“Rather than shutting down the internet, users will be targeted”: The Kremlin scales back its “sovereign Runet” plans

During the past spring, there was extensive discussion about the Russian government's attempts to separate the Runet from the global internet. Despite warnings from Vladimir Putin about the dangers of becoming “humiliatingly” dependent on foreign technologies and assertions from the head of the Ministry of Digital Development that Russia has achieved “digital sovereignty,” no tangible progress has been made in establishing a “sovereign Runet” thus far.

Читать на русском языке

• 1.Filtering, blocking, and tighter controls
• 2.Sanctions work in favor of the sovereign Runet
• 3.Why it's too early to relax and how to bypass blockages
• 4.“Transparent Internet” – have your passport ready
• 5.“Humanity is losing the internet”

The law on the sovereign internet, which was adopted in 2019, signified that the authorities were actively preparing for the possibility of disconnecting the Runet from the global network. Following the full-scale invasion of Ukraine, discussions surrounding Russia's potential disconnection resurfaced with increased intensity. Both sides proposed the disconnection: Ukraine requested the isolation of Russia from ICANN, the organization responsible for domain names, but their request was officially denied (representatives of ICANN stated that they lacked the authority to impose sanctions and emphasized their role in ensuring the internet's functionality rather than hindering it). However, many experts considered the disconnection of Russia from the internet as a part of sanctions to be an “excessive and unjust” measure. According to them, such a step would only impede the public's access to information that could potentially prompt Russians to withdraw support for military actions, while allowing access solely to information provided by the government. It is precisely for this reason that the Kremlin advocated for the concept of a “sovereign Runet.”

The “sovereignization” of the Runet is happening quite intensively, but it cannot be said that Russia is ready to completely disconnect from the outside world, according to Sargis Darbinyan, the head of legal practice at Roskomsvoboda. “There is still the banking sector, international trade—they still communicate with the world, and they need an internet connected to the global network for that. However, these channels are narrowing, and there is less interaction between users and foreign services.”

The expert also suggests that within the next few years, a complete ban on the transfer of user data outside the country may be implemented. Personal data of Russians has already been a subject of dispute between the authorities and international companies. For example, in 2016, the social network LinkedIn was blocked in Russia, with the explanation that the platform violated the law and stored the personal data of Russian users outside the country.

Alexey Shkittin, co-founder of the Berlin-based Institute for the development of public digital networks (IEDN), which studies internet technologies, speculated that when Russian authorities claim to have “built a sovereign internet,” they mean they have established a system of surveillance and control that allows them to restrict users' access to information:

“So far, there's no hint of complete isolation being anywhere close. Yes, technically they have made it possible to manage domain resources within the country—a system of address numbering—but they haven't fully implemented it. A totalitarian decision would be required for a complete transition. And even then, considering who is involved and how they are handling it, it could take years. There's no magical switch.”

The Kremlin doesn't have a magical switch. If they decide to disconnect the Runet from foreign traffic, it would take years to implement

The implementation of a sovereign internet is possible under certain critical conditions, says Shkittin: “If an international registrar blocks Russian IPs, it would be a dire situation. Then we would need to build our own registry and transition to a new addressing system, but there is currently no discussion about that.”

Darbinyan agrees with this viewpoint:

“Just setting up sovereign internet networks throughout the entire country is quite challenging. On the other hand, there are economic reasons as well. If this happens, banks that still collaborate with banks in friendly countries would simply be unable to continue doing so. Naturally, this would impact Russia's foreign trade, which is still oriented towards selling its goods and resources to the world. Therefore, they cannot afford to allow this to happen.”

Filtering, blocking, and tighter controls

The internet consists of autonomous systems through which data packets move from one IP address to another. For each packet, an optimal route is established unless a specific path is enforced, Shkittin explains.

