> The only thing that could be done, in principle, by ICANN and EU/US service providers is to block out all content coming in or out of Russia
I don't think this is true. The root DNS servers ICANN runs could stop handling requests for anything on the .ru/.su Russian TLDs. Though Russia runs the .ru servers internally, from ripn.net, there's still reliance on the root servers to point there. This would break Russian internal access to their own services.
If you run `dig +trace government.ru` you can see your first query is to the various "*.root-servers.net" name servers. When I did this my queries went like this:
A.ROOT-SERVERS.NET -> B.DNS.RIPN.NET -> NS2.GOV.RU
That first step, contacting the centralized root servers, is where ICANN could have killed .ru domain lookups. (also my knowledge of DNS is shaky, so someone correct me if I'm wrong)