How Do Sanctions Impact the Internet?

As the Internet is still relatively new, lots of questions remain to be answered as to what effect sanctions might have on its use, and how easy it will be for the organisations who help keep it running to do their work while remaining sanction compliant.

Our project proposes to adopt a systemic approach to investigating these questions. As well as documenting how sanctions are currently applied to the Internet, we will examine why there have been previous attempts not to apply sanctions to the Internet, whether contemporary problems necessitate the application of sanctions to the Internet, and what a desirable outcome might be for sanctions and Internet access in the future.

Some of the outcomes we hope for are:

• Policy solutions - considering past sanction exemptions, we aim to find any potential pathways to arguing for policies that diminish the impact of sanctions on access to the Internet, but which simultaneously help governments achieve their sanction goals
• Strategies for compliance with sanctions while keeping the Internet global - we expect the research to help reveal why businesses over-comply with sanctions and how risk strategies can change to maintain the provision of services while still complying with sanction rules
• Institutional changes - the research will look into whether we need institutional and governance changes in Internet governance organisations to maintain interconnectedness.

Consultation Process

This project uses stakeholder consultation and interviews as a major part of the research method. We have consulted with various stakeholders and held private interviews with experts, network operators, academics, civil society, and others. So far, we have presented our findings during a session at the RIPE 85 meeting, and the Central Asia Peering and Interconnection Forum (CAPIF 1) held in Kazakhstan. We have also interviewed ten individuals and organisations.

We will also participate in a panel this week at the United Nations Internet Governance Forum session co-organised with RIPE NCC and APNIC titled: Protecting a Global Internet in an Age of Economic Sanctions.

Research Outline

The research outline, for now, includes the following:

1. Historical implications of sanctions on access to Internet resources
2. Sanctions that directly affect Regional Internet Registries (RIRs) operations
3. Inequitable access to Number Resources because of indirect consequences of sanctions
4. The impact on network operators
5. Current and future policy solutions

Sanctions and the Internet: A Timeline

This timeline is a work in progress. It is evolving as we continue our research and is not fully representative of all the sanctions instances. We very much welcome your feedback on the timeline as we would like to present something comprehensive and more global at the end of the research project. The preliminary result of the timeline shows that:

• Since at least late 1990s, sanctions have been affecting the Internet
• Since 2010, there have been general economic sanctions imposed on various countries, but sanction reliefs were also issued (case of Sudan, Iran, Cuba and Crimea)
• Since 2020, there has been a sharp increase in economic sanctions and sanction relief due to the heightened conflicts (such as Taliban take–over, Russia invasion of Ukraine and uprising in Iran)

Click here for the PDF version of the timeline.

Current Findings

The growing list below details information crucial to this project. Much of the work so far has been aimed at getting a clearer, more organised picture of the intricate way in which the structures and processes that enable access to the Internet interact with efforts to ensure compliance with sanctions. Doing so has already helped with the further goal of identifying what potential solutions might look like.

Effect of sanctions on the operation of Regional Internet Registries (RIRs)

Computers on the Internet address each other through long strings of numbers that uniquely identify points from which packets can be sent and received. These numbers - Internet Protocol (IP) addresses - are distributed by the Regional Internet Registries (RIRs), usually to Internet Service Providers who then allocate them, in turn, to their customers. The RIRs also distribute the Autonomous System numbers (ASNs) that uniquely identify networks on the Internet.

Policies, regulations, and technical problems that curtail the distribution of IP addresses can thus have a significant impact on user access. Rather than merely depriving users of access to specific online services, lack of access to IP addresses effectively prevents people from going online at all.

Since legally, whatever can be categorised as a “transaction” may be subject to sanctions, and since IP addresses count as economic resources in some jurisdictions, sanctions can certainly affect the services provided by RIRs. What's more, again depending on jurisdiction, the third-party service providers RIRs rely on to do their work can also be impacted. At a minimum, the following can be affected:

• Inter-RIR transfers
  • Transfers can be recognised as a transaction, and since IP addresses are economic resources, the transfer of IP addresses from one RIR to another might face issues because of sanctions.
• Payment systems
  • Payment systems such as banks, credit card companies, and financial entities may not provide services to entities that have members from sanctioned countries and might therefore refuse to provide service to those members directly, or those entities, or both.
• Software providers
  • Software providers that RIRs procure to provide services such as dual-factor authentication might refrain from providing their services to members from sanctioned countries.
  • RIRs new membership, assignment, allocation or transfer requests (including End User requests).
• RIRs operations
  • RIRs services can be or have been affected by sanctions. New members from sanctioned countries (not only specific persons) could be impacted. Also, assignment, allocation or transfer of IP addresses requests cannot be handled.
  • RIRs must undertake a complex due diligence process that will take time for every request they receive from these countries. Doing such due diligence has to be outsourced sometimes because the information about the ownership structure available about the entities in question is incomplete or inaccessible. For example, Afghanistan’s central business registry database went down this year, and it is unclear how it can be accessed. The website redirects to the Ministry of Industry and Commerce.

Inequitable access to number resources

There may be inequitable access to number resources - the IP addresses and ASNs mentioned above - because of the indirect consequences of sanctions. Using compliance processes, RIRs can do the minimum to stay in compliance with sanction regimes and provide their services legally to the sanctioned countries. However, there is only so much they can do compliance-wise. When the impact of sanctions is indirect and entangled with other industries, then inequitable access to number resources might emerge.

