Donate Now
digital medusa logo

Sanctions and the Internet: Project Update 

Farzaneh Badii, Angie Orejuela

Introduction

A few months ago, RIPE NCC announced that they have commissioned Digital Medusa to undertake a research project based on the issue of sanctions and the Internet. We aim to include the RIPE community for consultative insights that the design of the projects will benefit from. More details about SancNet can be found on Digital Medusa. This blog discusses the direction of the project and briefly discusses future endeavors. We welcome input on what can be added or redirected in this study. We will also do a presentation about the project next week during a BoF session in Belgrade, Serbia. We look forward to seeing you in person or online. The session will take place on Tuesday, 25 October, from 17:30 to 18:30 (UTC+2).
To date, we have been conducting mixed research methods for the project. These include desk research and interviews with industry, operators, and policy actors. We plan on undertaking 10 to 15 interviews, and have completed 5 so far. If you want to talk to us about sanctions and their impact on your work, please reach out to Digital Medusa. In addition to conducting formal interviews, we hope to collect your feedback on the design and other aspects of the project.

Below is an outline of the work so far:

  • Historical implications of sanctions on access to Internet resources
  • Sanctions that directly affect RIRs operations
  • Inequitable access to Number Resources because of indirect consequences of sanctions
  • The impact on overall network operators (the broader RIPE community)
  • Current and future policy solutions

Scope

There are various types of sanctions that are usually imposed by nation states on specific nation states or certain activities (which includes sanctions on non-state actors). Sanctions include: trade restrictions (or more broadly economic sanctions), travel bans, the freezing of assets and arms embargoes. The focus of this research is strictly economic sanctions, because those are the primary kinds of sanctions that affect Internet resources. We also focus on access to critical properties of the Internet, specifically access to IP addresses. While we might learn from other compliance and policy practices related to other Internet services, our focus is primarily on access to IP addresses.

A brief history of sanctions related to the Internet

While the history of anything that can be called “sanctions” is long, the sanctions regimes that are common today derive mostly from ideas that emerged around the time of World War I and that were refined during the Cold War. The United States in particular embraced sanctions in an effort to confront political developments contrary to its interests and as an alternative to direct military engagement.
For better or worse, the Internet was largely designed to disregard jurisdictional borders. In keeping with that, nations and even regions were mostly ignored when allocating numbers and talking to other networks. Since the Internet Assigned Numbers Authority in particular (in the person of Jon Postel) was based in the US, this was a decision of some consequence, as every decade the US list of sanctioned countries expanded. It was not possible to have a global interconnected network based exclusively on US relations with other nation states. By 1990 it was already clear that handling all number registrations in a single registry was not able to keep up with the growth of the Internet, and the Internet Activities Board recommended to the US Federal Networking Council that mechanisms of delegation be embraced.  By 1993, the emergence of regional allocation authorities was already acknowledged, and by 1996 the use of Regional Internet Registries (RIRs) was already a best practice.
In the early to mid-90s, the Internet was still in its infancy, and in the US, it was not even clear that commercial traffic was permitted on the Internet (or the parts connected to the National Science Foundation’s NSFNet). Commercial pressures towards institutionalization were new, and organizations such as the RIRs had to feel their way through the implications of international sanctions regimes. Perhaps the regional division also made it easier for these organizations not to be affected by sanction regimes they were not based in. This, however, did not last long. By the end of the 90s and especially after 9/11, the US sanction regime underwent an evolution. The US Treasury office redesigned the system so that the private and especially the financial sector globally became entangled with the US sanction regime. Read Treasury’s War: Unleashing of a New Era of Financial Warfare by Juan Zarate to know more about that development. Later on, the EU and Australia also put in place their own sanction regimes.
The twin pressures of simultaneous expansion of the Internet, and the expansion of various sanction regimes, meant that inevitably the allocation of Internet resources became subject to sanctions. This sometimes happened directly, as RIRs were unable to provide services to sanctioned countries or persons. It sometimes happened indirectly, as the financial services necessary to pay Internet registries’ service fees were unavailable. It also affected the development and partnership of network operators.

Sanctions Timeline

This timeline is a work in progress. It is evolving as we continue our research and it is not fully representative of all the sanctions instances. We very much welcome your feedback on the timeline as we would like to present something comprehensive and more global in nature at the end of the research project. Click here for the PDF version.

Effect of sanctions on the operation of Regional Internet Registries

Legally, whatever can be categorized as a “transaction” may be subject to sanctions. RIRs’ services can be affected because of the jurisdiction in which they are located as well as third-party service providers’ jurisdiction. At a minimum, the following can be affected:
Inter-RIR transfers
Transfers can be recognized as a transaction and since IP addresses are economic resources, then transferring IP addresses from one RIR to another might face issues because of sanctions.
Payment systems
Payment systems such as banks, credit card companies and financial entities may not provide services to entities that have members from sanctioned countries, refuse to provide service to those members directly, or both.
Software providers
Software providers that RIRs procure to provide services such as dual factor authentication might refrain from providing their services to members from sanctioned countries.

