[ECtHR] Kharitonov v Russia: When Website Blocking Goes Awry
The applicant is the executive director of the Association of Electronic Publishers and a co-founder of the Association of Internet Users. He is the owner and administrator of the www.digital-books.ru website which features a compilation of news, articles and reviews about electronic publishing. The website had existed since 19 May 2008 and was hosted by Dreamhost, a US-based provider of shared web hosting service. The service provides hosting to multiple websites which reside on a single machine with a single IP address but have different domain names. When the user’s browser requests a website from the server, it includes the requested domain name as part of the request. The server uses this information to determine which website to show the user.
In late December 2012 users from various Russian regions reported to the applicant that access to his website was blocked by their internet providers by reference to “a decision by the competent Russian authority”. He checked the register of websites blacklisted by the Federal Telecom Supervision Service (Roskomnadzor) and found out that the IP address of his website had been entered into the blacklist by the decision of the Federal Drug Control Service dated 19 December 2012. The decision was intended to block access to another website, The Rastafari Tales (www.rastaman.tales.ru), featuring a collection of fictional stories about the use of cannabis, which was also hosted by Dreamhost with the same IP address as the applicant’s website.
The applicant complained to a court that the decision to block the entire IP address had the effect of blocking access to his website which did not contain any illegal information.
On 19 July 2013 the Taganskiy District Court in Moscow rejected the applicant’s complaint, holding that Roskomnadzor had acted within its competence, in accordance with the law and for the purpose of protecting children from harmful information relating to the use of drugs. It did not assess the impact of the contested measure on the applicant’s website. The applicant filed an appeal, relying in particular on the Court’s findings in the case of Ahmet Yıldırım v. Turkey (no.3111/10, ECHR 2012) which concerned indiscriminate blocking of a hosting service. On 12 September 2013 the Moscow City Court dismissed the appeal, finding that the principle of proportionality had not been disrespected because Roskomnazdor had lawfully blocked access to unlawful information. It did not address the effect of the blocking decision on the applicant’s website.
(..) profit-maximizing Internet access providers use technological implementation of the blocking that magnifies collateral blocking. The IP address blocking technique is one of the least expensive ways of restricting access to information. Internet access providers frequently choose it over other possible ways. In fact, Internet access providers may not even have the necessary equipment to employ a more granular method of website blocking. For example, Roskomnadzor, the authority, has recently reported that 50-55% of all Russian Internet access providers do not have equipment that allows to analyse Internet traffic and have to rely on IP address blocking. Providers that have no choice, but to engage in over-blocking since a failure to comply with the website blocking regulations will lead to fines and also possible suspension of the license required to provide their services. Moreover, in Russia, the courts do not consider unavailability of equipment that allows granular website blocking as a valid excuse for failure to block access only to targeted websites. To illustrate the real conditions consider that even Rostelecom, the largest Russian Internet access provider (38% market share of broadband market), in which the state is a majority shareholder, acknowledges that it is unable to use more granular website blocking techniques.
(..) At different times due to collateral blocking Russian users were not able to access widely-used Internet services such as: Google, Vkontakte, Wikipedia, Wayback Machine (http://web.archive.org/), GitHub, Reddit, Disney, Discovery and Nickelodeon blogs , VPN services, websites hosted on Amazon Web Services, and websites that use CDN services provided by CloudFlare. In addition to the lack of safeguards, the website blocking system in Russia has vulnerabilities that facilitates over-blocking. Any owner of a blocked website can unilaterally change the IP address of the website to any other IP address (for example, the IP address associated with youtube.com). In such case Internet access providers that use IP blocking will be required, under the threat of a penalty, to block the IP address associated with youtube.com making it immediately unavailable for Russian users. This vulnerability in the Russian website blocking system has been known since 2012, including by Roskomandzor, the authority. The magnitude of its wide exploitation for abuse is only rising. Since its start, internet access was blocked to a number of popular websites, including Wikipedia and news websites. It cannot be ruled out that this vulnerability is also responsible for a recent disruption in the banking system.
- (i) the importance of the decision and task of the Court,
- (ii) the reasons why the states should be held accountable for collateral over-blocking of the websites by private parties,
- (iii) importance of specific legal basis as to the target and means of blocking,
- (iv) the need to observe the principle of proportionality in grant and implementation of website blocking and
- (v) available remedies against the abuse of website blocking.