What Should Russians Do If VPNs Are Banned?

Whether Russia will ban access to VPNs from March 1 has been troubling experts and ordinary users for months, with lawmakers and the head of the Kremlin-linked Safe Internet League hinting it could happen. On the one hand, it would be the logical extension of Russia’s trajectory in recent years, as the crackdown on their use intensified.

On the other, Russian authorities have been slow to act. Their moves have also been predictable, giving market players time to prepare and adapt. As a result, the eternal cat-and-mouse game between censors and those who strive for a free internet continues.

The Kremlin has spent the past three years testing various ways to subdue and block VPN services. First, there were calls for VPN services to voluntarily add their names to a white list that obliged them to comply with Russian law. Then came VPN blocking by IP address, a familiar and well-tested mechanism for combating "undesirable" information. Then Russia activated the TSPU system (Technical Means of Countering Threats), which blocks connections to websites.

In 2023, we received many confirmations that several VPNs were partially or completely blocked in parts of Russia, and sometimes the entire country. These are blockings based on protocols and signatures that essentially block the whole technology and all the services that work on its basis. 

They are carried out through the TSPU, without adding to the government’s registry of blocked information. Usually, these blockings are only temporary. This is how the authorities develop the practice while minimizing risks to business infrastructure, where corporate networks and internal VPN tunnels often fail.

Another innovation from last year is Roskomnadzor's Order No. 168. It gives censors the right to add a page or an entire website to the prohibited resources registry (with subsequent mandatory blocking) if it contains information on how to access prohibited resources, advocates for the use of blocking circumvention technologies like VPNs, or offers to use or purchase them. This measure comes into force on March 1.

Let’s examine what could happen next.

Of course, the media, NGOs and other platforms that disseminate knowledge about VPNs would be the first to face problems, as they helped popularize their use. They will have to make a choice: clean up their resources to avoid a ban, or proudly continue writing about VPNs (but from under VPNs, because they will be blocked).

It will also affect people’s ability to download VPNs by hitting both official websites and aggregators through which they receive traffic. VPN providers are already looking for other ways to reach customers. Now these ways will become even more indirect.

All of this will change user behavior and the way people learn about and purchase VPNs, forcing marketing approaches to change. If information about various solutions is currently publicly available, then in the future it will be a little bit harder to get. Most likely, information about the sale of tools for bypassing blockades will slowly move from the web to Telegram. Perhaps marketplaces like Avito will be used, or users will spread them directly to each other. 

Lawyers have additional thoughts on how the situation could develop. For example, our partners from Network Freedoms have pointed out that some dormant articles in Russian legislation are yet to be applied, but may one day be used to prosecute any VPN administrator, down to the level of a home network for relatives and friends, or even their own use.

So far, the penalties under this article are not severe: administrative charges and a fine of up to 30,000 rubles ($324). In our colleagues’ opinion, these laws can be toughened, leading to harsher punishment. For example, in Turkmenistan, people convicted of installing and configuring VPNs for third parties face an administrative arrest of up to 15 days and a fine of over $8,600.

The tech community, on the other hand, is more inclined to analyze the censor’s current resources and capacities and design the most sustainable means of countering it. Russia still lags behind China and Iran in terms of banning, so it makes sense to use their experience to anticipate Roskomnadzor's next steps.

Unfortunately, we do not know for certain whether Russian censors are in contact with their Iranian counterparts, but there are reports that they have interacted with Chinese specialists. It is likely that the Kremlin is exchanging ideas and tactics with Beijing.

We know that Chinese deep packet inspection (DPI) systems tend to use short-term blocking instead of permanent blocking. This makes it difficult for users to access information, but it does not shut down data exchange completely. This is because China is very careful to make sure it does not harm authorized businesses in the process. 

We are now seeing the same approach from Russian censors. The use of VPNs on a private level is practically risk-free, while the distribution of such solutions can be prosecuted.

Today, the Russian version of DPI, TSPU, can block OpenVPN, WireGuard, IKEv2 and other protocols, including Shadowsocks — and that's just what we've heard from our trusted sources. But censors may already be testing blocking and more advanced tools somewhere inside Russia’s borders. What we can say for certain is that the TSPU system is evolving, gaining more and more coverage, and its capabilities are increasing as well.

In Russia, an increasing number of VPNs have been blocked, and there are fewer available that can circumvent restrictions. Some have one or two protocols and many IP addresses, which allows some users to use the service even when the service is blocked. Others have a lot of protocols, including traffic masking, which makes them invisible to censors.

Users in Russia should look into VPN services that can offer one of these protocols. At the moment, AmneziaWG, VLESS + Reality, VLESS over WS and CDN, Shadowsocks-2022, OpenVPN, or Shadowsocks over Cloak are some of the services currently coping with blocking

Will they work in the future? It's hard to say for sure, as each VPN has its own features, strengths, and weaknesses. But, as things stand, in the near term we will still be able to fight back against the Kremlin’s efforts to control access to the internet.

In any case, it is worth preparing several tools for yourself, which can be gradually put into operation if the previous one fails. Keep in stock proven traditional VPNs with complex protocols, self-hosted VPNs like Amnezia VPN and Outline, and alternative solutions like Lantern, Psiphon, and Tor. You can also use browser plug-ins like Censor Tracker or AntiZapret as a safety net.