Exam-Time Internet Shutdowns: Syria, Iraq, and Algeria in 2024

Every year, exam season in several Middle Eastern and North African countries brings with it a predictable wave of government-mandated Internet disruptions. The stated goal is preventing cheating, but the technical implementation—and the resulting impact—varies widely from country to country. Mid-2024 found Syria, Iraq, and Algeria all taking to their national playscripts once again, with each employing a different strategy for cutting access. Here we break down the Cloudflare-observed data for each.

Syria: The Full-Shutdown Approach

Syrian Telecom (AS29256) is, for all practical purposes, the entire Syrian Internet. It is one of only two ASNs in the country announcing IP space to the public Internet, and the only one of any scale. Once again this year, the state telecom provider announced its exam-day “disconnection” schedule on Facebook, and the shutdowns ran from May 26 through June 13, with daily multi-hour pauses on weekdays.

The implementation is a brute-force routing withdrawal. During each shutdown window, both IPv4 and IPv6 prefixes announced by Syria and by AS29256 drop to zero. With no routes being advertised, there is no path for any response to get back into the country—even if traffic can still exit.

This asymmetry is starkly visible in traffic to Cloudflare’s 1.1.1.1 resolver. As has been observed in previous years, traffic over UDP port 53 spikes aggressively during shutdown windows. Since DNS requests over UDP need no handshake, the resolver keeps receiving the request packets, but it has no route to deliver replies. Unanswered clients simply retry, and that retry flood appears as the spike.

Everything else falls silent. Any protocol requiring a TCP handshake—DNS over TCP, DoH, DoT, or plain HTTP(S)—drops to zero during the shutdown, since the handshake cannot complete. Hidden inside that UDP spike is a specific demographic: DNS lookups to 1.1.1.1 for Facebook, WhatsApp, Signal, and Telegram all surge during the cutoffs, suggesting these messaging apps are a primary driver of the retry traffic. On the authoritative DNS side, a similar pattern emerges. Traffic from Syria to Cloudflare’s authoritative DNS servers rises sharply when the shutdown begins and stays elevated until it ends, again signaling local resolvers retrying queries after receiving no responses, albeit at a less frantic pace than client applications.

In short, Syria’s model is simple: announce nothing, break everything.

Iraq: A Richer Mix of Tactics

Iraq’s situation is different from the outset. The Ministry of Communication announced a two-hour daily cutoff (06:00 to 08:00) for the intermediate studies general exams starting in late May. Iraq is also a far more fragmented network environment than Syria, with over 150 ASNs announcing space. This means shutdowns are often not complete at the country level, as some providers simply opt out. During shutdown windows this year, country-level traffic dropped by roughly 87%, with over 30 observed ASNs showing a complete loss of traffic.

Yet Iraq’s routing behavior is more variable than Syria’s. While ASN-level address-prefix withdrawals were observed for some major networks like Zainas (AS59588), Earthlink (AS199739), and Asiacell (AS51684), others like HulumTele (AS203214) and Halasat (AS58322) showed very little change in announced space.

Signals from 1.1.1.1 traffic are muddier here. In country-level graphs, the UDP resolver traffic appears unchanged, but this is likely an artifact of the time scale and the fact that Kurdish network providers in the north were not shutting down. A different story emerges in the TCP-based data: DNS-over-TCP, DoH, and HTTP(S) traffic all show clear troughs on shutdown days. Authoritative DNS traffic, particularly at the ASN level (e.g., Hulum), also visibly declines during the shutdown window.

The picture these measurements paint is of a complex disruption strategy rather than Syria's pure route-withdrawal playbook. The fact that some providers implement full withdrawals while others do not suggests a combination of techniques applied across the network landscape, including:

  1. IP-based blocking: Either withdrawing prefixes entirely or blocking access to specific IP ranges.
  2. Connection-level filtering: Terminating connections based on SNI or HTTP headers, often by an on-path device.
  3. DNS-based restrictions: Using operators of private resolvers to block resolution of hostnames at the source.

Iraq has obvious chokepoints for applying such policies—AS212330 (IRAQIXP) and AS208293 (AlSalam State Company) are both positioned upstream of a wide mesh of downstream providers. Iraq is, as the data suggests, far more sophisticated in its approach than its neighbor to the north-west.

Algeria: Poking Holes in the Web

Algeria has for years brought down its Internet during the nationwide Baccalaureate exams, a practice dating back to a 2016 test-leaking scandal. In 2024, exams ran from June 9-13. This year's approach, however, broke from the historical trend of full-blown blackouts. Two daily disruptions occurred—one in the morning starting roughly ~08:00 local time, and one in the afternoon—but the resulting national traffic impact was far lighter than previous years.

Unlike in Syria, there were no meaningful changes to announced IPv4 address space during exam days. This is not a routing-level withdrawal. Instead, HTTP(S) traffic graphs reveal a cleaner picture of the daily impact: a moderate decline exists during the morning disruption, while the afternoon window produces a more dramatic drop-off. Even in their softer version, the effects are plainly visible in TCP-based services like DNS-over-TCP, DoT, and DoH traffic. UDP-based resolver traffic, by contrast, largely sails through unaffected.

This signature points to tampering with TCP connections rather than mass blocking. Cloudflare’s internal data detection confirms it: spikes of post-ACK and post-PSH connection tampering align precisely with the daily timing of the disruption windows. Post-ACK tampering suggests a middlebox terminates established connection by sending RST packets before data exchange completes; post-PSH suggests a similar tactic after data is sent. Data from OONI probes corroborates this, with tests for WhatsApp, Telegram, Signal, and Facebook Messenger showing nearly unanimous "Anomaly" results starting June 9. Anomalous traffic for Google products further strengthens the case this is happening at a national or ISP level rather than just in isolated incident reports.

For Algeria, the prescription is clear: no full shutdown. They are, instead, targeting hostnames by interfering with TCP connections—leaving the door open on UDP but kicking the chairs out from under TCP connections that look suspicious, generally identified by SNI or IP address.

A Shift Toward Subtler Disruption

Historically, Internet shutdowns gave governments a blunt instrument good for one thing: clear, inconvenient, and disruptive to everyone. With Syria illustrating that in 2024, the new trend seems to be picking up more sophisticated, but arguably no less disruptive, methods. Both Iraq and Algeria are employing varied strategies of targeted interference in 2024—strategies that are nowhere near as immediate to diagnose from outside the country’s borders as classic routing withdrawal. Though there may be less internal recognition of the impact compared with full blackouts, the practical result—significant collateral damage to connectivity, media, and essential services—remains unchanged.