Cidram: Is it possible to block Republic of Crimea?

[100percentlunarboy]

Hi

Is it possible to block the Republic of Crimea?

If not, can you create a signature for it that can be installed on the Updates page?

Or perhaps the Republic of Crimea IPs are blocked via the Russia block lists?

Thanks!

[ghost]

I think they sort under the UA TLD, so give the Ukraine block list a try.

[100percentlunarboy]

Hiya, I was hoping to just block the Republic of Crimea as required by the US govt and still do business with Ukraine.

[Maikuolan]

Being a state, we'd probably need a reliable source that provides IPs/CIDRs by state, rather than just by country, to reliably block IPs/CIDRs in Crimea, without blocking the remainder of Ukraine and/or Russia. I tried googling for some a little earlier, but hadn't yet been able to find any, unfortunately (at least, any that were freely available both for download and integration with external projects/packages/services/etc).

Also, to my knowledge, both Ukrainian and Russian ISPs alike serve customers in Crimea (originally just Ukraine prior to Crimea's annexation by Russia, but Russia has since then built a cable to connect Crimea to the Russian mainland). I haven't heard anything about old cables being removed, and I've seen plenty of (relatively recent) connections from Crimea belonging to CIDRs that still announce as Ukrainian (as well as from Russia), so I think, to be sure about blocking Crimea (in the absence of any reliable sources for state-based IP/CIDR lists), you'd probably need to block both countries (which of course, isn't necessarily ideal, due to potentially also blocking any wanted traffic from elsewhere within both countries).

References:

• https://qz.com/243619/crimea-just-switched-over-to-the-russian-internet/
• https://dyn.com/blog/no-turning-back-russia-crimea/

We'll probably need to do more research into this I think, to be able to figure out a reliable solution.

[100percentlunarboy]

Thanks for looking into this. Guess I will need to block both Russia and Ukraine. let me know if you do come up with a solution. Thanks!

[Maikuolan]

Question: How stringent are the requirements to block Crimea? '^.^

I still haven't been able to find a particularly reliable source for Crimean CIDRs/IPs specifically, but I've thought of a way that I could build a Crimean blocklist, which definitely wouldn't block everything, but should be able to put a somewhat reasonable dent in any potential inbound Crimean traffic. Though various Russian and Ukrainian ISPs alike provide services in Crimea, and most of them don't announce specifically which CIDRs/IPs belong to which states/cities/etc, some of them do (in BGP records), and I could include those that announce as belonging to Crimea (or some parts thereof) in a theoretical future Crimean blocklist. There's also a few ISPs native to Crimea (like Crelcom, for example), specifically targeted towards Crimean internet users; I'm not sure whether they actually serve any users outside of Crimea, but at least, I assume that the majority of their users would be from Crimea. Those few specific ISPs could be included in entirety in a theoretical future Crimean blocklist.

For extra measure, a module could be created, to look for and speculatively block any hostnames that cite Crimean cities and things like that (no idea whether this would actually catch and block anything, as I haven't tested whether any ISPs in the region are actually forming their hostnames in this way, hence why I call it "speculative", but it's an idea, at least).

Considering the numerous things that this theoretical blocklist wouldn't include (e.g., all the Ukrainian and Russian ISPs which don't announce which CIDRs/IPs are serving which regions/cities/etc plus whatever other non-native channels might exist in the region), plus the potential for users to simply jump onto a VPN, proxy service, or other such thing in some other country in order to gain access to a website if their own IP address happens to otherwise be blocked, I absolutely would not guarantee this as a perfect solution. I'm also not so familiar with the exact wording of the US legal requirements in dealing with Ukraine, Russia, and Crimea, but.. if it's just some reasonable effort required, and if there happens to not be any mention of exactly how successful that effort needs to be (i.e., low stringency), then this solution might be sufficient as a way to block Crimea, without blocking all of Ukraine and Russia (albeit not entirely effective, due to not being able to guarantee that Crimea would be entirely blocked either). If the legal requirements demand that Crimea actually be 100% blocked though (i.e., high stringency), then I think, blocking the entirety of Ukraine and Russia alike would probably be required (albeit this still wouldn't prevent anyone from Ukraine or Russia from simply using some unknown and not currently blocked VPN or proxy service to get around any country-level blocks, if they know what they're doing; and in the case of high stringency, there's still the question of whether it's worded as such that the state needs to be blocked, or all the users within the state need to be blocked; in the latter case of being all the users, I think the legal requirements are likely impossible to fulfill, due to concerns like proxies and VPNs, but.. I assume it'd be a case of the former, of being the state that needs to be blocked, because that would make more sense than the latter, I think).

Anyway, when you've got a spare moment, let me know what you think. :-)

[100percentlunarboy]

I believe the rules are rather stringent.

Calls for blocks on “directly or indirectly, of any goods, services, or technology from the Crimea region of Ukraine”; and “the exportation, reexportation, sale, or supply, directly or indirectly, from the United States, or by a United States person, wherever located, of any goods, services, or technology to the Crimea region of Ukraine”.

Here is the exact wording:

https://www.treasury.gov/resource-center/sanctions/Programs/Documents/ukraine_eo4.pdf

I understand that there would be no guarantee of a perfect solution. I would hate to put you to all this trouble just for me! I would definitely use it if you produced a Crimea block. I am running the Russia block so combined with a Crimea block would be a good thing.

[Maikuolan]

Cheers. :-)

I'll have a read through it a little later today.

[ghost]

I have been looking into the free GeoLite2 data a bit deeper lately, and it might be possible to create a Crimea block list although it would not "watertight".

To quote MaxMind's release notes:

September 27, 2017
We completed our most recent review and update of Geolocation for Crimea. Our accuracy has increased as follows:

Approximately 89% of website visitors who are from Crimea are currently located by GeoIP as being in Crimea. Approximately 97% of the visitors who are located in Crimea by GeoIP are actually in Crimea.

They also write:

Due to the nature of geolocation technology and other factors beyond our control, we cannot guarantee any specific future accuracy level. Further, accuracy figures are subject to change as IP networks are reallocated.

The question is, would this be accurate enough for the purpose and worth following up a bit further?

.

[Maikuolan]

I haven't made any progress on this issue on my end since my previous comment (actually, haven't looked too much further into it either; been busy with other things since then unfortunately). Given that this issue hasn't seen any activity in the past 2 weeks, should I mark it as "resolved" and close it, or is this issue still relevant currently? Let me know when you've got a moment. Cheers. @100percentlunarboy @macmathan

[100percentlunarboy]

Hi Maikuolan and Macmathan

First off - sorry Macmathan I did not see your last reply. I must have missed the email notification.

I am still am interested in using it if possible but since I am currently blocking Ukraine and Russia I am in no hurry. Since I am the only one that seems interested in this block I will understand if it takes time to produce one or if it's not something you want to produce. I will use it if you make it - will understand if you don't. I understand that there is no guarantee on the accuracy.

[ghost]

I can have a go at making a list.

Accuracy will be as MaxMind has posted, which I quoted above.

I'll take it onwards in macmathan/Blocklists#3 from this point.

[Maikuolan]

Awesome; Sounds good. :+1:

[Maikuolan]

A new optional blocklist for blocking the "Republic of Crimea" has been created and released by Macmathan. Support relating specifically to this new blocklist should be directed here: https://github.com/macmathan/Blocklists/issues/3

As such, I'm marking this issue here as "resolved" (from the perspective of this repository) and closing.