Envisioning sovereign internet

Scitech Report

6 May, 2019 12:00 AM printer

Envisioning sovereign internet

Earlier this year, US officials briefed reporters on an extraordinary operation: they claimed to have launched an offensive cyber-attack against Russia to protect the integrity of the country’s midterm elections.

Government hackers from US Cyber Command had pre-emotively cut off the internet to a St Petersburg office building that houses the Internet Research Agency, better known as Russia’s troll factory, to prevent the spread of misinformation on election day in November 2018, US newspapers reported.

News of the attack, which was never confirmed by Russian officials, did not cause much surprise in Moscow. For years, global connectivity has been portrayed as a dangerous vulnerability in the escalating conflict between Russia and the west.

Days earlier, Vladimir Putin had warned that Russia could potentially be cut off from the global internet entirely. The west might hesitate to attack, he said, only because

Earlier this month, Russian lawmakers followed up on Putin’s recommendations, passing a bill codifying the country’s most ambitious attempt yet to wrangle control over Russia’s segment of the internet and its connection to the rest of the world.

The “sovereign internet” bill, which was tabled by lawmakers close to the country’s FSB security service, would require telecoms operators to closely monitor all internet traffic using filtering technology and also create the framework for an “on/off” switch that could allow Russia to cut itself off from the global internet in case of attack.

The bill, which will probably be signed into law by Putin soon, is seen as a step towards a Chinese-style firewall for Russia, where the internet has largely remained open since the 1990s.

The government has seen the power of hacking operations first hand. In 2008, Russian hackers launched a cyber-attack against Estonia that brought it to a standstill, while cyber-operations were an important element of the 2014 annexation of Crimea from Ukraine.

Since 2016, when Russian military hackers were accused of breaking into the servers of the Democratic National Committee and releasing damaging information about Hillary Clinton, the US has known it is a target.

“The US has now said that it wants to impose consequences on people who attack it in cyberspace and the Russians know that means them to a good extent,” says James Lewis, a researcher for the Center for Strategic and International Studies (CSIS) in Washington DC.

But critics remain skeptical about whether the overhaul is even possible. While China’s internet developed with an eye to controlling outside content, by investing fortunes in filtering technology and limiting entry points into the country, Russia’s has grown with entry points designed to promote the efficient flow of information and integration with the west.

The cost of implementation has been estimated at more than $300m, a number that will probably rise, analysts say. And a test of the system has been delayed as lawmakers recognise the potential disruption it could cause, amid protests from the tech industry.

Critics say that the government has set itself an impossible task that will allow it to peer further into the lives of its citizens without increasing security.

Lawmakers were “trying to issue new laws of nature,” says Alexander Isavnin, of the RosKomSvoboda movement, which advocates for internet freedom. He helped organise a protest in Moscow last month against the internet bill that attracted more than 15,000 demonstrators.

Nearly half of Russia’s internet traffic travels through an exchange point in Moscow called MSK-IX. In their book The Red Web, journalists Andrei Soldatov and Irina Borgan describe the 19-storey building as the “heart of the Russian internet”. Google rents a room on one floor, while an FSB listening post is located on another.

In order to cut itself off from the global internet, Russia would first have to divert all of its traffic through nationally controlled exchange points such as MSK-IX, where information can be analysed, content filtered and, in case of a crisis, the flow of information from abroad stopped.

Then, Russia will implement a nationally controlled proxy version of DNS, the domain name system that translates URLs into IP addresses and directs user traffic to the servers that websites are run on. DNS acts like a phone directory for the internet and if Russia can implement its own version, a costly fix, then it could control what servers were accessible from within Russia.

“For example, the URL for a foreign website, eg the Guardian, or app, eg Facebook, which the government doesn’t want allowed into the country could be directed to a dead-end IP address to thwart casual users or to nationally sanctioned, local social media websites. This is commonly used as part of the Chinese great firewall today,” says Alex Henthorn-Iwane, of ThousandEyes, a network monitoring company based in San Francisco.

Ideally, a Russian user wouldn’t notice much change if the government blocked traffic in and out of the country. Russian websites would continue to work and, the government hopes, users wouldn’t have much demand for the sites and services that become inaccessible.

But the process is daunting. It may be straightforward to redirect web traffic from a browser, but international finance and commerce increasingly rely on automated processes that generate cross-border traffic. And the products we use in daily life increasingly require internet connectivity, meaning that the Russian system would have to take into account phones, cars and other consumer products when designing the system.

Unlike China, “Russia is densely integrated into the global internet and digital ecosystem”, Henthorn-Iwane says. “A broad set of critical components of the Russian economy, from financial services to enterprise software-as-a-service applications all depend heavily on interconnections to services outside Russia. A full cut-off that suddenly isolates Russia from the internet would almost certainly disrupt all of these services causing a non-trivial economic impact.”

Russia, like other countries, is looking for a way to enjoy the economic benefits of the internet while avoiding the dangers of increased connectivity between people. Lewis of the CSIS says: “Countries want to be open for business but closed for politics.”

Long before the appearance of the “sovereign internet” bill, Russia had been seeking ways to limit the spread of information deemed dangerous, building databases of banned websites and occasionally pressing charges against internet users for what they post and like online.