Understanding Putin's Nationwide VPN Block: How Russia is Tightening Control Over Access and Privacy - Impact on Internet Freedom and Information Dissemination

Over the past week, Russian authorities have apparently increased their efforts to disrupt their citizens' access to virtual private networks (VPNs). In some regions of the country, many of the most popular such networks have become unusable.

As reported in the daily intelligence update, in addition to increased technical disruptions, the Russian state has launched a public information campaign in an attempt to scare citizens to avoid VPNs, claiming that they put their personal data at risk.

The update pointed out that VPNs, which allow users to hide their internet access, maintain privacy and bypass state-imposed censorship, are extremely popular in Russia, although they have been illegal since 2017. They allow users to access objective international news sources, including about the war in Ukraine.

VPNs probably represent the biggest single vulnerability in the Russian state’s attempts to ubiquitously control information inside the country.

VPN in Russia is still legal, but not allowed to talk about it

The Kremlin waged a war against online anonymity long before the full-scale invasion of Ukraine, but it seems that it was only the broad stream of sanctions, cutting off access to Western services, that really made the Russians aware. And even if not, he forced them to use solutions such as VPNs, which, for understandable reasons, the authorities do not like.

The nationwide ban on VPNs was repeatedly challenged by the courts and had to finally disappear from the Journal of Laws, but this does not mean that the rulers gave up. The amendment to the telecommunications law approved on July 31 by Vladimir Putin once again strikes at online privacy, although it does so in a slightly different way than before. By the way, a lot of fresh bureaucracy was thrown in.

Under the refreshed regulations, the very use of a VPN remains legal. On the other hand, it is prohibited to conduct activities consisting in "encouraging" the use of such solutions. In addition, you must not educate others on the topic of hiding web traffic, including grassroots initiatives such as creating guides on forums.

Meanwhile, for a long time, Russia has only allowed those tools that have local certification (in other words, they will send the logs to the services if necessary). So in the end, all legally available VPNs are somehow leaky, and now they can't be promoted. And this is just the beginning.

Russia: hosting only for selected people

And if that wasn't enough for someone, there is also licensing of hosting services. As a result, each service provider must obtain a special permit, proving to officials that "it has made every effort to exclude illegal activities of its customers".

At the same time, it is uphill for the customers themselves, because, as in the case of popular B2C services, they will be entered in the general register. This should include, among others: information on why the person purchased the hosting and a confirmation that the buyer was not previously punished in connection with online activity.

You have a Gmail account? Then you have a problem too

Putin agreed that citizens of the Federation, having an e-mail address with any foreign provider (iCloud, Gmail, Outlook, etc.), could not create an account with any local online service, be it social or any other. The official reason is concerns about the difficulty in establishing the identity of a given person, should he commit a crime.

But perhaps the most interesting idea is number three. Also, because it has the potential to create new problems for Russia. Namely, from December, administrators of Russian online services, relying on passport data, will have to verify the identity of each new user. The state announces the introduction of a special control system, which will be something like a register of Internet users.