Seeing a national internet outage in traffic measurements, and being careful about what that does and does not prove. Every panel below was produced from bundled recordings of real IODA measurements; the dashed line is the fitted seasonal baseline, and the shaded left-hand region is the window used to fit it.
Read this before quoting anything below. These are inferences from third-party traffic measurements, not observations of events. This tool cannot see intent: it sees packets stopping. A classification of “deliberate shutdown” is a hypothesis with a stated weight of evidence, not a finding of fact about any government, operator or incident, and it should be corroborated against reporting on the ground before it is repeated. It is not an emergency service and must not be relied on for safety-critical decisions. Where the evidence is thin, the tool says so; please carry that uncertainty forward rather than dropping it.
Sudan lost near-total national connectivity in early February 2024 during the ongoing conflict, with the major operators going offline. Attribution was contested at the time; the measurement record shows the collapse but not its cause, which is exactly the distinction this tool is trying to hold on to.
What a correct detector should say: SD: near-total loss on both the control plane (BGP) and the data plane, sustained for days, across every monitored operator. DE over the identical window is the control and should stay CLEAR.
Most consistent explanation: deliberate shutdown or ordered restriction (possible, 38% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 16:30 local time, reaching 98% below the seasonal baseline, and lasting 273.3 hours. 83% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 98% against a 85% fall in reachability. The main alternative not excluded by this evidence is power failure, natural disaster or conflict damage (26%). Held at 'possible' rather than 'likely': onset is not clock-aligned and does not repeat on a schedule. Asserting that a state ordered a shutdown requires more than this. This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| -3.0 | BREADTH_NOT_SINGLE | Single-operator fault | Rules out a single-operator fault. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| -1.8 | PLANE_BOTH_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut cable leaves the routing table largely intact. |
| +1.6 | LONG_DURATION | Submarine cable or upstream transit fault | Degraded for 11.4 days. Restoring a submarine cable needs a repair ship on station, which is a job of days to weeks, and the long tail is characteristic. |
| -1.6 | LONG_UNSCHEDULED | Deliberate shutdown or ordered restriction | Argues against an ordered restriction: it ran for days, began at no particular local time and never repeated on a schedule. Ordered shutdowns are normally bounded and tidy, because someone has to decide to end them. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | BREADTH_TOTAL | Deliberate shutdown or ordered restriction | 83% of monitored networks dropped simultaneously. Independent commercial operators do not fail together by chance; either they share infrastructure or they received the same instruction. |
| +1.2 | PLANE_BOTH | Deliberate shutdown or ordered restriction | Both planes collapsed together (BGP 98%, reachability 85%): networks were withdrawn from the routing table, so the outage is at the operator rather than in a cable. |
| +1.0 | PLANE_BOTH_POWER | Power failure, natural disaster or conflict damage | A total loss of power at core sites would also withdraw routes, so an infrastructure cause remains consistent with this. |
| +1.0 | BREADTH_TOTAL_POWER | Power failure, natural disaster or conflict damage | Equally consistent with a national grid failure hitting every operator at once. |
| +1.0 | LONG_DURATION_CONFLICT | Power failure, natural disaster or conflict damage | Also consistent with sustained infrastructure damage or fuel exhaustion. |
Alert level reasoning: sustained 98% drop below seasonal baseline for 273.3 h; deep national-scale drop; corroborated by merit-nt, ping-slash24 - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
No sustained drop above the 20% watch threshold in the scoring window.
Iraq has for several years imposed nationwide internet shutdowns during national exam sittings, in windows of a few hours on exam mornings. This is the least ambiguous class of deliberate shutdown because it is announced, bounded and repeated.
What a correct detector should say: IQ: repeated short outages beginning at essentially the same local clock time on many mornings, with cliff onset and cliff recovery. The repetition is the point: it is the strongest available evidence of a human schedule. GB is the control.
