Well-intentioned decisions have just made it easier for Putin to control the Russian Internet

This article is in large part inspired by a recent article from Meduza (in Russian).

Since the beginning of the war in Ukraine, Russian users have had problems accessing government websites and online banking clients. Browsers began to mark these sites as unsafe and drop the connection. The reason is the revocation of digital security certificates by foreign certificate authorities (either as a direct consequence of sanctions or as an independent, good will move); without them, browsers do not trust sites and “protect” their users from them.

However, these actions, caused - or at least triggered by - a desire to punish Russia for their gruesome actions in Ukraine, will have long-lasting consequences for Russian netizens.

Digital certificates are needed to confirm that the site the user wants to visit is not fraudulent. The certificates contain encryption keys to establish a secure connection between the site and the user. It is very easy to understand whether a page on the Internet is protected by a certificate. One need just look at the address bar of the browser. If the address begins with the https:// prefix, and there is a lock symbol next to the address, the page is protected. By clicking on this lock, you can see the status of the connection, the name of the Certification Authority (CA) that issued the certificate, and its validity period.

There are several dozen commercial and non-commercial organizations in the world that have digital root certificates, but 3/4 of all certificates are issued by only five of the largest companies. Four of them are registered in the USA and one is registered in Belgium.

As a rule, digital certificates have a tree structure: the owner of the root CA can allow the right to issue CAs signed by its root certificate. They, in turn, will issue child certificates. All participants in the chain earn money from this. For example, a company that owns many sites for different products can obtain a single identity certificate from a root certificate (RC) owner and use it to sign child certificates, separate for each site.

There have been a few reports about foreign CAs, including Sectigo and Digicert, restricting (revoking or not prolonging) their certificates for .ru, .by, .su and .рф top level domains (TLDs) and Russia-based organizations. Additionally, under the conditions of sanctions restrictions on payment systems, Russian sites may simply lose the ability to pay for such services.

Recent statistics (statonline, statdom) show that Sectigo and Digicert account for a small percentage of issued certificates. Let's Encrypt certificates, however, comprise the majority of all certificates issued. These certificates might not be used by the most important services and the biggest companies, but they are in widespread use in Russia. Should Let’s Encrypt and other CAs blindly follow the actions of Sectigo and Digicert, the impact would be enormous.

Where does CA censorship lead?

Modern browsers, as a rule, do not open sites that are not protected by a certificate, and provide a warning about an "insecure connection". In addition, search engines significantly lower such sites in search results. The security and authenticity of the connection is especially important when it comes to working with critical services: e-mail, social networking sites, online banking, and government services.

It is for the last two cases that Russia’s Ministry of Digital Development deliberately offers its own root certificate, from which it is possible to issue child certificates for banks and public service websites, without being tied to international organizations.

But there is a problem with this approach. Since Google (Chrome), Apple (Safari), Microsoft (Edge) and Mozilla (Firefox) do not recognize this certificate, users will either have to switch to browsers from Yandex and VK (formerly Mail.ru Group) or manually add a Russian certificate to the trusted list.

When installing domestic browsers, the process is clear. On March 10th, users of Gosuslugi (an e-government website that manages various government services like tax, marriage registration, passports, driving licenses, etc.) received a newsletter from the Ministry of Digital Transformation encouraging the installation of Yandex.Browser or Atom (Mail.ru), both of which "support Russian certificates."

Since the certificate is state-owned, its installation is a matter of placing trust in the authorities. Usually, when working with a secure site, the internet provider or any other party, except yourself and the secure site, do not have access to the data that the user exchanges with the page. State certificates, however, will allow the Russian government to access information in unencrypted form, by performing a so-called “man-in-the-middle” (MitM) attack.

In addition, the mass information campaign by banks and government services, which will need to be carried out in order to encourage users to install certificates, opens up new opportunities for telephone scammers. They will be able to convince users, allegedly on behalf of the support service, to install a fake certificate on their own devices.

Theoretically, the Russian government could try to ask foreign technology companies to accept their certificate. If the state root certificate is added to the trusted list, browsers will consider the connection to the site where Russian certificates are installed as safe. But in the current situation, it is difficult to count on such assistance. Users of foreign browsers, that is, the most popular ones - Chrome, Safari, Firefox - will have to be convinced to add the certificate to the list of trusted ones manually. That being said, global companies can still blacklist the certificate. In this case users won’t have any other option but to install a browser from a local company, which will obey orders to trust state-issued certificates.

How exactly can the government intercept encrypted communications using state-issued certificates?

HTTPS secures communication between browsers and websites by encrypting the communication, preventing ISPs and governments from reading or modifying it. Servers prove their identity by presenting certificates that are digitally signed by Certificate Authorities (CAs), entities trusted by web browsers to vouch for the identity of sites. 

