Is the Russian Internet a Lost Cause?

This article originally appeared in Future Tense, a collaboration among Arizona State University, New America, and Slate.

Two weeks ago, thousands of Russians took to the streets to protest the passage of a law that puts in motion an earlier plan to build an isolated, domestic internet. Moscow police reported 6,500 protesters in attendance, but other estimates put the count at more than 15,000. This makes it one of the largest protests in recent Russian history.

Under President Vladimir Putin and the current Kremlin, politically, the Russian internet—sometimes called the Runet—is a lost cause. The Runet consistently rates poorly on metrics of freedom and openness, thanks to a combination of self-censorship and intimidation underpinned by highly restrictive speech and expression laws as well as pervasive and overt telecommunications surveillance.

But the internet in Russia will outlast the Putin regime. So what happens to the Russian internet after Putin? If the character of governance in Russia were to undergo a massive shift, could new leadership just remove draconian policies and return the internet to its intended state—global, interoperable, and free? If Putin and his associates were pushed out of office right now, that could happen. Today, the actual construction of the Runet—its architecture—largely resembles that of the global internet. But the next few months and years could radically change the backbone of the Runet. Going back would be a huge technical challenge. It also may hasten the fragmentation of the global internet.

Internet fragmentation is already occurring in many places and ways. Certain websites, like those depicting President Xi Jinping as Winnie the Pooh, are inaccessible in China. The U.K. has set up a system to block malicious traffic coming into the country. South Korea has taken stepsto filter out or remove harmful content like revenge porn. But these sorts of policies tinker with the fringes of the internet and don’t alter its underlying functionality. The fragmentation is superficial, not fundamental.

What Russia is trying to do is different. Where others have made alterations that fragment the content layer of the internet, Russia is attempting to push fragmentation into the network layer, the set of processes and protocols that help move internet traffic from its origin to its intended destination. Creating a parallel network infrastructure will be a challenge, but it is not impossible. And once it happens, keeping the internet local becomes a relatively simple matter of instructing internet service providers and exchange point operators to alter routing protocols.

Since 2014, the Kremlin has considered configuring the Runet in a way that would enable the government to unplug it from the global internet. It said that it wanted the ability in the event of an “emergency,” like a major cyberattack from a foreign power. But the steps Russia has taken suggest that it isn’t only interested in building up its cybersecurity. It wants broader control of the internet and what its people do online. The past few years have seen steady passage and implementation of laws toward that end. In July 2014, the Russian parliament passed a law requiring websites with data on Russian citizens to store it within the country. In 2016, a new law required telecommunications and internet companies to keep all communications for six months, and another banned virtual private networks. In late 2017, the Kremlin announced that it would attempt to create a national domain name system, which would require that content be hosted on servers located in Russia. In December, in response to an “aggressive” U.S. cybersecurity strategy, the lower chamber of the Russian legislature passed a law that authorizes Rozkomandzor, the Russian internet regulator, to consolidate control over key internet infrastructure, like IXPs and ISPs, in the case of an emergency. Just this month, the Kremlin announced plans to restrict who can own and control satellite ground stations in Russia.

Together, these actions localize internet content and internet routing, with a view toward enabling the Russian government to disconnect the Runet from the global internet entirely.

Despite the Kremlin’s claims that it just wants to protect the country, the likelihood of the U.S. knocking all of Russia offline via a cyberattack is low. Even if it were doable, it’s unlikely it would be in the interest of the U.S. to do so, especially given the U.S. Cyber Command’s capacity to target and disconnect specific entities. But the narrative about needing an isolated, domestic internet fits with Putin’s claims that the internet is a CIA project and the Kremlin’s broader view of the internet as a threat to state security that must be controlled.

Hence the plans to route up to 95 percent of Russian internet traffic domestically by 2020. That would be an enormous increase: In 2017, foreign servers reportedly handled 60 percent of Russian internet traffic. In order to do so, Russian policymakers have had to figure out ways to store all the internet content Russians would try to access within the country and ensure that all of the requests to access that content are routed via infrastructure in Russia. Early steps, like restrictive freedom of expression and data storage laws, enacted largely superficial changes to the internet. But to really achieve the dual goals of local routing and storage, Russian policymakers would have to force changes on the internet’s infrastructure, which, once enacted, would be difficult to reverse. The combination of the national DNS, the December law, and the policy directive around satellite ground stations is setting the wheels in motion to do just that.

The open question is just how much progress Russia has made on implementing the meat of those proposals. It reportedly plans to test full disconnection in an exercise scheduled for April 1. Should that experiment fail, it will underscore the difficulty of near-total isolation from the global internet. If it succeeds, it will show that the Russians have taken the technical steps to back up their policy rhetoric. It will codify changes to the Russian internet at a level that is difficult to quickly reverse. And it will also prove the feasibility of a technical concept that despots around the world may desire to emulate.