Whitelists For Dark Times: Russian authorities persistently build a ‘closed’ internet on top of an ‘open’ one

The Russian authorities intend to conduct a historic experiment on the World Wide Web and, as usual, on their own population. Although the Russian internet was originally created in a decentralised way and developed as an organic part of the global network, the Kremlin now appears determined to 'carve' Runet out of it, turning it into a closed island connected to the global internet only by a 'suspension bridge' kept under strict control.

The radical nature of this project, however, stems less from the original plan and more from the authorities’ failure to implement more flexible versions of control over Runet.

After the start of the full-scale war, the authorities relied primarily on traditional methods of censorship, namely negative filtering, which involves removing undesirable content. The list of resources blocked by Roskomnadzor expanded rapidly. However, social media platforms and the widespread use of censorship-circumvention technologies prevented the authorities from achieving the intended outcome.

Our analysis indicates that blocking and throttling major social networks and services such as Facebook, Instagram and YouTube did not result in users migrating to VK, which is controlled by the Kremlin, nor did it produce a significant decline in online activity. On the contrary, the importance of social networks as sources of information continued to grow.

This experience prompted the Kremlin to turn towards testing positive filtering technologies. These are based on the principle of blocking all content by default and allowing only permitted material to pass through so-called whitelists.

The scale of mobile internet disruptions across Russia over the past six months cannot be explained by 'security' considerations as articulated in the official narrative. Having used these disruptions to engineer a sharp deterioration in internet access conditions, the Russian authorities are now presenting whitelists as a remedy for the chaos they themselves created.

They are seeking to develop and calibrate the architecture of a 'permitted' internet at the regional level, to centralise it and then to transfer it to the fixed-line internet. It remains unclear whether this is technically feasible, yet the authorities appear determined to press ahead. There is little doubt that, if the experiment succeeds, it will be replicated by other autocratic regimes and will mark the beginning of a new era of a fragmented web.

1. The censorship framework: why negative filtering failed

A belated closure

In contrast with China and with many authoritarian states in the Middle East, the Russian internet emerged and developed from the bottom up and in a fully decentralised manner. As a result, censorship capabilities were not embedded in its architecture. By the time internet censorship began to take tentative steps in Russia in 2012–2014, Runet already possessed a highly developed infrastructure and the population’s engagement with it was significant, with penetration exceeding 50%. While, in the second half of the 2010s, the authorities were laying the groundwork for the 'sovereignisation' of Runet (the Yarovaya package in 2016 and the Sovereign Internet Law in 2019), mobile internet, social networks and messaging services had become ubiquitous and were shaping the daily environment of much of the population. At this stage, legal and organisational actions aimed at creating a content-filtering system, such as the mandatory installation of TSPU equipment by all providers, remained largely invisible to users and did not alter their internet habits. The attempt to block Telegram in 2018 ended in failure and a rapid retreat by the authorities.

The launch of the full-scale invasion of Ukraine triggered the introduction of wide-ranging and systematic online censorship. The number of websites added to Roskomnadzor’s register rose from fewer than 200,000 at the end of 2021 to 1.2 million in 2025. The censorship system was built on top of the existing Runet and developed on an ad hoc basis, meaning that it consisted of situational reactions and the use of whatever tools were available (→ Polyakova, Meserole: Exporting Digital Authoritarianism). At the structural level it sought to borrow elements from both the Chinese and Iranian models of deep content inspection in order to create a reliable system of negative filtering that would cut users off from undesirable material.

A major obstacle to this strategy was the role of social networks, which remained outside the authorities’ control and had reached extraordinary levels of penetration in Russia. According to RePortal, 99 million Russians used social networks in 2022, representing 68% of the population; MediaScope put the figure at 73%. Social networks had become the universal point of access, navigation and dissemination for a wide range of content, including informational and political material.

In March 2022, the authorities almost simultaneously blocked Facebook, Instagram, Twitter and, partially, TikTok. Meta was designated an extremist organisation. The Meta-owned messaging service WhatsApp was not blocked, as the authorities claimed it did not engage in the public dissemination of information. Telegram also remained accessible, and the decision to throttle YouTube, another hugely popular service with a relatively small but noticeable political segment, was taken only in 2024.

