# Internet Sanctions on Russian Media: Actions and Effects

John Kristoff  0000-0002-8994-124X University of Illinois Chicago
<EMAIL_ADDRESS>,  Moritz Müller  SIDN Labs and University of Twente
<EMAIL_ADDRESS>,  Arturo Filastò  OONI<EMAIL_ADDRESS>,  Max Resing
University of Twente<EMAIL_ADDRESS>,  Chris Kanich  University
of Illinois Chicago<EMAIL_ADDRESS>and  Niels ten Oever  University of
Amsterdam<EMAIL_ADDRESS>
###### Abstract.

As a response to the Russian aggression against Ukraine, the European Union
(EU), through the notion of ‘digital sovereignty,’ imposed sanctions on
organizations and individuals affiliated with the Russian Federation that
prohibit broadcasting content, including online distribution. In this paper,
we interrogate the implementation of these sanctions and interpret them as a
means to translate the union of states’ governmental edicts into effective
technical countermeasures. Through longitudinal traffic analysis, we construct
an understanding of how ISPs in different EU countries attempted to enforce
these sanctions, and compare these implementations to similar measures in
other western countries. We find a wide variation of blocking coverage, both
internationally and within individual member states. We draw the conclusion
that digital sovereignty through sanctions in the EU has a concrete but
distinctly limited impact on information flows.

sanctions, filtering, censorship, Russia

††journalyear: YYYY††journalvolume: YYYY††journalnumber: X††doi:
XXXXXXX.XXXXXXX

##  1\. Introduction

In response to the Russian aggression against Ukraine, in 2022 the European
Union instated sanctions against “media outlets under the permanent direct or
indirect control of the leadership of the Russian Federation” to “introduce
further restrictive measures to suspend the broadcasting activities of such
media outlets in the Union, or directed at the Union.”

These sanctions are a novel form of government-initiated network manipulation
in several ways: unlike enforcement efforts aimed at e.g. torrent or streaming
sites, the domain names were not seized; unlike traditional national
censorship mechanisms (e.g. China’s), the blocking is being done by a
collection of sovereign nations, and is targeted at a specific, finite set of
outlets rather than aiming to be a comprehensive information control
mechanism.

Perhaps most importantly, this effort is not being centrally coordinated by an
individual sovereign entity, but rather by many countries, each engaging with
the internet companies within their own purview. This event presents an
opportunity to investigate a federated, governmental approach to restricting
the flow of internet traffic. We combine several vantage points and analyses
of several different approaches to internet sanctions to perform a
multidimensional characterization of these actions and their impacts.

This paper makes the following contributions:

  1. (1)

We contribute the first measurement study characterizing internet sanctions
carried out by a closely coordinating collection of states, namely the
European Union.

  2. (2)

We find that the most widespread sanction mechanism is DNS blocking (rather
than seizures), and the most complete blocking is performed nearest the
destination, but that blocking itself is far from uniform or ubiquitous, and
that circumvention via techniques like mirroring is not successfully policed.

  3. (3)

Synthesizing these results, we conclude that while at a governmental level the
EU was effectively able to coordinate its policy posture with respect to
sanctioning these entities, the union has not been able to coordinate the
technical implementation of these sanctions to largely or fully block access.
While these sanctions no doubt introduced a measurable reduction in traffic to
the sanctioned entities, complete or near-total blockage of sanctioned
entities will require new, closer forms of coordination at the organizational
or technical level.

##  2\. Background

Transnational communication networks have traditionally been used by nation
states to exert power outside of their territory, while preventing other
nation states from doing so in return (Zajácz, 2019). To gain control over
information networks, states use different strategies. Some do so by engaging
in the governance of the internet (Carr, 2015), such as standard-setting (ten
Oever and Milan, 2022) (DeNardis, 2014) or policy making around critical
internet resources (Christou and Simpson, 2007) (Mueller, 2010). However, in
these arenas states need to contend with other actors. In response, several
states have made policy proposals to enhance their ’digital sovereignty’
(Couture and Toupin, 2019) or ’data sovereignty’ (Mueller, 2017; Hummel et
al., 2021). Attempts to limit routes nationally or regionally have thus far
largely failed (Dönni et al., 2015), but filtering of information is a
commonly used approach (Deibert et al., 2008).

States regularly engage in the unilateral censoring of information on the
internet, and do so in a variety of technical means (Hall et al., 2023).
Another way of providing instructions for network operators and infrastructure
providers to engage in censorship is through multilateral internet sanctions.
Some would argue that both forms of censorship have contributed to permanent
internet fragmentation, which not only complicates technical operations, but
necessitates the need for greater international cooperation.(Fick et al.,
2022) In their overview paper Drake et al (Drake et al., 2016) describe three
kinds of internet fragmentation: commercial, technical, and governmental.
internet sanctions interestingly transverse all these categories.

###  2.1. International sanctions

In the international arena, a sanction is instantiated by a country in
response to the doing of another country. There are different kinds of
sanctions, that range from military actions and sporting events, to diplomatic
and economic sanctions. Here we will focus on economic sanctions. In economic
sanctions a country limits transactions, the provision of services, or travel
by citizens of a particular country, or particular actors (such as a
subsection of the inhabitants of a target country). In the past sanctions have
been placed on telecommunications equipment as a tool in trade wars (Hong,
2017; Rimkevich and Savinov, 2019). However, sanctions have not just targeted
networking equipment, but also traffic flows. An early example of this was
documented in a recent report (Badiei, 2023) that described a case as early as
1999, when a satellite internet connection provider from the United States
wondered whether it would be in violation of sanctions against Yugoslavia if
it would provide services there. This very early case clearly stipulates an
inherent risk of sanctions, namely an over-compliance and disproportionate
effect on general populations and therefore their impact on human rights
(Peksen, 2009), which is problematic because sanctions are regularly invoked
in response to human rights violations (Lopez and Cortright, 1997). To address
this countries often seek to provide carve-outs in sanctions to create more
targeted sanctions that do not negatively impact large populations (Gutmann et
al., 2020). However, these carve-outs do not always have the desired effect
because of over-compliance by the companies that need to implement these
sanctions against particular actors. Furthermore, companies regularly keep
measures they have taken due to sanctions in place after the sanctions have
been lifted, thus again leading to over-compliance (Breen, 2021).

###  2.2. Russia/Ukraine war and EU sanctions

The current and ongoing aggression against Ukraine started with the annexation
of Crimea and illegal military operations in Ukraine’s eastern Donbas region
by the Russian states in February 2014. In February 2022 Russia started a full
scale invasion attempt of Ukraine.

The EU has introduced sanctions against Russia since 2014. The first round of
EU sanctions were announced in March 2014 and primarily consisted of travel
sanctions. The second round of sanctions in April 2014 were expanded and the
EU made it explicit that sanctions were not aimed at harming people, but
designed to bring about change in behavior. In a third round, more entities
and persons were added to the EU sanctions against Russia which added up to a
total of 151 individuals and 37 entities. By February 2022, sanctions were
applied to Russian oil and gas, the banking sector, as well as the technology
and weapons industries. These are the heaviest sanctions ever adopted by the
EU.

What is most notable from the most recent sanctions is that in March 2022 the
EU banned the broadcasting of the news outlets Sputnik and RT. On June 2 2022,
the media outlets Rossiya RTR/RTR Planeta, Rossiya 24 and TV Center
International were added as well as the clarification that Russian state-
controlled stations and channels are barred from distributing their content
across the EU, whether via cable, satellite, internet, or smartphone apps.
Furthermore, advertising products or services on these stations or channels
was also forbidden.

###  2.3. Research scope

This paper is exclusively focused on characterizing the impact of the
sanctions passed by the EU on the internet communication of the sanctioned
media entities, its mechanisms, dynamics, and overall success. While there
have been concrete requests by the government of Ukraine to internet
governance and infrastructure actors ICANN and RIPE, these fall outside of the
remit of this paper. The same is holds true for initiatives such as the
Internet Sanctions Project (We, The Undersigned, 2022), that seeks to provide
guidance for the implementation of internet sanctions for network operators,
and thereby bridging the gap between policy makers and implementers and
limiting over-compliance. This article will also not focus on the provisioning
of numbering and addressing resources to sanctioned actors, such as those
provided by RIPE NCC, the Regional Internet Registry, which is registered in
the Netherlands (and thus falls under EU law) that covers Europe, the former
Soviet Union, and the Gulf region.

