Ukrainian Crisis Prompts Sanctions against Internet Backbone: What is the Stakeholders’ Response?

The prospect of being cut off from the Internet is not new for Russia. Back in 2014, the government and its various ministries started preparing for a scenario when Russia is cut off from the global Internet through outside interference. Along with working on its domestic legislation, Russia has been advocating for many years for an internationalized governance of the Internet, primarily concerning ICANN’s functions.

The Ukrainian crisis has turned out to be a stress-test for the established practices of Internet governance. Each level of the Internet (infrastructure, routing, apps, content) has its own stakeholders in charge of decision-making: while certain decisions made by foreign social networks and services in terms of content prompted Russia to restrict or block their operations in Russia, a status quo has thus far been preserved at the level of infrastructure.

In 2016, supervision over IANA was transferred from the U.S. government to Public Technical Identifiers acting on behalf of the global Internet community. Had back then ICANN’s transformation followed Russia’s scenario, the decision on Ukraine’s request to remove Russia’s domains from the root zone could have been taken by a vote similar to the UN General Assembly. Given the gravity of the current crisis, it would have been possible that the vote would have gone against Russia, just as it happened with suspending Russia’s membership in the UN Human Rights Council. The multistakeholder approach, therefore, operated this time as a safety catch, preventing geopolitics from triumphing over common sense and a functioning global network.

However, the multistakeholder model of Internet governance should be seen as a fail-safe against further attempts to use Internet-related sanctions to pursue geopolitical objectives. As of now, a number of stakeholders coming from civil society, the academe, states, and even the technical community say that it is high time that they considered such mechanisms that could effectively restrict the Internet for specific countries or territories amid crises or military conflicts. Given today’s trends for ensuring digital sovereignty and given many states’ intention to correlate cyberspace and national borders, the issue of using sanctions against the Internet’s unique identifiers that ensure its global nature and cogency no longer seems improper and contradicting the principles of Internet governance.

There is only one odd thing about the current situation: Why was the prospect of sanctions against the Internet infrastructure raised now? The Ukrainian crisis is not the first and only of its kind—still, no one had entertained such ideas before. In the very least, there was no major response to such ideas in the global Internet community. We can assume that this subject will be addressed at the upcoming IGF 2022 to be held under the UN’s auspices at the end of the year. The secretariat has just announced call for submissions for session topics, and the problem of the Internet’s fragmentation is a discussion priority.

A look at the global governance agenda for the Internet and an examination of how it evolved reveal that all stakeholders mostly preferred to channel their efforts into preserving a single, global, open, and accessible Internet for all—until recently. At the same time, the trends for “Balkanizing” and fragmenting the digital environment of the Internet into national jurisdictions were noted as alarming and at odds with the core principles of Internet governance. Yet, in 2022, intentional fragmentation of the Internet—following the implementation of anti-Russian sanctions—has suddenly been perceived as a “necessary evil” to stop military hostilities. Let’s investigate whether all stakeholders are indeed of the same opinion concerning the situation.

Ivan Timofeev:
Ukrainian Crisis. Who Has the Upper Hand?

What happened?

On February 25, in the wake of the first explosions in Ukraine’s territory, a new thread titled “RU government IP revoke” appeared on the website of the RIPE community’s working group on address policies.[1] The thread suggested considering ways for RIPE to influence the situation—in particular, they argued for revoking IP-addresses issued to networks associated with the Russian government. Other suggestions included revising RIPE NCC’s policy to vest it with the power to suspend the governance of assigned IP addresses as well as AS numbers in RIPE NCC’s for countries targeted by the EU and the U.S. sanctions.

Further, on February 28 and March 2, ICANN and RIPE NCC respectively received two identical official letters [1][2] signed by Mykhailo Fedorov, Ukraine’s Vice Prime Minister and Minister for Digital Transformation, whereby Ukraine requested support from the Internet organizations. Ukraine pointed out that Russia had breached international law by launching an armed attack against Ukraine’s territory and a cyber-attack against its IT-infrastructure. It became possible “due to the Russian propaganda machinery using websites continuously spreading disinformation, hate speech, promoting violence.”

As countermeasures, Ukraine requested the following:

• Revoke top-level domains (ccTLD) .ru, .su, and .рф from the DNS root zone;

• Facilitate a revoking of TSL certificates for sites in these domains;

• Shut down DNS root servers located Russia;

• Revoke IP-addresses from Russian members of RIPE NCC.

Ukraine’s leadership believes that these steps “will help users seek for reliable information in alternative domain zones, preventing propaganda.” This statement seems quite illogical, since the package of the measures proposed entails a virtually full cut-off of the country from the global Internet, which, for Russian users, would not be conducive to browsing alternative sources of information.