The impact of these blocks was limited by the rapid spread of VPN services. The level of VPN adoption, calculated based on download statistics, rose from 4% in 2021 to 42% in 2022. Although the use of VPNs was formally banned in 2017, according to a Levada Centre survey conducted in early 2025, 36% of those surveyed admitted to using them, and another 31% said they were aware of their existence. Among younger people aged 18 to 40, almost 60% reported using a VPN. These figures are likely to be understated, since respondents may have considered admitting VPN use to be sensitive.

A leaky curtain

Against the backdrop of difficulties with traditional methods of analysing the audience of Russian social networks under conditions of blocking and circumvention, data from Brand Analytics make it possible to track user migration on the basis of statistics on 'authors', meaning those who published at least one post in a given network in Russian.

The initial outflow of authors following the bans appeared striking. By autumn 2022, their number on Facebook and Instagram had fallen by 55%, from 41 million to 18 million accounts. However, the outflow halted at that level. At the same time, VK, which is controlled by the authorities, did not become the beneficiary of the departure of authors from the banned networks, contrary to expectations. The number of its authors increased at first, rising from 23.8 million in autumn 2021 to 28 million at the end of 2023, but then declined to 20 million. Meanwhile, the number of authors on Telegram grew rapidly. By the end of 2024 the increase amounted to 20 million users, a figure only slightly lower than the outflow from the banned networks. In addition, from the second half of 2024 the number of active Instagram users (authors) began to rise. In spring 2023 it was less than 40% of the pre-war level, yet by autumn 2025 it had increased more than one and a half times to reach 64% of the 2021 peak. Taken together, the number of authors across the four social networks Facebook, Instagram, Telegram and YouTube in 2025 reached 94% of the pre-war level, according to Re:Russia’s calculations based on Brand Analytics data, while the number of authors on VK fell to 82%.

Dynamics of the number of social media authors and their migration, 2021–2025, million people

According to research on the Russian segment of Instagram by Livedune, while bloggers with small followings (from 100 to 50,000 subscribers) had lost 45% of their audience, measured by views, by early 2024, medium-sized bloggers with 50,000 to 100,000 subscribers had lost one third and large bloggers only 18%. A similar pattern was observed among brands. Large brands with more than 50,000 subscribers lost only one third of their views over two years of blocking, whereas medium and small brands lost around half. By early 2024, however, views of stories were already rising across all categories and had reached between 85 and 97% of pre-war levels, which can be regarded as the completion of the adaptation phase.

The recovery of Instagram prompted the Kremlin to tighten restrictions on advertising on blocked networks and expand the fight against VPN services. A ban on VPN advertising entered into force in September 2025 and the use of VPNs became an aggravating circumstance in criminal cases. In the first ten months of the year Roskomnadzor blocked 258 VPN services and continued to expand the list of blocked protocols.

User behaviour on YouTube, which the authorities began throttling in August 2024 and intensified in December, showed similar trends. Google statistics indicate that traffic fell from 42 index points in the first half of 2024 to between 8 and 12 points in April to October 2025, a fourfold decline. At the same time, according to Mediascope, monthly audience reach declined far less, falling from 96 million people in July 2024 to 71 million in October 2025, a reduction of 26%. 'The volume of data passing through MSK-IX, Russia’s largest internet exchange point, began to rise from late July to early August 2024. This indicates that Russians began watching YouTube videos from foreign servers using VPNs,' commented DGAP expert Alena Epifanova. As for the number of Russian YouTube authors, it fell to 58% of the spring level by October 2024 but grew again over the following year, reaching 67%.

Internal data from YouScore.Top, which monitors the Russian-language news and socio-political segment of YouTube, present the following picture. Between 1 and 25 November 2025, compared with the same period in 2024, the top 100 socio-political channels by views lost almost two thirds of their subscribers. However, the number of views remained unchanged. It even grew slightly by 2% and, after adjusting for the weight of Ukrainian and Belarusian channels in the sample, the increase was around 7%.

According to Mediascope analytics, average viewing time across the Russian segment of YouTube fell threefold, from 50 minutes per day for the entire population in summer 2024 to 17 minutes per day in the last six months. The same study shows that most of the reduction occurred in the children’s and entertainment segments, namely cartoons and films, which are easily available on other platforms. These categories likely accounted for the bulk of total viewing time. Those who sought specific content on YouTube that is absent from other parts of Runet appear to have largely remained, adapting to VPN use.

