As Iran (possibly) moves forward with plans to cut itself off from the global Internet, and Beijing rails against online rumours, a mysterious hour-long disruption of web traffic in and out of China set off flurries of nervous speculation on Thursday. From The Guardian’s Tania Branigan:

Xu Chuanchao, an executive at Sohu, one of the country’s biggest internet portals, wrote on his microblog: “This malfunction is caused by the failure of China’s backbone network and is under renovation.”

But one company, Data Centre for China Internet, posted: “Latest news: most foreign websites can’t be accessed. Analysis: for commonly known reasons, a large number of foreign URLs are blocked. It is possible that the great firewall is undergoing some readjustment, mistakenly adding many foreign websites to the blocking list. The details are unclear ….”

“My gut feeling is that it was a software upgrade. The fact it was updated in a couple of hours suggests someone woke up and realised …” [said David Wolf of Wolf Group Asia.]

One popular theory was that the major earthquake off the Indonesian coast on Wednesday had disrupted submarine fibre optic cables. In the past, events as relatively minor as an unfortunately placed ship’s anchor have caused outages affecting tens of millions of people. But although the nearby Malacca Strait is a major bottleneck for submarine cables, the quake seemed unable to explain Hong Kong users’ isolation from the mainland, or why lesser-known VPNs appeared less severely affected than more prominent ones.

On Friday, China’s two telecom giants both professed ignorance of the brownout’s cause. From Charles Custer at Tech In Asia:

… [Both] Telecom and Unicom have officially denied that the issues were caused by infrastructure problems on their ends. Both companies say that during the outage there seemed to be nothing technically wrong with their networks, and they aren’t sure what caused the problem.

Unicom officials said the company’s internet reports showed the earthquake had not interfered with underwater cables that help connect China’s internet to the outside world. An expert at Telecom echoed that the problem was not with its network. This is significant because all Chinese internet traffic must be routed through Telecom or Unicom’s network infrastructure to get overseas.

Tech In Asia had previously asked readers abroad to test a number of China-based websites, and posted the results. China Real Time’s Josh Chin collected a range of comments from Twitter and Sina Weibo, while “Chinese official” @relevantorgans assured the Twittersphere that the Internet would return to normal “just as soon as there are no rumors or foreign press reports on it.” But the blockage ended sooner than that, without explanation. From Paul Mozur at China Real Time:

Did someone push the wrong button on China’s Internet filtering system? Did the country’s network infrastructure finally collapse under the weight of all those searches for the Kate Winslet nude scene that Chinese censors took out of the mainland version of “Titanic 3D”? Chinese Internet and telecommunications companies have so far decided to stay silent on the matter.

While the precise cause of the blackout remains unclear, the episode did illustrate just how jumpy China watchers and Chinese Internet users have become in recent days, as Beijing attempts to manage the recent downfall of Communist Party star Bo Xilai by issuing increasingly strident statements about the need to manage the spread of rumors online.

Update: Paul Mozur sheds some new light on the outage at China Real Time, citing data (with graphs) from web performance and security firm CloudFlare:

The company found that traffic from China Telecom and China Unicom’s networks both plummeted between 11 am and 1 pm on Thursday while traffic from other smaller networks, like that operated by China Mobile and China Railway, were relatively unaffected ….

Although [chief executive and co-founder Matthew] Prince stresses that their conclusions remain speculative, he said the fact that non-HTTP traffic continued likely points to the cut off being the result of web filtering. An engineer at his firm who declined to be named said: “Non-HTTP (or DNS) traffic was able to pass, which suggests that someone made a mistake when filtering something – likely they filtered the entire internet.”