Translation of directive to NOGs in Russia
Hi all, The attached document came to me with a note saying that non-compliance comes with a EUR 5000 fine starting this month. CDT has shared this document widely and made the statement to the press that, "Under penalty of a fine, telecommunications networks and autonomous systems in Russia are now obliged by the state to follow a specific set of instructions for network configuration. The new requirements effectively implement Russia’s National Domain Name System (DNS), described in legislation referred to as 'Russia's Sovereign Internet Law' that was passed in 2019. Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic. This has implications for the global governance of the DNS, a core component of the internet. The change to the internet within the borders of Russia creates a 'splinternet', and makes internet shutdowns within the country easier." I'll note that while it gives operators the choice to replace or_add_ the "root," that this would lower the bar significantly for national internet shutdowns. As I noted in the Rogue RSO WP call, this comes at an auspicious time for the WP's document to have a direct application. I'll be reviewing the document with this case in mind. Always interested in your expert takes if you'd like to share, -Mallory -- Mallory Knodel CTO, Center for Democracy and Technology gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780
Thanks for letting us know. Yes, I am unaware of any evidence that the Russian root server would download from IANA, or would in any other sense serve the root in the same way that the existing services do.
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Hi all,
The attached document came to me with a note saying that non-compliance comes with a EUR 5000 fine starting this month. CDT has shared this document widely and made the statement to the press that, "Under penalty of a fine, telecommunications networks and autonomous systems in Russia are now obliged by the state to follow a specific set of instructions for network configuration. The new requirements effectively implement Russia’s National Domain Name System (DNS), described in legislation referred to as 'Russia's Sovereign Internet Law' that was passed in 2019. Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic. This has implications for the global governance of the DNS, a core component of the internet. The change to the internet within the borders of Russia creates a 'splinternet', and makes internet shutdowns within the country easier."
I'll note that while it gives operators the choice to replace or_add_ the "root," that this would lower the bar significantly for national internet shutdowns.
As I noted in the Rogue RSO WP call, this comes at an auspicious time for the WP's document to have a direct application. I'll be reviewing the document with this case in mind.
Always interested in your expert takes if you'd like to share, -Mallory
-- Mallory Knodel CTO, Center for Democracy and Technology gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780 <Instructions for telcos to connect to NDNS v3.pdf>_______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
To some extent, the document reads like they're doing RFC8806-ish at a national scale. On Mon, Mar 1, 2021 at 1:25 AM Fred Baker via rssac-caucus < rssac-caucus@icann.org> wrote:
Thanks for letting us know. Yes, I am unaware of any evidence that the Russian root server would download from IANA, or would in any other sense serve the root in the same way that the existing services do.
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus < rssac-caucus@icann.org> wrote:
Hi all,
The attached document came to me with a note saying that non-compliance comes with a EUR 5000 fine starting this month. CDT has shared this document widely and made the statement to the press that, "Under penalty of a fine, telecommunications networks and autonomous systems in Russia are now obliged by the state to follow a specific set of instructions for network configuration. The new requirements effectively implement Russia’s National Domain Name System (DNS), described in legislation referred to as 'Russia's Sovereign Internet Law' that was passed in 2019. Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic. This has implications for the global governance of the DNS, a core component of the internet. The change to the internet within the borders of Russia creates a 'splinternet', and makes internet shutdowns within the country easier."
I'll note that while it gives operators the choice to replace or_add_ the "root," that this would lower the bar significantly for national internet shutdowns.
As I noted in the Rogue RSO WP call, this comes at an auspicious time for the WP's document to have a direct application. I'll be reviewing the document with this case in mind.
Always interested in your expert takes if you'd like to share, -Mallory
-- Mallory Knodel CTO, Center for Democracy and Technology gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780 <Instructions for telcos to connect to NDNS v3.pdf>_______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
_______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
-- Wes Hardaker USC/ISI
On Sat, Feb 27, 2021 at 11:12:53PM -0800, Fred Baker via rssac-caucus wrote:
Thanks for letting us know. Yes, I am unaware of any evidence that the Russian root server would download from IANA, or would in any other sense serve the root in the same way that the existing services do.
see also: <<Note well: I have personally reached out to operators inside the BRICS countries (Brazil, Russia, India, China, South Africa) to ensure that they know about the Yeti-DNS project, and can participate if they so choose. This reflects my view that if some country decides some day that ICANN cannot be trusted, and they want to create their own Internet DNS system, I want them to have the necessary expertise and competence and awareness of tradeoffs, in-country, to pursue their own sovereign course. If asked, I would advise such countries that any such independence would be nasty, brutish, and short. But I will not pretend that they have to listen to me.>> (vixie, 2016) https://www.circleid.com/posts/20160330_let_me_make_yeti_dns_perfectly_clear... i am very interested in how the russian internet law will affect the anycast instances in russia that f-root and others operate there. the regime may feel that they can demand the russian root zone file be used, and if refused, may feel that they can simply bogart the address space of the real root servers. vixie re:
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Hi all,
The attached document came to me with a note saying that non-compliance comes with a EUR 5000 fine starting this month. CDT has shared this document widely and made the statement to the press that, "Under penalty of a fine, telecommunications networks and autonomous systems in Russia are now obliged by the state to follow a specific set of instructions for network configuration. The new requirements effectively implement Russia???s National Domain Name System (DNS), described in legislation referred to as 'Russia's Sovereign Internet Law' that was passed in 2019. Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world???s internet traffic. This has implications for the global governance of the DNS, a core component of the internet. The change to the internet within the borders of Russia creates a 'splinternet', and makes internet shutdowns within the country easier."
