1
00:00:00,510 --> 00:00:02,910
- We're gonna get started
today with Bill Woodcock

2
00:00:02,910 --> 00:00:05,790
talking about the Internet's
role in sanctions enforcement,

3
00:00:05,790 --> 00:00:07,110
and Russia/Ukraine and the future.

4
00:00:07,110 --> 00:00:08,490
So let's give him a warm welcome

5
00:00:08,490 --> 00:00:10,509
up here in the DEF CON stage.

6
00:00:10,509 --> 00:00:13,509
(audience clapping)

7
00:00:15,930 --> 00:00:19,470
- Howdy! I'm not the world's
most organized speaker,

8
00:00:19,470 --> 00:00:22,110
and this is gonna be my first time

9
00:00:22,110 --> 00:00:23,790
running through these slides.

10
00:00:23,790 --> 00:00:26,433
Oh, okay. Can you guys hear me?

11
00:00:27,600 --> 00:00:29,040
All right. I was just saying,

12
00:00:29,040 --> 00:00:30,750
I'm not the world's most organized speaker

13
00:00:30,750 --> 00:00:32,940
and this is my first time
running through these slides.

14
00:00:32,940 --> 00:00:37,940
So I may not balance out the

15
00:00:39,510 --> 00:00:41,730
amount of talking per slide terribly well,

16
00:00:41,730 --> 00:00:44,040
but we'll try and get through this

17
00:00:44,040 --> 00:00:48,030
and leave enough time for a
little bit of Q&A at the end.

18
00:00:48,030 --> 00:00:52,920
So, what I'm here to talk
about is the question of

19
00:00:52,920 --> 00:00:57,920
what the Internet's role is
in sanctions enforcement.

20
00:00:57,960 --> 00:01:02,280
So, you're probably all, at least,

21
00:01:02,280 --> 00:01:04,590
a little bit familiar
with what sanctions are.

22
00:01:04,590 --> 00:01:09,590
Governments impose
sanctions on some party,

23
00:01:09,600 --> 00:01:11,910
and then banks, for instance,

24
00:01:11,910 --> 00:01:13,890
in the country of the government

25
00:01:13,890 --> 00:01:15,660
that's imposed the sanctions,

26
00:01:15,660 --> 00:01:19,053
have to not do business with that party.

27
00:01:21,840 --> 00:01:25,890
And sanctions more generally

28
00:01:25,890 --> 00:01:28,260
apply to things not just banks,

29
00:01:28,260 --> 00:01:30,450
and the internet is a thing,

30
00:01:30,450 --> 00:01:32,763
and their internet service providers.

31
00:01:34,350 --> 00:01:36,340
So there's this question of

32
00:01:37,230 --> 00:01:41,010
what internet service providers
should do with sanctions

33
00:01:41,010 --> 00:01:42,060
when they're imposed.

34
00:01:43,650 --> 00:01:48,650
That was brought to ahead

35
00:01:48,840 --> 00:01:51,430
in March of this year

36
00:01:52,650 --> 00:01:56,343
because, when Russia invaded Ukraine,

37
00:01:57,720 --> 00:02:01,740
Ukraine asked ICANN and RIPE,

38
00:02:01,740 --> 00:02:05,550
which is the IP and
Autonomous System Number

39
00:02:05,550 --> 00:02:08,043
allocation authority for Europe,

40
00:02:09,540 --> 00:02:11,970
essentially to cut
Russia off the Internet,

41
00:02:11,970 --> 00:02:16,590
to deactivate route
name servers in Russia,

42
00:02:16,590 --> 00:02:21,210
to revoke Russia's use of

43
00:02:21,210 --> 00:02:23,943
IP addresses and domain names.

44
00:02:26,970 --> 00:02:31,263
Both RIPE and ICANN refused that request,

45
00:02:33,630 --> 00:02:36,630
which was the right thing to do.

46
00:02:36,630 --> 00:02:41,250
But these are internet
governance organizations,

47
00:02:41,250 --> 00:02:43,860
and they refused the request summarily,

48
00:02:43,860 --> 00:02:47,610
they did not engage their
internet governance process,

49
00:02:47,610 --> 00:02:51,180
they didn't talk with their
constituency about this.

50
00:02:51,180 --> 00:02:54,870
They just said no as a

51
00:02:54,870 --> 00:02:56,820
sort of executive and legal matter

52
00:02:56,820 --> 00:02:58,953
rather than an internet governance matter.

53
00:03:00,540 --> 00:03:03,810
As a result of that request,

54
00:03:03,810 --> 00:03:07,230
the internet community never got engaged

55
00:03:07,230 --> 00:03:08,823
to discuss this.

56
00:03:12,330 --> 00:03:14,520
Obviously, from ICANN's point of view,

57
00:03:14,520 --> 00:03:17,160
and from RIPE's point of view,
this is a pain in the ass,

58
00:03:17,160 --> 00:03:20,130
and they'd rather not be
asked something like that.

59
00:03:20,130 --> 00:03:21,870
And having been asked,

60
00:03:21,870 --> 00:03:24,120
they don't really want to
have a discussion about it,

61
00:03:24,120 --> 00:03:25,980
they just want the whole thing to go away.

62
00:03:25,980 --> 00:03:28,563
So, each of them very quickly said no.

63
00:03:29,730 --> 00:03:34,730
But their responses were pretty brief

64
00:03:34,830 --> 00:03:36,330
and to the point,

65
00:03:36,330 --> 00:03:41,330
and didn't really help
Ukraine, as a country,

66
00:03:42,990 --> 00:03:46,470
figure out what they
could have asked instead.

67
00:03:46,470 --> 00:03:50,400
Like, okay, so the answer
to that question is no,

68
00:03:50,400 --> 00:03:55,400
but you are a beleaguered
country under attack,

69
00:03:56,280 --> 00:03:58,560
and it's perfectly reasonable

70
00:03:58,560 --> 00:04:00,360
for you to be looking at your options

71
00:04:00,360 --> 00:04:02,400
and trying to figure out what you can do.

72
00:04:02,400 --> 00:04:06,990
So, Vince Cerf and Steve Crocker, and I,

73
00:04:06,990 --> 00:04:10,860
and about 70 other people

74
00:04:10,860 --> 00:04:13,920
who are routinely involved
with internet governance

75
00:04:13,920 --> 00:04:18,420
got together and we spent 10
days hammering out a letter

76
00:04:18,420 --> 00:04:23,420
that provided a more in-depth response.

77
00:04:24,480 --> 00:04:29,480
So the answer was still
no, but it pointed out why,

78
00:04:29,730 --> 00:04:32,940
and it said what other options there were,

79
00:04:32,940 --> 00:04:35,250
what things they could have asked for

80
00:04:35,250 --> 00:04:38,823
that might have been easier
for somebody to say yes to,

81
00:04:40,560 --> 00:04:42,900
or specifically, easier for the

82
00:04:42,900 --> 00:04:45,100
internet governance
community to say yes to.

83
00:04:47,790 --> 00:04:52,790
So, that in turn led to an engagement

84
00:04:53,220 --> 00:04:54,990
of the internet governance community

85
00:04:54,990 --> 00:04:59,433
with this issue of sanctions,
and what would that look like.

86
00:05:01,260 --> 00:05:05,511
So let me run through a
little bit of the basics

87
00:05:05,511 --> 00:05:07,860
of what sanctions are.

88
00:05:07,860 --> 00:05:11,253
So, sanctions are things
that governments do.

89
00:05:12,180 --> 00:05:13,740
If you decide that

90
00:05:13,740 --> 00:05:15,600
you don't wanna do business with somebody,

91
00:05:15,600 --> 00:05:16,830
that's a boycott.

92
00:05:16,830 --> 00:05:18,330
So if it's private, it's boycott,

93
00:05:18,330 --> 00:05:19,953
if it's public, it's a sanction.

94
00:05:24,120 --> 00:05:26,370
Sanctions don't actually require

95
00:05:26,370 --> 00:05:29,130
any internet governance engagement

96
00:05:29,130 --> 00:05:31,620
because they're just a matter of law,

97
00:05:31,620 --> 00:05:34,350
and you decide whether
you're gonna follow the law

98
00:05:34,350 --> 00:05:35,310
or not follow the law.

99
00:05:35,310 --> 00:05:38,160
It's not really a matter for third parties

100
00:05:38,160 --> 00:05:41,673
to have policy discussions about.

101
00:05:43,530 --> 00:05:45,743
And the parties that
need to decide whether

102
00:05:45,743 --> 00:05:48,660
they're gonna follow the law
are internet service providers,

103
00:05:48,660 --> 00:05:52,170
people who are carrying internet traffic

104
00:05:52,170 --> 00:05:55,770
that may be either bound
for a sanctioned entity

105
00:05:55,770 --> 00:05:58,683
or coming from a sanctioned entity.

106
00:06:01,230 --> 00:06:03,930
Internet service
providers are incorporated

107
00:06:03,930 --> 00:06:06,360
and do business in specific countries.

108
00:06:06,360 --> 00:06:07,860
Those countries have governments,

109
00:06:07,860 --> 00:06:11,220
those governments may be doing sanctions.

