Are there risks to the new Armenia–Azerbaijan internet transit deal?

News of cooperation between Armenia's Telecom Armenia and Azerbaijan's AzerTelecom sparked intense discussion on social media about the potential security implications for Armenia. 

Telecom Armenia announced that it had signed a reciprocal internet transit agreement with AzerTelecom. According to the company, the deal will help diversify regional connectivity routes and improve network reliability.

#CivilNetCheck brought the main claims circulating on social media experts to cybersecurity specialists. 

One of the most common claims is that internet traffic passing through AzerTelecom's infrastructure could be analyzed and used to profile the behavior of Armenian users through a mechanism known as DPI.

DPI, or Deep Packet Inspection, is a method of analyzing network traffic. It allows operators to examine not only basic technical information about data packets but also certain characteristics of the traffic, such as which services or platforms are being used.

In other words, while DPI generally cannot see the contents of communications, it can reveal whether a user is accessing platforms such as YouTube, Telegram, or other services, even when a connection is encrypted.  

Although the agreement concerns the reciprocal provision of internet transit services, independent cybersecurity expert Artur Papyan said he had inquired with Telecom Armenia and was told the company does not currently plan to use Azerbaijani infrastructure, even though it has the option to do so. The Azerbaijani side, however, will be able to use Armenian infrastructure to ensure internet connectivity between mainland Azerbaijan and Nakhichevan.

Speaking with #CivilNetCheck, Papyan said that if Armenia were to use Azerbaijani infrastructure, it would generally be possible to analyze user behavior. However, he argued that the key question is how concerning such analysis would be in practice.

For example, even if the Azerbaijani side were to learn that part of Armenia's population uses Yandex Taxi, that information alone would not provide any particularly significant insight, Papyan said.

“Today, a foreign company such as Yandex Taxi can already see where you ordered a ride from, where you traveled, and so on. Against that backdrop, broad behavioral analysis based on large volumes of aggregated data is, in my view, less concerning,” Papyan said.

Hakob Papinyan, a cybersecurity specialist at the Armenian company RedSide Security, notes that analysis of internet traffic of this kind can provide a general picture of the preferences and behavior of users in Armenia. For example, it may be possible to determine that a user is accessing Facebook, but their activity within the platform itself would not be visible.

According to Papinyan, even if traffic analysis shows that users in Armenia most frequently access TikTok, Facebook, or Instagram, this would still not represent a complete picture, since only the traffic passing through a given infrastructure can be analyzed.

Vahan Hovsepyan, a representative of RIPE NCC, the Regional Internet Registry for Europe, the Middle East, and Central Asia, says that such traffic analysis can only provide a broad, general overview. He notes that obtaining more detailed information about a specific individual or organization requires higher-level investigative methods, which can be carried out without analyzing internet traffic.

Another widely circulated claim concerns whether users with fixed or static IP addresses are at greater risk because they can be more easily identified.

An IP (Internet Protocol) address is a numerical identifier assigned to a device or network connected to the internet. It ensures that data is correctly routed to the appropriate device, whether a computer, phone, or other system. An IP address can indicate approximate location, such as a city or country, as well as the internet service provider and network type, but it does not in itself reveal a user’s identity or exact address.

According to Papyan, identifying a user through a static IP address requires significant technical resources and the ability to analyze large volumes of traffic. He suggests that such a process can be more complex and costly than, for example, the use of spyware.

Cybersecurity specialist Papinyan also notes that identifying individuals is relatively more difficult, while the risk may be higher for organizations that use static IP addresses. In such cases, it may be possible to determine which services or platforms an organization uses, and that information could potentially be used to target those services. 

However, RIPE NCC’s Hovsepyan points out that operators often assign a single IP address to hundreds or even thousands of users, which significantly complicates the identification of a specific individual or organization.

Another claim suggests that AzerTelecom could gain the ability to manipulate or “poison” BGP routing paths.

BGP, or Border Gateway Protocol, is one of the core internet routing protocols. In simple terms, it determines the paths through which internet traffic travels from a user to a website or service. If BGP announcements are incorrect or manipulated, traffic can be misrouted or temporarily disrupted.

Papyan notes that BGP is an older protocol that played a foundational role in the internet’s architecture, and that issues related to it have existed and may continue to arise. However, he adds that such problems generally fall outside the scope of conventional cybersecurity concerns. 

Papinyan emphasizes that routing is largely automated, with systems selecting the most efficient available path. He says that manipulating or “poisoning” this process would require highly advanced technical capabilities.

Hovsepyan notes that BGP security risks exist both globally and in the region. He points to the 2008 incident in which Pakistani authorities instructed local operators to block YouTube within the country. Pakistan Telecom attempted to do so using BGP routing announcements, but a misconfigured internal route leaked beyond Pakistan’s network and propagated across the wider internet. As a result, the platform became temporarily inaccessible in various parts of the world.

A commonly circulated claim also suggests that Azerbaijan could use the connectivity as a tool of pressure or deliberately disrupt it.

According to Papyan, in such a scenario, Armenia could also use its ability to transit traffic toward Azerbaijan as a form of leverage. He highlights that Armenia is not dependent on a single communication route and receives internet connectivity from multiple directions. 

Hovsepyan notes that Azerbaijan does not provide internet services to Armenia. He explains that a significant portion of Armenia’s internet traffic physically passes through the territory of Georgia.

It is also notable that Georgia’s primary internet network operator, Caucasus Online, is 100% owned by Azerbaijani businessman Nasib Hasanov. However, experts stress that this does not mean Armenia’s internet connectivity depends solely on that company. According to specialists, Armenia has alternative routes through other Georgian operators, as well as southern connections via Iran and toward the Persian Gulf region. A disruption in one route could slow down internet speeds or increase latency, but the risk of a complete outage is considered limited. 

In comments to Armenpress on Tuesday, Telecom Armenia board chairman Alexander Yesayan said that under the agreement, the Armenian side will provide commercial transit internet traffic between Azerbaijan and its Nakhichevan exclave. He emphasized that this is not an internet service, but a data transit service via point-to-point connectivity.

Yesayan also stated that the cooperation does not involve data exchange between the countries, and that the Azerbaijani side will only gain access to bandwidth capacity, not to the data itself.