The Internet shouldn’t become a battleground. The Internet Society has been saying this for years. More recently, we called upon stakeholders to make sure that the sanctions imposed on Russia as a result of its invasion of Ukraine do not impact the global Internet infrastructure.
We’re not alone. The G7 made similar declarations, stating that access to Internet infrastructure is exempt from sanctions, and companies can continue to operate in these sectors in Russia. We hope that all other nations, including all nations involved in conflict, will also implement this declaration.
High-Stake Questions
The war in Ukraine raises a number of questions. How and why does the war impact the Internet? What sort of data is available that can help us understand what’s happening? Will the war have a lasting impact on the underlying fabric of the Internet?
To answer these questions, we used the data collected by organizations around the world to publish a series of blog posts on Internet Society Pulse. Here’s what we found.
- OONI Data: Looking For Anomalies and Blocks (24 March): Using data collected by our data partner, OONI, we saw that the number of anomalies on Russian networks increased in the early days of the war. Anomalies are signs of potential network interference, such as the blocking of a website or app. This indicated that more and more websites and apps in Russia were being blocked or could not be accessed.
- QUIC vs TLS on Russian Networks (25 March): TLS1.3 and Quic are two protocols that enable encryption on the Internet. Around the end of February, using Cloudflare Radar data, we saw that some Russian networks were clearly filtering QUIC traffic, after which browsers usually fell back to using TLS1.3. We speculated that the blocking of QUIC could be part of a system that the Russian government is using to apply selective filters to content that is deemed inappropriate.
- Where Are Russian Networks Being Disconnected? (28 March): As the sanction regimes were being implemented, many providers stopped providing services to their Russian customers, often as a consequence of economic sanctions. We looked at this from the perspective of Internet Exchange Points (IXPs) because these usually have an impact on latency, as well as on the actual economic cost of sending traffic. We saw that some Russian Internet Service Providers (ISPs) were being disconnected from key IXPs. This reduced the number of direct routes that they could use to send traffic, which impacted latency and increased transit costs.
- A Small Hijack of Twitter’s Space and the Role of RPKI (29 March): A Russian network operator briefly hijacked Twitter’s presence in the global routing system. The speculation around this incident was that the operator was trying to set up an internal Border Gateway Protocol (BGP) announcement to redirect all traffic intended for Twitter. But this announcement—only meant to remain on the internal networks—was leaked and then propagated to the rest of the Internet. The hijack did not cause the havoc that it could have because of the widespread adoption of a routing security practice called RPKI route origin validation. This demonstrates how important it is that stakeholders take routing security practices seriously and that initiatives like MANRS can make a difference during conflict.
- Top Categories for New Russian Internet blocks (OONI Anomalies) (30 March): We found that the censorship of websites on Russian networks had increased as the war progressed. There were also indications that the overall quality of the Russian Internet had deteriorated, with some increase in failures to load suggesting an increase in the background of network congestion.
- Investigated Internal Hijacks for Content Providers on Russian Networks (1 April): Is using routing attacks to censor social media Russia’s method of choice? It seems that this is the case, but this method is not always that effective.
- M-Lab Speedtest: What’s Going on in Ukraine? (6 April): As the war progressed into its seventh week, we turned our eye to Ukraine. Ukraine’s Internet seems to be quite resilient. After an initial dip, the measurement probes—the computers and smartphones with the M-Lab probes installed to run measurement tests—came back online. Since the measurements are run by end users, the M-Lab dataset can provide some useful insights on the situation on the ground by analyzing the changes in the metrics collected.
Watch our timeline of events since the war started on 20 February:
Internet Resilience Is Key to Keeping People Online
As we enter the third month of war, it is still difficult to draw any hard conclusions about the state of both the Ukrainian and Russian Internet from this data. Will the blocking of the QUIC protocol lead to the Russian Internet’s ossification—when technology freezes in place and innovation stops?
Will the bad practice of content blocking based on route hijacks be contained to Russia. If not, what will be the effect on the global Internet? The Ukrainian Internet has shown amazing resilience so far, partly due to the Internet’s distributed architecture. Will it keep up that resilience, or will there be a tipping point where it is unable to do so? We’ll keep analyzing the data to find out.
The Internet is, among other things, an instrument for peace. Everyone, everywhere should have access, regardless of their government’s actions.
Join us as we continue to observe and monitor the Internet, to protect it for the future.
Image credit: Hans Isaacson on Unsplash