Inside Syria’s Internet Wars: The Hidden Story of Engineer Mahmoud and the 2012 Outage

The 2011 Arab Spring reshaped the Middle East, but for Syria it triggered a new, silent war: a war fought in the cables that carried data across the country. In the early months of 2012, the Assad regime’s command over the nation’s only fiber route was tested when a single power fault cut the only link from Damascus to the coast. The result was an overnight Internet blackout that sent ripples through the global BGP routing table and sparked international debate about whether the shutdown was state‑controlled or a by‑product of war. Behind the statistics of such outages lies a human story. Mahmoud, a 33‑year‑old network engineer based in Aleppo, had long worked for Syria Telecom (now Syria Telecom), a state‑owned operator that relied on a handful of domestic and international connections. In late 2011, he and a team of engineers monitored the country’s BGP announcements, documenting every route withdrawal that marked a blackout. When, on 29 November 2012, the sole 400 km DWDM line from Damascus to Homs to Tartous lost power, Mahmoud reported the loss of all international routes. Because the link was single‑path, the blackout was total – but the real shock came a year later when the same outage was replicated in a manner that suggested intentional suppression. Mahmoud’s firsthand testimony came to an analyst at a nascent internet‑measurement start‑up. Over the months that followed, Mahmoud provided detailed maps of the national network: the positions of key routers, the passwords for core equipment, and the physical topology that connected cities like Aleppo, Homs, and Latakia to international carriers. His technical knowledge was invaluable to scholars, journalists, and even intelligence analysts in Washington. However, it was not just the state’s tactics that shaped Syria’s connectivity. In mid‑summer 2013, Mahmoud was seized at a roadside checkpoint by individuals identifying themselves as Islamic State (ISIS) operatives. The encounter illustrated the complexity of the conflict: a checkpoint ostensibly run by the regime turned out to be a joint operation with the extremist group. Facing interrogation, Mahmoud was forced to surrender his laptop and phone. While the ISIS investigators examined his files, Mahmoud was taken to a makeshift prison where he spent weeks under blindfolds and handcuffs, interrogated repeatedly over his knowledge of the national network. The interrogation served a dual purpose. Mahmoud’s knowledge of the telecom infrastructure enabled ISIS to identify critical nodes that, if disabled, would cripple northern Syria’s internet connectivity. After the ISIS fighters located the key fiber termination in a town that had recently fallen to the group, the network was cut, causing a prolonged blackout that lasted weeks. Mahmoud later recounted how, during a brief period of relative freedom, he learned that ISIS had indeed used the information he was forced to reveal to sabotage the national connectivity. One of the more dramatic episodes in the country’s shutdown saga occurred in June 2016, just as Syrian authorities planned nationwide exams in high schools. A government‑issued instruction to temporarily disconnect the country from the Internet was executed by a senior manager at Syria Telecom who ran scripts that removed the nation’s BGP routes from the global table. The shutdown was designed to prevent students from using mobile devices to cheat: “one side of the link is disabled, the other remains available for local traffic.” The tactic succeeded, but the delay in the second half of the plan – due to an unforeseen phone call from the Minister of Education – caused a temporary gap that was later revealed in BGP data and only disclosed to the public this year. While the regime’s strategies, the intervention of extremist groups, and the calculated outages for academic examinations intertwined, the underlying truth remains: Syria’s digital infrastructure became a battlefield where information flowed as fiercely as weapons. The state exercised tight control over BGP announcements, the extremist factions monitored the movement of routers and cables, and the international community, driven by both curiosity and suspicion, watched from afar. After the fall of the Assad regime in 2024, Mahmoud was finally free to speak openly. He shared his experiences with journalists and researchers, detailing how the network was split, how the outages were engineered in phases, and how engineers like him risked safety to keep the country’s internet alive. Today, he works with a small ISP in Greece and has built a new life for himself and his family, but the echoes of Syria’s fragile connectivity continue to resurface in any discussion about internet resilience in conflict zones. The story of Mahmoud, therefore, is not merely a personal narrative but a case study illustrating the complex, often invisible battles fought over the invisible highways that bind societies together. Key technical points from the 2012 outage: - The 400 km DWDM link from Damascus to Tartous was the sole international egress for Syria. Any fault along this path removed all BGP routes, causing a complete blackout. - BGP route withdrawal was asymmetric: inbound traffic was blocked, but outbound traffic could still leave Syria, creating a surge in DNS queries that never received responses. - After the 2013 fiber replacement, Syria Telecom employed a temporary ASN (AS24814) to restore service to northern Syria before migrating back to its main AS (AS29256). These technical details, first recorded by engineers like Mahmoud, underscore the delicate balance between infrastructure, policy, and the human cost of keeping a nation’s digital voice alive amid war.