National Cyber Warfare Foundation (NCWF)login

Russia Is Tightening Internet Controls, Leading to Operational Risks


0 user ratings
2026-10-15 14:02:42
milo
Blue Team (CND)
Explore Russia's escalating internet restrictions, VPN bans, and outages, and understand the growing operational and surveillance risks for organizations.

Executive Summary


Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024.


However, despite intensifying internet restrictions, technical and political limitations will likely prevent the Kremlin from achieving its long-held objective of a fully “sovereign internet” in the near term. The most likely scenario is that Moscow exerts extensive censorship and monitoring of online activity with increasingly strict –– though not absolute –– controls on circumvention and anonymizing tools.


Insikt Group assesses that the Kremlin’s primary objectives regarding internet restrictions are twofold: facilitating extensive surveillance of online activity to support control over the domestic information space while maintaining connectivity to the global internet, and developing national internet infrastructure under Kremlin control, enabling isolation from the global internet if the Kremlin so chooses. Efforts in support of these objectives have almost certainly provided the Kremlin with enhanced ability to control and monitor domestic online discourse.


In this environment, individuals and organizations operating in Russia are subject to increasing operational risks, including surveillance and exposure of sensitive data, challenges in conducting emergency communications, disruptions to corporate tools and digital applications, and legal risks. Entities with indirect exposure to Russia face an increased likelihood of supply-chain disruptions and sanctions violations and, over the longer term, face challenges in assessing the political and economic situation in Russia, as restrictions limit the availability of high-quality open sources.


Key Findings



  • The Kremlin is very likely using managed internet shutdowns across Russia to test and improve its ability to isolate the Russian internet, though technical and political limitations make it unlikely that it will achieve its objective of establishing a fully “sovereign internet” in the near term.

  • In the near- to medium-term, a combination of falling approval ratings for Russian President Vladimir Putin, declining public opinion amid economic strain, and ongoing Ukrainian drone strikes very likely incentivize Moscow to impose further internet restrictions, regardless of reported public dissatisfaction with some of these measures.

  • The Kremlin will very likely continue to pursue strategies to deter VPN use by forcing platforms to support VPN blocks and making VPN use more expensive and inconvenient, though likely avoiding direct punitive measures against individual users.


Kremlin Systematically Tightening Internet Restrictions


Since July 2025, the Kremlin has systematically tightened access to widely used civilian communications applications and VPNs, caused regular mobile internet outages across Russia, and instituted requirements that place Russian and foreign individuals and firms under increased government surveillance. The Kremlin likely views these measures as necessary to make it more difficult for Russian elites or the public to coordinate political dissent, and for the Ukrainian government to launch drone strikes against Russian critical infrastructure.


Restrictions Represent Marked Escalation in Control Over Russian Internet


Insikt Group assesses that, since 2012, Russians have seen their ability to operate without restriction on the internet decline in several waves, primarily driven by the Kremlin's calculation that Russians were using the internet to organize anti-government political actions.




2000–2012: Little Government Oversight



Laissez-Faire State Policy

During this period, the Kremlin generally viewed the internet as politically non-threatening, in part due to low internet penetration rates in Russia (from 1.8% in 2000 to 58% in 2011).



Thriving Media and Social Platforms


Individual expression on the internet was relatively free, with independent news sites such as Lenta, Novaya Gazeta, Ekho Moskvy, and Gazeta able to operate largely without government interference.


In addition, platforms such as LiveJournal and VKontakte (VK) –– Russia’s Facebook mirror –– operated largely without government control.





Minimal Government Regulation

Russian state telecommunications regulator Roskomnadzor was founded in 2008, but primarily handled telecommunications licensing rather than censorship or content filtering.



