Kentik Internet Analytics Director Doug Madory noticed this morning, traffic to Russian state ISP Rostelecom dropped significantly in the wake of its attempt to slow down Twitter. The outages appear to be caused by a poorly crafted substring in a blocklist/network design tool maintained by Russia’s Roskomnadzor agency.
Roskomnadzor’s intent was to slow down access to Twitter’s link-shortening service, t.co. All links embedded in tweets are automatically wrapped by this service, allowing Twitter to monitor the type and quality of the links its users share.
Russian authorities have been scolding Twitter for some time for the service’s failure or refusal to remove content that is illegal in Russia. This includes content that is illegal in most of the world and violates Twitter’s own terms of service, such as self-harm and sexualization of children, but Roskomnadzor claims only 2,000 such posts over the course of a year. It seems likely that the real sticking point for the agency is the messages encouraging children to participate in Russian opposition protests.
PBS reports on the unintended effects of Roskomnadzor’s Twitter restriction:
When the Russian authorities slowed down Twitter, some government websites faced downtime and access problems. It’s not clear if the events were related, and some experts suggested they could be the result of unrelated cyberattacks. The Ministry of Digital Development acknowledged outages on some government websites, but said they were related to equipment problems at communications provider Rostelecom.
Madory attributes Russian 3D artist Gregory Kodyrev with find a link between the Twitter throttle and many more widespread slowdowns – apparently Roskomnadzor accidentally blocked or restricted all domains containing the string t.co instead of just blocking the domain t.co yourself. This would lead to the throttle or block being applied to – say – microsoft.com, reddit.com and even the Russian state news site rt.com.
We don’t have access to IP addresses behind Roskomnadzor’s traffic filtering service to test this claim, but it seems to provide a reasonable explanation for the concrete observations of reduced traffic to Rostelecom networks.