The RIPE NCC has published its first transparency report on EU economic sanctions it has to comply with. In general most of the community favours a general exemption for allocating internet numbers. It is a case that will have to be decided at European level.
The service area of the RIPE region spans two and a half continents and reaches from Greater Europe to the Middle East and all across Russia. Some of the countries in its region have been sanctioned by the EU Member States and included in a list which the providers of products and services have to track.
While for many years the RIPE NCC has operated somewhat under the radar and allocated internet address resources neutrally – IPv4, IPv6 and autonomous system (AS) numbers – two years ago the RIPE NCC started worrying.
Stricter enforcement, changed risk assessment
A push by the Dutch prosecutor to enforce the sanctions was one reason that made the RIPE NCC reassess its compliance risks. Violations carry fines and prison sentences of up to five years.
“The understanding that IP and AS numbers are not ‘economic resources’ – and therefore not covered by sanctions - changed last year. We now have clear answers from the Dutch Ministry of Foreign Affairs after we reached out to them in 2020 and asked for clarification”, RIPE CEO Hans Petter Holen told the community.
The RIPE NCC still thinks that IP addresses should not be considered economic resources, RIPE NCC Legal Counsel Athina Fragkouli explained, and adds that “this was the position we communicated to the MFA. However they disagreed”.
Effects of sanctions
According to the first transparency report two members are affected, one in Syria and one in Iran.
Only financial sanctions against invidiuals have to be applied, and not country sanctions which would affect whole national communities, Fragkouli details in her blogpost for the community.
For the sanctioned members the RIPE NCC has to freeze addresses, refrain from allocating new resources and block transfers. “We do not have to de-register, though”, Holen explained at the RIPE meeting. The financial sanctions regime obliges the RIPE NCC staff to track who is on the list and who gets off again, not exactly the job for an address registry.
What’s more, the secondary effects of sanctions, so called indirect sanctions, add to the burden. Banks, for example, who are afraid of getting sanctioned for transfering money from country sanctions under one of the US sanction regimes, are hesitant to accept money from RIPE’s Iranian or Syrian customers. Holen reported that 67 RIPE members had not yet been invoiced, because the “banks considered these as high risk and would prefer not to receive funds from them”.
The entangled web of sanctions is an industry-wide problem, affecting not only the numbers, but also the names community, namely the Internet Corporation for Assigned Names and Numbers (ICANN) and its registrars, US-based researcher Farzaneh Badiei recently explained using the new Taliban government in Afghanistan as an example.
To recover the membership fees from the 67 members not on the sanctions lists, Holen said the RIPE NCC was preparing to use banks in Dubai. The issue could have been solved already, had the pandemic not made travelling so difficult in recent months.
With regard to the obligation to freeze IP addresses of people on the sanctions list, the RIPE NCC is looking for an exemption for IP addresses in line with its standing belief that these are not economic resources. “According to the MFA, there is currently no existing legal basis for an exemption”, Fragkouli says. “So the idea is to engage at the EU level and persuade the relevant parties to create such a legal basis that provides a blanket exemption”.
Without the option to return to a neutral service to members in its entire service region, RIPE was violating obligations it is bound to as a regional internet registry (RIR), one member wrote following the discussion at RIPE83. The global internet governance self-regulatory system defined criteria to operate a RIR (ICP-2) back in 2001, and “neutrality and impartiality in relation to all interested parties, and particularly the LIRs” is a core principle.
Community needs to address issue
Blanket exemptions are already possible in the US Office of Foreign Assets Control (OFAC) and also in some other jurisdictions like Australia, as Badiei reported in her post about Afghanistan.
But ICANN, for example, has not applied for an OFAC license, despite having been asked by commnity groups for some years, most recently in the Workstream 2 recommendations.
Badiei’s conclusion is that the community as a whole has to act. For years the problem of sanctions has been brewing, she notes, but it has never been addressed systematically. So she calls for a “holistic plan to work with governments in order to overcome these risks, perhaps through granting of general licenses or through transnational solutions. What we must not do is solve these issues one by one anymore”.
Athina Fragkouli: How sanctions affect the RIPE NCC
Farzaneh Badiei: The Tragedy of Internet Infrastructure in Afghansitan