China: The architect of Putin’s firewall

In the early morning of 27 April 2016, a group of Chinese officials in business suits headed towards a huge concrete building on Moscow’s Zubovsky Boulevard: the headquarters of Russia Today, Russia’s main propaganda outlet.

On that day, RT was hosting the First Russia–China Cyber Forum; top internet officials from both countries were in attendance. The Chinese had brought Lu Wei, the head of China’s State Internet Information Office, and Fang Binxing, the architect of the ‘Great Firewall’. They were warmly welcomed by Igor Shchyogolev, Vladimir Putin’s deputy on internet-related issues and former Minister of Communications, and by Alexander Zharov, chief of Roskomnadzor, the Russian agency responsible for internet censorship.

They had gathered to find a solution to a problem Russian authorities have been struggling with for five years: how to bring the internet and social media under their control. The Kremlin had woken up to the problem posed by Twitter and Facebook and their potential for mobilization after the Arab Spring and the protests against Putin in Moscow in 2011.

In 2012, the Kremlin had introduced a blacklist of websites to be blocked by the country’s Internet Service Providers, but that effort was unsuccessful. Russian users began using circumvention tools like TOR and VPN to access blocked websites and online media outlets.

Russian internet security 2012–2015

The Kremlin now turned to a strategy based on intimidation rather than technology, where the authorities would put pressure on companies rather than users.

Beginning in 2012, all sorts of tricks were employed to lure companies, both domestic and international, into closer cooperation with the Kremlin – introducing national internet filtering, requiring them to relocate their servers to Russia, and updating the national online surveillance system, SORM. This was another way of getting companies to fall in line with the authorities, since the companies were required to pay for the installation of surveillance equipment.

Frightened by constantly changing and repressive legislation, top-level officials of companies like Yandex, Google and Twitter rushed to the Kremlin to talk. But this was only partially effective.

The Kremlin’s biggest wager was on the data localization law that, under the pretext of protecting Russians from surveillance by the US National Security Agency, went into effect on 1 September 2015. Internet companies that collect personal information on Russian users were now required to store their data on servers within the country. The main targets of the initiative were Google, Facebook and Twitter.

The goal was not only to enable wiretapping by the Russian secret services by giving them access to the companies’ servers, but also to oblige the three Internet giants to be physically located in Russia. In short, the Kremlin wanted to force these global internet giants into a situation where, just like domestic companies, they would be ready to answer when the Kremlin called and cooperate in removing and blocking content, with their servers directly connected to the Russian security services.

But the offensive stalled. Time passed and contradictory messages came from Russian officials. In Autumn of 2015, the authorities began jailing users for posting critical comments on social media, but in most cases it was users of the Russian social network Vkontakte, not Facebook or Twitter.

On 27 April 2016, addressing the Russia–China Cyber Forum, Alexander Zharov praised Chinese companies for being quick to relocate their servers to Russia. But the entire point of data localization had nothing to do with China: nobody uses Chinese social media in Russia. What was happening?

Go East

The Russia–China Cyber Forum was one of the first signs that a new approach was being developed. The organizers came up with a joint roadmap. Their statement has two points. The first concerns the coordination of the two countries’ efforts on the global stage, meaning their activities at the UN level. The second point calls for ‘joint action to ensure the safety and sustainability of the national top-level domains of Russia and China’.

After the forum, talks between the two countries over cooperation on internet censorship intensified. In May, Nikolai Patrushev, Secretary of the Security Council of Russia, and Meng Jianzhu, Secretary of the Central Political and Legal Affairs Commission of the Communist Party of China, met in Grozny to talk about information security. According to officials, they also ‘discussed further cooperation between Russia and China in the fight against terrorism and in ensuring public order and countering colour revolutions’. 1

Visiting Beijing in June, Vladimir Putin signed a joint communiqué with Xi Jinping entitled ‘On cooperation in the development of information space.’ Among other things, it calls for ‘respect [ing] national sovereignty in cyberspace … and oppos[ing] interference in other countries’ internal affairs through cyberspace.’ 2

On 25 October 2016, Beijing hosted the “Infoforum”, Russia’s National Forum for Information Security. Fang Binxing, who was hosting the event, opened the forum by saying: that ‘Cyberspace sovereignty is a natural extension of national sovereignty’ that entailed jurisdiction over internet platforms and data. Four days later, the Russia–China Internet Media Forum began in Guangzhou. Alexei Volin, the Russian deputy minister of communications and mass communications, echoed Binxing’s statement, calling on Russia and China to join forces in protecting the internet and ensuring that ‘the national segments of the Internet are stable and invulnerable to external influence’.3

Immediate results and perspectives

There are at least two areas where Chinese and Russian internet censors can cooperate. First, in closing gaps in the internet filtering system. According to Denis Davydov, the executive director of the Safe Internet League, a Russian vigilante group launched in 2011 to police the internet, the League is working on developing a filtering system that would let censors ‘search and find’ information, not just block websites and pages. The League was closely involved in bringing the Chinese to Moscow in April, while in China Fang Binxing launched a ‘Society of Information Security’ that like the League uses volunteers to patrol the internet.

The second area is technology. In 2016, Russian officials began a campaign to reshape the infrastructure of the Internet – with the goal of bringing it under government control. In June 2016, Putin signed a new anti-terrorism package that requires communications providers to store user data (including calls and messages) for at least six months, while making it accessible to the security services; it also gives the government the power to demand the keys to encrypted traffic.

This presents a technology problem. The Kremlin has announced ‘import substitution’ – an attempt to portray western sanctions as a benefit to Russian industries. But the infrastructure of the Russian internet is built on western – largely American – technologies, above all Cisco. The Kremlin is now seeking a way to replace western technologies with something produced in Russia, or in the East.

China has signalled that they are ready to help. Talks were reportedly held between Russian officials and Huawei, the Chinese telecom equipment leader, about licensing its data storage and server technologies. In 2016, Huawei was a sponsor of almost every conference on information security in Moscow, and the company’s representatives were given a slot at the Russia–China Cyber Forum in April 2016. Huawei was also a ‘general sponsor’ of the Infoforum in Beijing – and a visit by Russian officials to the Huawei HQ in China’s capital was on the event’s agenda.

For years, the Russian secret services were suspicious of Chinese telecom equipment. They were very aware of reports that Beijing could use Huawei’s equipment for spying. But now their search for a solution to the ‘Internet problem’ could push Russia into the arms of Chinese telecom companies. One can only guess the implications for the Russian internet.