RIPE NCC Response to Request from Ukrainian Government

Letter from the Vice Prime Minister of Ukraine to RIPE NCC (PDF)
Response from Managing Director of the RIPE NCC (PDF)

Amsterdam, 10 March 2022

Dear Vice Prime Minister,

First, let me say that we at the RIPE NCC condemn the violent actions that have been taken against Ukraine and your people. Such actions undermine the cooperation that is at the heart of the Internet.

Your letter asks us to take four separate actions. Because our response to the first three will be of a more technical nature, we have addressed these in a separate appendix included with this letter. This is so we can provide you with a clear and straightforward response to your fourth request, which is the most relevant to our role and deserves the most attention: “Withdraw the right to use IPv4 and IPv6 addresses by all Russian members of the RIPE NCC”.  

We regret to inform you that we cannot comply with this request. We do not have a mandate to take such actions, and as an organisation governed by community developed policy and Dutch law, we cannot take such action unilaterally. We further believe that Internet number resource registrations should not be used as a means to enforce political outcomes, and that doing so would have serious implications for the Internet, not just in the Russian Federation but also for the rest of the world.

We are the authoritative source of information on who holds the right to registration of IP addresses and ASNs in our service region. Internet operators use this registry to make their own decisions on how to route Internet traffic, resulting in an open Internet in which everyone can connect on their own terms. Blocking or withdrawing resources from our registry would be unlikely to have immediate impact on interconnection or traffic in Russia, but it could have unpredictable consequences in terms of harming the global coordination that is necessary for stable Internet operations.  

This is an outcome that would play into the hands of those who want a less open Internet that can be used to enforce political decisions rather than allow open communications across the globe. As part of the technical community, we have long campaigned to maintain the open Internet, and our ability to do this depends heavily on preventing the registry from being used to achieve political ends.

Another effect of removing entries from our registry would be to diminish the ability of Internet operators to identify the source of Internet traffic, and consequently undermine their ability to make effective choices about who they should accept or block traffic from. Our registry also acts as an important data source for those who wish to monitor the health of the Internet in Ukraine and other countries. We provide this data freely to the Internet community and others who carry out research on the Internet and how traffic is routed over it. Compromising our registry in any way, or changing it according to political needs, would reduce trust in the data we provide and compromise everyone’s ability to get clear insight and understanding of what is actually happening with the Internet at any given time.

Although we are unable to comply with your specific request, I want to give you our assurance that we will do everything we can to ensure our Ukrainian members remain able to provide services to your people. For example, we will be contacting Ukrainian members to make it clear that they do not risk losing their IP addresses if they cannot pay their invoices or are unable to comply with certain administrative requests. They carry out their work under the most difficult circumstances imaginable, and we wish to express our solidarity with them and our respect for their efforts to maintain Internet access at such a critical time.

Finally, let me express my deep sympathy for the people of Ukraine and my sincere hopes for an end to the war that afflicts your country. We are a membership organisation, and we have close and long-held ties with many Ukrainian network operators who are providing Internet services to your people. And, crucially for us, we have Ukrainian staff among us, who experience great pain and uncertainty as they watch events unfold. With all of this in mind, I find it completely understandable that you would make this request of us. I only hope you can understand why it is that we must refuse.

Yours sincerely,

Hans Petter Holen
Managing Director
RIPE NCC

----

Appendix: Response to Remaining Items

Your letter requests four separate actions. For the sake of completeness, we have included our response to the remaining three below.

1. Revoke, permanently or temporarily, the domains “.ru”, “.рф” and “.su”. This list is not exhaustive and may also include other domains issued in the Russian federation.

The RIPE NCC does not have any role in issuing or revoking top-level domains like those you have listed. This remains the responsibility of ICANN and we refer you to their response.

2. Contribute to the revoking for SSL certificates for the abovementioned domains.

The RIPE NCC is not a Certificate Authority (CA) for domain names and does not issue SSL/TLS certificates for websites. The RIPE NCC is also not a member of the CA/Browser Forum.

3. Disable DNS root servers situated in the Russian Federation, namely:
4. Saint Petersburg, RU (IPv4 199.7.83.42)
5. Moscow, RU (IPv4 199.7.83.42, 3 instances)

The DNS root consists of 13 root servers operated by 12 independent organisations (including the RIPE NCC, which operates K-root). Aside from our underlying position as described in our accompanying letter, there is a strong consensus that the DNS must remain neutral. This can be seen in the following set of principles from the Root Server System Advisory Committee (RSSAC), which includes the principle that the root server system “must be a stable, reliable, and resilient platform for the DNS service to all users”.