Most consistent explanation: deliberate shutdown or ordered restriction (likely, 80% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 04:00 local time, reaching 65% below the seasonal baseline, and lasting 5.3 hours. 67% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 31% against a 65% fall in reachability. This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +2.6 | SCHEDULE_REPEATS | Deliberate shutdown or ordered restriction | The outage repeated 7 times at essentially the same local clock time. Repetition on a schedule is the strongest available evidence of a human decision; exam-period shutdowns look exactly like this. |
| -2.0 | SCHEDULE_NOT_PHYSICAL | Power failure, natural disaster or conflict damage | Argues strongly against a physical cause: neither grids nor weather repeat to a timetable. |
| -2.0 | SCHEDULE_NOT_CABLE | Submarine cable or upstream transit fault | Argues strongly against a cable fault, which is a single event followed by a multi-day repair. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | RECOVERY_CLIFF | Deliberate shutdown or ordered restriction | Recovery was as sharp as the onset: service came back in one step, as it does when a restriction is lifted rather than when equipment is repaired. |
| +1.2 | SHORT_WINDOW | Deliberate shutdown or ordered restriction | A 5.3 hour window starting on a round local hour looks like a bounded restriction. Failures have no reason to end tidily. |
| +1.0 | CLOCK_ALIGNED | Deliberate shutdown or ordered restriction | Onset at 04:00 local time, within 10 minutes of a whole hour. Physical failures do not consult a wall clock - but a random onset lands this close to an hour one time in three, so on its own this is weak. |
Alert level reasoning: sustained 65% drop below seasonal baseline for 5.3 h; deep national-scale drop; corroborated by bgp - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
No sustained drop above the 20% watch threshold in the scoring window.
On 14 March 2024 several submarine cable systems serving the West African coast (WACS, ACE, SAT-3 and MainOne) were damaged in the same period, cutting a large share of the region's international capacity. Restoration required cable ships and took weeks. This is the cleanest available example of an outage that is unambiguously physical and unambiguously not anyone's decision.
What a correct detector should say: Several neighbouring coastal countries degrade within the same few hours, at no particular local clock time, with a recovery measured in days rather than minutes. Cote d'Ivoire should be the deepest. Senegal sits north of the damage on different capacity and is the regional control: it should stay CLEAR, which is what stops 'the whole region dipped' from being read as 'every West African government acted at once'.
Most consistent explanation: submarine cable or upstream transit fault (likely, 58% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 09:45 local time, reaching 99% below the seasonal baseline, and lasting 68.2 hours. 83% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 86% against a 99% fall in reachability. 3 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is power failure, natural disaster or conflict damage (22%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +3.5 | REGIONAL_COOCCURRENCE | Submarine cable or upstream transit fault | 3 other monitored countries show an overlapping episode. Degradation that crosses borders points at infrastructure those countries share - a cable system or a common upstream - rather than at any one government. It takes a great deal more evidence to claim that several states acted in concert than to conclude that they sit on the same cable. |
| -3.0 | BREADTH_NOT_SINGLE | Single-operator fault | Rules out a single-operator fault. |
| -2.1 | REGIONAL_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against a single national order: 3 neighbouring countries fell with it. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| -1.8 | PLANE_BOTH_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut cable leaves the routing table largely intact. |
| +1.6 | LONG_DURATION | Submarine cable or upstream transit fault | Degraded for 2.8 days. Restoring a submarine cable needs a repair ship on station, which is a job of days to weeks, and the long tail is characteristic. |
| -1.6 | LONG_UNSCHEDULED | Deliberate shutdown or ordered restriction | Argues against an ordered restriction: it ran for days, began at no particular local time and never repeated on a schedule. Ordered shutdowns are normally bounded and tidy, because someone has to decide to end them. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | BREADTH_TOTAL | Deliberate shutdown or ordered restriction | 83% of monitored networks dropped simultaneously. Independent commercial operators do not fail together by chance; either they share infrastructure or they received the same instruction. |
| +1.2 | PLANE_BOTH | Deliberate shutdown or ordered restriction | Both planes collapsed together (BGP 86%, reachability 99%): networks were withdrawn from the routing table, so the outage is at the operator rather than in a cable. |
| +1.0 | PLANE_BOTH_POWER | Power failure, natural disaster or conflict damage | A total loss of power at core sites would also withdraw routes, so an infrastructure cause remains consistent with this. |
| +1.0 | BREADTH_TOTAL_POWER | Power failure, natural disaster or conflict damage | Equally consistent with a national grid failure hitting every operator at once. |
| +1.0 | LONG_DURATION_CONFLICT | Power failure, natural disaster or conflict damage | Also consistent with sustained infrastructure damage or fuel exhaustion. |