“There is no clear separation between Russian 'autonomous systems' and American ones on the internet. In reality, the internet is a unified system; it is not divided. Otherwise, we wouldn't be able to communicate with people in other countries, regardless of whether we use VPN or not. Currently, you can send packets through different routes, including through the autonomous systems of Western operators. In a sovereign internet, there is no external entry point. It is a completely isolated system, which means that signals do not leave the country's borders or come from outside of it. It is not exactly a local network but rather a kind of limited version of the existing internet.”

According to the expert, there are two ways to isolate a country. One way is to implement a powerful firewall, as done in China, and filter all external requests. However, in this case, the system can still be bypassed through a VPN because it is not completely isolated, Shkittin says. “It's like a fence. It can be climbed over or a hole can be found in it. But a sovereign internet is a different entity altogether. It involves implementing internal numbering, fully filtering networks within the country, maintaining a registry of domains and IP addresses to issue them internally. Then we would experience complete disconnection from external sources, and nothing, including VPN, would help.”

When the “sovereign internet” was initially announced, The Insider reached out to sources in Google's management to inquire whether the company was prepared to transition to new registries within Russia. Google responded that after analysis by their technical specialists, they concluded that Russia simply wasn't ready for such a reform, and therefore, the company did not consider these plans realistic.

According to Shkittin, he previously saw signs that the Russian authorities were planning to pursue a full-fledged “sovereign Runet” with alternative registries for IP addresses and domains. However, it seems that currently no progress is being made in that direction:

“Their efforts are not yielding significant results. It is likely that the technical problems have proven more difficult than anticipated, and there is a lack of objective motivation. I monitor various government procurements by Roskomnadzor, but I have not seen any such initiatives being pursued at present. It is possible that work is happening covertly or has already been completed. However, as of today, the concept of a 'sovereign internet' remains elusive. There are strict content filtering measures and restrictions on certain online activities, but overall connectivity still exists. It does not resemble a separate network. It is not akin to the situation in North Korea.”

North Korea has essentially built an internal local network, which may be sufficient for a country with a small number of users. However, implementing such a system on the scale of Russia would be challenging, the expert says:

“Even within the framework of a small company, transferring a registry from one IP address to another is a significant problem. On the scale of Rostelecom, it would be a catastrophe. Roughly speaking, Rostelecom had around 10 million IP addresses three years ago, which means roughly 10 million potential nodes. It is a monumental task. I don't even know who would take on such a responsibility. Therefore, I believe that there is sabotage of this idea at the operator level. This can only be realized with the full support of all operators, and none of them clearly want to disconnect from external resources.”

Implementing the North Korean scenario for the Runet would be difficult

Therefore, for now, Russia is more likely to continue down the path of implementing a “fence” approach, involving filtration, blocking, and tighter controls, suggests Shkittin. He noted that the authorities are currently trying to devise ways to combat VPN usage but do not appear to be planning to exit the global numbering registry.

Darbinyan believes it is not appropriate to compare Russia with either North Korea, where there has never been any form of a free internet, or China, where the internet was initially built differently.

“The current system in Russia is more similar to China's “Golden Shield” system, but it still has differences due to the historical development of the Russian internet. China did not have the same number of cross-border connections and scattered telecommunications operators that operated independently for many years, and the implementation process was different. However, the Russian censorship system is getting closer to the Chinese system.”

The expert explained that he was referring to the transition from a single-stage filtration process, which took place roughly from 2012 to 2022 when all resources and banned content were blocked by telecom operators, to a different legal landscape and technological basis that had formed by 2023.

There are now three filters in place, Darbinyan says:

“In addition to the operator's filter, there is also the “technical solution for threat countermeasures” (TSPU), which is controlled by Roskomnadzor (TSPU is a technical hardware and software complex that allows for restricting access to information). This filter was used to slow down Twitter, block Instagram, VPN services, and 'Smart Voting.' In other words, traffic is blocked at the operator's nodes, and the operators themselves do not know what is happening in their networks and how Roskomnadzor is changing the configuration. With the adoption of the law on social networks, a third filter was added. Social networks are required to independently remove all prohibited content that has not been blocked at the previous levels and is generated by users themselves.”

