgyznews.com/	2.0
7.	http://www.kyrgpress.org.kg/	3.1
8.	http://www.oasis.kg	1.9
9.	http://www.flb.ru/	0.8
10.	http://www.parohod.kg/	1.9
11.	http://www.iom.int/	0.3

The rest websites experienced recurrent failures with access to them in various time of a day as a result of the following errors:

• Connection reset by peer
• Socket timeout
• Too many connections

These errors occurred for several reasons:

• Servers on which these websites are located have high rate of visits and from time to time limit the number of simultaneous sessions to prevent overload.
• High load of channels to these websites caused the network collisions and crippled the information communication.
• Temporary communication failures both at the local ISP and external providers.

The obtained results and implemented survey obviously demonstrate that during the pre-election agitation and elections of President of the KR no intended blocking or difficulties with access to the checked resources were identified.  All problems with getting information and failures to connect to the web-sites occurred because of abundant visits of servers, temporary communication errors and technical collisions of servers of local ISP and foreign providers.