###  2.4. Ethics

As with many Internet measurement experiments, intentional consideration of
ethical ramifications of the work are of the utmost concern. We utilized
existing network measurement platforms that ensure active tests are run from
systems designed for such purpose and minimize opportunities for abuse.
Measurement platforms that utilized vantage points not under our sole
administrative control have informed consent procedures in place and enforce
firm restrictions on experiments that may be conducted. However, we raised
three unique areas of potential concern not explicitly covered
elsewhere.(Jones et al., 2015; Crandall et al., 2015)

  1. (1)

Our active measurements may raise sanctions enforcement alarms on systems we
do not control.

  2. (2)

Our active measurements may expose noncompliance with a network’s sanctions
enforcement expectations.

  3. (3)

Our active measurement traffic may be unwelcome on the infrastructure of a
country at war.

Given that our experiments were of modest type, duration, and scope, and that
we only attempt to make limited contact to potentially sanctioned resources,
we believe that our study poses no risk on the first concern. To address
concern two we do not highlight any specific networks that may be obligated,
but fail to comply with necessary sanctions enforcement requirements. We also
do not publish the source IP address of the vantage points used in any active
measurements. Regarding the final concern, in addition to carefully construed
low-impact active measurement tests, we avoid the use of RIPE Atlas probes and
EduVPN exit points located within Ukraine to limit the amount of traffic we
place on that country’s infrastructure.

Our research study was reviewed by two separate institution review boards, one
in Europe and another in the United States. They both concurred with our
analysis and approved the experiments.

##  3\. Methodology & Data

In this section we provide a high-level overview of our experiments,
measurement methodologies, and collected data. Our aim is to understand how
access to select Russian resources may have been affected due to sanctions
enforcement. We focus on connectivity and access to Russian media
organizations from vantage points in Europe unless otherwise noted. We do not
examine nor collect any traffic except that which is generated or required by
own active measurements through the platforms RIPE Atlas, EduVPN,
Dataplane.org and NLNOG RING or provided by OONI. All active measurements,
including those originating from within Ukraine are designed to be low-impact
and nonrecurring. For our RIPE Atlas measurements, we send 12 DNS queries per
domain name spread over a period of three hours. OONI data is retrieved from
the public s3 bucket and the raw data is reprocessed using the OONI Data
tool(OONI Data Kraken, [n. d.]). OONI measurements are collected through their
global network of volunteers who have gone through an informed consent
procedure where they are informed of the risks associated with participating
in this active measurement collection (Open Observatory of Network Inteference
([n. d.]), OONI). EduVPN, Dataplane.org, and NLNOG RING measurements are
manual non-recurring and each vantage point (VP) is accessed sequentially with
each measurement run in serial to prevent measurement traffic synchronization
toward targets.

###  3.1. Sanctioned resource selection

Block lists of domain names, IP addresses, URLs, or routing information are
commonly used to enforce network operator policies. In early 2022 we
considered two technical proposals that use block list techniques to enforce
internet sanctions against Russia. One is an ambitious, community cooperative
project focused on transparency. (We, The Undersigned, 2022) Another is a DNS-
based firewall approach that blocks access to IP addresses geo-located to any
country under sanction by the US government. (MacFarlane, Druce, 2022). We
found no evidence that either approach has been widely deployed, nor consensus
how they should be deployed.

We then evaluated US and European economic sanction lists published by
national and regional government agencies. One of the best known and most
influential is from The Office of Foreign Assets Control (OFAC) in the US
Department of Treasury (USDOT). OFAC maintains and enforces economic sanctions
targeting various entities around the globe, but it is primarily a list of
foreign agencies, commercial organizations, and individuals. (Office of
Foregin Assets Control, U.S. Department of the Treasury, [n. d.]) This list
data is populated with names, aliases, and known physical addresses, but may
also include associated internet resources such as as URLs, email addresses,
or cryptocurrency wallet identifiers. However, we often found the internet-
specific attributes in OFAC data to be incomplete, inconsistent, or
inaccurate. Furthermore, we could find no evidence that the OFAC list was
being widely used for internet sanctions enforcement. EU-based sanctions
regulations were more scattered as shown in Table 3 in Appendix A. In many of
these sanctions data sets, we found similar issues that would make
transforming them into internet block list solutions difficult.

Despite the apparent consistency and specificity challenges with existing
economic sanctions data, multilateral internet sanctions against Russia began
to take shape immediately following the February 24, 2022 attacks on Kyiv.
Implementation details from network providers were few and far between with
some ISPs grudgingly left to work out the details for themselves.(UK sanctions
law, A&A, and Domain blocking, [n. d.]) We decided to construct our own list
drawn from multiple authoritative sources. See Table 3. The focus on Russian
media in our study reflects the focus of sanctions from official European
governing bodies, but we also include two well-known Russian banks and a
branch of the Russian government that have been sanctioned by the US. In most
of our experiments we also utilize two _control_ web sites that are not
covered by any known sanctions. One is a static, benign web site on a U.S.
academic network. The other is the icanhazip IP address test site run by
Cloudflare. (Major Hayden, 2021)

###  3.2. Experiments and measurements

Internet sanctions enforcement may occur at a variety of points in the
communications path or at different layers in a protocol stack. To evaluate
enforcement we examine access across four broad dimensions: reachability,
Domain Name System (DNS) response, Transport Layer Security (TLS) handshake,
and Hypertext Transfer Protocol (HTTP) connection.

IP and transport reachability. We issue a series of ICMP, TCP, and UDP
traceroute probes to our sanctions list to identify when enforcement occurs at
the IP or transport layers. Traceroute access failures typically indicate
network-layer enforcement mechanisms such as a packet filter on a firewall or
via a firewalls or black hole route announcement. Where applicable, failures
above the IP layer by experiments described below are also recorded.

DNS query response behavior. For each domain in our sanctions list we perform
both A and AAAA DNS queries over UDP transport. Few names have associated AAAA
(IPv6) address mappings and we are limited by each vantage point’s local
network configuration whether we can conduct experiments over both IPv4 and
IPv6. Unless otherwise indicated, all results are based on IPv4 transport.
When necessary, we perform identification queries to detect the resolver
configuration if it is not directly available to us.

We identify block-attempts by relying on fingerprints published by OONI (OONI
blocking-fingerprints [Online], [n. d.]). Additionally, we manually examine if
IP addresses point towards websites. If the website contains information about
blocking efforts, we classify the response as a block-attempt. Finally, we
classify DNS responses containing errors or non-routable IP addresses (like
127.0.0.1) as block-attempts.

TLS handshake. We perform a TLS handshake to the IP addresses associated with
port 443 on the targets and perform TLS certificate verification. We can
detect TLS MiTM attempts by evaluating whether the server X.509 certificate
returned is valid given the SNI and destination IP address in our requests
when validated against the Mozilla root certificate list(Mozilla, [n. d.]).

HTTP$S$ request. Once a TLS session has been established we attempt to
retrieve the content of the homepage by issuing a HTTP GET request for the /
resource. We issue requests over both HTTP (80) and HTTPS (443) where
applicable. For each session we record all relevant HTTP response meta data
(e.g., headers and response status code) as well as body content.

###  3.3. Network measurement platforms

Table 1. Measurement platforms and supported connectivity tests. Platform | IP/TCP | DNS | TLS | HTTP(S)
---|---|---|---|---
OONI | TCP only | ✓ | ✓ | HTTPS only
RIPE Atlas | ✗ | ✓ | ✗ | ✗
EduVPN | ✓ | ✓ | ✗ | ✓
Dataplane.org | ✓ | ✗ | ✗ | ✓
NLNOG RING | ✓ | ✗ | ✗ | ✓

For our study we rely on a variety of network measurement platforms,
summarized in Table 1. Combined, these platforms allow us to run and evaluate
a variety of network experiments from in-country vantage points. The OONI and
RIPE Atlas platforms are widely used, well understood, and described
elsewhere.(Filastò and Appelbaum, 2012; Staff, 2015) In OONI most URLs were
already part of the testing lists and those missing were added in April
2023(Russian media github pull request, [n. d.]). EduVPN, Dataplane.org, and
the NLNOG RING may be less familiar to readers so we briefly summarize them
below.

EduVPN is a federated VPN project coordinated by SURFnet, the National
Research & Education Network (NREN) for the Netherlands. (EduVPN, [n. d.])
Participating organizations can provide two types of access: _Institute
Access_ and _Secure Internet_. The former grants access to the internal
resources of the host institution. The latter, which we use, only grants
access to the public internet through a trusted server. Our motivation for
using EduVPN is to assess the enforcement of sanctions in academic and
research networks. We setup individual VPN connections at each EduVPN server
to appear as a local client on the host network. DNS resolution configuration
varies by institution. We had access to 11 academic networks, of which four
were within the EU.

Dataplane.org is a non-profit network observation and measurement platform
that operates over 300 dedicated and virtual Linux server systems.
(Dataplane.org, [n. d.]) The majority of vantage points are in hosting
provider data centers around the globe. While these systems may not reflect
end-user experiences, they help provide additional insight into sanctions
enforcement seen in hosting environments or at the country-level. Almost all
vantage points on this platform utilize Google Public DNS.(Google Public DNS,
[n. d.])

NLNOG RING is project administered by the non-profit Netherlands Network
Operator Group (NLNOG).(NLNOG RING, [n. d.]) This platform is a collaborative
troubleshooting network consisting of over 600 Linux-based virtual machines
(VMs) in many distinct autonomous systems around the world. Participating
networks contribute VMs and in return are granted access to all others in the
network. The platform is widely used by network operators to troubleshoot and
debug network-related issues using common Unix-based tools. All vantage points
use a locally installed DNS resolver.

##  4\. Results

###  4.1. A view from OONI Probes

Since we care to know how sanctions enforcement is implemented (via DNS,
TCP/IP, or TLS) we first determine if the DNS responses are consistent. Given
an IP address and domain name pair, we consider an answer to be DNS consistent
if it is possible to successfully establish a TLS handshake using the domain
in the SNI from any vantage point (Tsai et al., 2023). If we don’t do this
first, we might misinterpret the TLS failure as a signal for TLS-level
blocking rather than via the DNS.

For addresses which are not DNS consistent, we manually determine if they are
serving block pages. We include a sample of block pages in Appendix A. If the
DNS is consistent, we proceed to the TCP connection and TLS handshake. For
each of these, we consider a failure to be an indication of blocking and
categorize them based on the specific error condition.

In order to assess the impact of the sanctions from all country origins, we
are interested in understanding how many ISPs in each country are blocking
which sites. Since DNS-based blocking is very prevalent in Europe(Ververis et
al., 2021), we introduce an additional disaggregation based on the configured
resolver of the OONI Probes. We refer to a resolver configuration as ”Internal
Resolver”, when the probe’s IP address and resolver IP address are both
originated from the same ASN. Otherwise the resolver is labeled ”External
Resolver”, which indicates the resolver service is provided by an upstream ISP
or third-party DNS provider.

Figure 1. Longitudinal view of first-seen blocking of www.rt.com as observed
by OONI. The dark-green is the total number of ASes for which blocking has
been observed. 77% of these ASes enforce sanctions within 3 months.

In the vast majority of cases an external resolver that performs blocking is a
larger regional upstream ISP. Since sanctions enforcement on most public DNS
resolver providers is rare, this also allows us to learn how many networks
would allow sanctions enforcement to be trivially circumvented by merely
switching the resolver to an alternative service. We plot the longitudinal
results in Figure 1.

Figure 2. Methods used by ISPs in Europe to implement filtering (OONI Data)

In Figure 2 we illustrate the frequency of enforcement mechanism types used
for www.rt.com, which is the domain where blocking is most common and for
which we have the most measurements. The error codes are defined in the OONI
df-007-errors specification. (OONI Spec DF007 Errors, [n. d.]) Some additional
code are created through some custom analysis. Specifically we mark as
dns.confirmed when we see an answer pointing to a known blockpage based on
fingerprints in (OONI Blocking Fingerprints, [n. d.]), dns.bogon indicates an
answer contains a bogon IP address, while tls.bad_cert consolidates all the
TLS related errors code starting with ssl_.

###  4.2. DNS according to RIPE Atlas

Table 2. Percentage of uncensored DNS responses received by RIPE Atlas probes
relying on ISP upstream resolvers.

Austria Belgium Bulgaria Croatia Cyprus Czechia Denmark Estonia Finland France
Germany Greece Hungary Ireland Italy Lithuania Netherlands Poland Portugal
Slovakia Slovenia Spain Sweden United Kingdom Switzerland Russian Federation
United States # ASes 8 6 7 3 2 10 10 1 10 10 37 4 5 6 14 2 12 7 5 4 4 6 13 28
18 42 55 # Upstream resolvers 25 22 11 5 5 34 19 2 21 78 205 7 7 16 33 3 53 19
8 7 9 14 37 103 59 79 229 # VPs 64 138 28 9 5 57 56 5 73 573 656 21 26 62 115
4 245 34 247 10 15 63 52 192 222 108 661 Orgs listed by the EC www.rt.com 7 1
9 0 0 38 33 0 2 2 25 0 14 13 23 0 5 28 0 0 0 34 100 81 99 96 98 de.rt.com 6 1
9 0 0 30 31 0 2 4 25 9 14 28 97 0 6 44 0 0 68 94 81 100 100 98 deutsch.rt.com
13 48 0 0 0 23 24 0 4 1 24 0 12 27 100 0 62 35 97 0 19 67 100 81 99 96 100
francais.rt.com 4 3 0 0 0 21 25 0 2 3 26 22 14 22 34 0 6 46 0 0 19 70 100 80
99 90 98 fr.rt.com 8 46 12 0 0 31 30 0 2 2 93 0 11 14 100 0 64 33 96 0 22 67
100 83 98 97 99 actualidad.rt.com 19 1 7 0 0 31 32 0 0 3 25 9 12 23 100 0 6 43
0 0 0 66 95 83 100 88 99 actualidad-rt.com 14 100 100 100 100 100 100 100 100
100 100 100 100 100 100 100 100 100 100 100 100 97 100 100 100 97 99
www.sputniknews.com 4 8 9 0 0 33 26 0 6 0 30 0 73 16 31 0 3 87 0 0 0 100 95 80
100 88 99 sputniknewslv.com 90 5 9 100 0 29 29 0 2 60 57 100 47 23 30 100 49
100 100 0 22 100 100 100 100 97 99 sputniknews.gr 100 1 0 75 0 35 8 0 0 60 63
11 46 25 26 100 50 100 100 0 0 100 100 100 98 96 99 sputniknews.cn 100 1 8 80
0 27 8 0 2 58 56 100 41 25 31 100 45 100 100 19 0 95 100 100 100 97 100
radiosputnik.ria.ru 5 34 7 100 42 80 0 2 99 99 87 100 100 100 0 100 6 100 0
100 95 100 100 100 97 100 sputnikglobe.com 100 100 100 100 100 100 100 100 7
100 99 100 100 100 100 100 100 100 100 100 16 100 100 100 100 89 100 www.rtr-
planeta.com 6 55 100 60 100 100 100 100 2 95 100 100 100 41 100 100 47 12 0
100 100 100 100 100 100 97 99 rtr-planeta.ru 17 100 100 100 100 100 77 100 100
100 100 100 100 100 100 100 99 100 100 100 100 100 100 100 100 100 100
vgtrk.ru 100 3 100 80 100 100 26 100 2 100 33 66 100 100 100 0 100 33 96 100
100 100 100 100 100 96 100 www.vesti.ru 15 52 81 80 100 100 30 0 36 56 100 100
100 34 100 100 100 40 96 100 100 100 100 100 100 94 99 www.tvc.ru 23 4 81 60
100 100 28 0 35 53 84 37 100 89 100 0 48 100 95 100 100 95 100 100 100 97 100
ntv.ru 4 46 100 0 100 100 28 0 2 100 29 75 100 100 100 0 98 36 0 100 100 95
100 98 100 97 100 smotrim.ru 100 58 100 19 100 100 30 0 2 57 31 50 100 18 100
0 100 33 0 100 100 95 100 100 100 97 99 ren.tv 9 1 100 0 100 100 34 0 2 99 29
55 100 33 100 0 97 37 0 100 100 100 89 100 100 94 99 1tv.ru 0 3 100 0 100 100
29 0 2 99 31 19 100 100 100 0 97 33 95 80 100 95 100 100 100 100 99
ww.rtarabic.com 15 100 100 100 100 100 46 0 39 56 85 66 100 100 100 100 96 100
100 100 100 100 100 100 100 96 100 sputnikarabic.ae 19 100 100 100 100 100 25
0 2 58 47 50 100 100 100 100 45 100 95 100 100 100 100 100 100 96 99 Mirror
pages esrt.online 17 100 100 100 100 94 100 100 100 99 99 100 92 100 100 100
100 100 100 100 100 100 100 100 100 94 99 esrt.press 26 100 100 100 100 100
100 100 99 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100
rtde.site 14 100 100 100 100 100 76 100 100 99 28 75 100 100 100 100 100 100
96 100 100 100 100 100 99 100 100 rtde.xyz 0 100 100 100 100 100 73 100 100 99
30 55 100 100 100 100 100 100 98 100 100 100 100 100 100 94 99 rtde.team 0 100
100 100 100 100 73 100 100 100 32 50 100 100 100 100 100 100 98 100 100 100
100 100 100 96 99 test.rtde.live 22 100 100 100 100 100 76 100 100 100 25 54
100 100 100 100 100 100 96 100 100 94 100 100 100 100 99 rtde.live 18 98 100
100 100 100 76 100 100 99 98 92 100 100 100 100 100 100 100 100 100 95 100 100
93 97 100 test.rtde.website 100 100 100 100 100 100 81 100 100 100 24 60 100
100 100 100 100 100 96 100 100 100 100 100 100 100 100 rtde.tech 12 100 100
100 100 100 85 100 100 100 27 72 100 100 100 100 100 100 96 100 100 100 100
100 100 97 99 rtde.world 35 100 100 100 100 100 78 100 100 99 29 63 100 100
100 100 100 100 94 100 100 100 100 100 100 99 rtde.me 21 100 100 100 100 100
76 100 100 99 29 46 100 100 100 100 100 100 95 100 100 100 100 100 98 97 99 TV
streaming svcs a-russia.ru 100 100 100 60 100 94 86 0 100 100 30 50 100 100
100 0 100 100 95 100 100 100 100 99 100 100 98 wwitv.com 100 100 100 100 100
100 43 100 88 100 28 28 100 100 100 0 100 100 94 100 100 100 100 100 100 100
100 www.glaz.tv 100 100 100 60 100 100 81 0 97 100 43 60 100 100 100 0 100 100
96 100 100 100 83 99 100 100 100 www.russisches-tv-fernsehen.de 100 100 100 60
100 100 100 100 100 100 100 100 100 100 100 0 100 100 100 100 100 100 100 100
100 96 99 ontvtime.tv 100 53 100 60 100 100 31 0 88 100 31 71 100 25 100 0 100
100 95 100 100 100 100 100 99 100 100 spbtv.online 100 100 100 100 100 100 100
0 100 100 32 50 100 100 100 0 100 100 97 100 100 100 100 100 100 97 100
www.coolstreaming.us 100 100 100 100 100 100 100 100 100 100 100 100 100 100
100 100 100 100 100 100 100 100 92 99 100 97 99 www.livehdtv.net 94 100 100
100 100 100 100 0 100 99 43 37 100 100 100 0 100 100 96 100 100 100 100 100
100 96 99 snanews.de 15 1 9 100 25 50 28 100 2 59 31 28 15 26 83 100 86 100 94
0 30 100 100 100 100 96 100 Other duma.gov.ru 100 100 100 100 100 100 81 100
100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 97 99
www.sber-bank.by 100 100 100 100 100 100 77 100 100 100 100 100 100 100 100
100 100 100 100 100 100 100 100 100 100 94 100 www.sberbank.ru 100 100 100 100
100 100 85 100 100 100 100 81 100 100 100 100 100 100 100 100 100 96 100 100
100 100 100 www.gazprombank.ru 100 100 100 100 100 100 78 100 100 100 100 100
100 100 100 100 100 100 100 100 100 95 100 99 99 97 99

Table 2 summarizes the measurement results between 2022-08-01 and 2023-09-19
per country and domain name. Each cell shows the share of responses that were
not blocked.

For each country, we select all available probes and query for the A record of
each domain name using the probe’s recursive resolver. To increase measurement
reliability, we only rely on probes that run on software version 3 or higher.
Also, we do not show results if we collected responses from two VPs or less.

Table 2 also shows that there is some form of DNS blocking in all countries in
the European Union (EU). At the same time, however, our measurements show the
extent to which blocking occurs differs widely. For example, while VPs in
Slovenia experience frequent blocking for domain names in the first round, no
VP experiences blocking for domain names belonging to organizations added in
the later rounds. In comparison, VPs in France also experience blocking for
most domain names added later to the sanctions list, however not as often as
the initial list of domain names. We found practically no evidence of DNS-
based blocking of US-sanctioned Russian banks or government domains. Outside
of the EU, we find some evidence of blocking on the small number of media
outlets sanctioned by the UK government.

Interestingly, the block lists and their implementation in member countries
and Internet Service Providers (ISPs) were inconsistent over time. For
example, the German regulator removed two domain names from their list after
their operators removed sanctioned content(Bundesnetzagentur, 2023). Our
measurements show that over-compliance varied as not all ISPs stopped blocking
the corresponding domain names right away, but after a few months the sites
became reachable by all ISPs again.

In contrast, the ISPs in Austria started blocking certain domains only after a
few months, even though they were specified months in advance and already
blocked in Germany. Furthermore, as an example of under-compliance, the newly
registered and sanctioned name for Sputniknews, sputnikglobe.com has not yet
been widely blocked as of this writing.

Overall, DNS-based blocking is present, but varies from provider to provider.
Domain names that belong to organizations listed in the first Council of the
European Union decision (Council of the European Union, 2022c) are blocked
more often than domain names added later. 45% of our VPs received at least one
blocked response for domain names related to organizations were listed in the
first package (i.e., version of the sanctions list). This number decreases
with each new round of packages: from 19% in the second to 17% in the fourth
round.

###  4.3. Lessons From EduVPN networks

Arguably, the users of academic and research networks have a high expectation,
desire, and need for open and unrestricted access to information. Internet
sanctions however may be at odds with certain academic pursuits. Therefore, we
also want to evaluate if sanctions enforcement is present on these networks as
well.

We configured 11 measurement Virtual Machines (VMs) to connect to each of the
available networks supporting the EduVPN platform. Each VM tunneled traffic
through its connected EduVPN session to a tunnel gateway using the DNS
resolvers provided by the VPN session. We validated the DNS responses using
Google’s public DNS service. The tests were run on May 09, 2023.

Four of the EduPVN networks fall under the legislation of the EU. These are
located in Germany, Denmark, Finland, and the Netherlands. Each of these
networks announce a DNS resolver in their own IP address space. Our results
focus on these four institutions. The non-European EduVPN sites show little
evidence of sanctions enforcement.

We observed different results in all four European research networks. The
Danish institution exhibited a limited amount of blocking. All domain names
were resolved as expected. We only observed failed TCP and HTTP/HTTPS tests on
the mirror sites of Sputnik News.

In contrast, a Finish institution exhibited the most complete blocking with
negative TCP and web responses for most news outlets and corresponding mirror
sites. DNS responses however were positive and valid.

The German and a Dutch institutions were similar to one another, revealing
that most media domains were unreachable via TCP and HTTP/HTTPS. However, the
behavior of the DNS between these networks differs slightly. In the German
network, the resolvers return NXDOMAIN responses, while the Dutch network
answers with SERVFAIL. We summarize results in Figure 3.

Figure 3.  Measurement observations of three EduVPN institutions. Measurements
marked with a “?” indicate the default limit of 30 hops was exceeded.

###  4.4. Hosting environments and sanctions

Reachability and HTTP(s) measurements run through Dataplane.org and NLNOG RING
platforms are conducted in a fashion similar to those performed in the EduVPN
environment described above. We ran HTTP/HTTPS and network connectivity tests
on three separate occasions in May 2023. We verified all VPs were able to
reach at least one of our two control targets. Our tests include retry
mechanisms to smooth over any natural, short-lived effects of host, path, and
destination variants given the size and diversity of VPs.

The results from both Dataplane.org and NLNOG RING are similar, but NLNOG RING
VPs were noticeably less reliable and exhibited greater inconsistency. Both
platforms show high high levels of blocking to sputniknewstv.com throughout
the EU region. However, while Dataplane.org VPs exhibited no serious problems
accessing HTTPS at our control nodes, a number of NLNOG RING VPs would
occasionally fail. We believe a larger proportion of the Dataplane.org VPs
fared better due to comparatively smaller average load, greater available
resources, and better than average environmental stability.

The use of Google DNS on the Dataplane.org platform and local resolver on
NLNOG RING result in relatively few instances of DNS-based sanctions
enforcement. Therefore, we focus on reachability and HTTP(S) connection tests.

Figure 4 summarizes the success rate of HTTPS reachability to our sanction
list from the Dataplane.org vantage points. Overall blocking is relatively
modest, largely due to the use of Google DNS, but we find interesting
anomalies when we scan the table vertically. For example, at the time of
measurements, sputniknews.gr and sputniknewslv.com were both hosted by a
popular DDoS mitigation provider used by many Russian networks. These domains
were largely inaccessible from most of the EU. We manually verified that
traffic between many countries and those sites is being blocked. A similar
situation appears to have occurred with www.gazprombank.ru, which was listed
in the USDOT OFAC sanctions list. We don’t know the motivation, but these DDoS
mitigation providers appear to have been performing sanctions enforcement
based on IP access control from countries that imposed sanctions. It is also
worth nothing that these blocks do not show up in our DNS-based measurements.

Figure 4.  HTTPS reachability success rate (2xx or 3xx HTTP response status
code) from Dataplane.org VPs.

##  5\. Discussion

###  5.1. Transparency of blocking

When analysing our measurements, we noticed network providers convey vastly
different messages to their users when access to a sanctioned internet
resource has been blocked, if they communicate a reason at all,

Overall, the vast majority of ISPs choose to implement blocking by some form
of DNS-based filtering. RIPE Atlas measurements §4.2 suggest 50% of ISPs
return a DNS error response to queries requesting a blocked domain name and in
three VPs feedback is conveyed via Extended DNS Errors (Kumari et al., 2020)
(info code 15 - blocked). OONI measurements §4.1 show that 87% of the 125 VPs
implementing blocks chose to do so via DNS. Of these, only 32 serve a block
page, meaning that in 74% of cases where blocking is implemented the user is
not informed of the reason why the resource is inaccessible.

The usefulness of block pages also varies. Some inform users the domain name
is blocked because of Russia sanctions (e.g. Figure 5). Others only show a
generic block page that are also used for sites blocked due to copyright
infringement (e.g. Figure 6).

###  5.2. Mirror pages

In response to DNS-based sanctions, new Russian domain names were registered
that mirrored the German and Spanish sanctioned websites of Russia Today (RT)
(see Table 3). In Germany, those domain names were listed on correspondence by
the regulator with groups representing the local internet industry
(Bundesnetzagentur, 2023). Additionally, the Austrian provider Liwest
published the Spanish domain names on their block page (Liwest, 2023).

Table 2 shows that in the majority of countries these new mirror pages are not
always blocked. For example, the Spanish sites are only blocked by Austrian
providers, but not in Spain as we would have expected. On the other hand,
German mirror pages are blocked by most providers in Austria and in Germany
with some exceptions. Measurements for VPs in one Portuguese network indicate
that some of the mirrored domain names are blocked only part of the time. A
possible explanation could be a load-balancer that forwards queries to
resolvers with diverging block lists but we could not confirm this theory.

We found another exception with the domain name rtde.live. This domain is
blocked in Austria but not in Germany whereas the third level domain names
test.rtde.live is only blocked in Germany. This is in accordance with the
sanctions by the German regulator, which lists test.rtde.live but not its
second level variant.

The list provided by the German regulator also contains domain names not
directly related to the sanctioned organizations, but which facilitate the
distribution of their content. These include websites that allow visitors to
stream the channels of RT among others. These names change with some
regularity and we can use these changes to observe correlated sanctions
enforcement changes. For example, we saw that after the German regulator
removed the domain names www.russisches-tv-fernsehen.de and
www.coolstreaming.us from the block list German ISPs followed suite
accordingly. Our measurements from August 2022 show that German networks that
originally blocked these domain names have lifted the blocks again.

###  5.3. Implementation of sanctions in NRENs

As already mentioned in section 4.3, researchers and academics have a keen
desire to access otherwise restricted information. Therefore, we wondered if
research facilities would be excluded from the regulations. Our work provides
evidence that some NRENs adhere to sanctions enforcement. The measurements of
a Finnish NREN reveal a rather broad implementation of sanctions. Our
observation of the German and Dutch networks align with DNS-based enforcement
of regular German ISPs. Only a research network in Denmark appears to be less
strict in comparison to national ISPs. A comparison of Table 2 and Figure 3
support these findings.

###  5.4. Placement of enforcement mechanisms

We found DNS-based blocking was the dominant form of implementing internet
sanctions. Functionally however, networks vary widely in how DNS-based
blocking was performed. Some networks redirect users to a page that may or may
not explain why a resource was blocked. Others simply return DNS errors,
sometimes with extended error codes, but usually not. Many networks rely on
third party resolution service such as Google Public DNS or Cloudflare DNS,
which do not appear to implement any sanctions enforcement regardless of
location. As long as a user can utilize an alternative DNS resolver, they
would be able to bypass most sanctions enforcement.

We found some evidence of IP address access control to enforce sanctions.
These mechanisms were typically the most complete and successful because they
were applied close to or at the destination where the restricted content was
hosted. While this approach was most effective, it was also the the least
popular type of mechanism deployed. This approach would also pose the greatest
risk of ”over-blocking” when multiple systems and services share an IP
address, which may explain why it was rarely employed.

##  6\. Related Work

The Russian invasion in the Ukraine and immediate consequences on internet
connectivity has sparked the interest of the research community. In addition
to generally network availability issues, internet censorship was studied in
the context of the war of Ukraine. However, to the best of our knowledge, no
studies focus on internet sanctions within the EU. The OONI project team has
measured censorship within Russia and show that censorship was extended to a
broader set of sites and services in the course of the conflict (Xynou and
Filastò, 2022; Roskomsvoboda, 2022). Also Ramesh et al. show that censorship
on Russian users increased. (Ramesh et al., 2022). Additionally, they study
the use of a new domestic certificate authority and the use and blocking of
censorship circumvention tools.

Other literature and reports focused on the response of services and
infrastructure in the Ukraine and in Russia. Jonker et al. (Jonker, Mattijs
and Akiwate, Gautam and Affinito, Antonia and Claffy, kc and Botta, Alessio
and Voelker, Geoffrey M and van Rijswijk-Deij, Roland and Savage, Stefan,
2022) study how the infrastructure of Russian websites and DNS infrastructure
changed in the course of the conflict. Luconi et al. study the impact on
routing and latency in the Ukraine (Luconi and Vecchio, 2023).

Outside of the scope of the Russian invasion, online censorship has been
studied extensively. Poort et al. study censorship and impact in Europe in the
context of copyright infringement (Poort et al., 2014). Their focus was on
ISPs in the Netherlands and not on the technical implementation of the
measures. Bortzmeyer has used RIPE Atlas probes to measure censorship
worldwide (Bortzmeyer, 2015). There, he also discusses caveats when using RIPE
Atlas probes to measure censorship. Ververis et al. study the impact of
censorship in mobile app stores (Ververis et al., 2019). The work of Ververis
et al. (Ververis et al., 2023) comes close to our own. Using OONI they
consider censorship generally, examining block list consistency and web
censorship behavior throughout EU member countries.

Finally, the topic of digital sovereignty has also gained traction in the
social science community. Perarnaud et al. analyse various EU policies on
digital sovereignty and their impacts (Perarnaud et al., 2022). Braud et al.
and Baur et al. both analysed digital sovereignty by looking at the “European
Cloud” project Gaia-X (Braud et al., 2021; Baur, 2023). With our analysis we
add a novel perspective on the issue of digital sovereignty in the EU and for
the future of internet sanctions.

##  7\. Conclusions

In this article we have analyzed how EU sanctions against Russian media, in
response to the Russian aggression in Ukraine, have been implemented. What we
have found is that these sanctions are inconsistently implemented across the
EU. The inconsistent implementation of the sanctions can at least in part be
attributed to the high-level description of the sanctions and the lack of
recommendations for technical implementation. This left implementation of the
sanctions largely to the interpretation of network operators without
sufficient guidance provided by national authorities in EU member states. This
led to a diffuse implementation and thus it could be argued has had limited
impact to increasing the EU’s digital sovereignty. However, it could be also
be said that this is typical for EU policy making, which always involves
raised tensions when it comes to the sovereignty of individual member states.

While the sanctions might not have proven to be as efficient and effective as
some may have liked, we anticipate this is just an early harbinger into a new
era of multilateral internet sanction events. This may also accelerate the
discursive concept of digital sovereignty into a technical reality. Future
work could compare the implementation of sanctions with other approaches to
attain digital sovereignty, specifically in the EU due to its supranational
nature and inherent tension between governance layers.

