In the weeks after the invasion of Ukraine, the Russian government blocked Facebook, Twitter, Google News, پراکسی News, NPR, Bild, and Amnesty International.
An independent news site, Mediazona, told Aljazeera that it had been blocked “because we cover honestly what is happening in Ukraine and call the invasion an invasion, and the war a war“.
The media outlet added that Russia has in recent days introduced “military censorship and there are almost no independent media left in the country”.
Monitoring firm Top10VPN reported that it analyzed over 12,500 entries to Russia’s central registry of blocked websites and found that 938 domains relating to the Ukraine invasion have been banned since Feb 24.
The Kremlin claims that the recent Facebook block is in retaliation to Meta’s block on state media outlets RT and Sputnik. Considering that daily downloads of the Facebook app from the Apple Store and Google Play Store more than doubled within seven days of the start of the invasion, at face value, it appears that Russians are seeking out another source of news and posed a threat.
On the 24th of March, the Russian government blocked Google News claiming that the algorithm promoted misinformation about the war. This latest move in the ongoing censorship escalation comes as Russia passed a bill that criminalizes the intentional spreading of what Moscow deems to be “fake” reports, with up to 15 years in jail.
UK Prime Minister Boris Johnson has even urged Russian people to install VPNs to avoid censorship of the mass killings blamed on Russian forces in Ukraine.
Why VPN Usage Is On The Rise And What It Means
In an interview with the Belarus-1 TV channel, The Kremlin press secretary Dmitry Peskov was asked if he uses a VPN. He replied, “yes of course, why not, it’s not banned.”
This statement seems to directly contradict the recent actions of the Kremlin, but his sentiment is shared by millions of Russians.
Top10VPN reported that the demand for VPNs spiked 2,692% percent higher than the daily average demand in mid-February.
Ironically, since the invasion of Ukraine began, Russia has forced Google to remove over 36k URLs that link to VPN services according to new research from Surfshark.
Russian citizens looking for independent media are driving this trend, and so are Russians trying to access international services that are now either blocked or boycotting the country in varying capacities.
Netflix, Disney, Discord, Spotify, WWE, Nintendo, Epic Games, Valve (Owners of Steam), Upwork, Apple, Airbnb, and at least a hundred other online services have stopped operating in the country.
Most companies haven’t resorted to an outright ban and are instead blocking the inflow of money into the country or state-sponsored content. TikTok for example has blocked Russian government-sponsored content in the EU. Valve has blocked payments into the country making it harder for developers to get paid.
Since Russia invaded Ukraine one month ago, traffic to VPN service Windscribe from users in Russia has increased by a factor of twenty, says Windscribe CEO Yegor Sak.
Altas VPN reported that on March 14, 2022, VPN installs in Russia reached an all-time high and surged by 11,253%, above the norm. Interest has continued, not dropping back to previous levels since.
Are VPNs Legal In Russia?
In November 2017, Russia passed legislation that prohibited VPNs from allowing access to sites blocked by the government.
To stay compliant, VPNs in Russia are expected to comply with Roskomnadzor, the Federal Service for Supervision of Communications, Information Technology, and Mass Media.
The legislation also forced VPNs to allow the Roskomnadzor to build backdoors into their software so they can spy on their users.
the Internet Protection Society advises Russian users only to buy VPN services from foreign companies.
On March 27, 2019, Roskomnadzor demanded that ten VPN services connect to the Federal State Information System, and block all sites on the register of prohibited information. Only one, Kaspersky Lab, complied with the requirement. Kaspersky is a Russian company.
The Roskomnadzor list of blocked sites has some truly evil content on it: child pornography, suicide, self-harm, which few would argue shouldn’t be blocked. That being said, it’s still not advisable to use a VPN that would agree to block this list. The Roskomnadzor has permission to spy on Russian users and any VPN provider that goes along with the requirement to block for the government may have taken a similar stance and let the government invade user privacy.
One VPN provider that was targeted and refused to comply was ExpressVPN.
ExpressVPN’s Li, speaking from Singapore, told Wired “Right after the company was banned, there were attempts to block ExpressVPN’s traffic. But the company was able to get around these by disguising its VPN traffic to look like regular traffic so it can’t be spotted by the authorities. “We prefer not to talk about it in great detail, but largely, it is just changing how our data packets look,” says Li, although he is bracing for more sophisticated blocking that copy techniques used by other countries where ExpressVPN already operates.