110
00:06:11,220 --> 00:06:14,580
Not every government define sanctions.

111
00:06:14,580 --> 00:06:17,527
A lot of them just default to
the United Nations and say,

112
00:06:17,527 --> 00:06:20,130
"Well, whatever the
United Nations sanctions,

113
00:06:20,130 --> 00:06:21,390
we will go along with.

114
00:06:21,390 --> 00:06:22,590
We will enforce that,

115
00:06:22,590 --> 00:06:25,650
but we're not going to
define new ones of our own."

116
00:06:25,650 --> 00:06:30,650
But the US, Canada, UK,
Australia, New Zealand,

117
00:06:31,560 --> 00:06:36,153
all of the European
Union, the African Union,

118
00:06:38,610 --> 00:06:42,270
Switzerland, Sweden,
these are all countries

119
00:06:42,270 --> 00:06:46,260
and intergovernmental
organizations that do sanctions

120
00:06:46,260 --> 00:06:49,710
over and above what happened
in the United Nations.

121
00:06:49,710 --> 00:06:53,490
It's a little bit hard to
get consensus in the UN

122
00:06:53,490 --> 00:06:56,670
on sanctioning anybody
because the UN's big

123
00:06:56,670 --> 00:06:58,763
and there are a lot of
folks who can say no.

124
00:07:00,900 --> 00:07:05,550
So, where there are problems
for internet service providers

125
00:07:05,550 --> 00:07:07,590
with sanctions are not

126
00:07:07,590 --> 00:07:11,520
if you're in a country and
you need to follow a law,

127
00:07:11,520 --> 00:07:12,870
that's pretty simple.

128
00:07:12,870 --> 00:07:17,870
It's when you've got operations
in multiple countries

129
00:07:17,910 --> 00:07:19,920
and you need to follow multiple laws

130
00:07:19,920 --> 00:07:22,260
that are not in agreement with each other.

131
00:07:22,260 --> 00:07:27,260
Now, if you're working
in the US and the UK,

132
00:07:27,900 --> 00:07:30,720
and the US says, "Sanction party A"

133
00:07:30,720 --> 00:07:33,000
and the UK says, "Sanction party B,"

134
00:07:33,000 --> 00:07:35,550
you can sanction both parties, A and B,

135
00:07:35,550 --> 00:07:37,440
and that's not in conflict.

136
00:07:37,440 --> 00:07:40,050
But sometimes there are laws that say

137
00:07:40,050 --> 00:07:42,180
that you can't mess with something.

138
00:07:42,180 --> 00:07:44,670
So that's when you get a conflict.

139
00:07:44,670 --> 00:07:49,410
So Russia, for instance,

140
00:07:49,410 --> 00:07:51,810
has passed domestic laws in Russia

141
00:07:51,810 --> 00:07:56,110
saying that you can't
sanction Russia, or that

142
00:07:58,020 --> 00:08:00,780
internationally imposed sanctions

143
00:08:00,780 --> 00:08:03,420
cannot be enforced inside Russia

144
00:08:03,420 --> 00:08:06,693
by a party that's doing
business inside Russia.

145
00:08:08,340 --> 00:08:11,583
And those are recently passed
laws and you can guess why.

146
00:08:12,900 --> 00:08:17,580
So, sanctions are

147
00:08:17,580 --> 00:08:19,683
a punitive measure, it's a punishment.

148
00:08:22,080 --> 00:08:25,833
But they're deescalatory
relative to launching a missile.

149
00:08:27,321 --> 00:08:30,810
In theory of armed conflict,

150
00:08:30,810 --> 00:08:35,460
this idea of deescalatory
measures is an important one.

151
00:08:35,460 --> 00:08:38,343
If you're trying to get out of a conflict,

152
00:08:39,450 --> 00:08:42,420
the notion is that you
should respond in kind

153
00:08:42,420 --> 00:08:44,490
but in a deescalatory manner.

154
00:08:44,490 --> 00:08:48,510
So, respond, but not as much
as the other person did,

155
00:08:48,510 --> 00:08:52,143
and that signals that you
want the conflict to go away.

156
00:08:53,280 --> 00:08:55,650
So, sanctions are deescalatory measure.

157
00:08:55,650 --> 00:08:58,080
You can show that you
still care about something,

158
00:08:58,080 --> 00:09:01,113
but you're not trying to make
the fight a bigger fight.

159
00:09:04,020 --> 00:09:06,810
There are these two different terms

160
00:09:06,810 --> 00:09:09,480
that are important to distinguish between:

161
00:09:09,480 --> 00:09:12,270
cyber sanctions and internet sanctions.

162
00:09:12,270 --> 00:09:17,100
This is a completely
artificial-contrived distinction.

163
00:09:17,100 --> 00:09:19,890
It's two labels that
are being used to denote

164
00:09:19,890 --> 00:09:21,243
two different concepts.

165
00:09:23,130 --> 00:09:28,130
Cyber sanctions denotes
a sanction of any kind

166
00:09:28,560 --> 00:09:32,010
that is imposed because
you didn't like something

167
00:09:32,010 --> 00:09:34,500
somebody did in cyberspace.

168
00:09:34,500 --> 00:09:37,620
Somebody does a cyber attack against you,

169
00:09:37,620 --> 00:09:41,190
steals your intellectual
property and publishes it online,

170
00:09:41,190 --> 00:09:44,400
and you block their bank accounts.

171
00:09:44,400 --> 00:09:45,753
That's a cyber sanction.

172
00:09:46,620 --> 00:09:51,620
Internet sanctions are sanctions
imposed via internet means,

173
00:09:52,590 --> 00:09:56,280
in response to whatever. Anything.

174
00:09:56,280 --> 00:09:58,830
Doesn't necessarily have
anything to do with the Internet.

175
00:09:58,830 --> 00:10:03,510
So, somebody invades a
city and blows up a school,

176
00:10:03,510 --> 00:10:05,730
and you wanna sanction them,

177
00:10:05,730 --> 00:10:07,080
but you want to sanction them

178
00:10:07,080 --> 00:10:08,670
by cutting them off the Internet,

179
00:10:08,670 --> 00:10:12,360
by blocking the routing
of their IP addresses,

180
00:10:12,360 --> 00:10:16,407
by revoking their domain names,
that's an internet sanction,

181
00:10:16,407 --> 00:10:18,480
and that's what I'm talking about today,

182
00:10:18,480 --> 00:10:20,163
not cyber sanctions.

183
00:10:21,990 --> 00:10:25,350
The other big distinction
that is worth understanding

184
00:10:25,350 --> 00:10:29,340
is between comprehensive
sanctions and targeted sanctions.

185
00:10:29,340 --> 00:10:33,060
Comprehensive sanctions are,
"We're sanctioning Russia.

186
00:10:33,060 --> 00:10:36,117
We're sanctioning Iran.
We're sanctioning Cuba."

187
00:10:37,200 --> 00:10:39,277
Targeted sanctions are,

188
00:10:39,277 --> 00:10:43,830
"We're sanctioning this
specific military unit.

189
00:10:43,830 --> 00:10:46,860
We're sanctioning this
particular business.

190
00:10:46,860 --> 00:10:50,250
We're sanctioning this aircraft."

191
00:10:50,250 --> 00:10:54,753
Targeted sanctions are
what everybody does now.

192
00:10:56,610 --> 00:10:59,730
Comprehensive sanctions, 50 years ago,

193
00:10:59,730 --> 00:11:00,930
yeah, that was a thing.

194
00:11:00,930 --> 00:11:02,040
It's just not anymore.

195
00:11:02,040 --> 00:11:07,040
Governments have by and large
really gotten past doing that,

196
00:11:08,130 --> 00:11:12,510
but in the public perception of sanctions,

197
00:11:12,510 --> 00:11:14,460
that's what a lot of people imagine.

198
00:11:14,460 --> 00:11:17,250
They imagine, "Russia invaded Ukraine.

199
00:11:17,250 --> 00:11:20,220
Therefore, Russia is gonna get sanctioned.

200
00:11:20,220 --> 00:11:24,390
Therefore, I can't do business
with anybody in Russia."

201
00:11:24,390 --> 00:11:26,220
But that's really not how it works.

202
00:11:26,220 --> 00:11:31,220
In fact, you could go and
you could download a list

203
00:11:31,440 --> 00:11:34,110
of all of the sanctioned
entities in Russia.

204
00:11:34,110 --> 00:11:36,930
And it would be, depending
on what country you're in,

205
00:11:36,930 --> 00:11:39,270
about 1000 entities.

206
00:11:39,270 --> 00:11:43,230
But those entities are gonna be like the

207
00:11:43,230 --> 00:11:45,243
St. Petersburg troll farm,

208
00:11:47,340 --> 00:11:52,340
Wagner, the mercenary company,

209
00:11:55,937 --> 00:12:00,307
a few ships, yachts
belonging to oligarchs.

210
00:12:01,740 --> 00:12:03,890
These are gonna be the
sanctioned entities.

211
00:12:06,300 --> 00:12:10,500
Blocking all of Russia is over-blocking,

212
00:12:10,500 --> 00:12:12,720
that's over-compliance with the sanction.