On March 4, Cogent—a Tier 1 operator (a multinational Internet provider that ensures cogency between continents)—said it would be shutting down some Russian networks. This step may slow down some foreign Internet services in Russia or cut off access to them altogether. Cogent, however, is not the only provider on the backbone market.

On March 7, the IETF published an Internet-draft (a special type of working documents) where the authors dwell on the technical means necessary to cut the Internet off at different levels, ranging from steps targeting the physical infrastructure to those aiming at routing traffic and information flows.[2] The document, in particular, notes, “Geopolitical conflicts can cause policy makers to question whether or not blocking the Internet connectivity for an opposing region is a constructive tactic.” The document also contains an overview of various technologies that may be used to implement regional blocking of Internet access, and it discusses the consequences of resorting to them.

On March 11, the LINX (the London Internet Exchange) suspended two Russian networks, Megafon (AS 31133) and Rostelecom (AS 12389). The Internet Society, another technical organization engaged in developing the Internet, harshly criticized this step, stating that politicizing cogency and governance of Internet backbone—regardless of the causes of such actions—puts at risk the Internet and user capability to benefit from it.[3] Having assessed the steps described above, the organization predicted further possibilities that may take place in case Russian networks are cut off from the Internet:

• Disruptions in network operations far beyond the country’s borders;

• Unintended consequences that undermine the use of the Internet by people in Russia;

• Splintering of the Internet along geographical, political, commercial, and technical boundaries;

• Setting a dangerous precedent that undermines trust in multistakeholder governance processes;

• Severe hindrances of the Internet’s reliability, resilience, and availability;

• Legitimization of dangerous playbooks for regimes seeking to control Internet access in future conflicts.

Naturally, Ukraine’s requests did not go unanswered: RIPE NCC and ICANN predictably refused to take the steps listed in the letters. “We regret to inform you that we cannot comply with this request. We do not have a mandate to take such actions, and as an organization governed by community-developed policy and Dutch law, we cannot take such action unilaterally. We further believe that Internet number resource registrations should not be used as a means to enforce political outcomes, and that doing so would have serious implications for the Internet, not just in the Russian Federation but also for the rest of the world,” RIPE NCC wrote in its reply.

Jonathan Katzman:
Securitization of Physical Cyberspace Infrastructure as a Nexus in U.S.-Russia Relations: The Case of Submarine Communications Cables

ICANN has specifically emphasized that its principal task is ensuring secure, stable, and resilient functioning of unique identifiers with a view to creating a single, global, and interoperable Internet. “In our role as the technical coordinator of unique identifiers for the Internet, we take actions to ensure that the workings of the Internet are not politicized, and we have no sanction-levying authority. Essentially, ICANN has been built to ensure that the Internet works, not for its coordination role to be used to stop it from working.” The Internet is a decentralized system, and no single stakeholder can fully control it or shut it down. ICANN’s principal role in the Internet Assigned Numbers Authority (IANA) is to ensure a consistent and unique assignment of Internet identifiers in line with global policies. These policies have been developed by a multistakeholder community that includes technical experts, the private sector, academics, civil society, governments, and other stakeholders that had jointly worked on finding consensus-based solutions for political and technical problems. The multi-stakeholder model “has allowed the Internet to flourish over decades, and this broad and inclusive approach to decision-making fosters the global public interest and makes the Internet resilient against unilateral decision-making.”

The established practice of Internet governance cannot base its operations on requests coming from a particular state and pertaining to internal operations in the territory of another state. This practice would destroy the trust in organizations that maintain the Internet’s critical infrastructure; consenting to Ukraine’s request would essentially spell the demise for RIPE NCC, ICANN, and similar organizations.

Somewhat later, in early April, the Internet Society launched the #StopTheSplInternet campaign with two key ideas:

• The day-to-day technical governance of the Internet should not be politicized. Management and operations of Internet infrastructure, including the naming, addressing, routing and security systems, should remain free from politics.

• Sanctions should not disrupt access and use of the Internet. Where needed, sanctions regimes should offer exemptions to ensure continued service of Internet infrastructure.

While some in the technical society responded highly negatively to the suggestions that sanctions on the Internet infrastructure be imposed, other stakeholders (in particular, civil society) opened the Pandora’s box by launching a multistakeholder discussion of the “feasibility of sanctions within the realm of our collective responsibility, and our moral imperative to minimize detrimental consequences” following the publication of the open letter. For the first time, a claim was articulated that the global Internet community must ponder and make decisions in the face of humanitarian crises, creating conditions for imposing sanctions and thereby proving that it has become mature enough to engage in governance along with governments.

The following statements have been proposed as a starting point for the discussion:

• Disconnecting a country’s population from the Internet is a disproportionate and inappropriate sanction, since it hampers access to the information that might lead them to withdraw support for acts of war, leaving them with access only to the information that their own government chooses to furnish.

