Disconnecting the Russian Internet: Implications of the New “Digital Sovereignty” Bill

President Putin says Russia needs to protect itself against the threat of being disconnected from the World Wide Web by outside forces. (credit)

► Earlier this month, a new bill aimed at protecting “Internet sovereignty” passed the first reading in the Duma. This legislative initiative has raised fears that the Kremlin seeks to isolate Russian Internet users from the outside world. Whether or not this is indeed what the Kremlin has in mind, the feasibility of such an ambitious project is highly dubious. What is not to be doubted, however, is that the Russian government is determined to thwart all unwelcome forms of public organization and ensure that the Russian people continue to be barred from using the Internet as an organizing tool. Maria Lipman talks to Tanya Lokot about the new attempt to tighten state control over the Internet by it what might entail.

Maria Lipman: What do you make of the new bill? Does it amount to cutting the Russian Internet off from the World Wide Web? Does this seem to be the goal of the Russian government (to the extent that we can speculate about the Kremlin’s goals)? If the goal is not so radical, what might it be?

Tanya Lokot: Despite the focus of a lot of mainstream media coverage on the “cutting off” aspect, the main goal of the new bill seems to be greater state control over the Russian segment of the Internet and over its connections to the rest of the global network. According to the authors of the bill, Russia’s main priorities are to ward off external threats and to be able to preserve some semblance of normal functioning within the Russian segment of the Internet in the event of an attack from without. So this centralization of control over the Internet is being presented as first and foremost a matter of geopolitical strategy and national security.

The so-called “kill switch” is allegedly an emergency measure of last resort, and would in theory only be used in the event of an external attack. But the proposed infrastructure that would enable such “sovereignty” also affords the state greater internal control over Russia’s digital public sphere and its networked infrastructure. Already, many experts, including digital rights advocates, industry representatives, opposition activists, and other lawmakers, justly caution that such concentration of power in the hands of the state regulator (Roskomnadzor) would unquestionably add to the restrictions on political expression and free speech already in place on the RuNet. Given the demonstrable decline in online freedoms and the number of restrictive regulations imposed by the Kremlin on the RuNet since 2012, it is not surprising that, under the guise of defending the country against external foes, the “sovereignty” bill at the same time aims to further neutralize those it sees as internal threats. Certainly, granting Roskomnadzor the technical capability to centrally manage an autonomous RuNet would make state surveillance and censorship easier, so civil rights activists and digital rights advocates are sounding the alarm already.

Lipman: Please discuss the technological and financial feasibility of this project.

Lokot: Essentially, the bill provides for a centrally managed system that would make it possible for the authorities to disconnect RuNet from the “external” web and to filter all the traffic, including internal, incoming, and outgoing traffic. So the “kill switch” would provide for the “cutting off” of all external networks (and, in theory, external cyber attacks) while preserving users’ access to all the websites and services hosted within Russia. Such a feat could also mean disconnecting Russia from the global DNS (domain name system) and preventing traffic from being routed through exchange points outside of Russia. Ironically, there is widespread consensus that it is virtually impossible for any external force to “disconnect” Russia from the global Internet, given how decentralized its connections currently are. As Stanislav Shakirov, technical director of digital rights organization Roskomsvoboda, points out, having a central choke point for incoming/outgoing traffic would actually make the country more vulnerable to cyber attacks.

In terms of filtering, as Andrey Soldatov has already explained the new bill takes the responsibility for filtering traffic off the shoulders of the Internet service providers (ISP) and puts the onus on the state regulator. This means that the state will need to develop, fund, and install more sophisticated systems in ISP facilities and traffic exchange points—ones capable of pre-filtering traffic and employing DPI (deep packet inspection) technology to catch “illegal” or banned content.

In an ideal world, all of this is certainly technically possible, but it would require painstaking preparation and putting in place a lot of new infrastructure, which requires significant funding that has to come from somewhere. The specifics of the technical implementation and the sources of funding for the “autonomous” RuNet are currently the biggest unknowns. The bill, although it passed the first reading in the Duma, offers little clarity on either, and, because of this, faced significant criticism from all kinds of actors, even those who support the plan as the next strategic step in Russia’s overall strategy of consolidating control over the online space.

Some media reports have blithely stated that the Russian government has agreed to finance the “sovereignty” project, but this statement is far from certain, as it is unclear how much it may actually cost. There are various existing pots of money that the authors of the bill have tried to claim for its implementation. These include the 1.8 billion rubles allotted for a “Center for monitoring and management of communication networks” in the 2019-2021 federal budget, and the 22.3 billion rubles budgeted for “information security” as part of the “Russia’s digital economy 2018-2020” program. The problem is that these budgets were formed long before the new bill came into existence, so it is highly unlikely that they will be used in their entirety to fund its activities.

Skeptics have speculated that, as is often the case in Russia, this bill may be yet another attempt by various players (including Roskomnadzor, the Telecommunications Ministry, the FSB, etc.) to “split” existing state funds and to funnel them toward their respective interests. And while some players warn of “external threats,” others are already offering convenient solutions in the form of legislation and infrastructure. As Maxim Trudolyubov writes, “in modern Russia, bans are in place not to ban [things], but to survive and to enrich [oneself].” But who says you can’t grow richer and ban things in one fell swoop?