213
00:12:12,720 --> 00:12:14,580
That's doing more than

214
00:12:14,580 --> 00:12:17,040
what government actually wants you to do.

215
00:12:17,040 --> 00:12:21,900
So, over-blocking, over-sanctioning

216
00:12:21,900 --> 00:12:26,670
is one of the primary problems
that happens with sanctions.

217
00:12:26,670 --> 00:12:29,460
A government says, "Well,
we've got a problem.

218
00:12:29,460 --> 00:12:31,710
We're gonna do this very
targeted intervention

219
00:12:31,710 --> 00:12:34,020
to try to fix the problem."

220
00:12:34,020 --> 00:12:35,707
And then somebody says,

221
00:12:35,707 --> 00:12:38,610
"Oh, well, I'll just
block the whole country."

222
00:12:38,610 --> 00:12:42,030
And that has a pretty bad effect.

223
00:12:42,030 --> 00:12:44,700
We don't really want
to block all of Russia

224
00:12:44,700 --> 00:12:48,600
and make it difficult
for regular people to

225
00:12:48,600 --> 00:12:52,260
get access to international
news, for instance.

226
00:12:52,260 --> 00:12:56,340
So, real-world targeted sanctions

227
00:12:56,340 --> 00:12:59,340
are what people need to comply with.

228
00:12:59,340 --> 00:13:02,850
And so, understanding
what those sanctions are

229
00:13:02,850 --> 00:13:05,910
and who the entities that
have been sanctioned are,

230
00:13:05,910 --> 00:13:09,270
is the most pressing problem

231
00:13:09,270 --> 00:13:10,920
if you're trying to be compliant.

232
00:13:12,270 --> 00:13:17,250
So if you talk with governmental
folks who do sanctions,

233
00:13:17,250 --> 00:13:19,080
what they'll tell you is that there are

234
00:13:19,080 --> 00:13:21,090
three purposes to sanctions:

235
00:13:21,090 --> 00:13:23,790
signaling, constraint, and coercion.

236
00:13:23,790 --> 00:13:27,757
Signaling is basically just
saying to the whole world,

237
00:13:27,757 --> 00:13:30,210
"We really don't like what
these people are doing.

238
00:13:30,210 --> 00:13:34,440
So, we're sanctioning them in
order to tell the rest of you

239
00:13:34,440 --> 00:13:35,997
that we don't approve of this."

240
00:13:38,070 --> 00:13:42,810
That's easy to do, and it
tends to be very successful,

241
00:13:42,810 --> 00:13:45,420
in the sense that if you sanction somebody

242
00:13:45,420 --> 00:13:47,820
and you communicate what you're doing,

243
00:13:47,820 --> 00:13:49,440
the rest of the world will understand

244
00:13:49,440 --> 00:13:51,090
that you disapprove of something.

245
00:13:51,960 --> 00:13:56,100
Constraint is using the sanction to try to

246
00:13:56,100 --> 00:14:00,210
stop the sanctioned party
from doing something.

247
00:14:00,210 --> 00:14:01,980
Shutting down their bank accounts

248
00:14:01,980 --> 00:14:05,370
so that they can't use
those bank accounts to

249
00:14:05,370 --> 00:14:09,423
continue to conduct business,
or conduct a war or whatever.

250
00:14:13,170 --> 00:14:17,460
Constraint is rarely an
all-or-nothing thing.

251
00:14:17,460 --> 00:14:19,890
If we talk about internet sanctions

252
00:14:19,890 --> 00:14:23,550
and talk about blocking
Russian domain names

253
00:14:23,550 --> 00:14:27,600
or blocking Iranian IP
addresses or something,

254
00:14:27,600 --> 00:14:29,340
it's not gonna kick them off the Internet,

255
00:14:29,340 --> 00:14:31,890
it's not gonna keep them
from using the Internet.

256
00:14:31,890 --> 00:14:35,190
It may make it more difficult
and more expensive for them.

257
00:14:35,190 --> 00:14:37,300
Just like a financial sanction

258
00:14:38,520 --> 00:14:39,900
where you shut down their bank account

259
00:14:39,900 --> 00:14:42,450
isn't gonna keep them from using money,

260
00:14:42,450 --> 00:14:44,580
it's just gonna make it a
lot more difficult for them.

261
00:14:44,580 --> 00:14:45,960
They're gonna have to use more cash.

262
00:14:45,960 --> 00:14:47,400
They're gonna have to set up

263
00:14:47,400 --> 00:14:49,290
other accounts under other names.

264
00:14:49,290 --> 00:14:54,180
They're gonna have to use their
grandmother's bank account

265
00:14:54,180 --> 00:14:56,193
instead of their own, whatever.

266
00:14:58,410 --> 00:15:03,410
So, the constraint thing

267
00:15:03,510 --> 00:15:06,060
is, again, it's not an absolute,

268
00:15:06,060 --> 00:15:08,220
it's more about creating friction

269
00:15:08,220 --> 00:15:09,963
that makes things more expensive.

270
00:15:11,250 --> 00:15:15,030
Coercion is where you're
trying to get the person

271
00:15:15,030 --> 00:15:18,090
to stop doing the thing
that you don't like.

272
00:15:18,090 --> 00:15:20,483
So, this is forcing them enough

273
00:15:21,450 --> 00:15:24,060
that they actually will
change their behavior

274
00:15:24,060 --> 00:15:26,460
where it's not just a constraint

275
00:15:26,460 --> 00:15:29,490
to keep them from doing
something involuntarily,

276
00:15:29,490 --> 00:15:31,323
but actually changing their mind.

277
00:15:35,495 --> 00:15:36,540
That's a tough one.

278
00:15:36,540 --> 00:15:40,740
So, if you talk with
governmental policy people

279
00:15:40,740 --> 00:15:45,740
who do sanctions, what
they'll tell you is that

280
00:15:45,840 --> 00:15:50,840
going down from the top,
a really good success rate

281
00:15:51,120 --> 00:15:56,120
on constraint or coercion
is like 10-20% success.

282
00:15:56,340 --> 00:15:59,070
And since sanctions cost governments

283
00:15:59,070 --> 00:16:00,843
very little to implement,

284
00:16:02,220 --> 00:16:05,880
it's worth doing, it's not a big deal.

285
00:16:05,880 --> 00:16:09,720
It may not have a huge effect,
but it's also not expensive.

286
00:16:09,720 --> 00:16:12,960
And the signaling part is
important for a lot of folks,

287
00:16:12,960 --> 00:16:14,790
so, why not?

288
00:16:14,790 --> 00:16:16,040
So sanctions are a thing.

289
00:16:18,360 --> 00:16:21,990
Governments have been using
sanctions for thousands of years

290
00:16:21,990 --> 00:16:22,890
at this point.

291
00:16:22,890 --> 00:16:26,430
So, there's plenty of build
up expertise inside government

292
00:16:26,430 --> 00:16:28,953
about what works, what
doesn't work, so forth.

293
00:16:30,480 --> 00:16:34,020
They've got realistic expectations about

294
00:16:34,020 --> 00:16:39,020
what they should expect of the
sanction in terms of success.

295
00:16:40,740 --> 00:16:43,020
They don't think that
sanctioning something

296
00:16:43,020 --> 00:16:45,570
is just gonna immediately stop

297
00:16:45,570 --> 00:16:47,270
the behavior that they don't want.

298
00:16:49,620 --> 00:16:51,510
They understand sanctions

299
00:16:51,510 --> 00:16:55,230
with respect to the movement
of money fairly well.

300
00:16:55,230 --> 00:16:57,570
Governments have a lot
of internal expertise

301
00:16:57,570 --> 00:16:59,970
around tracking the movement of money.

302
00:16:59,970 --> 00:17:04,503
And so, if a sanction is not
being enforced, they can tell.

303
00:17:05,550 --> 00:17:08,010
They don't really have that
kind of internal expertise

304
00:17:08,010 --> 00:17:11,190
around networking, around the internet,

305
00:17:11,190 --> 00:17:14,760
internet service providers, telecoms.

306
00:17:14,760 --> 00:17:17,700
So they don't really
know what's gonna work,

307
00:17:17,700 --> 00:17:19,500
they don't really know what's appropriate,

308
00:17:19,500 --> 00:17:21,330
they don't really know

309
00:17:21,330 --> 00:17:23,460
what degree of compliance they're getting.

310
00:17:23,460 --> 00:17:25,863
So this is an area where
things could improve.

311
00:17:26,790 --> 00:17:29,460
Internet service providers,
network operators

312
00:17:29,460 --> 00:17:31,230
could communicate more with government,

313
00:17:31,230 --> 00:17:34,803
educate them about what's
possible and what's feasible,

314
00:17:36,510 --> 00:17:40,623
and also communicate more about
what they're actually doing.

315
00:17:43,680 --> 00:17:47,490
Governments also don't
really have any expertise

316
00:17:47,490 --> 00:17:52,490
at identifying what could be sanctioned,

317
00:17:53,040 --> 00:17:54,960
associated with sanctioned entities.

318
00:17:54,960 --> 00:17:59,790
So if we look at the St.
Petersburg troll farm,

319
00:17:59,790 --> 00:18:01,177
and you ask a government person,

320
00:18:01,177 --> 00:18:03,270
"Okay, how do we sanction this?"