Taken together, these data suggest that the Kremlin’s campaign against social networks over three and a half years achieved only limited results. Facebook’s position in Russia appears to have been seriously undermined, although its difficulties, including ageing and shrinking audiences, were evident even before it was blocked. The main beneficiary of the restrictions was not VK, which is controlled by the Kremlin, but Telegram, which absorbed activity from other networks and attracted new groups of users across various social strata. The rapid increase in VPN use meant that, after the initial sharp outflow, the number of users, or at least accounts, on banned networks stabilised and then began to rise over the past year. Survey data confirm these trends. The share of social networks as an information source fell from 24% in 2021 to 17% in late 2023 and then rose again to 19% in August 2025. The share of Telegram increased from 4% in 2021 to 14% in 2025. As a result, the combined share of Telegram and social networks grew from 28 to 33% during the war years and, including YouTube, to 37%, significantly exceeding the share of television (→ Re:Russia: Digital Curtain).

As we noted earlier, government restrictions undoubtedly hindered the growth of the independent and opposition segments of Runet but did not inflict critical damage on them (→ Re:Russia: YouTube Window). More broadly, the Kremlin’s failure to monopolise the Russian segment of the global network stemmed from the deep entrenchment of Western and Kremlin-independent social networks in users’ daily practices. This dynamic forced the authorities to act with relative caution in imposing restrictions and encouraged users to invest significant effort in finding ways to circumvent them.

The inability to sever Russians from familiar social networks, combined with the existence of a relocated media and public sphere abroad, prevented the Kremlin from creating a reliable censorship framework within Runet. The system of negative filtering of undesirable content remained incomplete, even though similar restrictions were expanded successfully in offline domains such as journalism, publishing and other areas of public life. Online, the measures taken produced a leaky curtain consisting of numerous obstacles rather than an effective barrier.

2. Attempts at isolation: from degraded access to positive filtering

A history of failure: repressive MAX

A key reason for the limited success of the regime’s negative filtering strategy was the failure of VK, which is controlled by the Kremlin, to attract users away from the 'undesirable' networks. VK had initially been envisaged as a strategic hub for political management within Runet and became, in effect, a family enterprise of Sergei Kiriyenko, the official responsible for domestic policy. The concept of deep censorship based on the Chinese model presupposes the existence of effective infrastructural alternatives within the censorship perimeter, namely social networks and messaging services that are attractive to users and at the same time controlled by the authorities (→ Re:Russia: Catching Up with Hybrid Totalitarianism). In such a system, politically indifferent users choose more convenient platforms and migrate to state-controlled products, leaving the protest-minded minority in an inconvenient and isolated space.

Alongside VK, the authorities viewed the MAX messenger as such an alternative. MAX was intended to become a Russian analogue of China’s WeChat, an essential social tool. In VK’s case, the Kremlin had seized an existing market-ready product along with its user base. With MAX, however, the authorities had to rely on their own managerial abilities. The promotion of a non-competitive messenger therefore turned into a coercive campaign aimed at forcing its adoption and undermining the functionality of WhatsApp and Telegram, which Russian users were accustomed to.

From September onwards, MAX began to be preinstalled on every phone sold in Russia and its mandatory use was required for all groups and organisations connected with the state. Several regions launched pilot projects to transfer school chat groups to MAX, including Tatarstan, Mari El, Altai, the Khanty-Mansi Autonomous Okrug, and the Vladimir and Tver regions. The authorities planned to complete the full transition of Sferum, the online education platform, to MAX by 1 November. According to Doxa, the Ministry of Education and Science has now ordered this to be completed by 19 December. Reports already emerged in late October that students at the Polzunov College in Yekaterinburg were threatened with expulsion for refusing to install the messenger, according to Yekaterinburg-Online. In St Petersburg, housing associations were instructed to migrate community chat groups to MAX, writes Fontanka.