| · | CLOCK_UNTESTABLE | Measurement artefact, not a real outage | The sampling interval is too coarse to say whether the onset was aligned to a whole local hour, so the clock-alignment evidence is unavailable in both directions. |
Alert level reasoning: sustained 99% drop below seasonal baseline for 68.2 h; deep national-scale drop; corroborated by bgp - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
Most consistent explanation: submarine cable or upstream transit fault (likely, 63% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 10:30 local time, reaching 85% below the seasonal baseline, and lasting 325.2 hours. 83% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 85% against a 82% fall in reachability. 4 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is power failure, natural disaster or conflict damage (21%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +4.2 | REGIONAL_COOCCURRENCE | Submarine cable or upstream transit fault | 4 other monitored countries show an overlapping episode. Degradation that crosses borders points at infrastructure those countries share - a cable system or a common upstream - rather than at any one government. It takes a great deal more evidence to claim that several states acted in concert than to conclude that they sit on the same cable. |
| -3.0 | BREADTH_NOT_SINGLE | Single-operator fault | Rules out a single-operator fault. |
| -2.8 | REGIONAL_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against a single national order: 4 neighbouring countries fell with it. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| -1.8 | PLANE_BOTH_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut cable leaves the routing table largely intact. |
| +1.6 | LONG_DURATION | Submarine cable or upstream transit fault | Degraded for 13.6 days. Restoring a submarine cable needs a repair ship on station, which is a job of days to weeks, and the long tail is characteristic. |
| -1.6 | LONG_UNSCHEDULED | Deliberate shutdown or ordered restriction | Argues against an ordered restriction: it ran for days, began at no particular local time and never repeated on a schedule. Ordered shutdowns are normally bounded and tidy, because someone has to decide to end them. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | BREADTH_TOTAL | Deliberate shutdown or ordered restriction | 83% of monitored networks dropped simultaneously. Independent commercial operators do not fail together by chance; either they share infrastructure or they received the same instruction. |
| +1.2 | PLANE_BOTH | Deliberate shutdown or ordered restriction | Both planes collapsed together (BGP 85%, reachability 82%): networks were withdrawn from the routing table, so the outage is at the operator rather than in a cable. |
| +1.0 | PLANE_BOTH_POWER | Power failure, natural disaster or conflict damage | A total loss of power at core sites would also withdraw routes, so an infrastructure cause remains consistent with this. |
| +1.0 | BREADTH_TOTAL_POWER | Power failure, natural disaster or conflict damage | Equally consistent with a national grid failure hitting every operator at once. |
| +1.0 | LONG_DURATION_CONFLICT | Power failure, natural disaster or conflict damage | Also consistent with sustained infrastructure damage or fuel exhaustion. |
| · | CLOCK_UNTESTABLE | Measurement artefact, not a real outage | The sampling interval is too coarse to say whether the onset was aligned to a whole local hour, so the clock-alignment evidence is unavailable in both directions. |
Alert level reasoning: sustained 85% drop below seasonal baseline for 325.2 h; deep national-scale drop; corroborated by ping-slash24 - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
Most consistent explanation: submarine cable or upstream transit fault (likely, 56% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 05:00 local time, reaching 81% below the seasonal baseline, and lasting 33.5 hours. 50% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 63% against a 81% fall in reachability. 3 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is deliberate shutdown or ordered restriction (17%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +3.5 | REGIONAL_COOCCURRENCE | Submarine cable or upstream transit fault | 3 other monitored countries show an overlapping episode. Degradation that crosses borders points at infrastructure those countries share - a cable system or a common upstream - rather than at any one government. It takes a great deal more evidence to claim that several states acted in concert than to conclude that they sit on the same cable. |
| -2.1 | REGIONAL_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against a single national order: 3 neighbouring countries fell with it. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| -1.8 | PLANE_BOTH_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut cable leaves the routing table largely intact. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.2 | PLANE_BOTH | Deliberate shutdown or ordered restriction | Both planes collapsed together (BGP 63%, reachability 81%): networks were withdrawn from the routing table, so the outage is at the operator rather than in a cable. |
| +1.0 | PLANE_BOTH_POWER | Power failure, natural disaster or conflict damage | A total loss of power at core sites would also withdraw routes, so an infrastructure cause remains consistent with this. |
| +0.8 | RECOVERY_RAMP | Power failure, natural disaster or conflict damage | Recovery was gradual over hours, consistent with crews restoring sites individually. |
| · | CLOCK_UNTESTABLE | Measurement artefact, not a real outage | The sampling interval is too coarse to say whether the onset was aligned to a whole local hour, so the clock-alignment evidence is unavailable in both directions. |