## References

  * (1)
  * Badiei (2023) Farzaneh Badiei. 2023\.  _Sanctions and the Internet_.  Technical Report. Digital Meduda, RIPE NCC, Amsterdam.  https://digitalmedusa.org/wp-content/uploads/2023/05/SanctionsandtheInternet-DigitalMedusa.pdf
  * Baur (2023) Andreas Baur. 2023\.  European Dreams of the Cloud: Imagining Innovation and Political Control.  _Geopolitics_ (2023), 1–25.  Publisher: Taylor & Francis.
  * Bortzmeyer (2015) Stéphane Bortzmeyer. 2015\.  DNS Censorship (DNS Lies) As Seen By RIPE Atlas.  _RIPE Labs_ (2015).  https://labs.ripe.net/author/stephane_bortzmeyer/dns-censorship-dns-lies-as-seen-by-ripe-atlas/
  * Braud et al. (2021) Arnaud Braud, Gaël Fromentoux, Benoit Radier, and Olivier Le Grand. 2021.  The Road to European Digital Sovereignty with Gaia-X and IDSA.  _IEEE Network_ 35, 2 (March 2021), 4–5.  https://doi.org/10.1109/MNET.2021.9387709 Conference Name: IEEE Network.
  * Breen (2021) Emmanuel Breen. 2021\.  Corporations and US economic sanctions: the dangers of overcompliance.  In _Research Handbook on Unilateral and Extraterritorial Sanctions_. Edward Elgar Publishing, 256–269.  https://www.elgaronline.com/display/edcoll/9781839107849/9781839107849.00024.xml Section: Research Handbook on Unilateral and Extraterritorial Sanctions.
  * Bundesnetzagentur (2023) Bundesnetzagentur. accessed 2023\.  Sanktionslisten, Sperrlisten und Overblocking.  https://fragdenstaat.de/anfrage/sanktionslisten-sperrlisten-und-overblocking/.
  * Carr (2015) Madeline Carr. 2015\.  Power Plays in Global Internet Governance.  _Millennium_ 43, 2 (Jan. 2015), 640–659.  https://doi.org/10.1177/0305829814562655
  * Christou and Simpson (2007) George Christou and Seamus Simpson. 2007.  Gaining a stake in global internet governance: The EU, ICANN and strategic norm manipulation.  _European journal of communication_ 22, 2 (2007), 147–164.  Publisher: Sage Publications Sage UK: London, England.
  * Council of the European Union (2022a) Council of the European Union. 2022a.  Council Decision (CFSP) 2022/2478 of 16 December 2022 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine.  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32022D2478.
  * Council of the European Union (2022b) Council of the European Union. 2022b.  Council Decision (CFSP) 2022/327 of 25 February 2022 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukrainee.  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32022D0327.
  * Council of the European Union (2022c) Council of the European Union. 2022c.  Council Decision (CFSP) 2022/351 of 1 March 2022 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine.  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32022D0351.
  * Council of the European Union (2022d) Council of the European Union. 2022d.  Council Decision (CFSP) 2022/884 of 3 June 2022 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine.  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32022D0884.
  * Council of the European Union (2023) Council of the European Union. 2023\.  Council Decision (CFSP) 2023/434 of 25 February 2023 amending Decision 2014/512/CFSP concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine.  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32022D2478.
  * Couture and Toupin (2019) Stephane Couture and Sophie Toupin. 2019.  What does the notion of “sovereignty” mean when referring to the digital?  _New Media & Society_ 21, 10 (Oct. 2019), 2305–2322.  https://doi.org/10.1177/1461444819865984 Publisher: SAGE Publications.
  * Crandall et al. (2015) Jedidiah R Crandall, Masashi Crete-Nishihata, and Jeffrey Knockel. 2015.  Forgive Us our SYNs: Technical and Ethical Considerations for Measuring Internet Filtering.. In _NS Ethics@ SIGCOMM_. 3.
  * Dataplane.org ([n. d.]) Dataplane.org. [n. d.].  https://dataplane.org.
  * Deibert et al. (2008) R. J. Deibert, J. G. Palfrey, R. Rohozinski, and J. Zittrain (Eds.). 2008.  _Access Denied: The Practice and Policy of Global Internet Filtering_.  MIT Press, Cambridge, MA.
  * DeNardis (2014) Laura DeNardis. 2014\.  _The Global War for Internet Governance_.  Yale University Press, New Haven.
  * Dönni et al. (2015) Daniel Dönni, Guilherme Sperb Machado, Christos Tsiaras, and Burkhard Stiller. 2015\.  Schengen Routing: A Compliance Analysis. In _Intelligent Mechanisms for Network Configuration and Security_ _(Lecture Notes in Computer Science)_ , Steven Latré, Marinos Charalambides, Jérôme François, Corinna Schmitt, and Burkhard Stiller (Eds.). Springer International Publishing, 100–112.
  * Drake et al. (2016) William J. Drake, Vinton G. Cerf, and Wolfgang Kleinwächter. 2016.  _Internet Fragmentation: An Overview_.  Technical Report. World Economic Forum, Cologny, Canton of Geneva, Switzerland.  https://www.weforum.org/reports/internet-fragmentation-an-overview
  * EduVPN ([n. d.]) EduVPN. [n. d.].  https://www.eduvpn.org.
  * Fick et al. (2022) Nathaniel Fick, Jami Miscik, Adam Segal, and Gordon M. Goldstein. 2022.  _Confronting Reality in Cyberspace: Foreign Policy for a Fragmented Internet_.  Technical Report. Council on Foreign Relations.  https://www.cfr.org/task-force-report/confronting-reality-in-cyberspace
  * Filastò and Appelbaum (2012) Arturo Filastò and Jacob Appelbaum. 2012.  OONI: Open Observatory of Network Interference. In _2nd USENIX Workshop on Free and Open Communications on the Internet (FOCI 12)_. USENIX Association, Bellevue, WA.  https://www.usenix.org/conference/foci12/workshop-program/presentation/Filast{ò}
  * Google Public DNS ([n. d.]) Google Public DNS. [n. d.].  https://developers.google.com/speed/public-dns/.
  * Gutmann et al. (2020) Jerg Gutmann, Matthias Neuenkirch, and Florian Neumeier. 2020\.  Precision-guided or blunt? The effects of US economic sanctions on human rights.  _Public Choice_ 185, 1-2 (2020), 161–182.  Publisher: Springer.
  * Hall et al. (2023) Joseph Lorenzo Hall, Michael D. Aaron, Amelia Andersdotter, Ben Jones, Nick Feamster, and Mallory Knodel. 2023.  _A Survey of Worldwide Censorship Techniques_.  Internet Draft draft-irtf-pearg-censorship-10. Internet Engineering Task Force.  https://datatracker.ietf.org/doc/draft-irtf-pearg-censorship Num Pages: 45.
  * Hong (2017) Yu Hong. 2017.  _Networking China: The Digital Transformation of the Chinese Economy_ (illustrated edition ed.).  University of Illinois Press, Urbana, Chicago, and Springfield.
  * Hummel et al. (2021) Patrik Hummel, Matthias Braun, Max Tretter, and Peter Dabrock. 2021.  Data sovereignty: A review.  _Big Data & Society_ 8, 1 (Jan. 2021), 2053951720982012\.  https://doi.org/10.1177/2053951720982012 Publisher: SAGE Publications Ltd.
  * Jones et al. (2015) Ben Jones, Roya Ensafi, Nick Feamster, Vern Paxson, and Nick Weaver. 2015.  Ethical concerns for censorship measurement. In _Proceedings of the 2015 ACM SIGCOMM Workshop on Ethics in Networked Systems Research_. 17–19.
  * Jonker, Mattijs and Akiwate, Gautam and Affinito, Antonia and Claffy, kc and Botta, Alessio and Voelker, Geoffrey M and van Rijswijk-Deij, Roland and Savage, Stefan (2022) Jonker, Mattijs and Akiwate, Gautam and Affinito, Antonia and Claffy, kc and Botta, Alessio and Voelker, Geoffrey M and van Rijswijk-Deij, Roland and Savage, Stefan. 2022\.  Where .ru? Assessing the Impact of Conflict on Russian Domain Infrastructure. In _Proceedings of the 22nd ACM Internet Measurement Conference_. 159–165.
  * Kumari et al. (2020) W. Kumari, E. Hunt, R. Arends, W. Hardaker, and D. Lawrence. 2020.  Extended DNS Errors.  RFC 8914 (Proposed Standard).  https://doi.org/10.17487/RFC8914
  * Liwest (2023) Liwest. accessed 2023\.  Netzsperren Liwest.  http://86.56.128.186/.
  * Lopez and Cortright (1997) George A. Lopez and David Cortright. 1997.  Economic Sanctions and human rights: part of the problem or part of the solution?  _The International Journal of Human Rights_ 1, 2 (1997), 1–25.  Publisher: Taylor & Francis.
  * Luconi and Vecchio (2023) Valerio Luconi and Alessio Vecchio. 2023.  Impact of the first months of war on routing and latency in Ukraine.  _Computer Networks_ 224 (2023), 109596.  https://doi.org/10.1016/j.comnet.2023.109596
  * MacFarlane, Druce (2022) MacFarlane, Druce. 2022\.  Infoblox Response to Ukraine Crisis.  https://blogs.infoblox.com/security/infoblox-response-to-ukraine-crisis.
  * Major Hayden (2021) Major Hayden. 2021\.  A aew future for icanhazip.  https://major.io/2021/06/06/a-new-future-for-icanhazip.
  * Mozilla ([n. d.]) Mozilla. [n. d.].  https://wiki.mozilla.org/CA.
  * Mueller (2010) Milton Mueller. 2010\.  _Networks and states: The global politics of Internet governance_.  MIT press.
  * Mueller (2017) Milton Mueller. 2017\.  _Will the Internet fragment?: sovereignty, globalization and cyberspace_.  OCLC: 962233256.
  * NLNOG RING ([n. d.]) NLNOG RING. [n. d.].  https://ring.nlnog.net.
  * Office of Foregin Assets Control, U.S. Department of the Treasury ([n. d.]) Office of Foregin Assets Control, U.S. Department of the Treasury. [n. d.].  https://ofac.treasury.gov/ofac-sanctions-lists.
  * Office of Foreign Assets Control (2023) Office of Foreign Assets Control. 2023\.  Specially Designated Nationals and Blocked Persons list.  https://sanctionssearch.ofac.treas.gov/Details.aspx?id=35845.  Accessed: May 26, 2023.
  * OONI Blocking Fingerprints ([n. d.]) OONI Blocking Fingerprints. [n. d.].  https://github.com/ooni/blocking-fingerprints/.
  * OONI blocking-fingerprints [Online] ([n. d.]) OONI blocking-fingerprints [Online]. [n. d.].  https://github.com/ooni/blocking-fingerprints/blob/main/fingerprints_dns.csv.
  * OONI Data Kraken ([n. d.]) OONI Data Kraken. [n. d.].  https://github.com/ooni/data.
  * OONI Spec DF007 Errors ([n. d.]) OONI Spec DF007 Errors. [n. d.].  https://github.com/ooni/spec/blob/master/data-formats/df-007-errors.md.
  * Open Observatory of Network Inteference ([n. d.]) (OONI) Open Observatory of Network Inteference (OONI). [n. d.].  https://ooni.org/about/risks.
  * Peksen (2009) Dursun Peksen. 2009\.  Better or worse? The effect of economic sanctions on human rights.  _Journal of Peace Research_ 46, 1 (2009), 59–77.  Publisher: Sage Publications Sage UK: London, England.
  * Perarnaud et al. (2022) Clément Perarnaud, Julien Rossi, Francesca Musiani, and Lucien Castex. 2022.  _’Splinternets’: Addressing the renewed debate on internet fragmentation_.  Technical Report PE 729.530. European Parliamentary Research Service, Brussels. 80 pages.  https://www.europarl.europa.eu/RegData/etudes/STUD/2022/729530/EPRS_STU(2022)729530_EN.pdf
  * Poort et al. (2014) Joost Poort, Jorna Leenheer, Jeroen van der Ham, and Cosmin Dumitru. 2014.  Baywatch: Two approaches to measure the effects of blocking access to The Pirate Bay.  _Telecommunications Policy_ 38, 4 (2014), 383–392.
  * Ramesh et al. (2022) Reethika Ramesh, Ram Sundara Raman, Apurva Virkud, Alexandra Dirksen, Armin Huremagic, David Fifield Dirk Rodenburg, Rod Hynes, Doug Madory, and Roya Ensafi. 2022\.  Network Responses to Russia’s Invasion of Ukraine in 2022: A Cautionary Tale for Internet Freedom.  (2022).
  * Rimkevich and Savinov (2019) Svetlana Viktorovna Rimkevich and Yuri Anatolievich Savinov. 2019\.  Economic sanctions as a trade war tool in telecom equipment market.  _Russian Foreign Economic Journal_ 7 (2019), 75–89.  https://ideas.repec.org//a/alq/rufejo/rfej_2019_07_75-89.html Publisher: Russian Foreign Trade Academy Ministry of economic development of the Russian Federation.
  * Roskomsvoboda (2022) Roskomsvoboda. 2022\.  How Internet censorship changed in Russia during the 1st year of military conflict in Ukraine.  _OONI_ (2022).  https://ooni.org/post/2023-russia-a-year-after-the-conflict/
  * Russian media github pull request ([n. d.]) Russian media github pull request. [n. d.].  https://github.com/citizenlab/test-lists/pull/1271.
  * Staff (2015) RIPE Ncc Staff. 2015\.  Ripe atlas: A global internet measurement network.  _Internet Protocol Journal_ 18, 3 (2015), 2–26.
  * ten Oever and Milan (2022) Niels ten Oever and Stefania Milan. 2022.  The Making of International Communication Standards: Towards a Theory of Power in Standardization.  _Journal of Standardisation_ 1 (June 2022).  https://doi.org/10.18757/jos.2022.6205
  * Tsai et al. (2023) Elisa Tsai, Deepak Kumar, Ram Sundara Raman, Gavin Li, Yael Eiger, and Roya Ensafi. 2023\.  CERTainty: Detecting DNS Manipulation at Scale using TLS Certificates.  _Proceedings on Privacy Enhancing Technologies_ 2023, 3 (jul 2023), 122–137.  https://doi.org/10.56553/popets-2023-0073
  * UK sanctions law, A&A, and Domain blocking ([n. d.]) UK sanctions law, A&A, and Domain blocking. [n. d.].  https://www.aa.net.uk/etc/news/uk-sanctions-law-aa-and-domain-blocking/.
  * Ververis et al. (2021) Vasilis Ververis, Tatiana Ermakova, Marios Isaakidis, Simone Basso, Benjamin Fabian, and Stefania Milan. 2021.  Understanding Internet Censorship in Europe: The Case of Spain. In _13th ACM Web Science Conference 2021_. 319–328.
  * Ververis et al. (2019) Vasilis Ververis, Marios Isaakidis, Valentin Weber, and Benjamin Fabian. 2019.  Shedding Light on Mobile App Store Censorship. In _Adjunct Publication of the 27th Conference on User Modeling, Adaptation and Personalization_ _(UMAP’19 Adjunct)_. Association for Computing Machinery, New York, NY, USA, 193–198.  https://doi.org/10.1145/3314183.3324965
  * Ververis et al. (2023) Vasilis Ververis, Lucas Lasota, Tatiana Ermakova, and Benjamin Fabian. 2023.  Website blocking in the European Union: Network interference from the perspective of Open Internet.  _Policy & Internet_ (2023).
  * We, The Undersigned (2022) We, The Undersigned. 2022\.  Multistakeholder Imposition of Internet Sanctions.  https://wiki.sanctions.net/index.php/The_Open_Letter.
  * Xynou and Filastò (2022) Maria Xynou and Arturo Filastò. 2022.  New blocks emerge in Russia amid war in Ukraine: An OONI network measurement analysis.  _OONI_ (2022).  https://ooni.org/post/2022-russia-blocks-amid-ru-ua-conflict/
  * Zajácz (2019) Rita Zajácz. 2019\.  _Reluctant Power: Networks, Corporations, and the Struggle for Global Governance in the Early 20th Century_.  MIT Press.