The coercive nature of the initiative only deepens users’ suspicions.According to data from the Moscow Education project, verified by Novaya Gazeta, in Moscow on average only 7% of pupils and 20% of parents use MAX. Even among teachers, the installation rate reaches only 62%. The lowest levels of adoption are recorded in schools and gymnasiums with the highest ratings for pupil achievement in the Unified State Exam. Scepticism towards the messenger is linked to its inherent disregard for privacy. The SecurityLab portal highlights four main issues that fuel distrust: the privacy policy, which provides for the transfer of information including correspondence to third parties and state bodies; the absence of end to end message encryption; extensive integration with State Services, which part of the audience perceives as an expansion of state oversight; and the closed source code of the application. In essence, the authorities barely conceal that they view MAX as an instrument of control and surveillance.

A second element in the forced rollout of MAX has been a campaign of restrictions on the use of the widely adopted messengers Telegram and WhatsApp. Their reach has been estimated by MTS AdTech at 100 million and 90 million people, respectively. Under the pretext of combating online fraudsters, Roskomnadzor imposed restrictions on calls via WhatsApp and Telegram from August, and in October made it more difficult to connect to these messengers from Russian SIM cards.

Late autumn marked a new stage in the offensive against the messengers. On 22 October access problems with Telegram and WhatsApp were recorded in 34 regions home to nearly 93 million people, more than 60% of Russia’s population. Users were unable not only to make calls but also to exchange messages, according to the ‘On the Line’ project. Roskomnadzor soon acknowledged that it had begun a policy of partial restriction of their operation. Several further major disruptions were then reported in different regions: on 8 November Telegram users experienced difficulties with downloading media files and sending messages, and on 25 November, similar complaints began to pour in from WhatsApp users. In response to the complaints, two Duma deputies, Artem Kiryanov and Anton Nemkin, stated that the blocking of WhatsApp was only a matter of time.

Access degradation as the new norm

The forced introduction of MAX has marked a shift towards a new and more severe strategy for reshaping Runet: the messenger can succeed only if alternative options fade away, making choice impossible. A second and even more significant sign of this new phase has been widespread and systematic shutdowns of mobile internet. As a result, Russia has already spent almost six months in a state of progressive degradation of internet access and adaptation to this new reality.

The campaign began in May with several episodes of mobile internet shutdowns in Moscow, the Moscow region, St Petersburg and some other regions, which at the time were explained by Victory Day celebrations. Yet the shutdowns were not confined to the holiday period. According to On the Line, which monitors Runet on the basis of user reports, 69 instances of mobile internet disruption were recorded within a month, five times more than in the entire previous year (according to the American monitoring project Access Now).

In June, the figure increased tenfold to 622 incidents. This time they were explained by Operation Web, carried out on 1 June by the Security Service of Ukraine, during which several dozen aircraft of Russia’s strategic aviation were destroyed. In July, however, the number of shutdowns in different regions again tripled and reached around 60 episodes not per month but per day across Russia as a whole.

Mobile internet outages in 2025

These restrictions were also justified on security grounds (this was claimed, for example, by the heads of the Lipetsk, Tula, and Saratov regions). A never officially stated but popular explanation claimed that Ukrainian drones might use Russian mobile networks for navigation. Yet a joint investigation by The Insider and the On the Line project showed that there is no direct correlation between mobile internet restrictions and drone attacks. In May and June, out of 230 regional shutdowns only 78 coincided with drone strikes. This pattern persists today. For instance, the map of internet outages compiled by On the Line on 18 November listed 45 regions, including Khabarovsk and Primorsky Krais, Amur Oblast and even Sakhalin Island, none of which are within technical reach of Ukrainian drones.

According to a survey conducted by the Chronicles project, 72 percent of respondents experienced mobile internet shutdowns in October this year. In reality the figure is even higher. Among respondents aged eighteen to forty nine more than 80 percent reported disruptions, while those who did not notice shutdowns were mostly older people who make less use of mobile internet. In effect Russians are being habituated to living without the option of mobile access, as indicated by numerous eyewitness accounts and local reporting. People are relying more heavily on cash, navigating with pre downloaded maps and planning their routes so that they occasionally pass through locations with public Wi-Fi. Access degradation and a return to the pre mobile internet era are becoming normalised. In a number of districts and small towns the authorities have already announced that mobile internet will not return until the end of the war with Ukraine. At the regional level Ulyanovsk region became the first where the local authorities stated that mobile internet in some towns has been switched off permanently, until the conclusion of the special military operation.