Sanctions work in favor of the sovereign Runet

According to Darbinyan, the departure of many foreign companies from Russia and the imposition of technological sanctions have actually worked in favor of the Kremlin, as it allows them to take control over the entire audience and direct them to fully controlled and censored Russian platforms:

“As foreign platforms leave, Russian platforms and solutions take their place. Users have become accustomed to the so-called 'one-stop-shop' regime, where they can access email, storage space, and other services all on one platform. People are increasingly transitioning from Google, which is rapidly losing its position in Russia, to Yandex.”

The departure of foreign companies helped the Kremlin shift the audience to fully controlled Russian platforms

He also noted that Apple's departure from the Russian market and the ban on importing gadgets priced over $300 into Russia have contributed to the expansion of Chinese distributors. These distributors offer phones with pre-installed RuStore, which does not contain prohibited content, along with Russian applications that, according to the expert's expectation, will be in demand among users. He believes that not everyone will uninstall these apps and attempt to install Play Market, for example.

Last year, many new solutions were introduced by the Russian authorities, according to Darbinyan. Among them is the implementation of a national SSL certificate. (SSL, as well as TLS certificate, is a security certificate that encrypts data and acts as a kind of “identity proof” for a website. They are issued by special certification authorities.) Some Russian websites currently rely on this certificate, and they cannot function without it. Darbinyan notes that this certificate is only recognized by the Yandex Browser, as other browsers have rejected it as an untrusted certificate provider.

Why it's too early to relax and how to bypass blockages

The number of blocked websites has sharply increased after the full-scale invasion: according to Roskomsvoboda, around 20,000 different services and internet portals fell under “military censorship” last year. This trend will continue in the future, according to Darbinyan. In addition, the expert expressed concerns that the last platforms relied upon by independent Russian media and bloggers, such as YouTube and Telegram, could also be blocked: “If we are preparing for anything, it is for ongoing restrictions, blockages of individual resources, and everything in that spirit.”

The last platforms relied upon by independent Russian media and bloggers, such as YouTube and Telegram, could also be blocked

Sources at Google have also confirmed to The Insider that they consider the blocking of YouTube in Russia within the next year highly likely.

According to Darbinyan, another aspect that many fear is the transition to totalitarian practices involving mass prosecution of users with criminal or administrative penalties:

“There have been thousands of cases involving army discreditation and fake news charges, but they have not yet reached a mass scale. Nevertheless, the utilization of artificial intelligence systems in this context is an alarming trend. Examples of such systems are 'Oculus' and 'Vepr,' which were introduced earlier this year. These systems are designed to automatically search for prohibited content, posing significant risks.”

One of the most concerning aspects is what lies ahead: whether such a system will begin making legally significant decisions, such as automatically generating protocols for administrative offenses, speculates Darbinyan. This practice has already been tested during the pandemic in Moscow, where fines were issued automatically without the need for a protocol based on facial recognition technology, the expert adds.

Currently, these systems can raise red flags and send information to law enforcement agencies to initiate criminal cases, he further explains, noting that this situation significantly affects self-censorship. Users' freedom of speech and self-expression is severely restricted.

“We can see these trends intensifying and potentially leading to swift changes in legislation to allow these systems to go further and make legally significant decisions.”

According to another anonymous expert, “the Kremlin failed to shut down the internet, so they resorted to the old approach of 'shutting down' users en masse for likes and comments.”

Given the predictions of tightened controls in the Russian segment of the internet, experts have advised using various services to bypass censorship. Shkittin recommended using the VPN Generator service, created by the Internet Protection Society (OZI) in collaboration with the IEDN Institute, as a means to circumvent blocks.

Darbinyan also reminded users about the Censor Tracker plugin from Roskomsvoboda, which allows bypassing restrictions and warns users if the website they are about to visit is listed as an organizer of information distribution, capable of collecting and transmitting user data to law enforcement agencies.