For example, facebook.com provides a certificate to browsers that is signed by DigiCert, a CA that is trusted and built-in on virtually all browsers. Browsers can know they are talking to the real facebook.com by validating the presented certificate and confirming that it is signed by a CA that they trust (DigiCert). The certificate provided by facebook.com also contains a public cryptographic key that is used to secure subsequent communication between the browser and Facebook.

In an HTTPS interception attack (a kind of “man-in-the-middle” or MitM attack), an in-network adversary pretends to be a website (e.g. facebook.com) and presents its own fake certificate with the attacker’s public key. Normally, the attacker cannot get any legitimate CA to sign a certificate for a domain the attacker doesn’t control, and so browsers will detect and thwart this kind of attack. However, if the attacker can convince users to install a new CA’s root certificate into their browsers, the browsers will trust the attacker’s fake certificates signed by this illegitimate CA. With these fake certificates (or state-issued ones), the attacker (the state) can impersonate any website, modifying its content or recording exactly what users do or post on the site. For this reason, users should not install root CA certificates, because it opens them up to having their otherwise secure communication intercepted or modified without their knowledge.

Has anyone already introduced state certificates?

Russia predictably finds itself in the company of countries most concerned about internet sovereignty and foreign media influence. In China, there are currently more than ten Certificate Authorities that Microsoft has added to the list of trusted ones in Windows and the Edge browser. However, there have been cases of revoking the status of trusted Chinese CAs. In 2017, Microsoft, Apple, Google and Mozilla blacklisted the WoSign CA “due to loss of trust”. In 2015, Google and Mozilla stopped recognizing the root certificate of CNNIC - the organization responsible for managing the Chinese segment of the Internet. This came after attempts to use CNNIC child certificates to spy on users in Egypt.

An example closer to Russians can be found in Kazakhstan, where since 2015, under the pretext of fighting terrorism, the government has already tried to offer users a “state certificate” three times. The first attempt was so ill-conceived that it led to disruption of banks and popular Internet services. Mass failures occurred in international systems, such as websites, payment and advertising platforms. Browsers simply blocked traffic. Their security systems considered what was happening as a man-in-the-middle attack and showed users an error.

In two more subsequent unsuccessful attempts, the Kazakh authorities tried to issue certificates for Facebook, Twitter and Google, but users refused to install such certificates on their devices. Browser developers have blacklisted certificates en masse. Mozilla noted:

“To protect our users, Firefox, together with Chrome, will block the use of the Kazakhstan root CA certificate. This means that it will not be trusted by Firefox even if the user has installed it.” 

The Kazakh authorities have abandoned their attempts at manipulating certificates and have simply moved to the practice of massive Internet shutdowns during crisis situations.

What should Russian users do now?

It is not yet worth adding state certificates to the main browsers. It is better for Russian users to use Yandex.Browser or Atom from Mail.ru exclusively to access government websites and online banks. Russian internet users do not have to worry about the rest of their device’s traffic until the Russian root certificate is added to the list of trusted certificates provided by foreign developers. Yandex and Atom should only be used if there is a need to access Russian government websites and Russian online banks.

What can the international community do?

Governments and companies should be careful in their moves to place sanctions and restrictions on Russia; certain actions might actually help Putin and his regime to harden their grip on the Russian internet and freedom of speech (or whatever is left of it).

ICANN for example, in response to an inquiry to revoke SSL certificates for Russian domains, refused to do so, but did not condemn such requests. ICANN merely stated that this question is outside of their domain: 

“We do not have the ability to revoke the specific SSL certificates for the domains you mentioned. These certificates are produced by third-party operators and ICANN is not involved in their issuance.”

GreatFire, along with other parties advocating for free and safe internet access, urge all actors who are considering steps that would limit or endanger internet access in the Russian Federation to carefully consider the full impact of these sanctions and other measures. While revoking or not (re-)issuing SSL certificates might be thought of as a well-intentioned way of putting pressure on the Russian authorities, the unintended consequences of such an action might create the exact opposite situation - one where Putin has increased control over online speech in Russia.


More Blog Posts

Subscribe to our mailing list
Show content from Blog | Google+ | Twitter | All. Subscribe to our blog using RSS.

Thu, Aug 10, 2023

1.4 million people used FreeBrowser to circumvent the Great Firewall of Turkmenistan

Since 2021, the authorities in Turkmenistan have taken exceptional measures to crack down on the use of circumvention tools. Citizens have been forced to swear on the Koran that they will not use a VPN. Circumvention tool websites have been systematically blocked. Arbitrary searches of mobile devices have also taken place and have even targeted school children and teachers.

The government has also blocked servers hosting VPNs which led to “near complete” internet shutdowns on several occasions in 2022. Current reports indicate that 66 hosting providers, 19 social networks and messaging platforms, and 10 leading content delivery networks (CDNs), are blocked in the country. The government presumably is unconcerned about the negative economic impact that such shutdowns can cause.