RIRs New membership, assignment, allocation or transfer requests (including End User requests)

RIPE NCC has been clear about the need to undertake due diligence in case of several services that it provides to the members, namely new membership, assignment, allocation or transfer requests.

Inequitable access to number resources because of indirect consequences of sanctions

Using compliance processes, RIRs can do the minimum to stay in compliance with sanction regimes and provide their services legally to the sanctioned countries. However, there is only so much they can do compliance wise. When the impact of sanctions is indirect and entangled with other industries, then inequitable access to number resources might emerge. The inequitable access can happen because nationals of sanctioned countries (that are not themselves the target of sanction regimes) might not be able to register new number resources because banks are not willing to facilitate their transactions. The issue goes beyond that, sometimes countries that are not sanctioned but are transacting and sharing IP blocks with sanctioned countries might be affected as well.

Impact of sanctions on network operators

This category of impact on Internet resources goes beyond RIRs’ mandate but affects the communities RIRs serve. Most network operators want to connect indiscriminately and based on technical considerations such as overcoming latency and not based on nationality, creed, or related matters. It is this value of global interconnectedness that made the Internet global. However, network operators are also institutionalized, and many cannot simply connect with other networks without considering sanctions. Besides, sanctions might impact peering and collaboration among ISPs and Internet Exchange Points. This was evident in the case of Serbia in 1998 and then Cuba. American sanctions against Cuba (combined with restrictive national Cuban measures) stifled the development of networks in that country for a long time. Network operators might also be impacted in “sanction-locked” countries. Countries surrounded by sanctioned countries especially might be impacted because the network operators in sanctioned countries cannot peer with others effectively.

Current and future policy solutions. Tell us what you think

Our study so far has highlighted the following policy solutions to maintain the Internet global and interconnected. At this stage, we are only briefly mentioning each, it is by no means exhaustive and we can change the list based on your feedback. If you would like to add to the list please contact us.

A balanced, transparent compliance process: RIRs (specifically RIPE NCC) have been transparent about their compliance process and the initiatives they took to comply with sanctions but, at the same time, not affect access to IP addresses. However, there are shortcomings in compliance processes in sanction regimes. The list-based approach (which is an effective compliance approach) has affected access to Internet services in the past for nationals of sanctioned countries. But they seem to be still fairer than blanket-blocking a whole country because of sanctions. Investigating various compliance solutions in this space might help with easing access to Internet resources.

Sanction waivers, exceptions and regulations for access to essential properties of the Internet: This is also another approach to seek some relief from sanctions when it comes to access to the Internet. We need to explore the effect of waivers and licenses on sanction relief. There have been some cases in the past where specific licenses and waivers have been obtained for certain services on the Internet which can help us understand how the processes work and how we can use these processes to successfully seek relief.

Convening intra-industry coalition to provide services to facilitate access to critical properties of the Internet: This suggested approach convenes the finance industry and other industries and organizations that have a key role in facilitating access to Internet critical resources to work on their compliance, obtain specific licenses if needed, and undertake other efforts of this nature to mitigate the adverse effect of sanctions on access to essential properties of the Internet.

Changes in governance structure of the RIRs: this might come across as controversial but needs to be discussed. RIRs are regional for historical reasons. If there were technical reasons to prefer geographic distribution rather than using some other criteria, those reasons are not clear in the historical documentation. In the future, should we consider changing RIR’s governance structures, or creating some Internet registries along non-regional lines to preserve access to Internet resources?

Arguing for a global Internet in international fora: another solution for the problem of sanctions would be to build on cyber norms, explore the humanitarian value of access to essential properties of the Internet and draw infrastructural analogies to argue for exemption of RIRs from sanctions in international fora. We will delve into this issue and identify the appropriate fora and the grounds for which there can be exemption or other avenues.

Planning for a public sanctions and Internet database

We want to encourage public accessibility of our findings and are creating a database of current regulatory frameworks, industry actors and approaches that could affect providing access to essential properties of the Internet. In the process of that, we will be identifying and mapping the actors that are involved in the field of sanctions and the Internet: for example we will list compliance regimes, sanction regimes, and different private and governmental actors that may have a role in affecting access through sanction regimes. We will also enumerate key industry actors and their compliance practices which could potentially facilitate or hamper access to numbers resources. We look forward to your feedback on the usefulness and design of such a database.

About The Author

Farzaneh Badii

Digital Medusa is a boutique advisory providing digital governance research and advocacy services. It is the brainchild of Farzaneh Badi[e]i.Digital Medusa’s mission is to provide objective and alternative digital governance narratives.

Read More

About The Co-Author

Angie Orejuela

Deputy Editor-in-Chief for the Journal of Diplomacy and focuses her writing on how digital technologies affect global politics.For the past 3 years, she has also worked as a Microsoft Inside Account Manager for the North East, higher education region at SHI International.

Read More
digital medusa logo
Quick Links
All rights reserved 2021 www.digitalmedusa.org
%d bloggers like this: