Can Russia Actually 'Unplug' From The Internet?

from the it-won't-be-easy dept

As you may have heard, Russia recently announced a plan to run a "test" by which it would disconnect from the internet:

Russia is considering a plan to temporarily disconnect from the Internet as a way to gauge how the country's cyberdefenses would fare in the face of foreign aggression, according to Russian media.

The general idea behind this is to see what would happen if other countries (such as the US...) decided to try to cut Russia off from the internet:

The bill would require Internet providers to make sure they can operate if foreign countries attempt to isolate the Runet, or Russian Internet. It was introduced after the White House published its 2018 National Security Strategy, which attributed cyberattacks on the United States to Russia, China, Iran and North Korea.

As part of the experiment, communications oversight agency Roskomnadzor would examine whether data transmitted between Russia's users can remain in the country without being rerouted to servers abroad, where it could be subjected to interception.

Of course, this shouldn't come as a huge surprise. Over the past few years, Russia has made a bunch of fairly significant moves leading up to this. In 2014, it passed a new law demanding that user data remain on Russian soil, and threatened multiple US companies for failing to do so. Also, almost exactly two years ago, a top Putin adviser hinted at a similar plan to experiment with disconnecting the country from the internet to see how resilient a domestic Russian internet would be.

So the real question is whether or not this would actually work. Wired has a pretty thorough analysis of just how difficult this might prove for Russia:

“What we have seen so far is that it tends to be much harder to turn off the internet, once you built a resilient internet infrastructure, than you’d think,” says Andrew Sullivan, CEO of Internet Society, a nonprofit that promotes the open development of the internet.

[....]

The process by which it would do so remains challenging. “In short, Russia would need to do two things: Ensure that the content Russians seek to access is actually located somewhere in the country, and ensure that routing and exchanges could all occur domestically,” says Nicole Starosielski a professor at New York University and author of The Undersea Network.

[...]

No matter how much Russia has prepared, however, unanticipated issues will almost certainly arise if it tries to dissever from the rest of the world. “I’m absolutely sure that’s the case. It may not break from the perspective of their major infrastructure grinding to a halt, but that’s a risk that they’re taking,” says Paul Barford, a professor at the University of Wisconsin–Madison who studies computer networking. It’s difficult for internet service providers to know precisely how reliant they are on every piece of infrastructure outside their borders. “Because of the complexity across all levels of the protocol stack, there could be catastrophic failures somewhere,” says Barford.

There's a lot more in the Wired piece, but it certainly suggests that Russia might find it more difficult than it expects -- but I guess that's the reason why the country is considering this as a "test," rather than finding out how well it works out of necessity at some later date. To some extent, this sounds like a nation-state level experiment along the lines of Kashmir Hill's recently journalistic experiment in cutting out the various tech giants, which alone proved to be significantly harder than most people would have expected.

There is, of course, a larger point here. The value and importance of the internet is built quite heavily into the fact that it is a borderless, global network that allows information sharing and communication nearly anywhere. There have, obviously, been some limited challenges to that (China being the most notable), but it still remains mostly true. There have been increasing fears of a "fragmenting" internet, and Russia toying with this "test" only drives home how real that fragmentation may become in the very near future.

Filed Under: data localization, disconnect, fragmentation, internet, localization, russia

Putin's Adviser Says Russia Must Be Ready To Disconnect Itself From The Global Internet

from the death-of-"death-of-geography" dept

Back in November, we wrote about Russia's surprising move to enforce an older data localization law that requires all Internet companies to store the personal data of Russian citizens on Russian soil. At the time, that seemed to be just another example of Vladimir Putin's desire to keep a close eye on everything that was happening in Russia. But a comment from his Internet adviser, German Klimenko, hints that there could be another motive: to make it easier for Russia to cut itself off from the global Internet during a crisis, as The Washington Post reports:

Klimenko pointed out that Western powers had cut Crimea off from Google and Microsoft services after the peninsula was annexed from Ukraine by Russia (the companies were complying with U.S. sanctions on Crimea imposed after Russia's takeover). He suggested that showed why it was necessary for the Russian Internet to work on its own.

"There is a high probability of 'tectonic shifts' in our relations with the West," said Klimenko. "Therefore, our task is to adjust the Russian segment of the Internet to protect themselves from such scenarios." He added that "critical infrastructure" should be on Russian territory, "so no one could turn it off."

Klimenko's comments were made before the US announced its response to claims of Russian interference in the presidential election process. His analysis of "tectonic shifts" in US-Russia relations now looks rather prescient, although US threats to hack back made it a relatively easy prediction. And even though his call for Russia to ensure its critical infrastructure cannot be "turned off" by anyone -- in particular by the US -- may be grandstanding to a certain extent, it is not infeasible.