• Military and propaganda agencies and their information infrastructure should be considered potential targets of sanctions.

• Currently, the Internet, due to its transnational nature and consensus-driven multistakeholder system of governance, does not easily lend itself to the imposition of sanctions in national conflicts.

• It is inappropriate and counterproductive for governments to attempt to compel mechanisms of Internet governance to impose sanctions outside of the community’s multistakeholder decision-making process.

The authors of the letter also criticized punitive measures proposed by Ukraine, labeling them as inexpedient and harmful for the global Internet. Yet, they suggested compiling blacklists of IP addresses, autonomous systems, and domain names over which stakeholders could reach consensus, since this approach is “effective and carries no inherent danger of being over-broad. Once decided upon, it is easily invoked—and equally easily rolled back once the problem is resolved.”

Alexander Tabachnik, Lev Topor:
Russian Cyber Sovereignty: One Step Ahead

What is to be expected going forward?

The prospect of being cut off from the Internet is not new for Russia. Back in 2014, the government and its various ministries started preparing for a scenario when Russia is cut off from the global Internet through outside interference; drills were run and legislative framework was established. For instance, Law 90-FZ on the stable Russian segment of the Internet (Runet) was adopted in 2019; the measures stipulated in the law included, among other things, establishing Russia’s own routing database and a national system of domain names, which would allow to keep up the functioning of networks and retain the availability of resources in Russia’s national domain zone, but most likely not beyond it.

Along with working on its domestic legislation, Russia has been advocating for many years for an internationalized governance of the Internet, primarily concerning ICANN’s functions. Russia’s proposals include transferring such functions to an international intergovernmental organization—for instance, the International Telecommunications Union, where all the key decisions on the Internet’s critical infrastructure would be made by states instead of a corporation.[4] Another reason why the multistakeholder approach to the Internet governance is regularly criticized is its bias in favor of the interests of Western nations and large IT companies.

Amid such conditions, the Ukrainian crisis has turned out to be a stress-test for the established practices of Internet governance. Each level of the Internet (infrastructure, routing, apps, content) has its own stakeholders in charge of decision-making: while certain decisions made by foreign social networks and services in terms of content prompted Russia to restrict or block their operations in Russia, a status quo has thus far been preserved at the level of infrastructure.

In 2016, supervision over IANA was transferred from the U.S. government to Public Technical Identifiers acting on behalf of the global Internet community. Had back then ICANN’s transformation followed Russia’s scenario, the decision on Ukraine’s request to remove Russia’s domains from the root zone could have been taken by a vote similar to the UN General Assembly. Given the gravity of the current crisis, it would have been possible that the vote would have gone against Russia, just as it happened with suspending Russia’s membership in the UN Human Rights Council. The multistakeholder approach, therefore, operated this time as a safety catch, preventing geopolitics from triumphing over common sense and a functioning global network.

However, the multistakeholder model of Internet governance should be seen as a fail-safe against further attempts to use Internet-related sanctions to pursue geopolitical objectives. As of now, a number of stakeholders coming from civil society, the academe, states, and even the technical community say that it is high time that they considered such mechanisms that could effectively restrict the Internet for specific countries or territories amid crises or military conflicts. Given today’s trends for ensuring digital sovereignty and given many states’ intention to correlate cyberspace and national borders, the issue of using sanctions against the Internet’s unique identifiers that ensure its global nature and cogency no longer seems improper and contradicting the principles of Internet governance.

There is only one odd thing about the current situation: Why was the prospect of sanctions against the Internet infrastructure raised now? The Ukrainian crisis is not the first and only of its kind—still, no one had entertained such ideas before. In the very least, there was no major response to such ideas in the global Internet community. We can assume that this subject will be addressed at the upcoming IGF 2022 to be held under the UN’s auspices at the end of the year. The secretariat has just announced call for submissions for session topics, and the problem of the Internet’s fragmentation is a discussion priority.

1. The RIPE community that is open to any parties concerned should be distinguished from RIPE NCC incorporated in the Netherlands and implements decisions adopted by the community. RIPE NCC is one of five regional Internet registries that distributes IP addresses in Europe, in the Middle East, and Central Asia.

2. The Internet Engineering Task Force is a community that develops Internet protocols and standards.

3. A more detailed analysis of possible shutdown scenarios and their impact on the Internet’s features (Internet Way of Networking) see in the analysis based on the Internet Impact Assessment Toolkit
https://www.Internetsociety.org/resources/doc/2022/Internet-impact-brief-how-refusing-russian-networks-will-impact-the-Internet/

4. The ICANN community has a Government Advisory Committee (GAC), but it does not have any significant influence on ICANN’s decision-making.