How internet shutdowns actually work

There is no kill switch. When a government disrupts a country's internet, what actually happens is a regulator picking up the phone, or sending a directive, to a small number of licensed internet service providers who control the physical chokepoints traffic has to pass through. Zambia's election today is a live case study in exactly how that works, and how hard it can be to prove.

Researchers tracking African shutdowns document six primary technical methods: full mobile data shutoffs, IP address blocking, DNS interference, deep packet inspection, server name identification blocking, and throttling. A full blackout severs routing entirely, the internet equivalent of pulling a cable. Everything else is more surgical. DNS manipulation makes an ISP's servers return a false or empty result for a specific domain, so typing a site's address goes nowhere without anything else on the network breaking. Deep packet inspection goes further, letting a middlebox on the network actually read the contents of data packets and selectively block or slow specific apps and protocols, WhatsApp, Telegram, video calls, while the rest of the internet keeps working normally.

That selectivity is the point. Zambia's 2021 election shutdown blocked Facebook, Twitter, WhatsApp and Instagram specifically rather than cutting the country off entirely, a pattern consistent with DNS or DPI level blocking rather than a full network kill. It is also why these restrictions are hard to prove from outside the affected network. Packet filtering shutdowns are often invisible unless someone inside the country is actively probing for them, which is exactly the technical work groups like NetBlocks and the Open Observatory of Network Interference exist to do during elections like this one.

The regulator sitting at that chokepoint in Zambia is ZICTA, the body every rights group's letter this week was addressed to, since it licenses and directs the ISPs that would carry out any restriction. Zambia's government told citizens in June it would not deliberately restrict access, a statement about intent that says nothing about the technical layer underneath it. Zambia's government has never disclosed what specifically caused the 2021 disruption at the network level.

Kenya offers the sharper regional comparison. Its High Court struck down the government's power to order ISPs to block websites without a court order, ruling in July that permitting such blocks without judicial oversight amounted to prior restraint. Same technical power, the same ISP level chokepoint, a different legal outcome. Zambia's pending High Court challenge to its 2025 cyber laws is asking a version of the same question Kenya's courts already answered.

The economic accounting treats a severe slowdown the same as a blackout, and that detail undercuts the easiest government defence in advance. NetBlocks and CIPESA's costing methodology, which produced a global 2025 shutdown cost estimate of $19.7 billion, classifies disruptions by functional impact rather than by whether a network is nominally still connected. Throttled to the point that video, voice and modern web services stop working is counted the same as off. If Zambia's internet gets merely unusable today rather than technically absent, "we did not shut it down" will be a claim about semantics, not about what actually happened on the network.