##  Appendix A Block pages, timeline, sanctions list

Figure 5. Blocking page of a Dutch ISP. The text states “Upon the request of
the EU [link to the Dutch version of (Council of the European Union, 2022c)],
this domain is currently blocked. We are aware of the discussion and
objections about blocking websites, but we are complying with an explicit
order from the government. Above all, we hope that the war in Ukraine will
soon be over and we will try to help where needed.” (translated by the
authors). Figure 6. Blocking page of a Portuguese ISP. The text states “The
contents you are trying to access are blocked and are protected by Copyright
and Related Rights. Its access, use and/or disclosure, without the
authorization of the respective holder, is a crime provided for and punished
by law.” (translated by Google Translate). Figure 7. Blocking page of an
Austrian ISP. The page lists all currently blocked pages, the entity
requesting the block, and the date the block was added.

Table 3. Sanctioned organisation, measured hostnames, and source.

Sanctioned organisation Hostname Source Remark/Date added Russia Today English
www.rt.com Council Decision 2022/351 (Council of the European Union, 2022c) 1
March 2022 Russia Today UK www.rt.com Council Decision 2022/351 (Council of
the European Union, 2022c) 1 March 2022 Russia Today Germany de.rt.com Council
Decision 2022/351 (Council of the European Union, 2022c) 1 March 2022
deutsch.rt.com Council Decision 2022/351 (Council of the European Union,
2022c) 1 March 2022 Russia Today France francais.rt.com Council Decision
2022/351 (Council of the European Union, 2022c) 1 March 2022 fr.rt.com Council
Decision 2022/351 (Council of the European Union, 2022c) 1 March 2022 RT en
español actualidad.rt.com Council Decision 2022/351 (Council of the European
Union, 2022c) 1 March 2022 actualidad-rt.com Council Decision 2022/351
(Council of the European Union, 2022c) 1 March 2022 Sputnik
www.sputniknews.com Council Decision 2022/351 (Council of the European Union,
2022c) 1 March 2022 sputniknewslv.com Council Decision 2022/351 (Council of
the European Union, 2022c) 1 March 2022 sputniknews.gr Council Decision
2022/351 (Council of the European Union, 2022c) 1 March 2022 sputniknews.cn
Council Decision 2022/351 (Council of the European Union, 2022c) 1 March 2022
radiosputnik.ria.ru Council Decision 2022/351 (Council of the European Union,
2022c) 1 March 2022 sputnikglobe.com Council Decision 2022/351 (Council of the
European Union, 2022c) Registered 29 March 2023, sputniknews.com now redirects
to this domain name. Rossiya RTR / RTR Planeta www.rtr-planeta.com Council
Decision 2022/884 (Council of the European Union, 2022d) 3 June 2022 rtr-
planeta.ru Council Decision 2022/884 (Council of the European Union, 2022d) 3
June 2022 vgtrk.ru Council Decision 2022/884 (Council of the European Union,
2022d) 3 June 2022 Rossiya 24 / Russia 24 www.vesti.ru Council Decision
2022/884 (Council of the European Union, 2022d) 3 June 2022 TV Centre
International www.tvc.ru Council Decision 2022/884 (Council of the European
Union, 2022d) 3 June 2022 tvci.ru Council Decision 2022/884 (Council of the
European Union, 2022d) 3 June 2022 NTV/NTV Mir ntv.ru Council Decision
2022/2478 (Council of the European Union, 2022a) 16 December 2022 Rossiya 1
smotrim.ru Council Decision 2022/2478 (Council of the European Union, 2022a)
16 December 2022 REN TV ren.tv Council Decision 2022/2478 (Council of the
European Union, 2022a) 16 December 2022 Pervyi Kanal 1tv.ru Council Decision
2022/2478 (Council of the European Union, 2022a) 16 December 2022 RT Arabic
www.rtarabic.com Council Decision 2023/434 (Council of the European Union,
2023) 25 February 2023 Sputnik Arabic sputnikarabic.ae Council Decision
2023/434 (Council of the European Union, 2023) 25 February 2023 RT en español
mirror esrt.online Liwest Blocklist (Liwest, 2023) Registered 8 April 2022
esrt.press Liwest Blocklist (Liwest, 2023) Registered 8 April 2022 RT Germany
mirror rtde.site Bundesnetzagentur (Bundesnetzagentur, 2023) Registered 5
March 2022 rtde.xyz Bundesnetzagentur (Bundesnetzagentur, 2023) Registered 5
March 2022 rtde.team Bundesnetzagentur (Bundesnetzagentur, 2023) Registered 5
March 2022 test.rtde.live Bundesnetzagentur (Bundesnetzagentur, 2023)
Registered 6 April 2022 rtde.live Bundesnetzagentur (Bundesnetzagentur, 2023)
Registered 6 April 2022 test.rtde.website Bundesnetzagentur
(Bundesnetzagentur, 2023) Registered 6 April 2022 rtde.tech Liwest Blocklist
(Liwest, 2023) Registered 6 April 2022 rtde.world Liwest Blocklist (Liwest,
2023) Registered 6 April 2022 rtde.me Liwest Blocklist (Liwest, 2023)
Registered 6 April 2022 A-Russia a-russia.ru Bundesnetzagentur
(Bundesnetzagentur, 2023) Russian TV streaming site WWITV: World Wide Internet
TV wwitv.com Bundesnetzagentur (Bundesnetzagentur, 2023) TV streaming site
glaz.tv www.glaz.tv Bundesnetzagentur (Bundesnetzagentur, 2023) TV streaming
site Russisches Fernsehen www.russisches-tv-fernsehen.de Bundesnetzagentur
(Bundesnetzagentur, 2023) TV streaming site On TV Time ontvtime.tv
Bundesnetzagentur (Bundesnetzagentur, 2023) TV streaming site SPB TV World
spbtv.online Bundesnetzagentur (Bundesnetzagentur, 2023) TV streaming site
Coolstreaming www.coolstreaming.us Bundesnetzagentur (Bundesnetzagentur, 2023)
TV streaming site Live HD TV www.livehdtv.net Bundesnetzagentur
(Bundesnetzagentur, 2023) TV streaming site Rossiya Segodnya Group snanews.de
Liwest Blocklist (Liwest, 2023) German news site State Duma duma.gov.ru OFAC
Sanctions list (Office of Foreign Assets Control, 2023) Sberbank www.sber-
bank.by Council Decision 2022/327 (Council of the European Union, 2022b) 25
February 2022, Not part of Annex IX www.sberbank.ru Council Decision 2022/327
(Council of the European Union, 2022b) 25 February 2022, Not part of Annex IX
Gazprombank www.gazprombank.ru Council Decision 2022/2478 (Council of the
European Union, 2022a) 16 December 2022, Not part of Annex IX

Figure 8. Timeline of blocking of www.rt.com across providers in Europe Figure
9. Timeline of blocking of www.rt.com across providers in Europe