As Russia continues to develop and foster what it terms "internet sovereignty," it could eventually adopt similar infrastructure and integrate with the networks of other like-minded countries, such as China. While the development of sovereign internet structures would restructure the global internet to some degree, it would not necessarily affect its functionality at the core level. However, the additional independence and protection that accompany sovereign internet structures could ignite more state competition in the digital world, hampering global efforts to establish global norms on cyberspace.
Since its inception, the free-for-all nature of the global internet has defied the most robust forms of state control, but perhaps not for much longer. By April 1, the Russian government is expected to conduct a countrywide test of its ability to disconnect its internet infrastructure from the rest of the world's, following the Duma's passage of a draft law last month mandating changes to the country's internet infrastructure, Runet. While a test that actually disconnects the Russian web from the rest of the global internet may or may not eventually take place, one thing is certain: Russia is making significant changes to create infrastructure and a legal framework for what it terms a "sovereign internet." In essence, Russia hopes to develop a domestic intranet that can operate independently from the rest of the world, thereby giving it the opportunity to both protect online traffic — and go on the offensive against foreign internet traffic, if necessary.
The Big Picture
The divisions between Russia and the West have become more pronounced in recent years in a variety of fields, including, now, the cyber domain. Much as in the physical world, where Moscow has been developing a military deterrence and pursuing economic independence from the West to withstand threats and sanctions, Russia is shaping its internet infrastructure so that it can deal more effectively with internal challenges to its centralized rule, as well as external threats in the form of interstate competition.
The Quest for an Independent Internet
The idea for a sovereign internet emerged in China, but Russia has now taken the lead in developing the actual infrastructure needed to realize such plans. A sovereign internet differs slightly from existing control systems, such as North Korea's countrywide network, which is entirely disconnected from the global internet. And while sovereign internet systems bear some semblance to the "Great Firewall of China," or the control mechanisms that Iran has implemented — particularly in terms of the control of data flows in and out of the country — their aim is not simply to grant authorities control over internet access in a particular geographic area. Instead, the real target is to provide the state with the means to exercise the same level of sovereignty in the digital realm as it does in the physical world. In such a situation, the state assumes direct control over the internet infrastructure on its soil, allowing it to defend its systems from external attacks — much like states aim to guarantee their territorial integrity in the physical domain.
Sovereign internet infrastructure, moreover, allows states to reduce their dependence on foreign organizations that have assumed responsibility for its functions. Currently, the U.S.-based nongovernmental association ICANN manages the infrastructure that underpins the global internet. For Russia and China, this situation presents a liability since the organization — independent though it may be of the U.S. government — could become vulnerable to Washington's interference. Ultimately, the concept of a sovereign internet rests heavily on the idea that there should be equality among states in providing foundations for the internet's core functions through direct control over Domain Name System (DNS) servers, which essentially direct all traffic online.
For Russia, of course, this is not simply a principled quest for equality in internet infrastructure. Moscow has very real and practical goals in mind as it considers changes in the operation of Runet. Given the growing rifts between Moscow and the West — and particularly amid the increasing focus on the cyber domain — Russia is concerned about the vulnerability of its domestic infrastructure to large foreign cyberattacks. In the end, a more independent infrastructure, as well as the ability to maintain some level of functionality domestically when severing connections with the outside world, provides a blunt, yet effective, defense against such threats.
At the same time, information security is central to Moscow's efforts regarding Runet. Due to the inherent nature of the internet, online correspondence between Russian citizens and entities often leaves Russia's domestic infrastructure, raising the risk — as far as Moscow is concerned — that foreign powers could snoop on or disrupt such exchanges. Thus, as it redesigns its internet infrastructure to address such threats, Moscow is also seeking to ensure that digital communications or data transfers between Russians do not leave the country's domestic infrastructure.
Naturally, controlling the flow of data in and out of Russia also assists the government on another major concern: countering domestic political opposition. In the past, Russia has attempted to block the use of messaging services like Telegram, which anti-government activists have used to evade state surveillance, on the grounds that it facilitated terrorism, but these interdictions have been crude, resulting in major disruptions to other services. Accordingly, the reconfiguration of the Russian internet could make Moscow's task of denying them access to foreign-hosted services much easier.
Russia's quest for a sovereign internet is part and parcel of its efforts to insulate itself economically in response to the Russia-West standoff that began in 2014. On an even more global level, Russia's actions also exemplify a broader effort by states to regulate the internet and establish common norms on behavior in cyberspace; the European Union, for one, has attempted to move forward on this front by enacting regulations on the General Data Protection Regulation to protect privacy. The establishment of a Russian sovereign internet ultimately touches upon a much broader dynamic — sovereignty over cyberspace, which raises the question of what rights countries have in the digital realm.
The concept of a sovereign internet rests heavily on the idea that there should be equality between states in providing foundations for the web's core functions.
The Nuts and Bolts of an Independent Internet
One of the core elements of Russia's push to develop an independent internet infrastructure revolves around the functioning of the DNS servers that are a key component of the global internet infrastructure. These servers function as centralized directories that connect internet users with their intended destination. When someone attempts to visit a website or connect to an online service, DNS servers function as a high-level phonebook for internet domains. This means that when trying to connect to a service on the Russian .ru domain, the DNS servers will provide information on the location of the more detailed .ru registries to foster a connection.
