Russia leads globally in VPN service expansion despite government crackdown

In January, CEO of Gazprom-Media and former head of Roskomnadzor Alexander Zharov said YouTube could be blocked in Russia. Many Russian bloggers have already switched to a video platform by VK, the country’s largest social network. Moreover, 40 technical experts from China, which blocked YouTube back in 2009, arrived in Moscow in late March, Octagon reported.

YouTube is the only major foreign social network that users in Russia can still access without a VPN. Instagram, Twitter, and Facebook were blocked after the war began, along with independent media websites.

The mass online purges have shot Russia into the top-10 VPN-downloading countries, though before the war it ranked only 58th. In the first six months of 2022, almost a quarter of the country’s population downloaded VPNs compared to a mere 3.4% in 2020.

Russia leads in VPN service expansion

In late January 2023, popular VPNs reported disruptions: residents of Novosibirsk, Omsk, Altai and other regions in the Russian East were unable to connect. VPN providers believe that Roskomnadzor was testing VPN blocks. This is not the first “test” of its kind, and experts say that each time the attempts to jam VPNs become more and more successful.

In spring, Novaya Gazeta Europe launched VPNovaya, a VPN service which is almost impossible to block. For a €10 donation you can become an administrator of a local VPN, which you can share with friends and relatives in Russia and Belarus (up to 250 users). It is very easy to use. Step-by-step instructions are available here.

Roskomnadzor got the right to block VPNs back in 2017, when the federal law “On VPNs” came into force. It obliged VPN providers to connect to the federal state information system (FSIS), which contains a list of banned websites that VPNs must block.

In 2019, Roskomnadzor demanded that popular VPN services (NordVPN, VyprVPN, ExpressVPN, and others) join the FSIS. All the providers except Kaspersky Secure Connection refused.

In March 2021, Roskomnadzor slowed down Twitter. This was the first successful test of the Technical Threat Reduction System (TTRS), a piece of software that allows traffic to be filtered on a point-by-point basis. Since then, Roskomnadzor has been able to block and disrupt particular VPN services.

“It is commonly thought that the Chinese firewall is something scary that Russia has not yet reached,” says Mikhail Klimarev, director of the Internet Protection Society. “It might come as a surprise, but the blocking systems in Russia are much more sophisticated and modern now. In China, all traffic is walled off, but it is not censored in any way inside the country. We have such a wall around every telecommunications operator. That is TTRS — technology that allows you to block not only the domain address, but the protocol as well.”

In June 2021, Russia banned the first batch of VPNs: VyprVPN and OperaVPN. In September 2021, shortly before the Duma elections, when the opposition published its Smart Voting recommendations, Roskomnadzor tried to slow down Red Shield VPN.

After the war started, users of six more VPNs reported disruptions. Among them was Proton VPN — one of the most popular VPNs in Russia. In June, Roskomnadzor started blocking the service and it became unavailable for clients of Internet service providers with TTRS equipment. Roskomnadzor acknowledged attempts to restrict access to the service and called all blocking tools a threat.

“Roskomnadzor has slowly learned how to block VPNs. And not just by IP address, as it did earlier, but by protocol,” explains Roskomsvoboda lawyer Sarkis Darbinyan. “My sad prediction is that most services, especially the free ones, will stop working in the near future. Only those that have their own self-written protocols, which can fool Roskomnadzor’s tracking systems, will remain.”

Over the past year, Roskomnadzor has announced the banning of 19 VPN services. Among them are the country’s most popular VPN, Super Unlimited Proxy (over 14 mln downloads in Russia from 2015 to July 2022), as well as Proxy Master (10.8 mln downloads).

11 services had already been blocked, five removed their servers from Russia, and five more have experienced disruptions.

In February, several “public service announcements” about the dangers of VPNs were published on the VK page of the company ROCIT. The company’s official website states that ROCIT operates “with the financial support of the Ministry of Digital Development, Communications, and Mass Media.”

Nine videos accuse VPNs of leaking personal data and urge users to remove them from their devices. “VPN app = personal data leaks into the public domain”, warn the authors. In the videos, the characters’ personal addresses, credit card details, social security and taxpayer numbers get leaked because they used VPNs.

“These ads are aimed at people who know absolutely nothing about technology,” says Roskomsvoboda lawyer Sarkis Darbinyan. “No service knows your credit card number because all traffic is encrypted according to the PCI DSS standard which all payment services use. The VPN only knows where you connected to, but not what you did on Google.”

These PSAs also contradict the actions of the state itself.

“We see the government procuring VPN tunnels. The authorities want to make sure that there are no leaks and that information is transmitted through secure channels, so they use VPNs, which have always been the most reliable tool for tunnelling and encrypting traffic. But over time, people have started to use this tool as a means of circumventing censorship,” explains Darbinyan.