The Chinese have consciously made their own segment of the Internet quite independent, with strict controls on how data enters or leaves the country. Techdirt reported earlier that Russia was increasingly looking to China for both inspiration and technological assistance; maybe Klimenko's comments are another sign of an alignment between the two countries in the digital realm.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: censorship, fragmentation, great wall, internet, localization, russia

Russia Orders LinkedIn's Service To Be Blocked, Supposedly For Failing To Store Personal Data Locally

from the think-globally,-act-locally dept

Techdirt has written plenty of stories about Vladimir Putin's increasingly harsh clampdown on Internet freedom. But, like China, Russia is still coming up with new ways to tighten its control. One is the legal requirement that the personal data of Russian citizens must be stored on Russian soil. Now, a US company has fallen afoul of that 2015 law:

Russia's communications regulator [Roskomnadzor] ordered public access to LinkedIn's website to be blocked today (17 November) to comply with a court ruling that found the social networking firm guilty of violating data storage laws.

According to the EurActiv story, the ban is being put in place immediately:

LinkedIn's site will be blocked within 24 hours, the Interfax news agency cited Roskomnadzor spokesman Vadim Ampelonsky as saying. One internet service provider, Rostelcom, said it had already blocked access to the site.

What's curious is that LinkedIn is not the only US company to have flouted Russia's data localization law: both Google and Facebook have also ignored it. A post on NBC News suggests the following is the reason for that discrepancy:

A spokesman for the [Roskomnadzor] watchdog had earlier said that LinkedIn was punished for alleged leaks of user data, Russian media reported.

Information about 120 million LinkedIn user accounts was stolen in 2012, the attack reportedly blamed on Russian hackers.

Irrespective of the messy details of the LinkedIn case, requirements that personal data must be stored locally are likely to become an increasingly hot topic. Already, the EU is unwilling to finalize the Trade in Services Agreement (TISA) in part because of US demands that it should include unrestrained data flows -- something that could be illegal under EU privacy laws if applied to personal information.

With the person who will soon run the CIA keen on expanded government spying powers, it is almost certain that the current Privacy Shield framework, which allows the personal data of EU citizens to be sent to the US, will be struck down by the Court of Justice of the European Union. If that happens, the only way companies like Google, Facebook -- and LinkedIn -- would be able to operate in the EU would be to store their data on the continent. If they fail to comply, they won't be blocked, as in Russia, but they could be hit with a fine of up to 4% of their global turnover.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data hosting, localization, russia, tisa
Companies: linkedin, microsoft

How NSA Surveillance May Result In Fragmenting The Internet: EU Court Leaning Towards Ending 'Privacy Safe Harbor'

from the this-could-be-a-mess dept

If you haven't dealt with it, the "EU-US data protection safe harbor" is somewhat confusing to deal with. The basics, however, are that under an agreement between the US and the EU, if US companies wish to transfer data out of Europe and to American servers, they have to abide by this "safe harbor" process, whereby they agree to take certain steps to keep that data safe and out of prying eyes. The process itself is something of a joke (we at Techdirt have actually gone through it to make sure we weren't violating the law -- though I imagine many small American internet companies don't even know it exists). You basically have to pay a company to declare you in compliance, which in reality often just means that the company reviews your terms of service/privacy policy to make sure it has specific language in it. There have been plenty of (potentially reasonable) complaints out of the EU that the safe harbor process doesn't actually do much to protect Europeans' data. That may be true, but the flipside of it isn't great either. Without the safe harbor framework, it's possible that it would be much more difficult for American internet companies to operate in Europe -- or for Europeans to use American internet companies. Some in Europe may think that's a good idea, until they suddenly can't use large parts of the internet.

Either way, the whole safe harbor system has come under attack on a variety of fronts, and it looks close to breaking... all because of the NSA. Max Schrems, who made news back in 2011 by asking Facebook for a copy of all the data it had on him, argued that the NSA's PRISM surveillance program violated EU data protection rules. The European Court of Justice's Advocate General, Yves Bot, has now sided with Schrems and basically said that the NSA surveillance has made the safe harbor process invalid.

The European Court of Justice still needs to come out with its final decision, but it usually (though not always!) agrees with the Advocate General's recommendation. Here, the Advocate General basically says that NSA surveillance has completely undermined the idea that the US can keep Europeans' data safe, and thus the safe harbor cannot stand.

