In 1648, the Treaty of Westphalia was signed, ending 30 years of war across Europe and bringing about the sovereignty of states. The rights of states to control and defend their own territory became the core foundation of our global political order, and it has remained unchallenged since.
In 2010, a delegation of countries – including Syria and Russia – came to an obscure agency of the United Nations with a strange request: to inscribe those same sovereign borders onto the digital world. “They wanted to allow countries to assign internet addresses on a country by country basis, the way country codes were originally assigned for phone numbers,” says Hascall Sharp, an independent internet policy consultant who at the time was director of technology policy at technology giant Cisco.
After a year of negotiating, the request came to nothing: creating such boundaries would have allowed nations to exert tight controls over their own citizens, contravening the open spirit of the internet as a borderless space free from the dictates of any individual government.
Nearly a decade on, that borderless spirit seems like a quaint memory. The nations who left the UN empty-handed had not been disabused of the notion that you could put a wall around your corner of cyberspace. They’ve simply spent the past decade pursuing better ways to make it happen.
Indeed, Russia is already exploring a novel approach to creating a digital border wall, and last month it passed two bills that mandate technological and legal steps to isolate the Russian internet. It is one of a growing number of countries that has had enough of the Western-built, Western-controlled internet backbone. And while Russia’s efforts are hardly the first attempt to secure exactly what information can and can’t enter a country, its approach is a fundamental departure from past efforts.
“This is different,” says Robert Morgus, a senior cybersecurity analyst at the New America Foundation. “Russia’s ambitions are to go further than anyone with the possible exceptions of North Korea and Iran in fracturing the global internet.”
Russia’s approach is a glimpse into the future of internet sovereignty. Today, the countries pursuing digital “Westphalianism” are no longer just the usual authoritarian suspects, and they are doing so at deeper levels than ever before. Their project is aided as much by advances in technology as by growing global misgivings about whether the open internet was ever such a good idea to start with. The new methods raise the possibility not only of countries pulling up their own drawbridges, but of alliances between like-minded countries building on these architectures to establish a parallel internet.
What’s wrong with the open internet?
It’s well known that some countries are unhappy with the Western coalition that has traditionally held sway over internet governance. It’s not just the philosophies espoused by the West that troubles them, but the way those philosophies were baked into the very architecture of the internet, which is rather famously engineered to ensure no one can prevent anyone from sending anything to anyone.
That’s thanks to the baseline protocol the 2010 delegation were trying to work around: TCP/IP (transmission control protocol/internet protocol) allows information to flow with absolutely no regard for geography or content. It doesn’t care what information is being sent, what country it’s coming from, or the laws in the country receiving it; all it cares about is the internet address at either end of the transaction. Which is why, instead of sending data across predetermined paths, which might be diverted or cut off, TCP/IP will get packets of information from point A to point B by any means necessary.
It’s easy to dismiss objections to this setup as the dying cries of authoritarian regimes in the face of a global democratising force – but the problems that arise don’t just affect authoritarian regimes. Any government might be worried about malicious information like malware reaching military installations and critical water and power grids, or fake news influencing the electorate.
“Russia and China were just earlier than others in understanding the potential impact that a massively open information ecosystem would have on humans and human decision-making, especially at the political level,” says Morgus. Their view was that a country’s citizens are just as much a part of the critical infrastructure as power plants, and they need to be “protected” from malicious information targeting them – in this case fake news rather than viruses. But this is not about protecting citizens as much as controlling them, says Lincoln Pigman, a Russia scholar at the University of Oxford and a research fellow at the Foreign Policy Centre think tank in London.
A sovereign internet is not a separate internet
Russia and China started talking publicly about the “sovereign internet” around 2011 or 2012, as Russia’s two-year “winter of protest” was beginning to take hold, and as internet-borne revolutions rocked other authoritarian regimes. Convinced that these revolts had been stirred up by Western states, Russia sought to stop disruptive influences from reaching their citizens – essentially creating checks at its digital borders.
