Afghanistan Internet Presses On, Three Years After US Departure

Summary

Kentik’s Director of Internet Analysis uses BGP to see how the internet of Afghanistan has changed in the three years following the US military’s departure.

Three years ago, the US military withdrew its forces from Afghanistan, ending their involvement in what had become the country’s longest armed conflict. As the departure ceded the country to the Taliban, a sense of dread arose for many Afghans as well as for the future of the fragile progress the rugged country had achieved over the previous two decades.

At the time, I authored a blog post entitled, What’s next for the internet in Afghanistan? In that piece, I analyzed the remarkable growth the Afghan Internet had achieved in the previous decade by comparing the BGP topologies of the country in 2011 to 2021, “Fast forward 10 years and note the internet in Afghanistan has grown substantially – from six domestic ASNs to 40!”

As for internet access, there was justified concern for what would happen under Taliban rule:

• Would mobile and fixed line internet services be disrupted or disconnected?
• Would international sanctions against the Taliban cripple the fledgling telecommunications sector?
• Would the departure of foreign investment lead to degradation of service?

In this post, I dig into what has happened to the internet in Afghanistan in the past three years.

Internet under Taliban 2.0

Since their ouster in 2001 following the terrorist attacks on September 11th, the Taliban had come to embrace technology. A group that had once banned the internet, began using social media to push their worldview. The Taliban came to rely on WhatsApp to coordinate their military takeover of the country and later to operate their government.

Since taking over, the Taliban fighters have become “bored of the day-to-day drudgery of running” the country with some finding themselves “spending all their time on Twitter.”

Writing for the Internet Society’s Pulse blog in February this year, Robbie Mitchell reviewed the state of affairs for internet resilience in Afghanistan:

…Afghanistan which, contrary to first thought, has not experienced a prolonged government-enforced national shutdown or regional shutdown to the extent of other war-torn countries.

This has been mainly due to years of development in the country, which introduced, expanded, and strengthened critical Internet infrastructure, including a fiber optic backbone and an Internet Exchange Point.

Despite our worst fears, the internet in Afghanistan has largely stayed online, owing much to the development done in the years preceding 2021.

That is not to say there are no threats to digital rights in Afghanistan. Localized internet shutdowns have occurred under the Taliban beginning with a blackout in September 2021 in the Panjshir valley, one of the last remaining strongholds of anti-Taliban resistance. Most recently, internet service was cut in Kabul during the Shia Ashura holiday ceremonies in July.

In a recent report covering the Afghanistan internet, Chatham House reported:

While the new regime is taking steps to sharpen technical and regulatory measures to control the internet, personal devices are also just arbitrarily ‘seized’ at checkpoints, while individuals are subject to police ‘swiping through their apps’.

This description was echoed by an Afghan contact who added that, “there are several cases of detaining and investigating people for their social media comments or posts, recently a TikToker was beaten by the morality police.”

BGP analysis

From a BGP standpoint, the topology of Afghanistan has changed in subtle ways. The main players are still operating there. As would be expected, the companies connected to the US government presence are no longer there, while some new ASes have emerged. The analysis below excludes satellite-based service due to the difficulty of verifying which ranges are still utilized in-country.

The number of BGP routes representing the internet of Afghanistan grew over the past three years, however, those routes represented a significantly smaller amount of IP space. The count of IPv4 routes went from 468 to 528 in this time period, but the number of unique IPs those routes represented dropped 45%, from 252,928 to 137,984. The number of IPv6 routes in Afghanistan went from 5 to 12, but the amount of unique IP addresses went from one astronomical number to another astronomical number, 33% less, as depicted in the table below.

While some Afghan ranges like 121.127.32.0/24 are now being used outside of the country, many ranges are simply no longer routed such as 43.249.40.0/22 and 128.41.128.0/17.

AFTEL (AS55330)

In August 2021, AFTEL (Afghan Telecom) announced 66 prefixes, representing over 54,000 unique IPv4 addresses. Three years later, AFTEL announced 91 prefixes, representing 23,552 unique IPv4 addresses. Some address ranges simply moved to other Afghan ISPs. For example, 149.54.5.0/24 is now being originated by AS132471 (MTN Afghanistan).

