As of March 1, 2024, The Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor, RKN) can obstruct any VPN resources or websites that provide information on how to bypass internet restrictions imposed by the Russian government.
Artem Sheykin, the Deputy Chairman of the Council for the Development of the Digital Economy at the Federation Council, informed the RIA “Novosti” agency on October 3, 2023, that Roskomnadzor will also prohibit VPNs from all mobile app download platforms, including the App Store and Google Play. Furthermore, the agency will thoroughly examine RuStore, its Russian counterpart, which was introduced after the removal of Russian banking and financial applications from the app stores of Google and Apple.
Sheykin asserts that implementing a directive to block mobile applications VPNs will be predicated on one of its stipulations. Roskomnadzor forwarded a preliminary version of the directive to the Ministry of Justice on September 18, 2023. The document aims to obstruct resources that advocate for evading limitations and convince individuals of their appeal.
Already this year, Roskomnadzor blocked over thirty VPN services. The barring of VPN services by the agency predated the Russian invasion of Ukraine. Roskomnadzor restricted Russian access to the VPN services of the Opera browser and VyprVPN in June 2021. In September 2021, an additional six resources used to circumvent restrictions were blocked. Following the outbreak of hostilities between Russia and Ukraine, Roskomnadzor imposed more stringent restrictions on more than twenty VPN services in 2022.
Roskomnadzor altered its blocking strategies in 2023. Instead of barring the IP addresses of VPN servers, the protocols were blocked. Protocols govern data transmission between the connecting device and the VPN server. Their duty entails guaranteeing a secure and stable connection. Roskomnadzor prohibited popular protocols such as OpenVPN and WireGuard in early 2023. Particularly, a second surge of blocking occurred against WireGuard at the end of September.
Blocking the website, the IP address, and the protocol are the three ways to prevent users from connecting to a VPN. Each of these approaches has the potential to be just as efficient, but every service has its own set of technical skills to get around limits. Each of the three approaches can be used in tandem with one another.
It is common practice to identify VPN providers by analysing the characteristic encrypted internet traffic patterns. Russian internet service providers will notice the pattern and report it to Roskomnadzor if this traffic is routed to the same IP address. VPNs, on the other hand, are frequently able to outsmart Roskomnadzor.
Past attempts to block VPNs
Russian officials have tried in the past to stop people from using VPNs. There are times when authorities block resources with instructions on how to get around restrictions already in place. For example, Roskomsvoboda (a Russian NGO dedicated to protecting Internet users’ digital rights and promoting open self-regulatory networks) ran into this problem in 2015 when it launched its “Toolkit for Circumventing Blockades.” On the other hand, this kind of information was not against Russian law.
Legally, it was impossible to restrict resources promoting VPNs. People can locate the necessary information, even if every website containing guidance on circumventing blockades is inaccessible. Instructions regarding using VPNs will be disseminated through platforms such as Telegram. The situation changes when the Russians are no longer required to circumvent blockades. This could occur if Russia “imports substitutes” for social media.
The Russian network, known as Runet (An online Russian-language community), may be using the Chinese script. It is expected that within the next two years, Russia will emulate China by blocking both commercial and public VPN services. Primarily, this impacts services that employ the most basic protocols. Only those VPNs that explicitly cater to the Russian market and actively resist censorship or self-hosted VPNs will probably endure.
Evasive Measures and Legal Suits
Since VPN services can rapidly alter their IP addresses and domain names, blocking them is similar to a game of cat and mouse. In addition, they employ techniques known as obfuscation, which make VPN traffic appear identical to conventional internet traffic.
VPNs have taken legal action in opposition to these blockades. HideMy dot name initiated legal action against Roskomnadzor on October 4, 2023, to make the latter’s blockade illegal. The company intends to set a legal standard that will apply to other VPN services in this approach.
Because Roskomnadzor does not anticipate large companies such as Google, Apple, and Microsoft to comply with its demands, the agency must make official requests to these companies to remove VPNs from mobile app stores. Ultimately, it will be up to the companies themselves to decide whether or not they will comply with the requirements set forth by the government regulators. For instance, VPN applications cannot be downloaded from the App Store in China, and the entire App Store is highly controlled to ensure compliance with Chinese laws.
Nevertheless, Apple and Google have in the past disregarded the directives of Russian authorities on numerous occasions. Google was fined 7.2 billion rubles in May 2022 for failing to remove prohibited content from its Russian resources. Simultaneously, Google continued to disregard demands to delete banned information and refused to remove videos from YouTube detailing Russia’s invasion of Ukraine; this resulted in Russian courts imposing additional penalties of 3 million rubles and 21 billion rubles, respectively. At present, neither of the penalties has been remitted. Apple was additionally imposed a 400,000 ruble fine in August 2023 for its failure to remove podcasts about the conflict in Ukraine; this penalty has yet to be remitted.
Thus, it is conceivable that companies will once more disregard Roskomnadzor’s claims. Nevertheless, search engines like Google, Yandex, and Bing may exclude VPN services from their index pages. Furthermore, Russian authorities will try to reroute citizens to their sovereign app stores, including RuStore, which operates entirely within the jurisdiction of Russian regulators.
People will find a way to circumvent
Self-hosted VPNs are those where users acquire hosting space and configure their servers. Such VPN configuration and development is typically the purview of tech-savvy individuals and enthusiasts. Nevertheless, certain initiatives furnish users with setup instructions for self-hosted VPNs, which users of varying degrees of technical proficiency can follow.
These VPNs can accommodate anywhere from one to two users to one hundred. They only require them to be trustworthy individuals. Russian authorities will be incapable of discerning which servers all users use to establish connections. Completely blocking all VPNs in Russia is unattainable because restrictions spur the development of new circumvention technologies. This technological arms race between VPN developers and regulators will probably continue indefinitely.