321
00:18:03,270 --> 00:18:05,970
They go, "I don't know.
Cut them off the Internet.

322
00:18:05,970 --> 00:18:07,947
Don't know what that means, but."

323
00:18:08,940 --> 00:18:11,250
But if you talk with an
internet service provider,

324
00:18:11,250 --> 00:18:12,510
they're like, "Okay, well,

325
00:18:12,510 --> 00:18:14,610
we'll stop routing their IP addresses.

326
00:18:14,610 --> 00:18:15,443
How do we do that?

327
00:18:15,443 --> 00:18:17,880
Well, we're gonna look in the RIR who is,

328
00:18:17,880 --> 00:18:19,830
and see what IP addresses they have.

329
00:18:19,830 --> 00:18:22,080
We're gonna see what autonomous
system number they're using

330
00:18:22,080 --> 00:18:23,340
to originate that.

331
00:18:23,340 --> 00:18:25,320
We're gonna see what
other IP address blocks

332
00:18:25,320 --> 00:18:27,270
are being originated from the same AS.

333
00:18:27,270 --> 00:18:29,910
We're gonna see who their
upstream transit providers are,

334
00:18:29,910 --> 00:18:33,000
we're gonna go have a
chat with those folks.

335
00:18:33,000 --> 00:18:36,090
We'll see if they're multihomed, so forth.

336
00:18:36,090 --> 00:18:38,070
On the domain name side,

337
00:18:38,070 --> 00:18:40,320
look and see what the name servers are,

338
00:18:40,320 --> 00:18:44,640
what the contact information
for the registration is,

339
00:18:44,640 --> 00:18:47,430
who the registrar is, all the things.

340
00:18:47,430 --> 00:18:50,190
And we'll build up a little
set of the domain names

341
00:18:50,190 --> 00:18:52,560
that we think this party is using.

342
00:18:52,560 --> 00:18:56,310
We'll look to see what email addresses

343
00:18:56,310 --> 00:19:01,200
they have used on things, who
their email providers are.

344
00:19:01,200 --> 00:19:03,660
All of these are things that,

345
00:19:03,660 --> 00:19:06,270
from the internet perspective,

346
00:19:06,270 --> 00:19:09,420
we're very used to doing
in association with abuse.

347
00:19:09,420 --> 00:19:10,830
So if somebody is spamming,

348
00:19:10,830 --> 00:19:13,950
if somebody is running a botnet,

349
00:19:13,950 --> 00:19:15,300
we've got a lot of experience

350
00:19:15,300 --> 00:19:17,880
with tracking these things
down, doing the detective work,

351
00:19:17,880 --> 00:19:20,610
figuring out what the
associated resources are

352
00:19:20,610 --> 00:19:22,590
and shutting them down.

353
00:19:22,590 --> 00:19:26,820
This is no different. It's
exactly the same problem set,

354
00:19:26,820 --> 00:19:30,690
it's just a different
definition of badness.

355
00:19:30,690 --> 00:19:32,970
It's not our internet
definition of badness,

356
00:19:32,970 --> 00:19:35,910
it's a general human rights

357
00:19:35,910 --> 00:19:39,663
and international law
definition of badness.

358
00:19:42,630 --> 00:19:46,050
Now, as we got into all this,
what we discovered is that

359
00:19:46,050 --> 00:19:49,350
the thing that governments
are really bad at

360
00:19:49,350 --> 00:19:52,620
is publishing their list
of sanctioned entities.

361
00:19:52,620 --> 00:19:54,330
You'd think that would be kind of basic,

362
00:19:54,330 --> 00:19:57,067
but the way governments
handle this is like,

363
00:19:57,067 --> 00:19:59,043
"Hey you, take a memo.

364
00:20:00,030 --> 00:20:02,640
Put it on top of the stack of other memos

365
00:20:02,640 --> 00:20:05,187
from other sanctions that
we published before."

366
00:20:06,030 --> 00:20:09,780
Trying to get this
electronically on the internet

367
00:20:09,780 --> 00:20:10,890
is really, really tough.

368
00:20:10,890 --> 00:20:14,760
The only government that
publishes their sanctions list

369
00:20:14,760 --> 00:20:17,850
in a machine-readable format is the UK,

370
00:20:17,850 --> 00:20:20,733
and that's been down for
the last four months.

371
00:20:21,660 --> 00:20:24,573
So normally it works,
but just not recently.

372
00:20:25,710 --> 00:20:29,793
So they actually have
JSON files at a known URL.

373
00:20:30,660 --> 00:20:34,260
Everybody else is like, "Oh,
well, we can fax those to you.

374
00:20:34,260 --> 00:20:38,097
Or, let us scan them. Publish the PDF."

375
00:20:39,030 --> 00:20:41,253
So, that needs to be fixed.

376
00:20:44,970 --> 00:20:47,070
Internet service providers

377
00:20:47,070 --> 00:20:48,750
wanna to be compliant with the law.

378
00:20:48,750 --> 00:20:50,490
They don't wanna be in
trouble with the governments

379
00:20:50,490 --> 00:20:52,590
of the countries that they do business in.

380
00:20:53,580 --> 00:20:55,500
But they're mostly unregulated.

381
00:20:55,500 --> 00:20:57,180
This is completely different than banks.

382
00:20:57,180 --> 00:20:59,370
Banks have to deal with
a ton of regulation,

383
00:20:59,370 --> 00:21:02,820
and government regulators who
understand their business,

384
00:21:02,820 --> 00:21:04,500
know what's going on.

385
00:21:04,500 --> 00:21:07,080
ISPs don't have that
connection with government

386
00:21:07,080 --> 00:21:09,330
because they're not
regulated in most places.

387
00:21:10,560 --> 00:21:12,840
They also don't have
Know Your Customer laws

388
00:21:12,840 --> 00:21:13,673
that apply to them.

389
00:21:13,673 --> 00:21:17,520
If you're an ISP, you don't
have to sit your customer down,

390
00:21:17,520 --> 00:21:19,920
interview them, understand their business,

391
00:21:19,920 --> 00:21:22,200
take lots of records about
them and hold those records,

392
00:21:22,200 --> 00:21:25,140
and then check back with
them once a year to see if

393
00:21:25,140 --> 00:21:27,840
they're still doing the same
business they used to be.

394
00:21:28,770 --> 00:21:30,540
Whereas, in a lot of countries,

395
00:21:30,540 --> 00:21:32,460
Know Your Customer applies to

396
00:21:32,460 --> 00:21:34,173
pretty much any financial service.

397
00:21:36,510 --> 00:21:41,510
So, that doesn't really
prepare ISPs for dealing with

398
00:21:41,670 --> 00:21:44,613
sanctions enforcement stuff.

399
00:21:45,960 --> 00:21:49,410
But at the same time, ISPs
face all kinds of risks.

400
00:21:49,410 --> 00:21:54,410
So there are fines and criminal
prosecution possible for

401
00:21:55,110 --> 00:21:57,210
over-compliance, under-compliance,

402
00:21:57,210 --> 00:21:59,670
non-compliance, miscompliance.

403
00:21:59,670 --> 00:22:02,193
Getting it wrong has liability.

404
00:22:03,330 --> 00:22:05,250
But then there also the secondary effects.

405
00:22:05,250 --> 00:22:10,250
So, if you have customers, and
the customer gets sanctioned,

406
00:22:10,470 --> 00:22:14,670
and you don't sanction
them but their bank does,

407
00:22:14,670 --> 00:22:16,590
suddenly, they're not
gonna be able to pay you

408
00:22:16,590 --> 00:22:18,630
for the service that they've used.

409
00:22:18,630 --> 00:22:22,200
So, if you look at the
Russia/Ukraine conflict,

410
00:22:22,200 --> 00:22:24,750
this is actually what wound up happening,

411
00:22:24,750 --> 00:22:26,490
a bunch of internet service providers

412
00:22:26,490 --> 00:22:29,160
cut off all their Russian customers

413
00:22:29,160 --> 00:22:31,710
because they were sort of
looking out a few months.

414
00:22:31,710 --> 00:22:36,710
They were saying, "Well,
it's March 3 right now,

415
00:22:37,080 --> 00:22:42,080
and we bill monthly, net 30.

416
00:22:42,480 --> 00:22:44,100
So at the end of March,

417
00:22:44,100 --> 00:22:45,870
we're gonna send out a bill for March

418
00:22:45,870 --> 00:22:48,900
and it's gonna be due at the end of April.

419
00:22:48,900 --> 00:22:52,920
So, 60 days from now,

420
00:22:52,920 --> 00:22:56,400
will some of my customers
have been sanctioned,

421
00:22:56,400 --> 00:22:59,820
have their accounts frozen
and be unable to pay me?

422
00:22:59,820 --> 00:23:03,420
Don't know. Let's just
get rid of that risk.

423
00:23:03,420 --> 00:23:07,770
60 days from now, will Russia as a whole,

424
00:23:07,770 --> 00:23:10,170
be having trouble paying bills

425
00:23:10,170 --> 00:23:12,270
because the Ruble will have collapsed

426
00:23:12,270 --> 00:23:14,310
because of banking sanctions?

427
00:23:14,310 --> 00:23:16,890
Don't know. Okay, well, let's preemptively

428
00:23:16,890 --> 00:23:18,300
get rid of those customers."

429
00:23:18,300 --> 00:23:23,300
So we saw this wave of over-compliance

430
00:23:23,880 --> 00:23:26,100
back at the beginning of March

431
00:23:26,100 --> 00:23:29,370
of internet service providers not knowing

432
00:23:29,370 --> 00:23:33,240
what they should do, and doing too much.

433
00:23:33,240 --> 00:23:35,763
Some of them. Others
didn't do anything at all.

434
00:23:38,100 --> 00:23:41,610
And one, notably, said that,

435
00:23:41,610 --> 00:23:44,700
well, nobody can tell them
who to do business with.

436
00:23:44,700 --> 00:23:47,430
They were gonna keep
on selling services to

437
00:23:47,430 --> 00:23:48,903
Wagner and the troll farm.

438
00:23:50,340 --> 00:23:52,320
Then they lobbied the US government

439
00:23:52,320 --> 00:23:55,740
to get the US government
to put in an exemption

440
00:23:55,740 --> 00:23:58,980
for them to sell internet services

441
00:23:58,980 --> 00:24:01,170
to sanctioned entities at Russia.

442
00:24:01,170 --> 00:24:04,200
I have no idea why the US
government went along with that,

443
00:24:04,200 --> 00:24:06,750
and all the sanctions
people in other countries,

444
00:24:06,750 --> 00:24:08,790
looking at the US and wondering

445
00:24:08,790 --> 00:24:10,240
what the hell happened there.

446
00:24:11,100 --> 00:24:16,100
Anyway. So, there's also a problem that

447
00:24:16,110 --> 00:24:18,873
we discovered with network operators.

448
00:24:20,130 --> 00:24:25,130
There's a libertarian
streak that comes from

449
00:24:25,260 --> 00:24:28,200
how the internet got set up,

450
00:24:28,200 --> 00:24:31,050
switched from being a
US governmental project

451
00:24:31,050 --> 00:24:35,250
to a private sector thing
in 1992, dot-com bubble.

452
00:24:35,250 --> 00:24:36,730
A lot of people in this

453
00:24:40,957 --> 00:24:44,613
"this isn't a government
project anymore" mode,

454
00:24:46,980 --> 00:24:48,870
and there were also a lot of people

455
00:24:48,870 --> 00:24:51,960
who are very into privacy.

456
00:24:51,960 --> 00:24:56,730
And so you get some people

457
00:24:56,730 --> 00:24:58,890
running internet service providers

458
00:24:58,890 --> 00:25:02,550
who feel like they really
need to defend their customers

459
00:25:02,550 --> 00:25:04,230
against their government.

460
00:25:04,230 --> 00:25:06,180
Like, "If we're gonna choose sides here,

461
00:25:06,180 --> 00:25:08,490
we're always gonna choose
our customer's side."

462
00:25:08,490 --> 00:25:10,410
Now in principle, that's fine.

463
00:25:10,410 --> 00:25:13,830
But if, out of your 100,000 customers,

464
00:25:13,830 --> 00:25:18,060
two of them are really awful
human rights violators,

465
00:25:18,060 --> 00:25:19,830
and they get sanctioned,

466
00:25:19,830 --> 00:25:24,360
maybe those aren't the two that
you choose to go to bat for.

467
00:25:24,360 --> 00:25:27,090
So, this made a bit of a conflict there.

468
00:25:27,090 --> 00:25:30,130
And also, this sort of notion of

469
00:25:31,740 --> 00:25:33,060
the internet should be open

470
00:25:33,060 --> 00:25:36,450
and we shouldn't judge people
based on their content.

471
00:25:36,450 --> 00:25:40,110
And fine, if your customer is a furry,

472
00:25:40,110 --> 00:25:42,180
don't judge them on their content.

473
00:25:42,180 --> 00:25:47,180
But if they're killing lots of civilians,

474
00:25:47,250 --> 00:25:49,203
maybe judging that is okay.

475
00:25:51,780 --> 00:25:53,340
Internet network operators are also

476
00:25:53,340 --> 00:25:56,040
really, really good at blocking stuff.

477
00:25:56,040 --> 00:25:57,990
Lots of practice at blocking things.

478
00:25:57,990 --> 00:25:59,940
So again, this is really
just a question of

479
00:25:59,940 --> 00:26:01,410
matching up the sanctions

480
00:26:01,410 --> 00:26:05,190
with the already existing
skills of blocking.

481
00:26:05,190 --> 00:26:09,060
So, the German internet service providers

482
00:26:09,060 --> 00:26:10,807
went to their regulator and said,

483
00:26:10,807 --> 00:26:12,750
"We'd like some guidance here.

484
00:26:12,750 --> 00:26:15,750
Please tell us more about
what you want us to do."

485
00:26:15,750 --> 00:26:19,500
And the German regulator came back

486
00:26:19,500 --> 00:26:22,837
with a pretty clear statement
that basically said,

487
00:26:22,837 --> 00:26:25,830
"Well, you do too much, you do too little,

488
00:26:25,830 --> 00:26:28,920
you're either gonna get
prosecuted or hauled into court.

489
00:26:28,920 --> 00:26:32,100
Your choice. So maybe
you'd wanna just figure out

490
00:26:32,100 --> 00:26:33,300
what we want, and do it.

491
00:26:35,220 --> 00:26:39,963
So, the Germans anyway were pretty clear,

492
00:26:41,310 --> 00:26:43,590
but that's probably representative

493
00:26:43,590 --> 00:26:46,240
of the response that any
other government would give.

494
00:26:49,470 --> 00:26:52,170
You go asking governments whether
you need to follow the law

495
00:26:52,170 --> 00:26:54,933
or not, and the answer
is usually gonna be yes.

496
00:26:55,920 --> 00:26:59,823
So, we got this project going,

497
00:27:01,110 --> 00:27:04,680
internet style, just a
bunch of folks, volunteers,

498
00:27:04,680 --> 00:27:08,640
doing their thing, to
try to work through this

499
00:27:08,640 --> 00:27:12,780
and figure out how to get
internet service providers

500
00:27:12,780 --> 00:27:15,150
and governments into alignment on this

501
00:27:15,150 --> 00:27:18,210
because they both want to be, right?

502
00:27:18,210 --> 00:27:20,520
The internet service providers
want to be in compliance

503
00:27:20,520 --> 00:27:23,580
with the law, they don't want
to get prosecuted or sued,

504
00:27:23,580 --> 00:27:26,250
governments want to be
able to define a sanction

505
00:27:26,250 --> 00:27:30,600
and have it enacted by the private sector

506
00:27:30,600 --> 00:27:35,600
as intended, not overdone
or underdone, or whatever.

507
00:27:35,880 --> 00:27:38,043
So everybody wants to meet in the middle.

508
00:27:39,120 --> 00:27:40,563
There's a lot of goodwill.

509
00:27:41,460 --> 00:27:43,980
Now it's just kind of a question of,

510
00:27:43,980 --> 00:27:45,693
since March we've been working-

511
00:27:46,980 --> 00:27:47,820
- [Attendee] I think it's only one, right,

512
00:27:47,820 --> 00:27:49,020
'cause he's on the left?

513
00:27:51,120 --> 00:27:52,650
- Hello? Okay.

514
00:27:52,650 --> 00:27:54,690
Working through the specifics

515
00:27:54,690 --> 00:27:56,670
and figuring out where the problems are.

516
00:27:56,670 --> 00:27:59,130
And like I said, number
one biggest problem

517
00:27:59,130 --> 00:28:01,620
is getting governments
to publish the list of

518
00:28:01,620 --> 00:28:03,870
who has been sanctioned

519
00:28:03,870 --> 00:28:07,533
in a way that we can
consume electronically.

520
00:28:09,630 --> 00:28:14,310
So, this organization, we
got five working groups:

521
00:28:14,310 --> 00:28:18,390
policy, intelligence, oversight,
operations, and research.

522
00:28:18,390 --> 00:28:22,050
The policy group is trying to figure out

523
00:28:22,050 --> 00:28:23,910
who's been sanctioned.

524
00:28:23,910 --> 00:28:26,520
The intelligence group
then tries to figure out

525
00:28:26,520 --> 00:28:28,650
what internet resources are associated

526
00:28:28,650 --> 00:28:30,630
with sanctioned entities.

527
00:28:30,630 --> 00:28:34,080
The oversight board then
looks at the result,

528
00:28:34,080 --> 00:28:38,340
does a last sanity check before
handing it off to operations

529
00:28:38,340 --> 00:28:43,340
who publish the resources
of the sanctioned entities

530
00:28:43,620 --> 00:28:48,073
as a realtime feed using RPZ and BGP.

531
00:28:49,200 --> 00:28:52,080
So, RPZ for the domain names,

532
00:28:52,080 --> 00:28:55,290
BGP for the routes and autonomous systems,

533
00:28:55,290 --> 00:28:57,840
or the IP addresses,
not autonomous systems.

