What Is Access-Blocking to the Internet and How Is It Executed?

A) The Concepts of the Internet and Internet Access

To enable the reader to grasp what access-blocking signifies and how it is technically achieved, I wish to elucidate at the primary stage how the internet functions and how internet users gain access to the network.

The foundations of the internet originated approximately sixty years ago as the ARPANET project under the ARPA unit of the United States Department of Defense (DOD). Within ARPANET, a network architecture was developed to execute data sharing between geographically remote devices. The integration of local area networks (LANs) across ARPANET was succeeded by alternative network structures, which over time became interconnected nationally. This architecture—comprising wide area networks (WANs) formed by the aggregation of numerous LANs, which were themselves interconnected—subsequently expanded beyond the borders of the United States, connecting diverse networks across various nations via terrestrial and submarine cables. To enable access to databases residing on LANs, browser software was developed alongside FTP platforms, giving birth to Gopher and WWW-HTTP (with Gopher subsequently falling into obsolescence). It is precisely this global structure, wherein computing devices communicate in an interconnected state, that we designate as the Internet.

Accessing this internet network—which represents the union of numerous interwoven LANs and WANs—signifies an internet user connecting from their own local network to global WANs, and ultimately establishing communication with a server on a distinct network, utilizing the internet backbone constructed via cables, cellular base stations, and satellites interconnecting global networks. Thus, an internet user located in Istanbul can, through their local network, traverse the domestic Turkish backbone, pass through Internet Exchange Points (IXPs) along this backbone, and reach any terminus at the opposite end of the backbone, such as a server hosted in the United States.

B) Access Providers and Their Dominance Over the Backbone

As outlined supra, the internet backbone is a global network structure interconnecting devices, with its point of origin situated in the United States. Various corporate entities have constructed and continue to operate this internet backbone. These entities are legally defined as access providers. Global access provider ISPs interconnect the world fundamentally via submarine and terrestrial cabling infrastructure. Because global internet traffic traverses this multi-owned network architecture, inter-ISP cooperation alongside dedicated Internet Exchange Points (IXPs) across various global locations are established. Furthermore, domestic access providers possessing their own local backbone infrastructure exist; while intra-national traffic flows across the backbone of these domestic entities, extra-national traffic predominantly flows over global ISPs.

The access provider ISPs described above constitute the actual operators of the backbone. However, they lease portions of their operated backbone to third-party access provider companies, thereby enabling multiple ISPs to deliver services over a single backbone infrastructure despite unified underlying ownership. Internet users subscribe to these ISPs to establish outbound connections from their local networks onto the global internet network.

C) The Concept of Access-Blocking

In its most fundamental sense, access-blocking denotes the impossibility of client-server communication across the internet backbone. An internet user's outbound connection from their local network onto the internet can be blocked entirely, or access can be restricted to servers situated at specific network locations, or even strictly to specific data residing within those servers. For instance, an internet user's access to YouTube can be blocked in its entirety, or access can be restricted strictly to a specific channel on YouTube, a single video within that channel, or even a single comment embedded under a video.

C.1) Access-Blocking via Statutory Mechanisms versus Hacking

(The legal framework shall not be elaborated under this head.) Broadly stated, various statutory provisions governing access-blocking exist across diverse legislative enactments within Turkish law. Aside from these, Law No. 5651 specifies the technical methodologies through which access may be blocked, reducing these fundamentally to IP/DNS/URL-based blocking and derivative techniques. Access-blocking measures grounded in a valid statutory basis and executed in accordance with procedural law are designated as "lawful/statutory access-blocking." These technical procedures, detailed infra, constitute subscriber-centric restrictions executed across the network backbone.

However, executing an access-blocking measure against internet content does not strictly require the participation of the user end or the network backbone. A malicious hacker can equally block access by launching Distributed Denial of Service (DDoS) attacks. Furthermore, by configuring rogue DNS or proxy servers, or deploying a rogue router (methodologies conceptually categorized as man-in-the-middle attacks), an attacker can redirect clients to entirely different network termini or disrupt access altogether. All such outcomes unquestionably represent access-blocking achieved via hacking. It is self-evident that such methodologies lack statutory authorization and constitute criminal offenses.

Therefore, the core principle to comprehend is that lawful access-blocking can solely be executed across the backbone through operating ISPs, with their knowledge, and via methodologies conforming strictly to statutory law.

