UPDATE: AEPROVI is denying that it cooperated with the Ecuadorian government to block websites, despite the Telefónica memorandum.

According to a leaked internal memo of the multinational ISP Telefónica in Ecuador, the Association of Internet Providers of Ecuador (AEPROVI) collaborated with the Ecuadorian government to block their users' access to websites. The memo was obtained and published by the Associated Whistleblowing Press and the Ecuadorian whistleblowing platform, Ecuador Transparente. 

The memo describes how on March 28, 2014, between 7:20 pm and 7:53 pm, a technician received reports of users unable to access Google and YouTube. It explains that Telefónica staff verified the accessibility issues and reported them to Telefónica’s Network Operations Center (NOC). The NOC then confirmed that these websites were inaccessible due to AEPROVI “blocking access to certain Internet websites by request of the National Government." The leaked document explains that many clients were affected, prompting AEPROVI to roll back its website blocking in order to remedy the situation.

The memo confirms that the Ecuadorean state can—and has—ordered domestic Internet service providers to block websites. It is consistent with previous claims of Internet censorship by the government (see here1 and here2). Similarly, we’ve seen before how Ecuadorian officials have used foreign law firms to send copyright takedowns to remove dozens of websites, tweets, documentaries, and search results that it disapproves of.

WHO IS AEPROVI AND WHAT DID THEY DO?

AEPROVI is an association made up of nearly all of Ecuador’s ISPs including Telefónica (Movistar Ecuador), whose members control more than 95% of the country’s Internet traffic. AEPROVI manages key Internet infrastructure, including NAP Ecuador (NAP.EC), which runs Ecuador’s two major Internet exchange points (IXPs). Since IXPs bring together traffic from many ISPs into one location, they can be a tempting target for censoring the Internet in a centralized way. For example, filtering or deep-packet inspection hardware could be installed on the connections coming into an IXP, which could silently drop packets destined for a censored IP address or containing censored content. Alternatively, an IXP would be the perfect location for a censor to inject bad DNS responses when a customer tries to look up a domain like google.com or youtube.com. Instead of getting the correct IP address, the censor would instead inject a DNS reply that tells the customer’s computer that the domain doesn’t exist. Since the traffic of many different ISPs flows through an IXP, implementing the censorship there allows the censor to use a single, centralized system to affect as many people as possible.

The blocking incident mentioned in the memo occurred the same day that private emails allegedly from Rommy Vallejo, Director of the National Secretariat of Intelligence (SENAIN), were published on blogspot.ca, a blogging platform operated by Google. The blog post includes a YouTube video. The day before, President Rafael Correa claimed that his Twitter account had been hacked.

We don’t know if either incident inspired the government to order ISPs to block Google and YouTube specifically. As the Telefónica memo states, the blocking of Google properties might have been collateral damage in an attempt to block other websites. Until now, Ecuador’s Internet users were uncertain whether any censorship regime existed, or that it was implicated in the recent outage.

THE PUBLIC HAS THE RIGHT TO KNOW

The Ecuadorian public has a right to know when, why and how the Ecuadorian government is censoring their Internet, and under what law. The Associated Whistleblowing Press and Ecuador Transparente report that they “still don’t know which websites were blocked,” if any, beyond those mentioned. It is also unclear how many times blocking has occurred, which government institutions have the power to request blocks, and which ones have done so already. Article 8 of the Telecommunications Act allows the president to unilaterally decree a State of Emergency under vague standards and order content blocking without oversight by an independent and impartial court. But no Emergency Decree was published. Therefore, it appears that the blocking was illegal.

Additionally, the specific rules governing the collaboration between AEPROVI and the Ecuadorian government are unclear. Those rules, if they exist, should be public and accessible to all. The members of AEPROVI can assist in clarifying the situation by transparently documenting if, when and how they receive censorship orders from the Ecuadorian government, and why they chose to comply.

Under international human rights law, secret regulations, protocols and authorities, or secret interpretations of regulations, protocols and authorities, do not have the quality of law. A law that is not public is not a law. An essential component of a country that follows the rule of law is that all laws are known and accessible to all citizens. Similarly, laws, regulations, protocols or authorities that grant unfettered power to the government run afoul of the requirements of law. The scope and manner of the exercise of any governmental discretion must be indicated in the law itself or in published guidelines, with clarity so that individuals can reasonably foresee how the law will be applied in practice. This is all the more important given the inherent risks of arbitrariness in exercising power in secret, especially when that power is blocking access to Internet content.

As a signatory to the International Covenant on Civil and Political Rights (ICCPR), Ecuador has a responsibility to uphold the right to freedom of expression, online and offline. Under a framework put forth by former UN Special Rapporteur on Freedom of Opinion and Expression, content that is blocked must fit into very narrow categories: it must not be blocked solely because of political or government criticism, and it must be blocked only under lawful criteria. Furthermore, the state must be transparent and provide the public with a list of blocked content and the reasons why it has been blocked. Lastly, content blocking should occur only when an order has been made by a competent judicial authority or independent body. 

We, therefore, call on the Ecuadorian government to disclose under which legal authority it compelled AEPROVI to block access to Google, YouTube or other websites on March 28, 2014, and to be transparent about the use and scope of the blocking measures. Transparency is the first step toward combating censorship.

• 1. In page 27 of these slides, a staffer of the EcuCERT (Computer Emergency Readiness Team in Ecuador) made clear the "cooperation with the National Telecommunications Corporation and private internet service providers to block internet domains to avoid their operation".
• 2. The 2014 annual report of the Superintendency of Telecommunications (now ARCOTEL) made clear in page 64 that they are "blocking specific Internet domains" to combat piracy.