According to the Advocate General, that interference with fundamental rights is contrary to the principle of proportionality, in particular because the surveillance carried out by the United States intelligence services is mass, indiscriminate surveillance. Indeed, the access which the United States intelligence authorities may have to the personal data covers, in a generalised manner, all persons and all means of electronic communication and all the data transferred (including the content of the communications), without any differentiation, limitation or exception according to the objective of general interest pursued. The Advocate General considers that, in those circumstances, a third country cannot in any event be regarded as ensuring an adequate level of protection, and this is all the more so since the safe harbour scheme as defined in the Commission decision does not contain any appropriate guarantees for preventing mass and generalised access to the transferred data. Indeed, no independent authority is able to monitor, in the United States, breaches of the principles for the protection of personal data committed by public actors, such as the United States security agencies, in respect of citizens of the EU.

In short, thanks to indiscriminate mass surveillance by the NSA, we may witness a fractured and fragmented internet. That's a big deal.

The EU Commission and the US have been negotiating for a while to change the EU-US Safe Harbor setup anyway, so it's possible that even if the court follows the Advocate General's suggestion, a new, more acceptable, safe harbor process will be put in place. But, in the short term, this could create quite a mess for the internet. Once again, we see how the NSA's actions, which it claims are to "protect" America could end up doing massive economic damage to the internet.

Filed Under: advocate general, cjeu, data privacy, eu, eu court of justice, eucj, fragmentation, localization, max schrem, nsa, privacy, safe harbor, surveillance

German Data Protection Commissioners Take Action Against EU Data Transfers To US Under 'Safe Harbor' Program

from the more-confrontational dept

We pointed out last year that one of the knock-on effects of Edward Snowden's revelations about massive NSA (and GCHQ) spying on Europeans was a call to suspend the economically-critical Safe Harbor program. Without Safe Harbor, it would be illegal under European law for companies like Google and Facebook to take EU citizens' personal data outside the EU, which would make it more difficult to run those services in their present form. Nothing much happened after that call by the European Parliament's Civil Liberties, Justice and Home Affairs (LIBE) committee -- not least because it does not have any direct power to formulate EU policy -- but the unhappiness with Safe Harbor has evidently not gone away.

Heise Online reports that two of Germany's data protection commissioners -- those for the cities of Berlin and Bremen -- have started proceedings against the transfer of data to the US under the Safe Harbor agreement (original in German.) This seems to represent a hardening of their position. The Heise article quotes another data protection commissioner, this time for the city of Hamburg, as saying that the mood among his colleagues was more confrontational now. Similarly, the commissioner for Berlin commented:

"In my view, Safe Harbor is dead if essential improvements aren't found."

Whether the US authorities will be willing to make of those improvements, or whether they might just hope the European public's dependence on Google and Facebook will prevent drastic action being taken by the EU, remains unclear. Complicating matters still further is a separate argument about whether data flows should be included in the various trade negotiations involving the US and the European Union. The latest move by German data protection commissioners is unlikely to make resolving these issues any easier.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data privacy, data protection, eu, fragmentation, german, localization, safe harbor, us

Russian Law Demanding User Data Remain On Russian Soil Could Turn Into A Ban On Apple Products

from the old-man-rattles-saber-at-cloud dept

The Russian government's efforts to carve out its own internet continue. It's never been shy about its interest in accessing (and censoring) internet users' activity and data, what with its required registration for bloggers, demands for US-based companies to hand over user data and threats to block content stored on foreign servers -- and that's just since the beginning of this year.

A law outlawing the use of offshore servers to store Russian internet users' data and content goes into effect at the beginning of 2015. That means popular products like Apple's iPhone and iPad will all be technically violating Russian law with their automatic iCloud syncing.

This legislation can be partially blamed on the actions of Russia's most famous guest.

As the adoptive home of Edward Snowden, Russia is all too aware that many of its citizens' communications are stored on servers owned by the scary giants of Silicon Valley. Ultimately, the Kremlin is likely to be worried that cloud services offer the NSA a way to snoop on Russian citizens, state apparatchiks and perhaps even high ranking politicians.

The Russian government isn't that concerned about its citizens being spied on by foreign agencies. It probably just hates the competition. But even acts of unbridled self-interest (state apparatchiks, high ranking politicians) occasionally result in net gains for the otherwise ignored public.

This ban will affect all US tech companies, but local coverage seems to imply that iPhone users will be the first to feel the results. The law effectively bans Apple's products unless it switches iCloud services off for Russian users or decides to rent some space on local servers.

This is more Russian government control wearing the outward trappings of NSA backlash. As The Register notes, earlier this year the Russian government demanded Apple and SAP turn over source code, presumably to check it over for surveillance backdoors.

Other countries have announced their intention to purchase network technology and services from non-US companies in the wake of Snowden's revelations, but much of the noise was there to deflect attention away from their own domestic surveillance programs. But in Russia's case, its surveillance/control desires lay much closer to the surface, if not out in the open completely. This law doesn't look much like NSA backlash. It looks like a convenient excuse for government expansion.

Filed Under: cloud, localization, russia, surveillance
Companies: apple