Mon, Aug 03, 2020

Announcing the Release of GreatFire AppMaker

GreatFire (https://en.greatfire.org/), a China-focused censorship monitoring organization, is proud to announce that we have developed and released a new anti-censorship tool that will enable any blocked media outlet, blogger, human rights group, or civil society organization to evade censors and get their content onto the phones of millions of readers and supporters in China and other countries that censor the Internet.

GreatFire has built an Android mobile app creator, called “GreatFire AppMaker”, that can be used by organizations to unblock their content for users in China and other countries. Organizations can visit a website (https://appmaker.greatfire.org/) which will compile an app that is branded with the organization’s own logo and will feature their own, formerly blocked content. The app will also contain a special, censorship-circumventing web browser so that users can access the uncensored World Wide Web. The apps will use multiple strategies, including machine learning, to evade advanced censorship tactics employed by the Chinese authorities.  This project will work equally well in other countries that have China-like censorship restrictions. For both organizations and end users, the apps will be free, fast, and extremely easy to use.

This project was inspired by China-based GreatFire’s first-hand experience with our own FreeBrowser app (https://freebrowser.org/en) and desire to help small NGOs who may not have the in-house expertise to circumvent Chinese censorship. GreatFire’s anti-censorship tools have worked in China when others do not. FreeBrowser directs Chinese internet users to normally censored stories from the app’s start page (http://manyvoices.news/).

Fri, Jul 24, 2020

Apple, anticompetition, and censorship

On July 20, 2020, GreatFire wrote to all 13 members of the Subcommittee on Antitrust, Commercial and Administrative Law of the U.S. House Committee on the Judiciary, requesting a thorough examination into Apple’s practice of censorship of its App Store, and an investigation into how the company collaborates with the Chinese authorities to maintain its unique position as one of the few foreign tech companies operating profitably in the Chinese digital market.  

This letter was sent a week before Apple CEO TIm Cook will be called for questioning in front of the Subcommittee on Antitrust, Commercial and Administrative Law. The CEOs of Amazon, Google and Facebook will also be questioned on July 27, as part of the Committee’s ongoing investigation into competition in the digital marketplace.

This hearing offers an opportunity to detail to the Subcommittee how Apple uses its closed operating ecosystem to not only abuse its market position but also to deprive certain users, most notably those in China, of their right to download and use apps related to privacy, secure communication, and censorship circumvention.

We hope that U.S. House representatives agree with our view that Apple should not be allowed to do elsewhere what would be considered as unacceptable in the U.S. Chinese citizens are not second class citizens. Private companies such as Apple compromise themselves and their self-proclaimed values of freedom and privacy when they collaborate with the Chinese government and its censors.

Mon, Jun 10, 2019

Apple Censoring Tibetan Information in China

Apple has a long history of censorship when it comes to information about Tibet. In 2009, it was revealed that several apps related to the Dalai Lama were not available in the China App Store. The developers of these apps were not notified that their apps were removed. When confronted with these instances of censorship, an Apple spokesperson simply said that the company “continues to comply with local laws”.

In December, 2017, at a conference in China, when asked about working with the Chinese authorities to censor the Apple App Store, Tim Cook proclaimed:

"Your choice is: do you participate, or do you stand on the sideline and yell at how things should be. And my own view very strongly is you show up and you participate, you get in the arena because nothing ever changes from the sideline."

In the ten years since Apple was first criticized for working with the Chinese authorities to silence already marginalized voices, what has changed? Apple continues to strictly follow the censorship orders of the Chinese authorities. When does Tim Cook expect that his company will help to bring about positive change in China?

Based on data generated from https://applecensorship.com, Apple has now censored 29 popular Tibetan mobile applications in the China App Store. Tibetan-themed apps dealing with news, religious study, tourism, and even games are being censored by Apple. A full list of the censored apps appear below.

Thu, Jun 06, 2019

Report Shines Spotlight on Apple’s Censorship Practices in China

The newest Ranking Digital Rights Corporate Accountability Index makes recommendations on what companies and governments need to do in order to improve the protection of internet users’ human rights around the world. Ranking Digital Rights (RDR) works to promote freedom of expression and privacy on the internet by creating global standards and incentives for companies to respect and protect users’ rights.

In their 2019 Accountability Index, RDR looks at the policies of 24 of the world’s most important internet companies in respect to freedom of expression and privacy and highlights the companies that have made improvements and those companies that need to do more. RDR notes that:

Insufficient transparency makes it easier for private parties, governments, and companies themselves to abuse their power over online speech and avoid accountability.

In particular, the report highlights how Apple has abused their power over online speech, and notes instances of this in China. According to the report, Apple has not disclosed data around the content that it removes from its App Store when faced with requests from the government authorities.

While [Apple] disclosed data about government requests to restrict accounts, it disclosed no data about content removal requests, such as requests to remove apps from its App Store. Apple revealed little about policies and practices affecting freedom of expression, scoring below all other U.S. companies in this category.

The report makes intelligent and sensible recommendations for governments. However, the recommendations also highlight how difficult it is to have these discussions with governments like China’s.

Subscribe to our blog using RSS.

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.