Why Large Parts of the Internet Have Suddenly Vanished for Millions of Users

For the past six weeks or so, Internet users in Syria, Cuba and Iran have seen blank pages when they access websites hosted by Softlayer, IBM’s cloud infrastructure unit. The company blocked people in those countries from receiving any content hosted by SoftLayer, which counts Tumblr, SlideShare and Box among its customers.

These countries, along with North Korea and Sudan, are subject to U.S. trade sanctions. That means that American companies can’t do business with people or firms with connections to the territories—it is forbidden to ship goods, transfer money, or provide certain services to them.

But should the ban also apply to serving web pages to random internet users who happen to live in sanctioned countries?

SoftLayer says it put the network-level ban on Internet traffic to sanctioned countries to comply with the law. But other cloud providers interpret the rules differently.

Rackspace, for example, says that it also complies with sanctions laws, but doesn’t block internet traffic—it avoids signing up customers in sanctioned countries by checking addresses and other geographical markers.

“The blocking of [Internet traffic] is one mechanism that can be used, but not the only one for maintaining compliance with export control regulations,” Lillian Pang, senior director of legal affairs, told Quartz. “Rackspace adopts different methods of filtering including filtering by billing address of customers, which enables Rackspace to capture countries with export control restrictions.”

Another cloud company, Linode, says it doesn’t block Internet traffic either, because it’s not very effective.

“We don’t feel blocking IP addresses is a reliable measure,” Thomas Asaro, Linode’s chief operating officer, told Quartz. IP databases are error-prone, and “there is a significant chance to cause collateral damage for innocent consumers of the internet,” he added.

SoftLayer didn’t respond to a request for comment from Quartz. One of its customers, WebFaction, said the ban went into effect on Feb. 1, citing an email sent by SoftLayer.

The scale and the scope

The scale of SoftLayer’s traffic ban is significant. Iran has 39 million internet users, putting it in the top 20 countries by number of users. They aren’t able to see any of the 1.5 million websites estimated to be hosted by SoftLayer, which account for 0.4 percent of all the sites on the Internet, according to technology tracker BuiltWith. The ban would also restrict data from apps hosted by SoftLayer.

It is a disquieting reminder of how geopolitics can intrude on the virtual world, with unexpected and uneven effects. On the face of it, SoftLayer is simply a technology company making a conservative interpretation of trade-sanction laws. After all, if a company can’t sell airplane parts to North Korea, why would it be allowed to deliver data there?

But at the same time, this reading of the rules may be at odds with the ultimate aim of embargoes, according to Jillian York of the Electronic Frontier Federation.

“Sanctions as they affect technology can be really problematic, because they can end up affecting the very people that the U.S. wants to help,” she told Quartz. “Tech sanctions in particular really impact the user.”

Let’s consider Iran again. The Iranian government already has extensive means of controlling what citizens can access on the internet. Banning Internet traffic to Iran, before it even hits the government’s firewall, adds an extra layer of restrictions on an already tightly controlled system. As York described:

Iranians are dealing with this two-fold. They’re getting doubly hit. That’s a demonstration of how hypocritical this issue is. We’re concerned about Iranian censorship, but we’re censoring Iranians at the same time.

A descending cloud

The penalties for breaking sanctions are serious. (Ask any big bank.) But companies can apply for special licenses to provide certain digital services to sanctioned countries. The online education provider Coursera did this in 2014, allowing people in Sudan and Cuba to sign up for its classes (aside from advanced science, technology, engineering and math courses). The hassle and lingering liability of this approach means that most companies don’t bother, York told Quartz.

As more—and more sensitive—data and services ascend to the cloud, sanctions-linked bans, whether justified or not, show that “the metaphor of the cloud has serious limitations,” according to Mark Graham, a professor who researches Internet geographies at the Oxford Internet Institute.

“Data is always inherently in, or moving through, real or geographic places,” he told Quartz. “We often assume away those geographies–precisely because of metaphors like the cloud–and assume that geography no longer matters once we’re online.”