Alert level reasoning: sustained 81% drop below seasonal baseline for 33.5 h; deep national-scale drop; corroborated by bgp - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
Most consistent explanation: submarine cable or upstream transit fault (possible, 48% of the weighted evidence). Traffic declined gradually, taking over 2 hours to lose half its depth starting 05:15 local time, reaching 52% below the seasonal baseline, and lasting 1.0 hours. 50% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 0% against a 52% fall in reachability. 1 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is power failure, natural disaster or conflict damage (25%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +2.6 | PLANE_DATA_ONLY | Submarine cable or upstream transit fault | Reachability fell 52% while BGP announcements only fell 0%: the prefixes are still advertised but packets are not getting through. That is the classic fingerprint of a severed cable or a failed upstream transit path, not of a network being switched off. |
| +2.2 | SHAPE_RAMP | Power failure, natural disaster or conflict damage | Onset is a ramp over two hours or more, consistent with sites failing one by one as battery and generator reserves are exhausted. |
| +2.1 | REGIONAL_COOCCURRENCE | Submarine cable or upstream transit fault | 1 other monitored countries show an overlapping episode. Degradation that crosses borders points at infrastructure those countries share - a cable system or a common upstream - rather than at any one government. It takes a great deal more evidence to claim that several states acted in concert than to conclude that they sit on the same cable. |
| +1.5 | UNCORROBORATED | Measurement artefact, not a real outage | No second measurement method shows the same event, so a fault in one platform's collection cannot be excluded. |
| -1.2 | SHAPE_RAMP_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against an ordered shutdown, which is normally executed in minutes. |
| -0.8 | PLANE_DATA_ONLY_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues somewhat against an ordered shutdown, which more often withdraws routes as well - though filtering at the edge can also spare the control plane. |
| -0.7 | REGIONAL_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against a single national order: 1 neighbouring countries fell with it. |
| · | CLOCK_UNTESTABLE | Measurement artefact, not a real outage | The sampling interval is too coarse to say whether the onset was aligned to a whole local hour, so the clock-alignment evidence is unavailable in both directions. |
Alert level reasoning: sustained 52% drop below seasonal baseline for 1.0 h; deep national-scale drop; held at WARNING: no independent second source agrees yet
Most consistent explanation: submarine cable or upstream transit fault (likely, 73% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 11:30 local time, reaching 30% below the seasonal baseline, and lasting 15.2 hours. 50% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 15% against a 30% fall in reachability. 3 neighbouring monitored countries dipped in the same window. This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +3.5 | REGIONAL_COOCCURRENCE | Submarine cable or upstream transit fault | 3 other monitored countries show an overlapping episode. Degradation that crosses borders points at infrastructure those countries share - a cable system or a common upstream - rather than at any one government. It takes a great deal more evidence to claim that several states acted in concert than to conclude that they sit on the same cable. |
| -2.1 | REGIONAL_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues against a single national order: 3 neighbouring countries fell with it. |
| -2.0 | CORROBORATED | Measurement artefact, not a real outage | Two independent measurement methods agree (tier B), which makes a single-platform artefact unlikely. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +0.8 | RECOVERY_RAMP | Power failure, natural disaster or conflict damage | Recovery was gradual over hours, consistent with crews restoring sites individually. |
| · | CLOCK_UNTESTABLE | Measurement artefact, not a real outage | The sampling interval is too coarse to say whether the onset was aligned to a whole local hour, so the clock-alignment evidence is unavailable in both directions. |
Alert level reasoning: sustained 30% drop below seasonal baseline for 15.2 h; corroborated by merit-nt - different measurement method but the same aggregation platform (tier B: independent sensors, shared ingestion)
While building the fixtures for the March 2024 East African cable damage, the country-level IODA aggregates turned out not to show it: daily medians for Tanzania and Kenya are flat across the whole window. What the detector did find was an hour-long simultaneous dip on 18 March in all three countries at the same UTC minute, which is far more consistent with a gap in the active prober than with anything happening in East Africa. It is kept as a fixture deliberately, because a tool like this is only trustworthy if it is willing to say 'this is probably my own instrument'.
What a correct detector should say: A short dip appears in three countries beginning at the identical UTC sample and recovering within about an hour. A detector that reports this as a regional shutdown is wrong. The correct answer is to flag it as a probable measurement artefact: real events do not start at the same instant in three countries and then stop, and the countries' daily medians are unchanged throughout. This case exists to prove the artefact guard fires.
