Kremlin’s New Moves Towards ‘Internet Sovereignty’

Executive Summary:

• The Kremlin instituted restrictions on the civilian use of virtual private networks (VPN) and U.S.-built technology at the beginning of September, ostensibly fearing that the U.S. government is using the technology to sow internal discord in Russia.
• The Russian Duma approved legislation on July 15 to create a national messaging system, known as “Max,” that will combine communications with state services, similar to the People’s Republic of China’s (PRC) WeChat.
• These measures fit into Moscow’s broader project of creating a sovereign internet space, which includes banning foreign messaging platforms, restricting VPN use, and the continued crackdown on civilian digital encryption.

The Kremlin is continuing to develop its “sovereign internet,” a project to silo its domestic internet from global networks, under the pretext of national security (see EDM, February 15, November 25, 2024, February 6). Beginning September 1, Moscow instituted additional restrictions on the use of virtual private network (VPN) technology, including a ban on advertising VPNs or sharing information on circumventing the bans. VPNs are now also considered an “aggravating circumstance” while committing a crime (SKBGroup, August 11; Meduza, September 1). These new laws will require service providers to monitor search queries made by customers and continue traffic monitoring to block many VPN encryption protocols. One survey cited in the Russian press found that over 60 percent of VPN users in the country use the technology to access banned social media networks, highlighting the technology’s ability to bypass the Kremlin’s censorship structures (Newizv, August 1).

The September legislation is not a full ban on VPNs, as commercial VPN technology is still necessary for various information technology (IT) tasks. The partial ban will still make work more difficult for Russia’s Search Engine Optimization (SEO) firms, Russian companies that have employees outside of Russia, the numbers of which have grown dramatically since the outbreak of the war in 2022, and firms that rely on access to foreign information technology (Interfax, July 21).

Russian Minister of Digital Development Maksut Shadaev stated that the U.S. State Department is financing the development of VPN technologies in Russia. Shadaev claims this financing began during September 2024 State Department meetings with major U.S. technology companies, including Amazon, Google, Microsoft, and Facebook. Shadaev asserts that the meetings discussed how to improve VPN access inside Russia to create internal discord (Interfax, June 22).

The September ban also targeted Speedtest, a technology developed in the United States that Russian telecom operators use to measure internet data transfer speeds. The Kremlin justified the ban by citing the company’s supposed compliance with U.S. intelligence services (Cnews, July 30).

On July 15, the Russian State Duma approved legislation to create a national messaging system that will combine communications with state services, similar to WeChat in the People’s Republic of China (PRC) (T-J, June 24). Social media company VKontakte developed the Russian national messenger system, known as “Max.” The messaging application will enable citizens to interact with government services, according to parliamentarian Sergei Boyarskii. The platform enables users to sign documents electronically, verify their identities by uploading documents, and obtain digital identification for everyday use (RBC, June 10). Max works with both Russian and Belarusian phone numbers, demonstrating the two countries’ pursuit of a “unified information space” (see EDM, March 27; Belta, July 11). Sources in Russia’s Federal Security Service (FSB) remain skeptical about the platform’s security and do not want citizen data stored in the system until the remaining security issues are resolved, according to independent industry press sources (Habr, August 5).

The Russian Communications Authority (Roskomnadzor) banned the use of foreign messaging platforms for communication with Russian citizens, effective June 1, because the services did not comply with laws requiring their server infrastructure to be located within Russia (IXBT, June 1). In August, Roskomnadzor banned Signal, a messaging platform that utilizes end-to-end encryption for secure communication (Interfax, August 9). Later in the summer, Russian users began to experience outages when attempting to use WhatsApp and Telegram (RBC, August 13).

The bans target some of Russia’s most common communications technologies—68 percent of Russian citizens use WhatsApp daily (Lenta, July 18). The Russian government has also blocked the Discord messaging app since October 2024, ostensibly for distributing content that is banned (Interfax, October 9, 2024).

The development of a national messaging service fits with the Kremlin’s overall goal of walling off the Russian internet following its full-scale invasion of Ukraine. Moscow has taken steps, including creating a national Transport Layer Security (TLS) certificate system, testing a national Domain Name Service (DNS) system, and continuing its crackdown on civilian use of digital encryption. Russia’s internet restrictions also include disabling mobile telecommunications internet networks to block Ukrainian drone communications, a policy that also poses risks to Russians who may be left without the ability to communicate during crisis situations as the Kremlin’s war against Ukraine continues (Lenta, May 21). The creation of Max is just one example that highlights Russia’s development of a “sovereign internet.”