Russia’s Digital Underground

MOSCOW — On March 26, a village school in a distant Russian region in Eastern Siberia, only few kilometers from the Mongolian border, was raided by the authorities. A team of FSB agents with the support of a local prosecutor’s office rushed into the school in Kochetovo village in the Tuva republic. Were these agents of the state hot on the trail of terrorists, Mafiosi, or drug smugglers? No, they were there to check on a software update, specifically whether the school’s computers were outfitted with filtering software to prevent access to banned websites.

They shortly found out that the software was installed, but did indeed have some gaps: one of the agents typed in "How to make a bomb" on Yandex, Russia’s most popular search engine, and got back 13 million links. Kavkaz Center, the Chechen rebels’ propaganda website, also turned out to be accessible. The inspection team also reported that sites with instructions for making a smoking blend were accessible. As a result, a lawsuit was filed by the local prosecutor and the school’s director Andrei Oyun was fined. (Russian legislation makes responsible the organizations that provide access, not Internet service providers.) But forget who takes the blame — the real concern is that Moscow, even in the far outer reaches of the country, is tightening the screws on the web.

The principle of Internet censorship is not a new one to Russian authorities. For at least five years, regional prosecutors have implemented court decisions requiring Internet providers to block access to banned sites accused of extremism. But this has not been done systematically: sites blocked in one region remained accessible in others.

The Single Register, officially introduced on Nov. 1, 2012, aimed to solve this problem. Three government agencies — the Roskomnadzor (the Federal Service for Supervision of Communications), the Federal Antidrug Agency, and the Federal Service for the Supervision of Consumer Rights and Public Welfare — submit data for the government’s black list of sites. Service providers are then required to block access to sites within 24 hours of their blacklisting on the Single Register.

Since November 1, hundreds of websites have been banned from the Russian Internet. The list includes websites ranging from text taken from William Powell ‘s The Anarchist Cookbook to the lighthearted Australian viral YouTube hit "Dumb Ways to Die." The law has had offline consequences as well. Institutions providing public access to the Internet — schools, libraries, Internet cafés, and even post offices — have been targeted for law enforcement inspections to check whether their computers have special software to prevent access to banned websites.

The introduction of national Internet filtering was one of the measures the Kremlin adopted in response to the Arab Spring as well as the street protests that erupted following last year’s controversial Russian presidential election. To the Kremlin and the security services, these events served as proof that social networks were another tool created by the United States to topple regimes in the countries where the opposition is too weak to mobilize protests. "New technologies are used by Western special services to create and maintain a level of continual tension in society with serious intentions extending even to regime change…. Our elections, especially the presidential election and the situation in the preceding period, revealed the potential of the blogosphere," said the FSB First Deputy Director Sergei Smirnov on March 27, 2012, at a meeting of the Regional Anti-Terrorist Structure within the Shanghai Cooperation Organization.

This assumption has come to define the Kremlin’s approach to the Internet both in Russia and abroad. At home, the Kremlin’s introduction of the national black list was accompanied by the deployment of new surveillance technologies to monitor social networks and the Internet as a whole. In August 2012, at a meeting organized by the Ministry of Communications, a working group of representatives of the country’s biggest telecom companies concluded that the only way to implement the law which established the Single Register was through deep packet inspection (DPI) technology, which allows Internet service providers to peer into people’s Internet traffic and read, copy, or even modify e-mails and webpages. DPI also helps identify users — what is downloaded by whom, and who looked for what on the Internet. By late fall 2012, all the biggest telecoms in Russia had DPI operational on their networks.

This effort also built on earlier initiatives. Russia’s security services started buying special software from companies such as Analytic Business Solutions, SyTech, iTeco, and Medialogia for monitoring in the mid-2000s. The most famous example was in 2006, on the eve of the G8 summit in St. Petersburg, when the Interior Ministry bought a "Random Information Collection System" from the Russian software company Smartware — as a precaution, it claimed, against extremism. Now dozens of Russian companies supply software to monitor the activities of opposition groups — or anyone, theoretically — in social networks. 

There’s evidence these efforts may be going beyond Russia’s borders. In August, Kommersant reported that the Foreign Intelligence Service, or SVR, is developing software that will let it secretly manipulate social media. Once developed, the software could allow SVR personnel to monitor social networks, but also spread propaganda abroad. Reports suggest these efforts will mainly be aimed at other countries in the Commonwealth of Independent States and Eastern Europe.

So far, the government has proven adept at getting major international websites to comply with its directives: Google removed the controversial The Innocence of Muslims video from YouTube on December 26, Twitter blocked an account that promoted drugs on March 15, and on March 29, Facebook took down a page called Club Suicide rather than see the entire network blacklisted.

All of these efforts add up to a larger philosophical and operational aim: the Kremlin intends to establish a system of state sovereignty within cyberspace, with clearly delineated virtual borders. At the International Telecommunication Union (ITU) conference in Dubai last December, Moscow made efforts to convince the international community to hand over the functions of managing the distribution of domain names and IP-addresses to the ITU. Up until now this has been the responsibility of non-profit organizations based in the United States, organizations that by and large hold information freedom paramount. While the U.S. government exercises little influence over these groups, Russia views the Internet as a vertical hierarchical structure under the control of one country, the United States, and it aims to take some of that power back.

The Russian delegation to the conference proposed limiting the right of access to the Internet in such cases where, "telecommunication services are used for the purpose of interfering in the internal affairs or undermining the sovereignty, national security, territorial integrity and public safety of other states, or to divulge information of a sensitive nature." The Russian proposals were supported by China
and 87 other countries, but not the United States or Europe. But Moscow does not intend to let the matter rest. "We could return to that issue at the coming G8 Summit," Andrey Krutskikh, a special coordinator for information technologies in the Foreign Ministry, told us.

Russia’s vision of a bordered Internet probably won’t come to pass, but that won’t stop it from stepping up its controls domestically. The worst-case scenario isn’t quite the creation of a national firewall, modeled after China’s, as it’s unlikely that the Kremlin could do this in practice. But the Russian government could conceivably launch a campaign to bring the world’s most popular global web platforms such as Gmail, Facebook, or Twitter under Russian jurisdiction — either requiring them to be accessible in Russia in the domain extensions under government control (.ru, .su, etc.) or obliging them to be hosted on Russian territory.

"The option that some [global] resources will be obliged to establish Russian representative offices is plausible. I think many companies could agree to this. After all, the Russian Internet market is one of the largest in Europe." said Karen Kazaryan, chief analyst at the nonprofit Russian Electronic Communications Association. If this were to happen, such services would then be subject to local legislation and forced to build in backdoors for monitoring or manipulation by the secret services.

For a long time, Russians enjoyed complete freedom online. In the 1990s and 2000s, Russian officials claimed repeatedly they would never adopt the Chinese approach to Internet censorship. But the Kremlin’s fear of the rise of political activism on the Internet and of the protests that gripped Moscow last year must be palpable. If a school in a Siberian village can get raided by the famously cumbersome Russian bureaucracy, what’s next?