2012–2015: Blocklists and Platform Takeovers Following Mass Protests



Laws Passed Creating Blocklists of Websites

In 2012, following the largest protests in Russia since the fall of the Soviet Union, the Kremlin passed law No. 139-FZ, titled “On Introducing Amendments to the Law on Protection of Children from Information Harmful to Their Health and Development,” which created the Unified Register of Banned Websites. This introduced internet service provider (ISP)-level technical infrastructure, enabling the Russian government to block domains and IP addresses through domain name system (DNS) tampering.

In 2014, the Kremlin passed the Lugovoy Law (No. 398-FZ), allowing for extrajudicial blocking of websites the government considered “extreme” or which called for unauthorized protests.



Platform Takeovers by the Kremlin

The Russian Government started taking over platforms it considered politically threatening. For example, VKontakte founder Pavel Durov was forced out of Russia in 2014 after refusing to hand over data to the Federal Security Service (FSB). The Kremlin facilitated the transfer of control of VK to state-aligned businessmen, including Vladimir Kiriyenko, who is currently VK's CEO.



Data Localization Targeting Foreign Internet Companies

In 2014, the Russian government passed the Data Localization Law (No. 242-FZ), mandating that foreign internet companies store Russian citizens’ personal data on physical servers inside Russia, likely to make it easier for the Kremlin to access that data for surveillance purposes.



2016–2021: Surveillance Mandates and Attempts to Block Platforms



Laws Passed to Mandate Data Sharing, Restrict VPNs, and Pursue Sovereign Internet

In 2016, the Kremlin passed the Yarovaya Law (No. 374-FZ and No. 375-FZ), which forced ISPs and communication providers to retain metadata for up to three years and message and audio content for six months, and to provide that information to Russian security services without a warrant.

In 2017, the Kremlin passed the Anonymizers Law (No. 276-FZ), formally prohibiting the use of VPNs to circumvent blocked websites.

In 2019, the Kremlin passed the Sovereign Internet Law (No. 90-FZ), which required Russian ISPs to install TSPU (technical means of counteracting threats, технические средства противодействия угрозам) controlled by Roskomnadzor, thereby giving the state the power to throttle or sever external traffic to a platform.



Attempts to Block Platforms Have Mixed Results

In 2018, Roskomnadzor attempted to block Telegram by IP-banning millions of cloud servers. The attempt failed, disrupting banking and retail systems without shutting down Telegram.

In 2021, the Kremlin launched its first large-scale deployment of TSPU –– deep packet inspection (DPI) hardware –– to throttle a mainstream social media platform, thereby demonstrating technical maturity in the Kremlin’s ability to throttle platforms.



2022–2024: Crackdown on Independent Media, VPN Blocks



Mass Blocking and Shutdown of Independent Media


Following Russia’s full-scale invasion of Ukraine, the Kremlin blocked hundreds of independent news outlets (including Meduza, BBC, Radio Free Europe, and Ekho Moskvy) by pushing DNS and SNI (Server Name Indication)-level blocks to TSPU devices across all ISPs simultaneously. In addition, the Kremlin throttled, before outright blocking access to, social media platforms such as Facebook and Instagram. This was accomplished via TSPU's packet-dropping mechanism before full blocks were applied in March 2022.


In 2024, Roskomnadzor began throttling YouTube to near-unusable levels, likely to force users onto state-controlled video platforms.





Anti-VPN Actions


In 2023–2024, Roskomnadzor began blocking underlying VPN protocols, including OpenVPN, WireGuard, and Shadowsocks, via DPI hardware.


In 2024, the VPN Advertising Ban (No. 406-FZ) took effect, prohibiting the advertising of VPNs and other tools that circumvent blocks on certain websites and platforms.





Table 1: Russian approaches to internet restrictions from 2000–2024 (Source: Recorded Future)



Source: RecordedFuture
Source Link: https://www.recordedfuture.com/research/russia-restrictive-info-environment


Comments
new comment
Nobody has commented yet. Will you be the first?
 
Forum
Blue Team (CND)



Copyright 2012 through 2026 - National Cyber Warfare Foundation - All rights reserved worldwide.