Most consistent explanation: measurement artefact, not a real outage (likely, 57% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 08:20 local time, reaching 54% below the seasonal baseline, and lasting 1.0 hours. 100% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 1% against a 54% fall in reachability. 2 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is submarine cable or upstream transit fault (25%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +4.0 | SYNCHRONISED_ARTEFACT | Measurement artefact, not a real outage | The dip begins in 2 other countries within the same measurement sample and clears within a few hours. Independent national outages do not start on the same tick; a gap in the measurement platform does. Treat this as an instrument fault until a second platform shows it. |
| -3.0 | BREADTH_NOT_SINGLE | Single-operator fault | Rules out a single-operator fault. |
| -3.0 | SYNCHRONISED_NOT_REAL | Deliberate shutdown or ordered restriction | Argues strongly against any real-world cause, including an ordered shutdown. |
| +2.6 | PLANE_DATA_ONLY | Submarine cable or upstream transit fault | Reachability fell 54% while BGP announcements only fell 1%: the prefixes are still advertised but packets are not getting through. That is the classic fingerprint of a severed cable or a failed upstream transit path, not of a network being switched off. |
| -2.0 | SYNCHRONISED_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut does not repair itself within the hour. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| +1.5 | UNCORROBORATED | Measurement artefact, not a real outage | No second measurement method shows the same event, so a fault in one platform's collection cannot be excluded. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | RECOVERY_CLIFF | Deliberate shutdown or ordered restriction | Recovery was as sharp as the onset: service came back in one step, as it does when a restriction is lifted rather than when equipment is repaired. |
| +1.4 | BREADTH_TOTAL | Deliberate shutdown or ordered restriction | 100% of monitored networks dropped simultaneously. Independent commercial operators do not fail together by chance; either they share infrastructure or they received the same instruction. |
| +1.0 | BREADTH_TOTAL_POWER | Power failure, natural disaster or conflict damage | Equally consistent with a national grid failure hitting every operator at once. |
| -0.8 | PLANE_DATA_ONLY_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues somewhat against an ordered shutdown, which more often withdraws routes as well - though filtering at the edge can also spare the control plane. |
Alert level reasoning: downgraded to WATCH: the leading explanation is a measurement artefact (57%), not an event on the ground - sustained 54% drop below seasonal baseline for 1.0 h; deep national-scale drop; held at WARNING: no independent second source agrees yet
Most consistent explanation: measurement artefact, not a real outage (possible, 46% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 08:20 local time, reaching 55% below the seasonal baseline, and lasting 1.0 hours. 33% of the 6 monitored networks in this country were affected at the same time. BGP routing fell 0% against a 55% fall in reachability. 2 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is single-operator fault (27%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +4.0 | SYNCHRONISED_ARTEFACT | Measurement artefact, not a real outage | The dip begins in 2 other countries within the same measurement sample and clears within a few hours. Independent national outages do not start on the same tick; a gap in the measurement platform does. Treat this as an instrument fault until a second platform shows it. |
| +3.0 | BREADTH_NARROW | Single-operator fault | Only 33% of monitored networks are affected while the rest of the country is unchanged. This is an operator problem, not a national event. |
| -3.0 | SYNCHRONISED_NOT_REAL | Deliberate shutdown or ordered restriction | Argues strongly against any real-world cause, including an ordered shutdown. |
| +2.6 | PLANE_DATA_ONLY | Submarine cable or upstream transit fault | Reachability fell 55% while BGP announcements only fell 0%: the prefixes are still advertised but packets are not getting through. That is the classic fingerprint of a severed cable or a failed upstream transit path, not of a network being switched off. |
| -2.5 | BREADTH_NARROW_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues strongly against a national order, which would reach all licensees. |
| -2.0 | SYNCHRONISED_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut does not repair itself within the hour. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| +1.5 | UNCORROBORATED | Measurement artefact, not a real outage | No second measurement method shows the same event, so a fault in one platform's collection cannot be excluded. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| -1.5 | BREADTH_NARROW_NOT_POWER | Power failure, natural disaster or conflict damage | Argues against a widespread physical cause. |
| +1.4 | RECOVERY_CLIFF | Deliberate shutdown or ordered restriction | Recovery was as sharp as the onset: service came back in one step, as it does when a restriction is lifted rather than when equipment is repaired. |
| -0.8 | PLANE_DATA_ONLY_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues somewhat against an ordered shutdown, which more often withdraws routes as well - though filtering at the edge can also spare the control plane. |
Alert level reasoning: sustained 55% drop below seasonal baseline for 1.0 h; deep drop but narrow: only 33% of monitored networks affected, so this looks like one operator rather than the country
Most consistent explanation: measurement artefact, not a real outage (likely, 57% of the weighted evidence). Traffic fell off a cliff, shedding half its eventual depth within 30 minutes starting 08:20 local time, reaching 48% below the seasonal baseline, and lasting 1.0 hours. 83% of the 6 monitored networks in this country were affected at the same time. BGP routing fell -0% against a 48% fall in reachability. 2 neighbouring monitored countries dipped in the same window. The main alternative not excluded by this evidence is submarine cable or upstream transit fault (25%). This is an inference from traffic measurement alone. It is not a finding of fact about any government, operator or event, and it should be corroborated against reporting on the ground before being repeated.
