When someone in Cuba types the address of an independent outlet and the page does not load, they almost never see a notice saying “blocked”. They see a blank screen, or an error, or simply a wait that never ends. That ambiguity is deliberate. There is one screen that does tell you something, and further down I explain why that one does not come from this machine. Let’s look at how it is done, technically.
The three levels where a connection can be cut
1. DNS: faking the address
Before connecting to a site, your device asks a DNS server for its numeric address. It is like asking a directory for a phone number. If that directory is controlled by the same party that wants to censor you, it can answer with the wrong number, or not answer at all.
It is the cheapest method and the easiest to get around: using a different DNS server is enough. That is why it is rarely used alone.
2. The IP address: bricking up the building
If blocking is applied to the server’s IP address, it no longer matters how you found it: packets to that address do not pass. It is more effective and also cruder, because a single server may host hundreds of innocent sites that fall with it.
This method has gained weight in Cuba precisely because encryption spread, and it is now used to censor sites served over HTTPS.
3. Deep packet inspection: looking inside
This is the serious level, and it is the one ETECSA uses as its primary mechanism. Deep packet inspection, or DPI, means intermediate equipment that examines the traffic passing through it and decides what to do with it in real time.
The technique documented in Cuba is TCP connection resetting: when the system identifies a request toward a forbidden destination, it injects a packet that cuts the connection dead, and the user gets a blank page or a network error. Nobody tells you that you have been censored. It looks like the internet is failing, which is the perpetual excuse.
How it has changed
The most detailed public measurement data that exists is from 2017, from the OONI project, and it has to be cited with that date up front: they documented at least 41 blocked domains, all with something in common: they criticized the government, covered human rights, or were circumvention tools. Blocking was applied through DNS tampering, HTTP injection and TCP/IP resets, and at that time it affected only the HTTP version of sites, so using HTTPS was enough to slip past it.
That window closed. As encryption became standard, the censor lost the ability to read which specific page you were requesting, and responded by moving up a level: blocking the whole IP.
It is a familiar race worldwide. Every privacy improvement forces the censor into a cruder method, and every cruder method causes more collateral damage and is more visible.
That the race continued is measured. In July 2021, during the 11J protests, OONI documented the blocking of Signal, and of WhatsApp, Telegram, Facebook and TikTok as well. The technical detail matters: the TLS handshake to Signal servers failed consistently with a connection reset error, which points to deep packet inspection equipment reading the SNI field, the one part of that handshake that travels in the clear and states which site you are connecting to. It is the same reset as in 2017, one step up, now over encrypted traffic.
That report also leaves a figure worth keeping in mind: Cuba has a single autonomous system, AS27725, and it is ETECSA. A whole country, one network, one owner.
And there is data considerably more recent than 2017. Freedom House, in its Cuba report covering June 2023 to May 2024, lists as blocked the sites of 14ymedio, CubaNet, Diario de Cuba, El Estornudo, Cubalex, ADN Cuba, CiberCuba, Rialta and Proyecto Inventario, among others, as well as Change.org and Avaaz. OONI detected signs of blocking in that same period on circumvention tools such as Anonymouse and Megaproxy. And ETECSA filters text messages containing words such as “democracy,” “dictatorship,” “protest,” “communism” and “VPN.”
On March 17, 2024, after the protests in Santiago de Cuba, El Cobre and Bayamo, Kentik and Cloudflare Radar recorded five hours of reduced traffic. This time there was no national cut: there was throttling. Slowing the network instead of switching it off makes it hard to upload a video or go live, while still allowing the claim that the network is simply unstable. The same logic as always, refined.
Who builds the machine
A detail that tends to get overlooked. According to ETECSA’s own corporate magazine, its principal technology providers are three Chinese companies: Huawei, TP-Link and ZTE. OONI even found traces of Chinese code in the access portals for wifi zones.
You do not need to assume a conspiracy to grasp the implication: a country’s infrastructure is bought from whoever sells it, and whoever sells it sets what that infrastructure is able to do. ETECSA did not invent these filtering and control capabilities, but it bought them knowing what they are for, and it is ETECSA that keeps them switched on against Cubans. Whoever sells the machine decides what it can do. Whoever switches it on decides who it is aimed at.
The other screen, the one that does tell you something
A Cuban who has read this far is going to tell me that they do see notices, that they get 403 all the time. That is right, and where that 403 comes from needs explaining, because it does not come from this machine.
Hundreds of foreign services close the door on Cuban addresses of their own accord, to avoid breaching United States sanctions, or out of fear of breaching them. A team from the University of Michigan and Georgia Tech measured this from inside Cuba and published it at USENIX Security in 2024: of 10,093 domains tested, 546 are closed to Cuba. Of the 395 HTTP responses they collected, 347 were 403 Forbidden and 9 were 451, the code that exists to say “unavailable for legal reasons.” The 404 barely shows up: it falls into a bucket of seven cases, alongside 503.
Two more findings from that study. 88% of those domains do not explain why they are shutting you out. And 32 of those block pages are served with a 200 OK status code, that is, answering “all fine” while denying you what you asked for. Among the services closed to Cuba is Spotify, which hosts podcasts about the embargo on Cuba.
They are not the same thing, and I do not want them confused. ETECSA blocks so that you cannot read: it picks sites for what they say, which is why the lists are full of independent outlets and human rights organizations. That is censorship, and it is the state apparatus doing its job. A foreign company refusing a range of addresses does not know who you are and does not care what you were about to read: it is complying, or believing it is complying, with a rule that could cost it money. That is collateral damage, and it is worth saying where it comes from: Cuba is under sanctions because of what its government does, not because of what Cubans do. The user is left with a similar screen, but the responsible party, the motive and the remedy are different, and lumping them together suits only one of the two.
How to tell which wall you hit
If the page keeps loading and never finishes, or comes up blank, or the browser says the connection closed on its own, it is almost always the cut from here. If it answers quickly, with a laid-out page that says 403, or “not available in your region,” then you reached the server and it was the server that shut the door.
And it is worth knowing, because the remedy is not the same. Against the cut from here you need ETECSA not to recognize your traffic, which is the obfuscation I wrote about when comparing free VPNs. Against the one from over there it is enough that your exit to the internet is not a Cuban address. From the island you almost always need the first to get the second.
What this means for someone inside
Three concrete things.
One: a page failing to load does not mean it is blocked. And a page loading does not mean nobody knows you opened it. The ambiguity works for the censor, not for you.
Two: blocking is applied to something recognizable. A domain, an IP, a protocol signature. That is why tools that make their traffic unrecognizable work, as I explained when writing about Psiphon and the million and a half.
And three, the most important: all of this only determines what you can see. It does not determine what can be done to you afterwards. The convictions I have documented in this series did not come from someone reading your traffic on a DPI box. They came from content published in plain sight and from people who talked. Filtering and repression are two different machines, and the second one is the one that jails you.