Rerouting of Kherson follows familiar gameplan

Summary

Since the beginning of June 2022, internet connectivity in the Russian-held Ukrainian city of Kherson has been rerouted through Crimea, the peninsula in southern Ukraine that has been occupied by Russia since March 2014. As I explain in this blog post, the rerouting of internet service in Kherson appears to parallel what took place following the Russian annexation of Crimea.

This blog post was published as a companion piece to an article on the same topic in today's New York Times.

Since the beginning of June this year, internet connectivity in the Russian-held Ukrainian city of Kherson has been rerouted through Crimea, the peninsula in southern Ukraine that has been occupied by Russia since March 2014. As I explain in this blog post, the rerouting of internet service in Kherson appears to parallel what took place following the Russian annexation of the Crimean peninsula.

Russian rerouting of Crimea (2014)

Following Russia’s annexation of Crimea in March 2014, Russian Prime Minister Dmitry Medvedev made a highly publicized visit to the Crimean city of Simferopol to announce plans to integrate the newly acquired territory into Russia.

During his visit, Medvedev stated (also tweeted above) that it was imperative for Rostelecom (state telecom of Russia) to immediately begin construction of a submarine cable from mainland Russia to Crimea across the Kerch Strait. “The transfer of important information by foreign companies is unacceptable,” he said. The foreign companies he was referring to were the Ukrainian ones.

In April 2014, the Russians announced that a new 46km submarine fiber optic cable spanning the shallow littoral waters of the Kerch Strait had been completed and was operational with a reported capacity of 110 Gbps.

The following month, Rostelecom announced that its branch in Crimea would operate under the name «Миранда-медиа» or “Miranda-Media”. However, it wasn’t until July 17th that a new autonomous system number, AS201776, appeared in the global routing table by the name of Miranda-Media. A week after its appearance, AS201776 began providing transit to two ISPs in Crimea on July 24th, namely, KCT (AS48004) of Simferopol and ACS-Group (AS42986) of Alupka.

On July 31st 2014, I broke the story of the activation of the Kerch Strait cable linking Russia to Crimea, covered by Vice, The Verge, among others.

One of the first prefixes announced by Miranda-Media was 178.34.152.0/21. RIPE registration data for the prefix at that time showed that it had been the address space assigned to the Sochi Winter Olympics several weeks earlier. After serving that mission, it had been transferred to Russia’s next strategic project, Crimea.

inetnum:         178.34.128.0 - 178.34.191.255  
netname:         Macroregional_South  
descr:           OJSC Rostelecom Macroregional Branch South  
descr:           Winter Olympic Games of Sochi 2014  
descr:           Sochi, Russia  
descr:           The Olympic Games are finished. Transition period. Apr, 2014  
country:         RU

In the subsequent months in 2014, Crimean ISPs changed how they reached the global internet. Instead of connecting to Ukrainian telecommunications companies over the land bridge to mainland Ukraine, they connected to Russia via a submarine fiber optic cable. As a consequence, latencies to websites hosted in Russia dropped while latencies to websites hosted in mainland Ukraine spiked. The graphic below illustrates the increase in latency from Kiev, Ukraine to CrimeaCom (AS28761) in July 2014.

At the time, one of Miranda-Media’s new Crimean customers even advised its users about this change in latency in the following message one its website:

The Russian takeover of the Crimean internet was more than just re-routing traffic through Miranda-Media’s link to Russia, it was about taking over the local network as well. On September 24, 2014, Ukrtelecom reported that its assets in Sevastopol were forcibly seized and turned over to a new entity, Sevastopol Telecom (aka Sevtelekom).

The Russian press coverage of the seizure had a different perspective: it stated that the reason for the disconnection of Ukrtelecom’s Sevastopol network was unknown and lauded “Russian networks” for quickly restoring Sevastopol’s communications.

On that same day, AS59833 (Sevtelekom) first appeared in the global routing table - another new Miranda-Media customer network.

Russian rerouting of Kherson (2022)

The city of Kherson lies in the south of Ukraine and has been under Russian control since the early days of the invasion. Despite some brief outages, internet service there had been largely uninterrupted.

However, at 16:12 UTC on April 30th, internet service in the city of Kherson and its surrounding areas went down. SkyNet (Khersontelecom, AS47598) was the first to return to service the following day at 16:02 UTC on May 1st, but it wasn’t connecting through its normal upstreams. Instead of its Ukrainian transit providers, it was using Miranda-Media (AS201776) in Crimea to reach Rostelecom in Russia for connectivity to the outside world.

At 16:15 UTC on May 2nd, a second Kherson ISP (Brok-X, AS49168) came back online using transit from Miranda-Media. However, by the end of the day on May 4th, internet service across Kherson was up and again routed via Ukrainian transit. By then, both AS47598 and AS49168 ceased using Miranda-Media to route traffic to the internet.

Later that same day, the owner of SkyNet (KhersonTelecom) took to Facebook to explain his rationale for reconnecting his service through Russia. “On April 30, EVERYTHING fell!”, he said, adding that he had no choice but to “turn on the circuit of the Crimean operator Miranda.” While some local residents thanked him, others accused him of using “enemy internet”, a decision he defended in the post.

Following the restoration on May 4th, ISPs in Kherson returned to their previous Ukrainian transit providers until May 30th when another city-wide internet outage struck at 14:43 UTC. At that time, Kherson ISPs lost their links to other Ukrainian networks, possibly for good. The few Kherson ISPs that stayed online did so by using transit from Miranda-Media. Within a few days, every network in Kherson was either offline or connected to the internet via the Crimean provider.

Below is an animation of the phased reconfiguration of the ASes that make up the internet of Kherson over this period.

Conclusion

With Kherson’s internet traffic routed through Moscow, the Russian government has the ability to surveil, intercept, and block communications with the outside world. This creates a grave risk for the citizens of Kherson, especially those resisting the occupation of the city. Additionally, if Crimea is any guide, we may also see telecommunications assets in Kherson seized and turned over to Russian owned companies.

A routing configuration with a single upstream for a whole city is a fragile one. If anything should happen to the circuit to Miranda-Media, Kherson will have no options to restore service while their links into Ukraine are down.

Under normal circumstances, the use of multiple transit providers offers leverage to the customer when it comes to contract negotiations. A customer with a single upstream becomes a captive audience for the provider. However, given the situation in Kherson, internet users may be a captive audience in more ways than one.