#DEFCON: How Sanctions Impact Internet Operators

When governments around the world began to impose sanctions against Russia in early 2022 after the invasion of Ukraine, there were many unanswered questions about how to actually implement them for internet operators.

In a session at the DEFCON 30 security conference in Las Vegas, USA, Bill Woodcock, executive director at the Packet Clearing House (PCH), detailed the challenges and the response of internet operators to government sanctions.

Woodcock explained that sanctions are a tool used by governments to impose restrictions on individuals or entities, such as a business or a nation state. While sanctions can be implemented by financial institutions, for example, a bank freezing assets, sanctions also apply to other things, including internet service providers. With the recent imposition of global sanctions against Russia, the question of what internet service providers should do with sanctions when they’re imposed became the topic of debate.

An initial thought coming from some in government was to remove Russia from the internet itself. Woodcock said that a group of 70 internet luminaries including Vint Cert, Steve Crocker and himself sent a letter to government officials explaining why Russia could not be kicked off the internet. That said, there are other actions that internet service providers can and should take to adhere to international sanctions.

How Sanctions Can Work with Internet Service Providers

The idea of restricting or removing access for individuals or businesses is not a new concept for internet governance.

Woodcock noting that service providers have long had the ability to block the routing of a specific IP address, in response to a terms of service or other violation. Domain registries can also take actions against specific domain names, as necessary.

“If somebody is spamming or running a botnet, we’ve got a lot of experience with tracking these things, figuring out what the associated resources are, and shutting them down,” Woodcock said. “This is no different, it’s exactly the same problem set, it’s just a different definition of badness. It’s not our internet definition of badness, it’s a general human rights and international law definition of badness.”

The difficult part for many internet service providers, however, is having a digital, machine readable format of entities and individuals that have been legally sanctioned by a government. To that end, the Internet Sanctions Project has been launched. Woodcock explained that the project is all about having a definitive set of resources that aligns internet service providers and governments on the issue of sanctions.

“The internet service providers want to be in compliance with the law, they don’t want to get prosecuted or sued,” Woodcock said. “Governments want to be able to define a sanction and have it enacted by the private sector as intended.”