What is clear even now, despite the lack of technical detail in the bill, is that implementing such a comprehensive system of control will be a costly endeavor. Where exactly the state funding will come from, how much of it will actually be spent as planned, and how much will be pilfered by various agencies remains nebulous. And, as the Russian journalist and radio host Aleksandr Plushchev said, discussing the bill on his Telegram channel, “I just hope that, as usual, it all gets stolen along the way. [Corruption] is the lesser evil.”

Lipman: To the extent that the Russian Internet can be “disconnected,” how is it going to affect Russian users? Of course, users can be fairly diverse—which categories of users and which functions are most likely to be affected?

Lokot: We know from opinion polls that many Russians believe that Internet censorship is warranted and that cyber attacks are a major threat to national security. Though not everyone might be unhappy with the proposed restrictions, those who are vulnerable (because of their political or personal views) and are already alarmed at the tightening of state control over the online sphere will obviously protest even louder.

Russian digital rights advocates fear—with good reason—that the bill’s provisions will simply lead to further centralization of state power over the RuNet and will make it significantly easier to stifle dissent and critical expression, as well as allow for tighter control of people’s access to external opinions and information. If the “kill switch” were to be implemented, it would also likely render useless the alternative tools, such as VPNs and proxy servers, currently used by many to access banned content.

The potential consequences of a centrally managed, routed, and filtered RuNet would likely affect almost every Internet user in Russia, whether through greater surveillance, more pervasive censorship, or, in the event of a disconnect, loss of access to the majority of Internet services that currently constitute part of most Russians’ daily routine. The bill would also create issues for many Russian Internet businesses, given that a significant proportion of them are connected to global payment, e-commerce, and banking systems. Internet service providers would suffer as well: critical industry voices have cautioned that implementing the costly infrastructural changes would definitely lead to rising operating costs and consumer tariffs, as well as potentially result in lower-quality service for customers. 

Lipman: Is the Kremlin’s current strategy similar to the Internet restrictions in China? Right now, as far as I understand, in Russia, we enjoy much greater freedom than users in China do, correct? Is Russia moving in the “Chinese” direction or is the Kremlin’s strategy different? If the latter, how would you explain the difference?

Lokot: The trend toward greater Internet sovereignty and “balkanization” of the Internet has been evident around the world for some time from Brazil to the EU and beyond. But it does seem that Russia is quite enamored with the Chinese model, given the scope of the new bill and the fact that its authors argue for complete independence in terms of infrastructure and traffic routing. China, though, has a peculiar history in that its national firewall and sophisticated filtering system are combined with a wide array of national services, such as Baidu, WeChat, and Weibo, that have come to replace the global (mostly Western) platforms. Chinese citizens have become used to these services, which provide them with search, payments, social networks, and much more in exchange for harvesting their data for surveillance purposes. But this system is so stable because it was developed over a number of years and is supported by significant state funding and investment in infrastructure and local Internet businesses. In Russia, it would be nigh on impossible to create such a system due to differences in the political and economic climate. Not least, a China-style walled garden would be difficult to implement because Russians, at least until 2012, enjoyed a mostly free Internet with access to the vast majority of its global offerings. Taking those away completely might not spoil the “autonomous RuNet” for everyone, but it would certainly sour the existence of many who are used to what they currently have.

Lipman: In his piece about the bill, which you have already mentioned, Andrey Soldatov compares the current attempt to restrict the Internet to the Soviet strategy of sacrificing technological progress and “putting the USSR at a disadvantage for decades” for the sake of limiting public access to information. Do you agree with this comparison?

Lokot: I think Soldatov is mostly spot on here: while some technological progress may still happen in isolation, there will likely be significantly fewer opportunities for Russian Internet startups—and many of them have already moved to the West in search of venture capital. Even existing major players in the Russian market may be in trouble, despite the existence of a national “digital economy” strategy and all its lofty aspirations. While some of them (e.g., Mail.Ru and Yandex) have expressed support for the new bill in principle, it is clear that the fallout of the autonomy project might affect them in different ways. Even now, we can see that some Internet companies, like Mail.Ru, are attempting to combine running a profitable business and cooperating with the FSB and Roskomnadzor, in an attempt to survive and curry favor. Others, like Yandex, certainly support the idea of national cybersecurity (they would look weird if they did not) and might gain a greater market share in the RuNet if players like Google were shut out of it, but I doubt they are overjoyed about the prospect of only doing business in the autonomous Russian web, as they are currently also working in markets other than Russia.

Some industry voices have also lamented the fact that this push for autonomy would destroy Russia’s investment potential for external players. As the Russian government continues to push for further isolation in terms of using local hardware and software in place of foreign options—and now also for centralized management and monitoring of all Internet communications in the country—it is increasingly unlikely that foreign companies, be they makers of technology or Internet services, will want to do business with a “sovereign” digital state that cares little for international norms or digital freedoms. So while the imagined future described in the new bill might offer the Russian state greater control over the networked sphere, it will also likely impede any meaningful technological innovations or collaboration on an international scale. 

Tanya Lokot is Assistant Professor in the School of Communications at Dublin City University, Ireland. She researches digital activism and protest in Russia and Ukraine, and the Russian-speaking Internet more broadly. She has worked as a journalist and media trainer, and has been a Contributing Editor for RuNet Echo, a Global Voices project.