A VPN that’s not based in Russia would be unaffected by these requirements. There are however heft fines for the individual. If VPN companies are found to be non-compliant both they and the users can be fined. The user fine sits at RUB300,000. The VPN’s fine is RUB700,000.
In 2019, Russia blocked its first VPNs and it’s been gradually blocking more and more since with efforts ramping up since the war started.
Approximately 20 VPNs are blocked in the country. The authorities have plans in place to block more, according to politician Alexander Khinshtein, chairman of Russia’s Committee on Information Policy, Information Technologies, and Communication in the Duma, the country’s main legislative body. “VPNs get blocked daily. It’s not an easy task, but it gets done,” he said on March 15 in a live broadcast on the VK social media platform.
How Can VPN Providers Avoid Getting Blocked In Russia?
When it comes to foreign services the main recourse that Russian authorities have is to block access to the IP addresses associated with a particular VPN server.
There are blacklists of VPN-owned IP addresses that are used by banks and other financial services to stop people from logging into accounts with a VPN enabled. It’s a precaution against fraud, as hackers can use VPNs to appear to be from the same country as the account holders.
As these lists of public IP addresses are publicly available it’s easy enough to block access to them.
Providers can play whack-a-mole with authorities trying to block them by continually changing the IP address associated with their servers. At this point, it’s just a question of resources.
In 2021, Roskomnadzor took aim at six leading providers: Hola!, ExpressVPN, KeepSolid, Nord VPN, Speedify, and IPVanish. These are some of the largest and most trusted providers that exist.
VPN services can also change how IP packets look to disguise that they come from a VPN server. Companies like SurfShark offer obfuscated servers for extra privacy. These VPN servers are configured specifically to hide the fact that they are VPNs. A good VPN hides itself.
It’s expected that Russia will continue advancing its detection methods. Moving onto AI algorithms that monitor traffic.
The Great Firewall of China is already capable of monitoring connections to learn, discover and block encrypted VPN protocols. These machine learning algorithms have been applied at scale to carry out encrypted traffic analysis, a technique advocated by Fan Bingxing, the founding father of China’s web filtering system. Russia will likely follow a similar path.
VPN providers also use machine learning in China to beat the government’s machine learning algorithms.
How Do VPNs Work?
To better understand what all this means, it would help to take some time to understand how VPNs actually work.
An easy way to think of a VPN is it’s like a mail forwarder. Likewise, an ISP (internet service provider) is the post office, with the infrastructure to carry web traffic around the world.
Internet packets are the parcels. They leave the user’s computer and the ISP transports them to the address that belongs to a website.
With a VPN, all the internet packets are collected before they leave the user’s computer and wrapped in an encrypted envelope. On this envelope is the address of the VPN server. All traffic is re-routed to the server, where the envelopes are unpacked before they are forwarded to their intended destination.
A VPN gets in the middle of the communication and breaks the chain.
Without a VPN: user’s computer – ISP – end destination
With a VPN: user’s computer – ISP – VPN – end destination
The actors on the left of the VPN don’t know anything about the actors on the right of the VPN and vice versa.
It all works the same way in reverse too. The end destination sends traffic to the VPN, that’s then routed back to the client in an encrypted envelope that the ISP is unable to open.
If you’re interested, click here to learn more about how VPNs work.
How Are Russians Paying For VPNs
Visa, Mastercard, Apple Pay, and Google Play have all suspended operations in Russia.
Russians “have no way of paying right now for any VPN service, because they can’t pay using Visa or MasterCard, they can’t use Google Play, they can’t use Apple Pay,” says Yegor Sak, founder of Windscribe.
An unfortunate consequence of this is that the majority of Russians now use free VPNs. These companies are known for their shady practices such as selling data to advertisers, profiling users and exposing users to malware. No one deserves to be put at risk from cybersecurity attacks because of the actions of their government and VPN CEOs agree. They are going so far as to make some services free in Russia because Russians have no way to pay for them.
Another option is cryptocurrency. VPNs like ExpressVPN and IPVanish have accepted payment in bitcoin and other cryptocurrencies for years now. The advantage of this is it’s another layer of anonymization. The blockchain is public and all transactions are visible, but it’s more work for authorities to identify to whom the addresses belong.
