On January 30th, Russia’s internet was disrupted for several hours. Specifically, websites using .RU top-level domains stopped loading for Internet users both inside and outside Russia. The incident affected major online companies such as search engine Yandex, social network Vkontakte and e-commerce platform Ozon, as well as the websites of several large banks and online marketplaces. Later, Russia’s Ministry of Digital Development confirmed the experts’ suspicions, stating that the entire .RU domain temporarily lost its DNSSEC (Domain Name System Security Extensions), i.e. used to ensure normal web browsing. It was announced that the digital signature was suddenly broken. Meduza explains how this happened, where RuNet is headed, and why the chaos of Russia’s internet suppression after the invasion of Ukraine gave way to a more consistent online quarantine plan.
Russia’s DNSSEC implements BRB, leaving millions of people wondering what happened
DNSSEC outages typically occur as a result of hacker attacks or domain zone administrator errors. In the case of Russia, observers also speculated that Tuesday’s problems may be related to an experiment by authorities to independently test the usability of Russia’s internet. New information indicates that a technical error was the root cause, and an investigation is ongoing.
The TLD .RU/.РФ Coordination Center, a nonprofit organization that manages the domain’s registry operations and DNS infrastructure, said in a statement on January 31 that the problem was due to a flaw in the software used to create the domain’s encryption keys. I said that there is. “Like any technology solution, DNSSEC must be improved over time to correct detected operational errors,” the Coordination Center explained. At the same time, the group emphasized that DNSSEC technically worked as intended (insofar as domain name resolution requests were blocked when a software flaw prevented the DNS server from verifying the authenticity of the response). .
In other words, the digital signatures did not match, causing a shutdown as per the system’s design.
Tuesday’s DNSSEC had little impact on users of the Russian State Domain Name System, a national infrastructure legislated in late 2019 that replicates the current domain name scheme responsible for routing Russia’s internet traffic. . The premise of the new system is to maintain the normal functioning of the Russian Internet even if the root zone located abroad is disconnected for any reason. In such an emergency, federal regulators have the power to force Russian internet service providers to route traffic to the domestic DNS.
At the same time, this infrastructure has allowed Russian authorities themselves to instigate the isolation of the Russian part of the internet, which Net Freedoms Project researchers believe is currently happening. State officials are not hiding this possibility. Lawmakers like Senator Andrei Krishas have from the beginning described Russia’s national DNS as a companion to other DNS servers that are not limited to emergency situations. It is clear that authorities are interested in increasing traffic to domestic DNS. All requests to domestic DNS go through an agency controlled by Roskomnadzor, the Russian federal censor. This expands the state’s ability to monitor internet browsing data and control the flow of information.
How many paths does RuNet have to take?
Whatever the reason for the January 30th RuNet outage, Russian internet users have also reported other outages in recent weeks. First, his messaging services Telegram and WhatsApp ceased service in the Far East. Then his LTE mobile internet began to fail in St. Petersburg, Pskov, Novgorod and surrounding areas.
Last year, in early July, Russia temporarily shut down its country’s global internet access as part of an exercise mandated by the “Digital Sovereignty” law adopted in 2019. These exercises are supposed to be held every year, and if they had been held in 2023, there would have been nothing noteworthy. Russian authorities did not completely ignore it even in 2022, the first year of a full-scale invasion of Ukraine.
In August 2023, Alexander Amzin wrote in Meduza’s Signal newsletter that the war in Ukraine has accelerated Russia’s internet repression, making the authorities’ actions aimless and chaotic. But almost two years later, the Russian government’s options have been narrowed down to his one question. “Will Russia’s Internet Leave the World Wide Web?”
Of course, Amzin acknowledges that “cyberbalkanization” has already fragmented the Internet into several large, autonomously regulated pieces. He cites technology and media analyst Ben Thompson’s comments about the competition between the four major internet models. namely, the US laissez-faire system, the Chinese model built on information control, the European “rule by regulation” model, and India’s tolerance for foreign digital products but protection “when it comes to the physical layer of technology.” I firmly adhere to my principles. Amzin added to this list the isolated internet models seen in Iran and North Korea, and the hybrid model built in Turkey. In Turkey, local internet remains dependent on popular foreign services, but the state is putting economic pressure on these companies if they promote political instability. free expression.
Since Western countries imposed sanctions after Russia annexed Crimea, the Kremlin has ruled out any development of RuNet that would be compatible with U.S. or European systems (though the Kremlin has said that it has no plans to protect personal data from Silicon Valley). spent several years imitating certain European standards). More recently, as authorities explore an internet model built on Chinese import substitution, Turkish “enforcement measures” and a completely isolated “chebarnet” (more on this term below). , Russia borrows money from other authoritarian states.
Amzin points to giants like Yandex and Vkontakte and argues that Russia has the technological means to create a completely import-substitute internet, but Russia as a domestic market is a big deal for foreign companies. He points out that the company is not making enough profits to dictate conditions externally. world. Amuzin said Turkey’s use of fines to force foreign companies into political compliance would have been “perfect” for Russia had it not been for the invasion of Ukraine (particularly when the topic shifted from democratic values to commercial interests). economic rationality has declined due to the invasion of Ukraine. Kremlin Internet policy decisions.
As a result, Russia is left with only two options: the Chinese model and the Iranian or North Korean model.
“Sheba Net”
Most people around the world may frown in confusion when they hear the word “cheburashka,” but in Russia it is a cultural product that everyone knows. Cheburashka is a fictional character from a children’s book created in the 1960s by Soviet writer Eduard Uspensky, who later starred in his popular stop-motion animated film series.
In April 2014, after the annexation of Crimea, Federal Councilor Maksym Kaujaladze said that Russia had created “its own internal information system” and that “no one else has Cheburashka”. He suggested that we should call him “Cheburashka.” Almost immediately after the news media reported on the senator’s proposal, IT professionals on online forums coined the term “Chebarnet.” These early comments indicate that Russia’s tech community quickly understood that authorities were seeking complete control of the country’s internet, if not global isolation.
Kafjaladze went on to advocate a secure satellite network that would become Russia’s answer to Starlink and OneWeb, but the idea of isolating Russia’s internet would take on a life of its own.
In 2015, the first outline of Chebarnet appeared in a study carried out for the Institute of Internet Development by Igor Ashmanov, a technical expert with patriotic tendencies, who believed that the future of RuNet would be maximized. He asserted that digital sovereignty (no matter what rules the Russian state sets, there is nothing to stop it). like), import substitution, and information security. This change will require Russia to develop its own operating system, software, mobile application ecosystem and, ideally, its own microchip. States will control everything, including user identification, payment systems, social networks, and even gaming services.
Ashmanov’s bold vision for Russia’s internet became less far-fetched as the years went by, until the invasion of Ukraine in February 2022 elevated the internet from visionary to policy.
Reports tailored in English for Meduza Kevin Rothrock