But internet sovereignty is not as simple as cutting yourself off from the global internet. That may seem counterintuitive, but to illustrate how self-defeating such a move would be, one need look no further than North Korea. A single cable connects the country to the rest of the global internet. You can disconnect it with the flip of a switch. But few countries would consider implementing a similar infrastructure. From a hardware perspective alone, it’s close to impossible.
“In countries with rich and diverse connectivity to the rest of the internet, it would be virtually impossible to identify all the ingress and egress points,” says Paul Barford, a computer scientist at the University of Wisconsin at Madison, who maps the network of physical pipes and cables through which the global internet runs. Even if Russia could somehow find all the hardware by which information travels into and out of the country, it wouldn’t serve them very well to close these faucets, unless they are also happy to be separated from the world economy. The internet is now a vital part of global commerce, and Russia can’t disconnect itself from this system without mangling its economy.
The trick, it would seem, is to keep some types of information flowing freely while impeding others. But how can this sort of internet sovereignty possibly work, given TCP/IP’s notorious agnosticism?
The leader in separating problematic from authorised internet content has traditionally been China. Its Golden Shield, otherwise known as the Great Firewall of China, famously employs filters to selectively block certain internet addresses, certain words, certain IP addresses and so on. This solution is by no means perfect: it’s software-based, meaning that programmers can design further software to circumvent it. Virtual Private Networks and censorship avoidance software like Tor get around it.
More to the point, the Chinese system won’t work for Russia. For one thing, “it relies heavily on the big Chinese platforms taking the content down”, says Adam Segal, a cybersecurity expert with US think tank, the Council on Foreign Relations, whereas Russia is “more reliant on US social media companies”.
Much of China’s advantage also comes down to the physical pipes its internet is built on. China, suspicious of the new Western technology from the get-go, only permitted very few entry and exit points to be built from the global internet into its borders, whereas Russia was initially quite welcoming of the internet boom and is now consequently riddled with interconnects. China simply has fewer digital borders to keep an eye on.
So, Russia can’t afford to turn itself into a corporate internet. And it can’t replicate China’s approach. Russia is therefore working on a hybrid method that neither relies entirely on hardware nor on software – instead messing with the set of processes and protocols that determine whether internet traffic can move from its origin to its intended destination. Internet protocols specify how all information must be addressed by your computer, in order to be transmitted and routed across the global wires; it’s a bit like how a Windows machine knows it can’t boot up an Apple operating system. This is not one specific thing. “In effect a protocol is a combination of different things – like data, an algorithm, IP address – across different layers,” says Dominique Lazanski, who works on international internet governance and consults on standards development.
One of the most fundamental of these is the DNS standard – the address book that tells the internet how to translate an IP address, for example 38.160.150.31, into a human-legible internet address like bbc.co.uk, and points the way to the server that houses that IP location.
It’s DNS that Russia has been setting its sights on. At the beginning of April, the country was supposed to test a new method of isolating the entire country’s internet traffic so that citizen internet traffic would only stay within the country’s geographical boundaries instead of bouncing around the world. The plan – which was met with skepticism from much of the engineering community, if not dismissed outright – was to create a Russia-only copy of the DNS servers (the internet’s address book, currently headquartered in California) so that citizens’ traffic would be exclusively directed to Russian sites, or Russian versions of external sites. It would send Russian internet users to Yandex if they typed in Google, or the social network VK instead of Facebook.
To lay the groundwork for this, Russia spent years enacting laws that force international companies to store all Russian citizens’ data inside the country – leading some companies such as LinkedIn to be blocked when they refused to comply.
“If Russia succeeds in its ultimate plans for a national DNS, there wouldn’t be any need for filtering out international information. Russian internet traffic would just never need to leave the country,” says Morgus. “That means that the only stuff that Russians – or anyone – would be able to access from inside Russia is information that's hosted inside Russia, on servers physically in the country. That would also mean no one can access external information, whether that is their external cash or whether it's Amazon to buy that scarf.”
Most experts acknowledge that Russia’s primary goal in doing this is to increase its control over its own citizens. But the action may have global consequences too.