Why Free VPNs Are So Risky
Ever heard the expression that if you aren’t paying it’s because you’re the product? That’s never been more true than with free VPNs.
In 2016, CSIRO did a study of 283 Android VPN apps. It found that 67% of the VPN apps studied in this analysis embedded at least one tracking library in their code to track users’ online activity.
The same CSIRO study reported that 65 percent of paid VPN providers didn’t track users’ online activity, but only 28 percent of free services did the same.
Paid VPNs don’t have the same incentives to track their users, and sell their data. They trade on their reputation. The target audience is seeking out this software to avoid trackers, if it gets out that the VPNs are the ones tracking them then that’s very bad publicity.
In 2020, the personally identifiable data of over 20 million free VPN users was exposed online.
vpnMentor, cybersecurity researchers, claim they found an unsecured server shared by several free VPNs. The researchers say the server was “completely open and accessible, exposing private user data for everyone to see”.
It’s not just browsing history that’s a risk. The team of researchers looked into the entries within the exposed database. They found personal details, email addresses, home addresses, clear text passwords, IP addresses, and other identifying information.
Cybersecurity Risks
Data from security firm Imperva found that 90% of all cyberattacks in early March focused on either Ukrainian or Russian targets, with only 5% actively targeting US-based targets.
The aggressive targeting continued as of March 15, with Russia and Ukraine accounting for three-quarters (74%) of targets within the past 48 hours.
There’s a greater chance than ever before that Russian ISP will be hacked and their data exposed online. By using a VPN, especially a paid VPN, the user’s browsing history and any unencrypted traffic isn’t visible until it’s outside of Russia. If a VPN has a no-logs policy, there’s nothing linking that communication back to its user.
The international group of hackers, Anonymous, declared cyberwar on Russian President Vladimir Putin in a video shortly after Russia invaded Ukraine a month ago. While this war is targeting higher-ups and Putin’s inner circle, there’s inevitably some spillover that affects everyday people.
Is It Bad That Russians Use VPNs, Shouldn’t The West Isolate Russia?
Companies have rushed to isolate Russian citizens on economic, social, and political fronts. The question needs to be asked though, is this trend positive? or are we just doing the authoritarian government’s job for them and effectively censoring the internet for Russians. Are these companies’ decisions to censor Russian citizens done for Ukraine’s benefit or to score brownie points and virtue signal to customers back home. What is achieved other than pushing them towards their despotic government, and giving local Russian companies a monopoly?
Restricting money flow into the country makes sense, but restricting the movement of information and content doesn’t.
“Millions of Russians rely on the internet for unbiased information on war and current domestic and international affairs,” says Gabriele Racaityte, Surfshark’s head of public relations.“
Isolation is Dangerous
Sanctioning Putin’s inner circle is one thing, but going after the livelihood of ordinary people is another. Here’s an example, now that Facebook is blocked, the country is transitioning to local social media, which is controlled by the government and a fertile breeding ground for propaganda.
After Facebook was blocked, Russia’s most popular social media site is now VKontakte. It is directed by Vladimir Kirienko, the son of the deputy head of Putin’s administration, Sergey Kirienko. How are free-thinking Russians supposed to pierce the propaganda bubble in government-controlled echo chambers?
It’s more important than ever that Russians have access to VPNs.
Final Words
VPN use has risen drastically in Russia and will likely never return to what it was. As Putin’s government continues to block access to the free press, and as international apps and services block access for Russian citizens, it’s inevitable that VPNs will help circumnavigate these restrictions.
What remains to be seen is how far the state’s media watchdogs will go to block VPN access. Are they going to continue playing whack-a-mole with providers? Or will Russia get a Chinese-inspired firewall with artificial intelligence closing VPNs as they are detected?
For now, Russian citizens are just struggling to pay for VPNs. It’s gotten to the point where CEOs of VPN companies, who believe Russian access to free information is important, are giving away services for free. Analysis has found that Russia has been the target of upwards of 90% of cyber attacks since the invasion began.
Will the continued online isolation of the country push citizens further toward Moscow’s narrative? It seems likely. Will VPNs play a significant role in the future of Russia’s online interaction? Inevitably.