“Transparent Internet” – have your passport ready

By the end of the year, Russia plans to launch a pilot project for a secure and “absolutely transparent” internet accessible only to Russian citizens using a personal identifier obtained through registration with a passport, according to Vedomosti citing Andrey Svintsov, a deputy chairman of the State Duma Committee on Information Policy, Information Technologies, and Communications. Access to this network will not be possible from “anonymous devices.” This will allow security services to easily identify the account holders. However, according to the deputy, the “unprotected internet” will also remain, but users on that network will be personally responsible for their personal data and other security matters. However, the deputy clarified to MK that the pilot project was planned to be conducted “within a large company.” Previously, in early June, Svintsov discussed this idea on the Govorit Moskva [Moscow Speaks] radio station.

According to Shkittin, the reference to a “large company,” is likely to mean a major internet service provider such as Rostelecom. It would be strange to test such a system within a large company that already has an intranet, the expert believes.

“Most likely, they are talking about developing internet access with user identification through 'Gosuslugi' [government services portal]. They haven't come up with anything new, really. Perhaps the telecom operator will offer its customers the choice between using the secure mode or the regular mode. I assume there will also be propaganda promoting the secure internet as being 'more reliable' and so on, while presenting the regular internet as something dreadful.”

The expert also believes that this testing period can be used for psychological preparation of users, getting them accustomed to the need for authentication: “In reality, there has been no anonymity on the internet for a long time—you can already track a person through their IP and device data. So, this project is more about strengthening psychological control: by authenticating, the user will not just assume that they can be identified if something happens, but they will already know for sure that any actions they take are visible. I think this will have a very strong psychological impact on the population and will deter people from engaging in any, let's say, unlawful actions from the state's point of view.”

Furthermore, in theory, the authorities can introduce a biometric verification system that allows authentication based on biometric data, the expert suggests. He notes that technically, after authentication, the user will not enter a different internet but rather will end up in a different section of it. Most likely, this section will be limited to trusted “whitelisted” resources. Such a scheme is easier than blacklisting millions of undesirable websites, explained Shkittin. “Nevertheless, this is still not a sovereign internet: structurally, the internet will not change. It will simply be a heavily regulated part of it.”

Colleague of Deputy Svintsov, Alexander Khinshtein, stated in early June that he was not aware of such initiatives: “I don't support hype for the sake of hype. I am not aware of such initiatives [...] Much is yet to come, but not accessing the internet based on passports (at least in the foreseeable future).” He also mentioned that it is only possible to remove all negative content from internet resources by authorizing users through passports. In conditions where users access the web anonymously, law enforcement agencies should get involved.

Maksut Shadayev, Minister of Digital Development, Communications, and Mass Media, also insists that the authorities have not been discussing mandatory identification of internet users through passports: “I can guarantee that everything will remain as it is.”

“Humanity is losing the internet”

All countries are attempting to regulate the internet, experts say. There is no complete freedom anywhere, Shkittin emphasizes. Darbinyan also mentions internet censorship worldwide, saying that even countries in the European Union resort to blocking various resources: “For instance, the Baltic countries not only block websites related to Russian propaganda but sometimes indiscriminately block everything without proper assessment. While this issue is most strongly felt in countries with authoritarian regimes, Iran has more similarities with China and Turkmenistan than with the Baltic countries or Latin America. Nevertheless, the problem undeniably exists. Humanity is gradually losing the internet as a unified global platform accessible from all corners of the world due to the implementation of various restrictions.”

Furthermore, Darbinyan reminds about the proposal from European Parliamentarians to ban end-to-end encryption, which could affect a significant number of resources, such as messaging apps like WhatsApp, Telegram, and Signal. Shkittin notes that every country, even the most democratic one, has made attempts to restrict numerous aspects of the internet:

“Some countries ban torrent downloads, others block Russian domains, and in certain places, internet access is temporarily suspended during times of unrest. When the internet first emerged, it was created by well-intentioned individuals for the benefit of all, but as it expanded, it became apparent that everyone has their own notions of freedom, rights, and possibilities.”