I'll note that while it gives operators the choice to replace or_add_ the "root," that this would lower the bar significantly for national internet shutdowns.
As I noted in the Rogue RSO WP call, this comes at an auspicious time for the WP's document to have a direct application. I'll be reviewing the document with this case in mind.
Always interested in your expert takes if you'd like to share, -Mallory
-- Paul Vixie
As of this point, AFAIK the Russians have not done anything to F Root, or any other RSO. That's not to say that they can't or won't, but to my knowledge they haven't.
On Mar 1, 2021, at 9:27 AM, Paul Vixie via rssac-caucus <rssac-caucus@icann.org> wrote:
On Sat, Feb 27, 2021 at 11:12:53PM -0800, Fred Baker via rssac-caucus wrote:
Thanks for letting us know. Yes, I am unaware of any evidence that the Russian root server would download from IANA, or would in any other sense serve the root in the same way that the existing services do.
see also:
<<Note well: I have personally reached out to operators inside the BRICS countries (Brazil, Russia, India, China, South Africa) to ensure that they know about the Yeti-DNS project, and can participate if they so choose. This reflects my view that if some country decides some day that ICANN cannot be trusted, and they want to create their own Internet DNS system, I want them to have the necessary expertise and competence and awareness of tradeoffs, in-country, to pursue their own sovereign course. If asked, I would advise such countries that any such independence would be nasty, brutish, and short. But I will not pretend that they have to listen to me.>> (vixie, 2016)
https://www.circleid.com/posts/20160330_let_me_make_yeti_dns_perfectly_clear...
i am very interested in how the russian internet law will affect the anycast instances in russia that f-root and others operate there. the regime may feel that they can demand the russian root zone file be used, and if refused, may feel that they can simply bogart the address space of the real root servers.
vixie
re:
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Hi all,
The attached document came to me with a note saying that non-compliance comes with a EUR 5000 fine starting this month. CDT has shared this document widely and made the statement to the press that, "Under penalty of a fine, telecommunications networks and autonomous systems in Russia are now obliged by the state to follow a specific set of instructions for network configuration. The new requirements effectively implement Russia???s National Domain Name System (DNS), described in legislation referred to as 'Russia's Sovereign Internet Law' that was passed in 2019. Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world???s internet traffic. This has implications for the global governance of the DNS, a core component of the internet. The change to the internet within the borders of Russia creates a 'splinternet', and makes inte rnet shutdowns within the country easier."
I'll note that while it gives operators the choice to replace or_add_ the "root," that this would lower the bar significantly for national internet shutdowns.
As I noted in the Rogue RSO WP call, this comes at an auspicious time for the WP's document to have a direct application. I'll be reviewing the document with this case in mind.
Always interested in your expert takes if you'd like to share, -Mallory
-- Paul Vixie _______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic.
I'm sure everyone here on RSSAC Caucus knows this, but "root servers that route most of the world’s internet traffic" is quite wrong, of course. Almost all of us have to correct this when we hear it in our communities, so it's unfortunate to see it here. --Paul Hoffman
Thanks, Paul. Yes, this is disconcerting. To quote our FAQ, routers route traffic. DNS Servers, including root servers, respond to DNS requests.
On Feb 28, 2021, at 3:46 PM, Paul Hoffman via rssac-caucus <rssac-caucus@icann.org> wrote:
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic.
I'm sure everyone here on RSSAC Caucus knows this, but "root servers that route most of the world’s internet traffic" is quite wrong, of course. Almost all of us have to correct this when we hear it in our communities, so it's unfortunate to see it here.
--Paul Hoffman_______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
You're right of course, and that's an embarrassing sentence to have gotten past my too-quick proofread. Hopefully we can replace "route" in the copy that's online now, -Mallory On 2/28/21 8:11 PM, Fred Baker wrote:
Thanks, Paul. Yes, this is disconcerting. To quote our FAQ, routers route traffic. DNS Servers, including root servers, respond to DNS requests.
On Feb 28, 2021, at 3:46 PM, Paul Hoffman via rssac-caucus <rssac-caucus@icann.org> wrote:
On Feb 27, 2021, at 8:12 AM, Mallory Knodel via rssac-caucus <rssac-caucus@icann.org> wrote:
Internet service providers have been asked to replace or add a "rogue" root server operator, ostensibly run by the government, in place of the 13 globally distributed DNS root servers that route most of the world’s internet traffic. I'm sure everyone here on RSSAC Caucus knows this, but "root servers that route most of the world’s internet traffic" is quite wrong, of course. Almost all of us have to correct this when we hear it in our communities, so it's unfortunate to see it here.
--Paul Hoffman_______________________________________________ rssac-caucus mailing list rssac-caucus@icann.org https://mm.icann.org/mailman/listinfo/rssac-caucus
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
-- Mallory Knodel CTO, Center for Democracy and Technology gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780
participants (6)
-
Fred Baker -
Fred Baker -
Mallory Knodel -
Paul Hoffman -
Paul Vixie -
Wes Hardaker