D) Methodologies Deployed in Lawful Access-Blocking

D.1) General Principles

Let us conceptualize a large enterprise network topology encompassing hundreds of connected devices—a vast architecture wherein numerous virtual LANs (VLANs) are interwoven, managed by interconnected switches and routers. The network administrator exercises control over this network, deeply inspecting data packets via analysis software or advanced Deep Packet Inspection (DPI) technologies, thereby enabling—upon deploying appropriate technical configurations—the reading of communications embedded within every data packet across the network, including messaging data transmitted via mobile applications.

The national network architecture within a country is structured similarly to the enterprise model described above. The sole distinction resides in the fact that where multiple ISPs operate within a country, multiple administrators exist, and the technical infrastructure deployed by these respective administrators may diverge.

D.2) Server IP Address-Based Methodologies (Whole-Site Access-Blocking)

Because protocol suites in the DOD standard model—predominantly TCP/IP and UDP—are operated in internet communications, client and server IP addresses constitute the primary nodal points of communication. (To be sure, entities controlling a LAN can easily restrict devices bearing specific internal IP and MAC addresses to limited internet destinations, which practically amounts to access-blocking; however, this falls outside our scope.)

In access-blocking techniques executed by access providers specifically at the IP address level, the fundamental technical nodes are the routers and DNS servers that route the client onto the internet. The router that directs an internet user from their local network onto the backbone of their subscribing ISP can be configured to prevent the user from reaching servers operating on specific IP addresses and port numbers. This represents the most traditional technique of access-blocking. Through this mechanism, access to the servers of any website whose IP addresses and ports are known can be blocked, as can access to DNS servers, VPN servers, or TOR nodes.

The secondary methodology operating specifically at the IP level incorporates domain names into the process, utilizing DNS servers that execute IP-to-domain mapping. For this mechanism to function successfully, the internet subscriber's endpoint device must be configured to resolve requests via the access provider's controlled DNS server rather than alternative third-party DNS resolvers.

Because these traditional methodologies target server IP addresses and port numbers, they block access to the website or application in its entirety. Furthermore, where auxiliary systems such as email servers hosted on the identical server are not partitioned over distinct IP addresses or port numbers, access to such collateral services will likewise be blocked.

D.3) URL-Based Blocking Methodologies Granting Comprehensive Network Control

When an entire website is blocked from access, a issue centered on the "right to internet access" arises if the platform possesses high societal significance and a vast user base. Although thousands of obscure websites are completely blocked from access without attracting public concern, executing blanket access-blocking against platforms harboring immense user bases, such as YouTube or Wikipedia, blocks all internet users from accessing non-infringing areas of those platforms, thereby creating significant legal, constitutional, and ethical dilemmas.

The force capable of preventing such dilemmas from emerging is, at its core, technology. As recalled from the enterprise network example supra, the more sophisticated the technology available to a network administrator, the greater their operational dominance over the network becomes. Thus, the crucial point to remember is this: high-level network technologies first establish profound network dominance, which subsequently creates technical capabilities such as URL-based blocking. Through this profound dominance, the substantive content of data packets becomes fully observable and readable.

Achieving URL-based blocking necessitates exercising dominance over network traffic and maintaining the technical capability to intervene in data traffic flowing across the network. The technical reality established at this junction is that, alongside diverse hybrid technologies, two primary methodologies are deployed: ISPs routing traffic through proxy servers and/or establishing packet analysis architectures. Through these technologies, most layers of data packets become accessible and controllable. Consequently, URL-based access-blocking can be executed to restrict access strictly to a single video or article hosted on a website. As technology advances, the scope for executing URL-based blocking expands, permitting operational control over encrypted communication structures such as SSL and data streams flowing across VPNs. Within packet analysis architectures, this is achieved by deploying Deep Packet Inspection (DPI) technologies.

(The precise technical methodologies deployed by each individual access provider in Türkiye to execute access-blocking remain undisclosed to the public. Indeed, no binding technical rule exists on this point; under Law No. 5651, access providers are expected to block access to websites or URLs utilizing specified, analogous methods, which represents the correct legislative approach.)

Recommendation to the Reader

For readers seeking a deeper understanding of the technical and structural framework governing access-blocking, I recommend consulting the relevant sections of THE RED WEB by Andrei Soldatov and Irina Borogan to grasp the historical evolution of this architecture in Russia, URL-based blocking procedures, and the development of SORM—a sophisticated DPI surveillance framework.