534
00:28:57,840 --> 00:29:00,810
And then the research group is there to

535
00:29:00,810 --> 00:29:03,300
track how all this is going,

536
00:29:03,300 --> 00:29:08,043
collect statistics, run
the beacon, so forth.

537
00:29:09,540 --> 00:29:11,493
So where do things stand right now?

538
00:29:12,810 --> 00:29:16,350
The main thing that's
going on right now is

539
00:29:16,350 --> 00:29:21,350
we've had a lot of talk
in the European Union,

540
00:29:22,110 --> 00:29:25,473
among a lot of governments about this.

541
00:29:27,000 --> 00:29:29,550
Everybody is happy with the idea.

542
00:29:29,550 --> 00:29:32,670
Now it's this question of
working through the specifics,

543
00:29:32,670 --> 00:29:36,270
and the OECD seems like
the good place to do that.

544
00:29:36,270 --> 00:29:40,440
And so there's been a
work program going for

545
00:29:40,440 --> 00:29:42,480
3/4 months now,

546
00:29:42,480 --> 00:29:47,480
well, since the beginning
of April, in the OECD.

547
00:29:47,550 --> 00:29:51,063
So the OECD is like the
civilian counterpart to NATO.

548
00:29:52,080 --> 00:29:53,310
After World War II,

549
00:29:53,310 --> 00:29:56,580
there was the Marshall
Plan to rebuild Europe.

550
00:29:56,580 --> 00:29:58,440
The OECD, the Organization for

551
00:29:58,440 --> 00:30:00,180
Economic Cooperation and Development

552
00:30:00,180 --> 00:30:03,720
is the civilian side of that,
NATO is the military side.

553
00:30:03,720 --> 00:30:07,500
So for dealing with economic stuff,

554
00:30:07,500 --> 00:30:12,500
the OECD is the place to get
standards and best practices,

555
00:30:13,350 --> 00:30:16,950
harmonized, then published
for the member countries,

556
00:30:16,950 --> 00:30:19,810
which is the 38 largest

557
00:30:23,280 --> 00:30:24,753
free market democracies.

558
00:30:27,480 --> 00:30:31,980
So, the thing that we're
trying to get standardized is

559
00:30:31,980 --> 00:30:34,890
how the list gets published

560
00:30:34,890 --> 00:30:37,713
because different countries
have different lists.

561
00:30:39,300 --> 00:30:40,770
And right now, it's a huge mess,

562
00:30:40,770 --> 00:30:43,070
I'll get into the details
of that in a little.

563
00:30:44,520 --> 00:30:47,950
We also need governments
to be really clear that if

564
00:30:49,190 --> 00:30:53,790
a network operator uses this mechanism

565
00:30:53,790 --> 00:30:57,090
to enact a sanction,

566
00:30:57,090 --> 00:31:00,120
that that is not over or under-compliance,

567
00:31:00,120 --> 00:31:02,283
that that is sufficient compliance.

568
00:31:04,500 --> 00:31:07,380
Right now, all the technical
mechanisms of doing this

569
00:31:07,380 --> 00:31:09,270
are proven out,

570
00:31:09,270 --> 00:31:11,110
and we're not

571
00:31:13,980 --> 00:31:16,803
putting anything into the feeds yet.

572
00:31:18,180 --> 00:31:20,010
And all of these working groups are up,

573
00:31:20,010 --> 00:31:21,480
except the intelligence group,

574
00:31:21,480 --> 00:31:25,260
we didn't want to have a
bunch of frustrated detectives

575
00:31:25,260 --> 00:31:28,210
trying to detect things
if there wasn't yet

576
00:31:29,640 --> 00:31:32,733
a clean feed of data
coming in from governments.

577
00:31:34,590 --> 00:31:37,500
So I mentioned this earlier,

578
00:31:37,500 --> 00:31:39,217
I just wanted to have a slide about it,

579
00:31:39,217 --> 00:31:41,640
"Do sanctions disconnect
anybody from the internet?"

580
00:31:41,640 --> 00:31:44,077
If you tell internet service providers,

581
00:31:44,077 --> 00:31:47,607
"Cut off this party,"

582
00:31:48,540 --> 00:31:50,760
are they gonna be off the internet?

583
00:31:50,760 --> 00:31:52,380
And the answer is no.

584
00:31:52,380 --> 00:31:54,660
Just like if you shut
down their bank accounts,

585
00:31:54,660 --> 00:31:56,250
it doesn't prevent them from using money,

586
00:31:56,250 --> 00:31:57,840
it just makes it more difficult.

587
00:31:57,840 --> 00:32:00,603
So, then there's sort of this question,

588
00:32:09,930 --> 00:32:14,700
there are people on the libertarian side

589
00:32:14,700 --> 00:32:16,050
on one hand

590
00:32:16,050 --> 00:32:19,800
and people on the
extreme human rights side

591
00:32:19,800 --> 00:32:21,090
on the other hand,

592
00:32:21,090 --> 00:32:25,140
who think that,

593
00:32:25,140 --> 00:32:30,140
because communications are a

594
00:32:30,360 --> 00:32:32,970
defined human right,

595
00:32:32,970 --> 00:32:35,640
that messing with people's communications

596
00:32:35,640 --> 00:32:36,933
is a really bad idea.

597
00:32:41,310 --> 00:32:45,840
So, if it were the case that

598
00:32:45,840 --> 00:32:47,940
sanctioning somebody's
internet communications

599
00:32:47,940 --> 00:32:49,680
would cut them off the internet,

600
00:32:49,680 --> 00:32:51,930
that would be a valid point.

601
00:32:51,930 --> 00:32:53,580
But since it's really just a matter of

602
00:32:53,580 --> 00:32:55,890
increasing friction for them,

603
00:32:55,890 --> 00:32:59,463
their human right to communicate
has not been violated.

604
00:33:00,660 --> 00:33:02,250
So then there's this question about

605
00:33:02,250 --> 00:33:04,980
what does this friction mean?

606
00:33:04,980 --> 00:33:06,960
We're not opening up their bank account

607
00:33:06,960 --> 00:33:08,133
and taking money out.

608
00:33:10,380 --> 00:33:12,810
So, what's happening there?

609
00:33:12,810 --> 00:33:16,470
Internet communications is
all about collaboration.

610
00:33:16,470 --> 00:33:18,360
Internet service providers get together

611
00:33:18,360 --> 00:33:19,860
at internet exchange points,

612
00:33:19,860 --> 00:33:21,990
they collaboratively operate them.

613
00:33:21,990 --> 00:33:24,480
The bandwidth is produced
in the exchange points,

614
00:33:24,480 --> 00:33:28,410
ISPs take it and deliver it to end users.

615
00:33:28,410 --> 00:33:32,073
And all of that happens
through cooperation.

616
00:33:32,940 --> 00:33:35,760
When we cooperate, we get efficiencies.

617
00:33:35,760 --> 00:33:38,280
If we work together on something,

618
00:33:38,280 --> 00:33:41,970
that efficiency makes
something more valuable to us

619
00:33:41,970 --> 00:33:43,980
or cheaper for us.

620
00:33:43,980 --> 00:33:47,250
If we choose not to
cooperate with someone,

621
00:33:47,250 --> 00:33:50,970
their costs go up because
their efficiencies get worse.

622
00:33:50,970 --> 00:33:55,350
So, what's happening, if we stop routing

623
00:33:55,350 --> 00:33:58,803
IP addresses on behalf
of a sanctioned entity,

624
00:33:58,803 --> 00:34:01,410
it's not that we're cutting
'em off the internet,

625
00:34:01,410 --> 00:34:03,810
but we're saying, "We're
no longer going to

626
00:34:03,810 --> 00:34:08,580
cooperate with you to make
things more efficient for you.

627
00:34:08,580 --> 00:34:12,600
So, your costs are your costs,
whatever those might be,

628
00:34:12,600 --> 00:34:14,310
not my problem."

629
00:34:14,310 --> 00:34:17,313
So that's the mechanism
that's happening there.

630
00:34:18,210 --> 00:34:20,060
A few other problems that we ran into

631
00:34:20,970 --> 00:34:23,700
that there aren't
necessarily good answers to.

632
00:34:23,700 --> 00:34:26,790
Let's say that the troll
farm goes and finds

633
00:34:26,790 --> 00:34:30,150
the public school next
door and gets on their wifi

634
00:34:30,150 --> 00:34:32,800
and routes all their traffic
through a public school.

635
00:34:33,870 --> 00:34:34,860
We got two choices.

636
00:34:34,860 --> 00:34:39,000
One choice is, "Okay, now we
block that public school also,"

637
00:34:39,000 --> 00:34:41,250
or, we say, "Well, we were trying to

638
00:34:41,250 --> 00:34:42,450
sanction the troll farm,

639
00:34:42,450 --> 00:34:45,747
but I guess we're not gonna do this one."

640
00:34:47,190 --> 00:34:49,590
Neither of those is a great answer.

641
00:34:49,590 --> 00:34:51,663
If you decide to block the school,

642
00:34:52,744 --> 00:34:56,227
the answer that sanctions
people have come up with is,

643
00:34:56,227 --> 00:34:59,070
"Well, yes, that harms them,

644
00:34:59,070 --> 00:35:00,990
but we're not the ones causing the harm.

645
00:35:00,990 --> 00:35:02,250
We're the proximate cause

646
00:35:02,250 --> 00:35:04,740
but we're not the ultimate
cause of that harm.

647
00:35:04,740 --> 00:35:06,360
It's the party that used them

648
00:35:06,360 --> 00:35:08,010
to try and circumvent the sanction

649
00:35:08,010 --> 00:35:09,987
that's causing that harm."

650
00:35:11,820 --> 00:35:14,420
That's not an answer that's
gonna satisfy everybody.

651
00:35:15,450 --> 00:35:18,540
We've got another problem
specific to domain names,

652
00:35:18,540 --> 00:35:21,240
which is, if we block a domain name,

653
00:35:21,240 --> 00:35:23,640
then somebody creates a subdomain of that,

654
00:35:23,640 --> 00:35:25,890
should that also be blocked,

655
00:35:25,890 --> 00:35:27,993
or, are subdomains fair game?

656
00:35:29,160 --> 00:35:31,650
Again, there's the risk
of over-compliance here

657
00:35:31,650 --> 00:35:35,400
if we block the domain
and everything below it,

658
00:35:35,400 --> 00:35:37,980
that may catch other parties, who knows,

659
00:35:37,980 --> 00:35:40,180
might take a little bit
more detective work.

660
00:35:41,760 --> 00:35:45,660
We've also got conflicts with
privacy and anti-trust law.

661
00:35:45,660 --> 00:35:49,200
In a lot of countries, the
information needed to identify

662
00:35:49,200 --> 00:35:53,490
a sanctioned entity is
gonna be PII, right?

663
00:35:53,490 --> 00:35:58,110
It's gonna be protected
personal information,

664
00:35:58,110 --> 00:35:59,670
and there are gonna be a lot of rights

665
00:35:59,670 --> 00:36:01,440
that they have around that.

666
00:36:01,440 --> 00:36:04,650
And so, if government wants
us to take that information

667
00:36:04,650 --> 00:36:08,580
and use it, not for the user's benefit,

668
00:36:08,580 --> 00:36:11,130
but for the government's
benefit and public benefit,

669
00:36:11,130 --> 00:36:14,553
then we need a carve-out in
law saying that that's okay.

670
00:36:15,510 --> 00:36:17,730
Likewise, if we're gonna work together

671
00:36:17,730 --> 00:36:21,843
with other internet
operators to block somebody,

672
00:36:23,550 --> 00:36:26,850
we need an exemption under
law from anti-trust that

673
00:36:26,850 --> 00:36:28,983
would allow us to talk about that.

674
00:36:33,000 --> 00:36:36,390
And now we're getting into the trivia

675
00:36:36,390 --> 00:36:38,610
and I'm gonna blow through a lot of this,

676
00:36:38,610 --> 00:36:40,320
but I'm leaving it in the slides.

677
00:36:40,320 --> 00:36:42,390
So if you guys are interested

678
00:36:42,390 --> 00:36:45,270
and wanna look at the details
of how all this works,

679
00:36:45,270 --> 00:36:47,460
it's in the slide deck.

680
00:36:47,460 --> 00:36:51,720
The beacon is an artificial
set of domain names,

681
00:36:51,720 --> 00:36:54,300
networks, and autonomous system numbers

682
00:36:54,300 --> 00:36:57,690
that are getting sanctioned, artificially,

683
00:36:57,690 --> 00:36:59,220
not by an actual government,

684
00:36:59,220 --> 00:37:03,120
but as part of this
process so that researchers

685
00:37:03,120 --> 00:37:06,240
can check and see how far the effects

686
00:37:06,240 --> 00:37:08,100
of this mechanism are propagating.

687
00:37:08,100 --> 00:37:10,830
And it was important to
get this up and running

688
00:37:10,830 --> 00:37:15,120
on day zero so that the
baseline would start at zero

689
00:37:15,120 --> 00:37:16,323
for the effectiveness.

690
00:37:18,570 --> 00:37:19,590
Number one problem

691
00:37:19,590 --> 00:37:22,920
we're having with the
data is transliteration.

692
00:37:22,920 --> 00:37:26,010
All these governments decide
that it's simpler for them

693
00:37:26,010 --> 00:37:27,930
to use their local character set

694
00:37:27,930 --> 00:37:31,530
than the character set
used by the language

695
00:37:31,530 --> 00:37:34,980
of the place where the
sanctioned entity is.

696
00:37:34,980 --> 00:37:39,980
So, you get Cyrillic and
Arabic transliterated into

697
00:37:40,140 --> 00:37:43,380
Roman characters, and everybody
does that differently.

698
00:37:43,380 --> 00:37:46,680
So here we've got two examples.

699
00:37:46,680 --> 00:37:51,303
The first one, Anatoliy,
common enough name,

700
00:37:52,500 --> 00:37:54,900
three different common
transliterations of it

701
00:37:54,900 --> 00:37:56,223
into Roman characters,

702
00:37:57,660 --> 00:38:01,050
and that problem is just rampant.

703
00:38:01,050 --> 00:38:03,153
Every single sanctioned entity,

704
00:38:04,260 --> 00:38:05,820
sanctioned in three different countries,

705
00:38:05,820 --> 00:38:08,550
they're gonna spell it
three different ways.

706
00:38:08,550 --> 00:38:10,920
So, Unicode is our friend, right?

707
00:38:10,920 --> 00:38:12,780
Unicode solves this problem.

708
00:38:12,780 --> 00:38:15,900
Take the official name of the entity,

709
00:38:15,900 --> 00:38:19,320
as defined by their own
government in their own documents,

710
00:38:19,320 --> 00:38:23,550
use that in Unicode as our primary label,

711
00:38:23,550 --> 00:38:26,040
and then, sure, have transliterations,

712
00:38:26,040 --> 00:38:29,340
but mark them as not the canonical data.

713
00:38:29,340 --> 00:38:30,930
Likewise, we've got all kinds of things

714
00:38:30,930 --> 00:38:32,910
that get abbreviated a
zillion different ways.

715
00:38:32,910 --> 00:38:36,720
So, Open Joint Stock Company

716
00:38:36,720 --> 00:38:39,120
gets abbreviated a zillion different ways.

717
00:38:39,120 --> 00:38:42,210
That is just a property.

718
00:38:42,210 --> 00:38:47,210
It's a property of the other
name that can be tokenized.

719
00:38:47,670 --> 00:38:50,853
That token can be represented
in local language wherever.

720
00:38:52,230 --> 00:38:53,700
A lot of these problems get solved

721
00:38:53,700 --> 00:38:55,860
by having the right database schema,

722
00:38:55,860 --> 00:39:00,300
and defining the data types in
the schema in a sensible way.

723
00:39:00,300 --> 00:39:03,540
And I am going to blow through slides

724
00:39:03,540 --> 00:39:06,690
explaining all the different
things that we think

725
00:39:06,690 --> 00:39:09,780
we've learned about how to
do that database schema.

726
00:39:09,780 --> 00:39:14,310
But you go to the sanctions.net website,

727
00:39:14,310 --> 00:39:16,260
it's a Wiki,

728
00:39:16,260 --> 00:39:20,340
your contributions and thoughts
are very, very welcome.

729
00:39:20,340 --> 00:39:24,303
Okay. So, folks have
questions about this stuff.

730
00:39:28,050 --> 00:39:29,850
Sir?
- [Audience Member] Yeah.

731
00:39:29,850 --> 00:39:31,680
Thank you for that talk.

732
00:39:31,680 --> 00:39:33,960
It seems to me the problem
with transliteration

733
00:39:33,960 --> 00:39:35,610
that you were just talking about,

734
00:39:36,870 --> 00:39:39,821
artificial intelligence,
natural language processing

735
00:39:39,821 --> 00:39:42,420
and standardizing that could go a long way

736
00:39:42,420 --> 00:39:44,220
in solving that problem.

737
00:39:44,220 --> 00:39:45,993
So, are you looking into that?

738
00:39:47,940 --> 00:39:50,730
- Alright. I don't know
if everybody was able to

739
00:39:50,730 --> 00:39:52,620
hear the question clearly.

740
00:39:52,620 --> 00:39:55,560
Question is around natural
language processing

741
00:39:55,560 --> 00:39:57,960
and artificial intelligence
and machine learning,

742
00:39:57,960 --> 00:40:00,480
could those help in identifying?

743
00:40:00,480 --> 00:40:04,680
I think the problem here
is that machine learning,

744
00:40:04,680 --> 00:40:06,540
if you've got millions
and millions of things

745
00:40:06,540 --> 00:40:08,910
to train it on, sure.

746
00:40:08,910 --> 00:40:12,750
This is more like the no-fly list

747
00:40:12,750 --> 00:40:15,690
where everybody named Mohammed

748
00:40:15,690 --> 00:40:18,213
is suddenly no longer
allowed on an airplane.

749
00:40:19,440 --> 00:40:21,690
It's pretty easy to get wrong.