| wt | rule | supports | reasoning |
|---|---|---|---|
| +4.0 | SYNCHRONISED_ARTEFACT | Measurement artefact, not a real outage | The dip begins in 2 other countries within the same measurement sample and clears within a few hours. Independent national outages do not start on the same tick; a gap in the measurement platform does. Treat this as an instrument fault until a second platform shows it. |
| -3.0 | BREADTH_NOT_SINGLE | Single-operator fault | Rules out a single-operator fault. |
| -3.0 | SYNCHRONISED_NOT_REAL | Deliberate shutdown or ordered restriction | Argues strongly against any real-world cause, including an ordered shutdown. |
| +2.6 | PLANE_DATA_ONLY | Submarine cable or upstream transit fault | Reachability fell 48% while BGP announcements only fell -0%: the prefixes are still advertised but packets are not getting through. That is the classic fingerprint of a severed cable or a failed upstream transit path, not of a network being switched off. |
| -2.0 | SYNCHRONISED_NOT_CABLE | Submarine cable or upstream transit fault | Argues against a cable fault: a cut does not repair itself within the hour. |
| +1.5 | SHAPE_CLIFF | Deliberate shutdown or ordered restriction | Onset is a cliff: half the eventual loss happened within 30 minutes, consistent with a configuration change - though not with that alone. |
| +1.5 | SHAPE_CLIFF_CABLE | Submarine cable or upstream transit fault | A cable parting is equally instantaneous, so a cliff onset carries no weight either way between a cut and an order. |
| +1.5 | UNCORROBORATED | Measurement artefact, not a real outage | No second measurement method shows the same event, so a fault in one platform's collection cannot be excluded. |
| -1.5 | SHAPE_CLIFF_NOT_GRID | Power failure, natural disaster or conflict damage | Argues against a grid or disaster cause: batteries and generators normally produce a decline over hours, not a step. |
| +1.4 | RECOVERY_CLIFF | Deliberate shutdown or ordered restriction | Recovery was as sharp as the onset: service came back in one step, as it does when a restriction is lifted rather than when equipment is repaired. |
| +1.4 | BREADTH_TOTAL | Deliberate shutdown or ordered restriction | 83% of monitored networks dropped simultaneously. Independent commercial operators do not fail together by chance; either they share infrastructure or they received the same instruction. |
| +1.0 | BREADTH_TOTAL_POWER | Power failure, natural disaster or conflict damage | Equally consistent with a national grid failure hitting every operator at once. |
| -0.8 | PLANE_DATA_ONLY_NOT_ORDER | Deliberate shutdown or ordered restriction | Argues somewhat against an ordered shutdown, which more often withdraws routes as well - though filtering at the edge can also spare the control plane. |
Alert level reasoning: downgraded to WATCH: the leading explanation is a measurement artefact (57%), not an event on the ground - sustained 48% drop below seasonal baseline for 1.0 h; sharp cliff-edge onset at national scale; held at WARNING: no independent second source agrees yet
During the protests that began in September 2022, mobile internet in Iran was repeatedly restricted. The restrictions hit mobile networks while fixed-line connectivity largely persisted, and country-level aggregates of routed and responsive /24s are dominated by fixed-line infrastructure, so the national signal barely moves. This is the single most important case in the set: it shows that a CLEAR from this tool means 'no large country-wide drop in these particular signals', not 'no shutdown'. Detecting mobile-only restrictions needs per-ASN monitoring of the mobile operators, or a measurement platform that sees client traffic rather than infrastructure.
What a correct detector should say: A KNOWN FALSE NEGATIVE, kept deliberately. The correct output is CLEAR with a sub-threshold note, not a WATCH. Country-level routed-prefix counts dip about 7.6% on the night of 21 September 2022 at z = -15 - statistically unmistakable, and nowhere near the 20% threshold this tool escalates on. Anyone reading the ladder alone would conclude nothing happened in Iran, which is wrong, and that is exactly the limitation a user needs to know about before trusting a CLEAR.
No sustained drop above the 20% watch threshold in the scoring window.