On Friday, I wrote about the new sanction affecting Internet access providers in the UK, The Russia (Sanctions) (EU Exit) (Amendment) (No. 9) Regulations 2022.

Read that blogpost for background, if you have not done so already. This one just contains some (important) updates.

The UK Sanctions List contains a new type of "Sanction Imposed": "Internet Services Sanctions"

When I wrote the original blogpost on Friday, I speculated about how the new sanction might be shown on the UK Sanctions List.

We now know the answer: it is described, under the "Sanctions Imposed" section of the UK Sanctions List, as "Internet Services Sanctions".

This means that, if you download the ODS version, and filter column Q ("Regime Type") to show only the Russian sanctions, you can then filter column T ("Sanctions Imposed") to include only organisations subject to "Internet Services Sanctions".

At the moment, there are two organisations on that list (column E):

• TV-NOVOSTI
• ROSSIYA SEGODNYA

Column AF lists websites and, for "ROSSIYA SEGODNYA", includes "https://rossiyasegodnya.com".

An open letter from Ofcom, with domains not on the UK Sanctions List

Ofcom has published an open letter about the new regulations.

It's great to see Ofcom trying to help ISPs pro-actively here - genuinely, it's really welcome.

Less helpful is the fact that letter expressly references two domains, neither of which are on the UK Sanctions List:

For these purposes, internet services provided by TV-Novosti include rt.com; internet services provided by Rossiya Segodnya include sputniknews.com.

The organisations are on the list, but not the domains.

Conversely, the URL "https://rossiyasegodnya.com"", which is on the UK Sanctions List, is not in Ofcom's letter.

This may suggest that Ofcom considers it reasonable for an ISP to go beyond the domains listed on UK Sanctions List, but instead (or, perhaps, additionally), to work out what sites and services are operated by those companies, identify the domains in question, and prevent access to those. It does not explain why "https://rossiyasegodnya.com" is not mentioned in Ofcom's letter.

Bearing in mind that the obligation is limited to taking "reasonable steps", that feels pretty burdensome to me, and it would make far more sense if the UK Sanctions List contained a complete list of domains or URLs, to which ISPs must prevent access.

The XML version of the UK Sanctions List is still missing

The UK Sanctions List is normally provided in four formats:

• ODT (a "Word"-like document)
• ODS (an "Excel"-like document)
• html (a simple webpage)
• XML (structured data)

The XML version is the most useful for automated retrieval and analysis and, sadly, it has gone missing. Hopefully just temporarily and, for now, the ODS version is probably the easiest to work with.

Implementation

This measure came as a shock to pretty much all ISPs, large and small alike.

I spent time over the weekend looking at how ISPs - especially smaller ISPs, without existing DNS or URL blocking infrastructure - might implement this, and what "reasonable steps" might not look like. This is going to vary from provider to provider, but it is not helped by the lack of certainty as to how many domains/URLs might be in scope.

A "quick fix" solution might be suitable for a small number, which varies infrequently, but would not be suitable if the list grows rapidly.

I remain concerned if there is an expectation on ISPs to do more than prevent access to domains/URLs expressly listed on the sanctions list.