750
00:40:21,690 --> 00:40:24,240
If you get it wrong, it
has pretty bad consequences

751
00:40:24,240 --> 00:40:25,890
for somebody specific.

752
00:40:25,890 --> 00:40:29,793
There aren't a lot of cases to train on.

753
00:40:30,900 --> 00:40:34,320
And knowing when you've gotten it right

754
00:40:34,320 --> 00:40:37,120
and when you've gotten it
wrong is not necessarily easy.

755
00:40:38,640 --> 00:40:43,263
And it's not like the
answer is unknowable.

756
00:40:45,420 --> 00:40:49,350
Knowing what somebody's name is

757
00:40:49,350 --> 00:40:51,810
as spelled in Arabic,

758
00:40:51,810 --> 00:40:53,790
it's their name, it's on their passport,

759
00:40:53,790 --> 00:40:56,253
it's on a zillion documents.

760
00:40:58,920 --> 00:41:01,110
If we can identify the person at all,

761
00:41:01,110 --> 00:41:04,263
probably we can identify them
in their native language.

762
00:41:05,610 --> 00:41:09,030
Is that name gonna be
unique? Not necessarily.

763
00:41:09,030 --> 00:41:13,290
But, put together with
a bunch of other things,

764
00:41:13,290 --> 00:41:18,290
like, if it's a person, their
height, their date of birth,

765
00:41:21,090 --> 00:41:23,193
identifying characteristics.

766
00:41:24,544 --> 00:41:25,500
You put enough of those things together

767
00:41:25,500 --> 00:41:30,090
and you've got a unique identity defined.

768
00:41:30,090 --> 00:41:33,060
This kind of thing, yeah, there
is a lot of technology for.

769
00:41:33,060 --> 00:41:36,510
I mean, we spent the
last 20 years developing

770
00:41:36,510 --> 00:41:40,140
machine learning so that
we could identify consumers

771
00:41:40,140 --> 00:41:41,910
uniquely and make absolutely sure

772
00:41:41,910 --> 00:41:45,030
that we can sell everything
to the right person.

773
00:41:45,030 --> 00:41:48,210
Sure, we know how to identify people.

774
00:41:48,210 --> 00:41:50,370
There are ways in which
machine learning can help,

775
00:41:50,370 --> 00:41:54,600
but the name part is not that big a deal

776
00:41:54,600 --> 00:41:56,820
and doesn't need giant fire power.

777
00:41:56,820 --> 00:42:00,960
It just needs government
people to understand

778
00:42:00,960 --> 00:42:02,703
what Unicode is. Sir!

779
00:42:04,290 --> 00:42:05,123
- [Audience Member] Bill, can you hear me?

780
00:42:05,123 --> 00:42:06,690
First of all, I think you did a great job.

781
00:42:06,690 --> 00:42:10,183
So, this beginning thing
about not doing necessarily

782
00:42:10,183 --> 00:42:12,300
a good communication, I thought
you did an excellent job.

783
00:42:12,300 --> 00:42:13,680
There's number one.

784
00:42:13,680 --> 00:42:17,890
Number two. Could you expand
or give your opinion on

785
00:42:19,423 --> 00:42:21,300
the registrars and registers of

786
00:42:21,300 --> 00:42:23,550
the who host these
domains and then forward,

787
00:42:23,550 --> 00:42:27,360
or integrate them into
everything you were saying,

788
00:42:27,360 --> 00:42:29,133
using that as an example, please?

789
00:42:30,210 --> 00:42:35,040
- Okay. So question
regarding the integration

790
00:42:35,040 --> 00:42:38,760
into all this of the
domain name registrars.

791
00:42:38,760 --> 00:42:42,090
So with domain names,
we've got the registrant,

792
00:42:42,090 --> 00:42:45,870
who is the ultimate end
user of the domain name,

793
00:42:45,870 --> 00:42:48,690
or the party that bought it.

794
00:42:48,690 --> 00:42:50,370
We've got the registrar,

795
00:42:50,370 --> 00:42:53,310
who is the party that sold it to them.

796
00:42:53,310 --> 00:42:55,050
We've got the registry,

797
00:42:55,050 --> 00:42:57,960
which is where the unique records of

798
00:42:57,960 --> 00:43:00,450
who controls what are.

799
00:43:00,450 --> 00:43:04,290
The registry almost never
has a direct relationship

800
00:43:04,290 --> 00:43:06,420
with the registrant,

801
00:43:06,420 --> 00:43:08,793
the registrars always sit in the middle.

802
00:43:11,250 --> 00:43:13,110
It's sort of like you buy a car,

803
00:43:13,110 --> 00:43:15,510
you're not buying it from Ford or GM,

804
00:43:15,510 --> 00:43:17,220
you're buying it from a dealership.

805
00:43:17,220 --> 00:43:19,623
And so your relationship
is with the dealership.

806
00:43:20,880 --> 00:43:22,890
That analogy is gonna seem really dated

807
00:43:22,890 --> 00:43:25,233
in about 10 years,
probably. But there you go.

808
00:43:26,670 --> 00:43:31,670
So, if we're gonna engage
parties, the issue is that

809
00:43:31,740 --> 00:43:33,360
once the car has been sold,

810
00:43:33,360 --> 00:43:35,850
the dealership is not involved anymore.

811
00:43:35,850 --> 00:43:39,330
So once a domain name has been registered,

812
00:43:39,330 --> 00:43:43,560
the registrar isn't really involved

813
00:43:43,560 --> 00:43:47,700
unless there's some
registrant-initiated change.

814
00:43:47,700 --> 00:43:49,357
So if the registrant says,

815
00:43:49,357 --> 00:43:51,600
"I wanna change my domain name servers"

816
00:43:51,600 --> 00:43:54,570
or, "I wanna change my
address" or something,

817
00:43:54,570 --> 00:43:56,940
then the registrar gets involved

818
00:43:56,940 --> 00:43:59,313
by sending those changes
up to the registry.

819
00:44:00,660 --> 00:44:02,730
There's a protocol called EPP,

820
00:44:02,730 --> 00:44:05,520
Extensible Provisioning Protocol,

821
00:44:05,520 --> 00:44:09,420
that runs between registrar and registry.

822
00:44:09,420 --> 00:44:11,370
That's all automated.

823
00:44:11,370 --> 00:44:13,980
And so the registrar's
job is basically just

824
00:44:13,980 --> 00:44:16,050
feed information into EPP.

825
00:44:16,050 --> 00:44:17,790
That's a one-directional thing.

826
00:44:17,790 --> 00:44:20,940
It goes into the registry,
there's nothing that comes back.

827
00:44:20,940 --> 00:44:25,890
So there isn't really much to do

828
00:44:25,890 --> 00:44:29,340
with the registrar.

829
00:44:29,340 --> 00:44:32,790
The registrant is the problematic
party in the first place,

830
00:44:32,790 --> 00:44:35,760
so we can't really deal
with them directly.

831
00:44:35,760 --> 00:44:40,050
The registry can remove a domain name

832
00:44:40,050 --> 00:44:41,523
at the registry level,

833
00:44:42,990 --> 00:44:46,500
and that is exactly the right point to

834
00:44:46,500 --> 00:44:48,960
do that blocking most effectively,

835
00:44:48,960 --> 00:44:51,753
but that's a 100% blocking
of that domain name.

836
00:44:52,620 --> 00:44:53,640
So there are gonna be people

837
00:44:53,640 --> 00:44:55,590
who are gonna say that that's overkill.

838
00:44:57,360 --> 00:45:00,660
Having looked through the
list of who gets sanctioned,

839
00:45:00,660 --> 00:45:02,250
I would disagree.

840
00:45:02,250 --> 00:45:04,590
The people who get
sanctioned by and large are

841
00:45:04,590 --> 00:45:06,180
pretty bad folks.

842
00:45:06,180 --> 00:45:09,510
And I am perfectly happy

843
00:45:09,510 --> 00:45:12,513
with having them not be on my internet.

844
00:45:13,920 --> 00:45:16,740
But there's a question of

845
00:45:16,740 --> 00:45:20,430
how much fight you want to get into with

846
00:45:20,430 --> 00:45:23,880
libertarian folks and internet
freedoms folks and so forth.

847
00:45:23,880 --> 00:45:28,420
So the other place that
you can do that is at the

848
00:45:30,420 --> 00:45:32,760
DNS recursive resolver level.

849
00:45:32,760 --> 00:45:37,760
So, Quad9, and CloudFlare, and Google,

850
00:45:38,010 --> 00:45:39,870
between the three of them,

851
00:45:39,870 --> 00:45:44,460
right there, that's like half
the world's DNS resolution.

852
00:45:44,460 --> 00:45:47,890
So, three organizations could

853
00:45:49,020 --> 00:45:51,870
pretty effectively do this.

854
00:45:51,870 --> 00:45:54,720
All right. I think that's it for our time.

855
00:45:54,720 --> 00:45:55,740
Thank you all very much.

856
00:45:55,740 --> 00:45:59,310
And I'll be over there somewhere,

857
00:45:59,310 --> 00:46:01,860
if anybody has further
follow up questions.

858
00:46:01,860 --> 00:46:05,073
Thanks a lot.
(audience clapping)