What is an internet shutdown, and how are they actually done?
A deliberate disruption of internet access by a government or an actor acting on its instruction, affecting a population, a region or a service. They have become more frequent, and the techniques are well documented.
The methods, from blunt to precise:
Full national shutdown. Ordering operators to stop routing — either by withdrawing BGP announcements, so the country's address space disappears from the global routing table, or by physically disconnecting international gateways. Visible externally and immediately, which is how researchers detect them.
Regional shutdowns, disabling mobile service in specific areas, which is the most common form and is frequently used around protests and examinations.
Mobile-data-only shutdowns, leaving voice and text working, which limits the political cost while achieving most of the effect since most access is mobile.
Throttling, degrading speed until video and images fail while text-based services technically work. Deliberately deniable, and harder to prove than a full shutdown.
Service blocking, targeting specific platforms by DNS, IP or protocol fingerprinting.
Curfew shutdowns, on a nightly schedule.
How they are ordered. Usually through legal powers over licensed operators, who face licence loss or criminal penalty for refusing. Operators are rarely willing participants, and several have published transparency reports recording the orders.
When they happen: elections, protests, conflict, communal violence, and — routinely in some countries — national examinations, to prevent cheating.
The documented harms:
Economic cost, estimated in billions annually, falling hardest on small businesses and informal workers who depend on mobile money.
Safety, where emergency services and ambulance calls fail.
Concealment of abuses, since shutdowns frequently coincide with events that would otherwise be recorded.
Healthcare, banking and education interruption.
How they are detected: routing data, active measurement platforms, traffic volume from large providers, and probe networks run by research organisations — which is why shutdowns can be independently verified rather than only reported.