To reach the global internet, AFTEL now uses three transit providers: ElCat (AS8449) of Kyrgyzstan to the north, and PTCL (AS17557) and Transworld (AS38193) of Pakistan to the south. AFTEL had been also getting transit from TIC of Iran (AS49666) until March 2024 and Kazakhtelecom (AS9198) until July 2024.

In 2010, my colleague Jim Cowie at Renesys published the first evidence of Iran providing IP transit services into neighboring Iraq and Afghanistan. The service in Afghanistan was part of a larger influence campaign Iran was waging to win over the population of the western province of Herat. At present, no Iranian telecom is providing IP transit services into Afghanistan.

MTN Afghanistan (AS132471)

MTN is still operating in Afghanistan despite an announcement in 2020 that the South Africa-based telecom would be departing the region. In 2022, the Afghan subsidiary was sold for $35 million to Lebanese investor group M1, but the sale is still in process.

AS132471 footprint in the routing table increased slightly in the past three years from 29 to 32 routes.

Etisalat Afghanistan (AS131284)

The Afghan subsidiary of UAE-based Etisalat continues to operate in Afghanistan. AS131284 went from originating 32 routes in 2021 to 44 in 2024, going from 10,752 to 11,264 unique IP addresses in three years.

Afghan Wireless (AS38742, AS138322)

Afghan Wireless uses two ASNs to operate their network and each has experienced growth in the past three years. AS38742 went from 23 routes representing 9728 unique IPs in 2021 to 71 routes representing 20,224 IP addresses. AS138322 went from 30 to 32 routes, representing 10,496 and 16,384 IP addresses, respectively.

Roshan (AS45178)

Roshan is a mobile operator which went from originating 29 routes representing 6,912 IP addresses in 2021 to 23 routes representing 5,888 IP addresses.

Notable departures and entrants

As the US military withdrew its forces from Afghanistan, the internet routes used to support operations in the country were also pulled. AS5800 was the main ASN used for Department of Defense communications in Afghanistan, and it went from originating nearly 100 routes to zero by the end of 2021.

Along with AS5800, the DoD stopped announcing routes (143.74.253.0/24, 144.104.103.0/24, 146.16.128.0/20, 150.196.176.0/20) from AS1501 and AS1541.

Afghan companies supporting the US DoD also began disappearing from the routing table, including RANA Technologies (AS55732) and Sniperhill Internet services (AS140082). Sniperhill’s Afghan IP range (103.148.71.0/24), previously announced from the US, is now announced by Afghan provider Cyber Net ISP (AS136986).

Neda Telecommunications (AS55745 and AS133174) has also significantly reduced its Afghan footprint. AS133174 disappeared from the global routing table in June of 2024 and much of the address space previously originated by AS55745 is now being used (presumably leased) outside of Afghanistan, including the following IP ranges: 117.55.199.0/24, 117.55.202.0/24, 117.55.203.0/24, 117.55.206.0/23, 117.55.206.0/24, and 117.55.207.0/24.

Finally, the American government-funded media organization Radio Free Europe / Radio Liberty (AS202756) also stopped operating in Afghanistan.

Since August 2021, a few new ASNs have appeared, routing internet traffic from Afghanistan.

• Speed Light ICT Services Company (AS150155) first appeared in the global routing table in August 2022.
• Hindukush Bridge ICT Services Company (AS149173), using IP addresses previously originated by Instatelecom Limited (AS55424), first appeared in December 2021.
• Hewad Aziz Services Company (AS149771) first appeared in May 2022.

Looking to the future

In December, Afghanistan School on Internet Governance (AFSIG) held its first event in three years. Organized by the Internet Society, the mission of the AFSIG is to “promote Internet knowledge through training, mentoring, community engagement, and collaboration.“ The return of the event was especially notable because of the female participation. 29.4% of the 60 attendees as well as the head of the organizing committee were women.

Additionally, the inaugural Afghanistan Network Operators Group (AFNOG 1) was held on December 6, 2023 and there will be an AFNOG 2 - it is scheduled to take place in November this year.

Despite the many challenges, the internet community in Afghanistan is pressing on.

Thanks to Mohibullah Utmankhil for his inputs on this article.