While hundreds of DNS servers and mirrors (which reflect the former's datasets, thus improving capacity) are located in Russia and around the world, ICANN has centralized the management of this directory. Updated directories are distributed from one root server to the others before proceeding to a multitude of mirrors. But Russia is concerned that if the United States, for example, sought to remove the .ru domain from these directories, Moscow would have no direct control over the constellation of DNS servers to prevent it. In the past, Russia and China have tried to bring the management of the DNS system under the auspices of the United Nations, where they wield greater influence, but ICANN's assumption of responsibility for these monitoring tasks — instead of the U.S. government's — has precluded that effort. Whatever the case, the prospect of the .ru domain's erasure is remote, as the organizations sustaining the global internet infrastructure would unlikely tolerate any politicization of the domain directory.
Ultimately, Russia feels as if it must develop its own DNS infrastructure that it controls directly, both because it would be unable to rely on the global DNS infrastructure if it willingly disconnected from the global internet and because it wishes to prevent the unlikely event of anyone tampering with DNS functionality through the current structure to its detriment. In such a scenario, Russia's own independent DNS servers would continue to operate as intended and facilitate internet functionality within Runet alone, even if the .ru domain lost connection with the rest of the world.
Many, however, fear that such moves could balkanize the internet, replacing the current centralized and homogenous DNS infrastructure with separate groups of competing DNS networks. While this could occur if the trend of implementing sovereign internet infrastructure spreads to different countries, it would be unlikely to impede the functionality of the internet as a whole. After all, the very goal of creating independent DNS infrastructure is to impose sovereignty on domestic network infrastructure, all while maintaining compatibility with the rest of the worldwide internet.
What Happens in Russia Stays in Russia
Russia, meanwhile, has also enacted some legislation (and is proposing more) to force large service providers like Google, Facebook, Twitter and others to physically locate their servers or data centers within Russia. This effort is central to Russia's attempts to keep Russian internet traffic within the country, while also subjecting these operations to national legislation.
The very structure of Runet might already facilitate Russian cyberwarfare activities.
Internet service providers operating within Russia, for example, are required by law to provide a surveillance suite that allows Russian authorities to intercept online communications. By keeping all internet traffic among Russian entities contained in the country, the government will guarantee its ability to intercept all communications, reinforcing its internal security capabilities. In response to the rise of satellite-provided internet that threatens this capability, Moscow enacted a law that obligates all providers of such services in the country to establish Russian-based ground stations that would relay all traffic. Accordingly, even internet over the airwaves would fall under the purview of the system of surveillance that the Russian state has developed.
Such measures, however, are also designed to allow Runet, as much as possible, to operate independently. This means that while Russia hones its ability to conduct surveillance over Russian internet traffic, it also reduces the chances for others to do so. Furthermore, in the extreme event that Runet lost its connection with the rest of the world, it would still retain a large degree of functionality to continue operating in isolation in Russia. Without question, however, such an event would still be highly disruptive to Russia itself, as internet usage drawing on services located outside the country would no longer be able to function. In such a situation, the economic consequences could be vast.
Escalation in the Cyber Domain
Russia's exertions to create a sovereign internet, meanwhile, could also increase the feasibility of large-scale cyber offensives. Russia's very ability to disconnect itself from the rest of the world is not only a defensive measure shielding the country from the rest of the world, but also something that could allow Moscow to theoretically disrupt the global internet infrastructure to a significant degree while insulating itself from the aftereffects. In reality, however, such an act would be tantamount to economic suicide, meaning it would likely only occur in prelude to a war or as an act of desperation. As long as Runet is intertwined with the global internet infrastructure, an attack of that magnitude would damage Russia as much as it does others.
But it's not just a Russian disconnect and an attack against global internet infrastructure that could result in an escalation between Moscow and the rest of the world. The very structure of Runet might already facilitate Russian cyberwarfare activities and afford Moscow more room to invoke plausible deniability. Shielding all Russian internet activity on Russian-controlled DNS servers would significantly impede the investigation of malicious cyberactivity when attacks do occur. International investigators might still be able to point the finger at Russia following such attacks, but the isolation of Runet would complicate their efforts to assign responsibility to specific entities inside the country. Equally, forces outside Russian infrastructure would find it much more difficult to directly target separate Russian entities online.
Beyond the potential for an escalation in cyberactivity this added degree of protection provides, this infrastructure also gives Moscow a greater opportunity to repress internet activity within Russia. Moscow has been conducting a constant battle to block certain internet services, such as Telegram, that it has dubbed a threat to stability. As countries attempt to block such services, however, creative minds invariably find ways around the barriers. Developing the ability to sever Runet from the global internet infrastructure, accordingly, provides the ultimate response. While a scorched earth operation — internet style — would also disrupt a significant share of non-hostile foreign internet usage, it could provide Russia with a last-ditch defense in the event of an uprising against the government. In the end, a sovereign internet offers Russia a route to greater political stability — particularly as it would grant it greater control over the heretofore unruly web — and more resilience in the face of outside pressure. Given that, it's a prospect that Moscow is unlikely to pass up.
No comments:
Post a Comment