Content Sovereignty: Geolocalization

The evolution of the internet over the past three decades has been nothing short of magical. Starting from the snail-paced DSL connections using modem and telephone lines, we’ve now come to an era where a 1 Gbps home connection seems like no big deal.

On the content front, too, what started as a trickle built up to a dot-com bubble that burst circa 2000. Even after that bubble burst, we’ve been in a phase where web content was available to everyone. News, weather, sports, information of any kind—all of this was available for free to anyone with internet access. Google, the noun, rode the wave to become google, the verb. New technologies like SEO emerged as off-shoots of the growth.

Meanwhile, companies that relied on offline revenue watched their fortunes shrink as customers shifted to the convenience of online. After all, why trek to a store when you could get everything at the click of a button?

This sparked an increased investment in tech and measures to monetize the content that these media organizations were generating. Governments around the globe have also realized that the technology is here to stay and have moved, or are moving, many of their services online to enable easy access for their populace. The COVID period has only accelerated the transition to online content delivery.

Trend of content in local languages shows an increase

Over the past few years, there has been a shift in the language availability of online content. Every year, we see more content emerging in a wider variety of languages, and this trend shows no signs of slowing. As figure 1 highlights, English has long been the dominant language online. However, that lead is gradually shrinking as content in other languages gains momentum and popularity.

Figure 1: Content languages in use in the internet

Over the past decade, English-language content has fallen 5% while many European languages have steadily increased. This graph only shows the languages that make up >0.1% of all websites, meaning that content in new languages is also on the rise. This is only natural as the reach of the internet grows into previously untouched regions of the world—these new audiences need to access and consume information in a language they understand. Organizations know this and tailor content based on a user’s location.

Let’s take an example of a new internet user in Nicaragua. Many Nicaraguans speak a dialect of Spanish that is heavily influenced by Nahuatl and Nawat, languages that were spoken by Nicarao people inhabiting the western half of the country. About 20 years ago, only English-language content could have been delivered to this user. Now, websites cater to the local language and can deliver content in Nicaraguan Spanish to users there.

Government and financial institutions implement source country-based filters

I have written about government institutions starting to deliver services to their populace as they embrace internet technology. Governments are slow and understandably cautious in adopting new technologies, and not long ago, very few government services were available online. Early movers in this space quickly realized the pros:

• Deliver services more quickly and easily
• Cut out middlemen that can slow down and drive up the costs of services

And cons:

• Inadequately protected websites can easily be compromised by malicious actors
• Non-members of the intended populace may be able to access and benefit from the services

To combat these risks, government institutions have fallen back to a basic firewall rule as a first line of defense. One of the most common ways to determine a user’s location is with the source IP address of the traffic. All public IPv4 ranges are mapped to different countries across the world. Institutions implement source country-based allow listing of traffic. Traffic with a source IP that matches an allowed region is permitted to reach the destination web server and access content, while other traffic is dropped at the firewall.

There are disadvantages to this approach. First among them: an exposed IP address is an easy target for malicious actors.

Note: This is not a zero trust method of access. To be safe and secure, institutions must apply zero trust principles to their network architecture and not base their defense on IP addresses, which can be spoofed and otherwise misused. Zscaler promotes the use of zero trust architecture for securing the digital transformation journey. 

The Problem

Optimal or not, organizations use IP address filtering for security. As a multinational company, you would have a presence in many of these countries. These locations would be characterised by:

1. A small employee/ user base (< 100)
2. Expensive to establish and maintain an office location

You still need a local IP address so users can access local content and government websites that restrict access based on the geolocation of the IP address.

Users in that country would typically receive “local” IP addresses in order to access local content and government websites. Would these users be on corporate devices, and would company security policies still apply for them? This would present a challenge for any CISO: ensure a uniform security posture across all users, wherever they may be.

Source IP address is the most common way content providers determine a user’s location. Other methods employed by providers such as Google are device location, work/home addresses, and previous activities. Users can restrict these methods via their device settings, but the source IP address cannot be changed without using a VPN connection to another location in the country of interest.

Solutions from Zscaler

Zscaler has multiple solutions to the aforementioned issue depending on the use case. All of these service offerings have required infrastructure (physical or virtual) in their environment in those locations. In the very near future, we are excited to bring you a new service, delivered completely from the Zscaler cloud. Stay tuned for more updates in the next few weeks!