Whitelists for dark times

Systematic and widespread internet shutdowns are accompanied by the testing of so-called whitelist technology: a limited set of services and websites that remain accessible even during shutdowns. The number of regions in which whitelists are already being used had risen to 57 by the end of November, according to the On the Line project. In daily snapshots, however, they are normally activated in fewer regions. In September they were used on average in 24 regions, in October in 39 and in November in 43, according to data from On the Line and our calculations. It appears that whitelists were tested in Moscow for the first time.

Number of regions where ‘whitelists’ are activated, September–November 2025

The formation of ‘whitelists’ remains embryonic and disorderly. According to the Ministry of Digital Development, the first version included government services (Gosuslugi, the websites of the government, the presidential administration and the electronic voting platform), social networks and entertainment sites (VK, Odnoklassniki, Mail.ru, the MAX messenger, Dzen and Rutube), as well as consumer services (Yandex platforms, the Ozon, Wildberries and Avito marketplaces, the Mir payment system and the websites of the main mobile operators). On 14 November the list was significantly expanded to include dozens of official websites, state media and other resources. It is expected to be broadened again soon by adding the applications and websites of a number of banks, streaming platforms, building suppliers and even car forums, according to Kommersant. A fierce lobbying battle has emerged around inclusion in the list.

Testing of whitelists confirms that the technology is built on two-tier positive filtering. Unlike censorship, which operates as negative filtering by identifying and blocking prohibited content within the data stream, positive filtering entails complete blocking at the first tier and the passage of authorised content on the basis of an approved list at the second tier. The technology appears to rely on EcoSGE software, which, according to a recent Human Rights Watch report based on an interview with Mikhail Klimarev, head of the Internet Protection Society, was developed by the state-owned company Research and Development Partners (RDP.ru).

Against the backdrop of widespread shutdowns and the degradation of access, whitelists are perceived by citizens and businesses as a panacea, a restoration of minimal comfort. A widespread narrative assures them that whitelists are intended to preserve access to a set of services and websites during temporary mobile internet shutdowns for security reasons, in other words to help normalise the situation in exceptional circumstances. This is the view expressed by most of the business figures interviewed by The Bell, which discussed the issue with the Russian business community.

Yet the scale and geography of the shutdowns clearly indicate that the actual purpose of the whitelist strategy is the opposite. Whitelists represent a model of sovereign internet that provides access only to an approved set of addresses. The shutdown on Sakhalin on 18 November has no relation to any 'extreme situation'. On the contrary, it artificially creates such a situation in order to justify a shift to an authorisation-based system even where no security threat exists.

The Russian authorities are preparing to present the transition to an authorisation-based internet as a new service offered after the chaos of shutdowns that they themselves created. A now familiar tactic is the shifting of responsibility for an unpopular and supposedly unavoidable measure onto regional authorities. The Kremlin employed the same strategy during pandemic lockdowns, the announcement of partial mobilisation and the campaign to restrict abortions (→ Re:Russia: Abortion Sovereignty). Regional administrations are expected to communicate with the public about new measures that limit their rights and to absorb and suppress the resulting discontent.

Even so, success in the Kremlin’s strategy of making the Russian internet sovereign is far from guaranteed. As practice shows, whitelists work only partially and not very reliably. Most importantly, the loss of access to familiar services and content still appears to citizens as a temporary and extraordinary disruption, and one that does not affect household use of fixed-line internet. Once the authorised mobile internet environment is normalised and technically calibrated, the transfer of the whitelist ideology to fixed-line access will become a separate challenge.

Three and a half years of war have thus revealed two phases in the Kremlin’s approach to internet censorship. In the first phase the authorities sought to address the issue through negative filtering technologies, blocking untrusted resources and social networks beyond state control, yet overall they failed. This barrier proved porous and unreliable. That negative experience pushed the Kremlin towards a more ambitious project aimed at cutting the Russian segment out of the global network through positive filtering and the construction of a sovereign internet structured around lists, based on the principle that only what is authorised is accessible. It is unclear whether this is technically achievable, but the authorities appear determined to persist. If the experiment succeeds there is little doubt that it will be replicated by other autocracies, ushering in a new era of a fractured web.

@ Re:Russia / Evgeny Antonov, Kirill Rogov