Russian sanctions and their impact on internet service providers, app stores and social media

How do Russian sanctions affect internet service providers, app stores and social media?

The question

How do Russian sanctions affect internet service providers, app stores and social media?

The key takeaway

The sanctions regimes globally are becoming increasingly complex: countries are ramping up the scope and reach of their sanctions regimes and the UK and EU are starting to give their regulators the tools, personnel and funding to truly police these regimes. However, with so many different sanctions targeting so many different aspects of business, there are a number of traps for the unwary, particularly in those sectors not previously included in sanctions regimes, including the tech industry.

The background

On 24 February 2022, the UK began to introduce significant new sanctions on Russia and Belarus following the Russian invasion of Ukraine. These new sanctions, found in the Russia (Sanctions) (EU Exit) Regulations 2019 (Regulations), were introduced to put pressure on the Russian economy, deter people and companies from supporting Russia and Putin, and limit Russia’s ability to spread disinformation. 

As part of these sanctions, the UK has the power to name people and entities as Designated Persons which means that restrictions can be imposed such as asset freezes, travel bans and restrictions on internet services. 

The development

On 29 April 2022, the 9th amendment to the Regulations brought into force Regulation 54A described as a regulation to prevent the “provision of internet services to or for the benefit of designated persons” which imposes positive obligations on social media and internet service providers and app stores to prevent UK users from coming into contact with any content generated or services provided by Designated Persons subject to internet services sanctions (Internet Services Designations).

At present, there have been a limited number of these Internet Services Designations, but with allegations of misinformation on the rise, it is likely that a number of Internet Services Designations will be added to the list of restrictions on the over 1500 existing Russian sanctions regime Designated Persons. 

The specific restrictions are:

• social media providers are obliged to take reasonable steps to prevent UK users from encountering content:
• generated on social media by a Designated Person
• uploaded by a Designated Person, or
•  shared by a Designated Person
• internet service providers which provide access to virtually all/some end points on the internet must take reasonable steps to prevent UK users from accessing a service made available by means of the internet which is provided by a designated person; and
• app stores must take reasonable steps to prevent UK users from downloading or otherwise accessing a service made available through the internet which is provided by a designated person.

Why is this important?

Breaching sanctions can have severe legal, monetary and reputational consequences for businesses and individuals, including criminal penalties and imprisonment. 

Regulation 54A imports a requirement for “reasonable steps” to have been taken to prevent UK users from encountering content from a designated person. No guidance has been given by the sanctions regulators as to what reasonable steps means, but it is likely that it will include:

• Risk assessment: the nature and extent of the risk of UK users encountering content from a Designated Person.
• Proportionality of risk-based prevention procedures: given the level of identified risk, what is appropriate given the level of control and supervision that can be exercised over the content of a Designated Person?
• Top level commitment: the “tone from the top” and commitment to sanctions compliance
• Due diligence: taking an appropriate and risk-based approach to the screening of Designated Persons.
• Communication (including training): communication, embedding and understanding of the policies and procedures proportionate to the identified risk.
• Monitoring and review: documented monitoring and review, including modifications and improvements where necessary.

Any practical tips?

Given the increase in the complexity and reach of the UK sanctions regime, it is essential that regular consideration is given to sanctions compliance. 
Social media, internet service providers and app stores should look at their sanctions policies and procedures and check that they are fit for purpose in this brave new sanctions world. In particular:

• when and how often are service users screened for sanctions compliance?
• what additional measures can be put in place in the event of internet sanctions designation?

This is very important as, if a breach of sanctions did occur, it is likely that Ofcom (and other sanctions regulators) will consider the following when considering the course of action to take, including whether to impose a penalty:

• whether the breach was self-disclosed fully and promptly
• the level of cooperation with any inquiries, and 
• the action being taken to improve future compliance.

Winter 2022