A multi-perspective view of Internet censorship in Myanmar FOCI’21, August 27, 2021, Virtual Event, USA • Active Probing: The IODA system periodically probes approximately 3.5 M /24 network blocks worldwide and adaptively send more probes upon lack of response using the Trinocular methodology developed by ISI/USC [68]. It uses responses to determine when /24 blocks get disconnected from the Internet. IODA’s methodology and data sources are under active development, drawing upon lessons from a wide body of recent research [6, 15, 16, 32, 43, 63–66, 68, 80]. A.2 a form of tampering. As a first step, the web connectivity test attempts to identify which DNS resolver is being used by the user. It does so by performing a DNS query to special domains (such as whoami.akamai.com) which will disclose the IP address of the resolver. (2) DNS lookup Once the web connectivity test has identified the DNS resolver of the user, it then attempts to identify which addresses are mapped to the tested host names by the resolver. It does so by performing a DNS lookup, which asks the resolver to disclose which IP addresses are mapped to the tested host names, as well as which other host names are linked to the tested host names under DNS queries. (3) TCP connect The web connectivity test will then try to connect to the tested websites by attempting to establish a TCP session on port 80 (or port 443 for URLs that begin with HTTPS) for the list of IP addresses that were identified in the previous step (DNS lookup). (4) HTTP GET request As the web connectivity test connects to tested websites (through the previous step), it sends requests through the HTTP protocol to the servers which are hosting those websites. A server normally responds to an HTTP GET request with the content of the webpage that is requested. Additional analyses of Internet connectivity outages Here, we present additional analyses and details about the Internet connectivity shutdowns that occurred in Myanmar following the military coup. Figure 6 shows how the Internet outage that occurred on the day of the coup (Feb 1) affected various networks and highlights differences in the timing and extent of the outage. We then proceed to show in Figure 7 a time period that includes the start of cellular restrictions (March 15th) and a sample of the nightly Internet connectivity shutdowns that affected almost all Myanmar Internet users between Feb. 14 to Apr. 28th. A.3 Detailed methodology for observing censorship using OONI datasets A.3.2 Comparison of results: Identifying censorship. Once the above steps of the web connectivity test are performed both over a control server and over the network of the user, the collected results are then compared with the aim of identifying whether and how tested websites are tampered with. If the compared results do not match, then there is a sign of network interference. Below are the conditions under which the following types of blocking are identified: To investigate the blocking of websites and social media, we analyzed OONI measurements collected from Myanmar (similarly to our previous studies in 2020 [45] and 2017 [81]). OONI measurements are regularly collected and contributed by users of the OONI Probe app [57], which is free and open source, designed to measure various forms of internet censorship and network interference. Here, we present additional details about how we used measurements collected by OONI probe to identify potential censorship. OONI Probe’s web connectivity test [59, 60] examines whether websites (included in the Citizen Lab test lists [46]) are reachable, and if they are not, the test attempts to determine whether access to them is blocked by means of DNS tampering, TCP/IP blocking or by a transparent HTTP proxy. The web connectivity test performs four steps: Resolver identification, DNS lookup, TCP connect, and HTTP GET request. By default, this test performs the above (excluding the first step, which is performed only over the network of the user) both over a control server and over the network of the user. If the results from both networks match, then there is no clear sign of network interference; but if the results are different, the result is flagged as “anomalous”. Depending on the type of anomaly detected (DNS, TCP/IP, HTTP), we can infer the type of blocking. • Confirmed DNS blocking: If the DNS response observed by the user contains IP addresses that (previously) hosted blockpages or an address in private IP address ranges. • DNS blocking: If the DNS responses (such as the IP addresses mapped to host names) do not match. Note that DNS blocking is not a superset of "Confirmed DNS blocking"; we only list a test result as "DNS blocking" if it was not categorized as "Confirmed DNS blocking" per the above specification. • TCP/IP blocking If a TCP session to connect to websites was not established over the network of the user. • HTTP blocking If the HTTP request over the user’s network failed, or the HTTP status codes don’t match, or all of the following apply: (1) The body length of compared websites (over the control server and the network of the user) differs by some percentage (2) The HTTP headers names do not match (3) The HTML title tags do not match A.3.1 Web connectivity test details. Below we provide information about how each step performed under the Web Connectivity test works. (1) Resolver identification Internet Service Providers, amongst others, run DNS resolvers which map IP addresses to host names. In some circumstances though, ISPs map the requested host names to the wrong IP addresses, which is Figure 4 shows the aggregated results of the web connectivity tests run by Myanmar users and presents details about the types of anomalies observed. 35