The inequitable access can happen because nationals of sanctioned countries that are not themselves the target of sanction regimes might not be able to register new number resources. After all, banks are not willing to facilitate their transactions. The issue goes beyond that; sometimes, countries that are not sanctioned but are transacting and sharing IP blocks with sanctioned countries might be affected as well.

Impact of sanctions on network operators

When individuals want to use services on the Internet - for example, browse a website or send an email - various networks handle these requests. The requests go through networks in the form of packets, and that makes up what we call Internet traffic. Network operators are in charge of carrying this traffic. Through Internet peering, networks agree on helping one another to handle the traffic. Economic sanctions can potentially impact actors involved with Internet peering.

Sanctions and de-peering

When specific sanctions apply to individuals with formal roles in telecommunication services (for example, the CEO of a telecom operator), the Internet Exchange Point that is subject to the sanctions regime in question will have to terminate the network operator’s membership. This‌ can have the following consequences:

• De-peering has consistently been recognised as an extreme step, as it means customers might not reach specific sites on the Internet. (See this paper for more information.) If the network operator is large and serves smaller network operators, those network operators are also affected. This will affect the quality of access and create latency. Some argue (as reported in Russian state-owned media) that it does not impact their services. Such network operators claim they can have access to global traffic through Asia. But there are restrictions. For example, it is difficult to peer with Chinese operators due to their domestic restrictions on Internet traffic.
• Network operators that are sanctioned might carry Internet traffic of other non-sanctioned countries. In such a case, the sanctions (and revocation of membership from IXPs) can affect other network operators based in other countries.
• When revocation of membership from a well-established Internet Exchange Point happens, the individual members of that exchange point will likely stop peering with the sanctioned network bilaterally.

Cache servers

Cache servers are a means of making sure that much of the most popular content available on the Internet is always “close”, in a network sense, to the end user. These services enable the web, in particular, to satisfy enormous demands. Cache servers do not necessarily serve a peering function, but they are essential for cloud providers and peering locations, as well as for the quality of access to the Internet. They are even sometimes critical for having meaningful access to the Internet. A cache server temporarily stores information on a local network, making browsing faster.

Cache servers are usually installed in data centres, ISPs, and peering locations. Trade restrictions, export, and import controls, and sanctions could impact the availability of these servers. There were two reported cases of Google shutting down its caching servers in two Russian ISPs. Google (reportedly) stated that the reason was a change in legal practices and compliance with sanctions. There are reports about Cache servers being unavailable in Afghanistan as well.

Current and future policy solutions

Our study so far has highlighted the following policy solutions to maintain the Internet global and interconnected. At this stage, we are only briefly mentioning each, it is by no means exhaustive, and we can change the list based on the feedback we receive.

• A balanced, transparent compliance process - RIRs (specifically RIPE NCC) have been transparent about their compliance process and the initiatives they took to comply with sanctions while, at the same time, not affecting access to IP addresses. However, there are shortcomings in compliance processes in sanction regimes. The list-based approach (which is an effective compliance approach) has affected access to Internet services in the past for nationals of sanctioned countries. But they seem to be still fairer than blanket-blocking a whole country because of sanctions. Investigating various compliance solutions in this space might help with easing access to Internet resources. We need to especially focus on how banks comply or over-comply with sanctions and how payment systems sanction compliance mechanisms work.
• Sanction waivers, exceptions, and regulations for access to essential properties of the Internet - This is another approach to seeking some relief from sanctions when it comes to access to the Internet. We need to explore the effect of waivers and licenses on sanction relief. There have been some cases in the past where specific licenses and waivers have been obtained for certain services on the Internet which can help us understand how the processes work and how we can use these processes to seek relief successfully. Depending on the nature of Internet services, sanctions apply to them differently. For example, GitHub provides one kind of service, and it has successfully obtained a specific license for that kind of service. It might be different for other tech companies such as content delivery networks and cloud services that provide multiple services which might be subjected to sanctions or not.
• Convening intra-industry coalition to provide services to facilitate access to critical properties of the Internet - This suggested approach convenes the finance industry and other industries and organisations that have a key role in facilitating access to Internet critical resources to work on their compliance, obtain specific licenses if needed, and undertake other efforts of this nature to mitigate the adverse effect of sanctions on access to essential properties of the Internet.
• Drawing the Internet value chain - When sanction licenses are issued, usually they are not comprehensive enough, and some essential Internet services might be left out from the licenses, which make the license ineffective. Drawing the Internet value chain might help with more effective licenses. It entails locating each actor (Internet or non-Internet related) that has some role in providing access to the Internet.
• Changes in the governance structure of the RIRs - this might come across as controversial but needs to be discussed. RIRs are regional for historical reasons. If there were technical reasons to prefer geographic distribution rather than using some other criteria, those reasons are not clear in the historical documentation. In the future, should we consider changing RIR’s governance structures, or creating some Internet registries along non-regional lines to preserve access to Internet resources?
• Arguing for a global Internet in international fora - another solution for the problem of sanctions would be to build on cyber norms, explore the humanitarian value of access to essential properties of the Internet and draw infrastructural analogies to argue for exemption of RIRs from sanctions in international fora. We will delve into this issue and identify the appropriate fora and the grounds for which there can be an exemption for access to critical properties of the Internet. We also aim to map the organisations and processes and evaluate which process is more effective in bringing us closer to finding a solution to mitigate the impact of sanctions.