Meduza asked four experts to sketch three likely futures for VPNs in Russia. The best possible scenario may be the one Russians are already living in.

Every month, it gets harder for VPN services to operate in Russia. They must constantly devise new ways around the restrictions, often trying to anticipate the next move by Roskomnadzor, Russia’s federal censorship agency. Infrastructure costs are rising, pushing up prices for users, while the number of users is falling as many grow frustrated with unstable connections. Meduza asked four experts to sketch three possible futures for VPN services in Russia, ranging from the worst to a relatively stable one that, as things stand, might even count as good news.

Russia’s authorities make no secret of their goal: to defeat VPNs. And they no longer limit themselves to blocking the services outright.

Roskomnadzor has been steadily improving its blocking methods, which periodically disrupt popular online services. That is what happened in November 2025, when the agency learned to identify and block VPNs running on the Xray/VLESS protocol by indirect telltale signs in their traffic.

By May 2026, the agency had improved those mechanisms and moved from regional experiments to broader deployment. It also turned to other methods: briefly blocking entire subnets it considered “suspicious.” The strategy is simple: degrade the quality of VPN connections until users give up.

In June, Amnezia, one of the largest VPN services, faced large-scale distributed denial-of-service, or DDoS, attacks that its developers attribute to Roskomnadzor. The service worked only intermittently for a month before full access was restored. Then, on July 7, Amnezia VPN representatives reported a new attack.

The authorities are not stopping at direct blocks. They are also squeezing users indirectly, making VPNs as inconvenient as possible to use and to pay for. In early April, at the demand of the Digital Development Ministry, all major mobile carriers barred users from topping up their Apple ID balances from their mobile phone accounts. For some users, that made paying for a VPN harder.

A couple of weeks later, dozens of Russia’s largest internet services — again at the authorities’ demand — began blocking access to their apps for users with a VPN turned on. An additional fee for foreign traffic was also under discussion, but Deputy Digital Development Minister Ivan Lebedev told the State Duma on July 7 that the ministry is no longer considering it.

Still, Digital Development Minister Maksut Shadayev has said publicly that he has been tasked with “reducing VPN use.” He reportedly opposes the harshest measures, such as administrative penalties for using a VPN.

On paper, no one stands to gain from tightening the restrictions further: it could hurt business badly and stoke more public discontent. But logic loses out the moment the authorities sense a threat, foreign or domestic.

The most realistic scenario is something between mediocre and bad

Alexander Amzin, media expert

What I see isn’t three separate scenarios so much as forks in the road. Depending on whether the authorities succeed at one or the other, they can combine in various ways:

• Reliably determining whether a person is using a VPN. If they manage it, they have evidence: you used a VPN.
• Restricting access to circumvention apps — limiting them to corporate use, say, or introducing “white lists” of permitted VPNs. The question then becomes which VPN you use: the “right” kind or not.
• Criminalizing VPNs. I find it hard to believe this won’t happen. But the question is not whether there is a law; it’s how the law gets enforced.
• A string of show arrests, fines, and prison terms for using circumvention apps. That requires a technological and legislative foundation, plus the political will to punish people rather than simply file the violations away.

In the bad scenario, we end up with several kinds of pressure at once, economic included. A national security threat is invented, resources are allocated to meet it, and then the right people start controlling those resources. The threat never goes away, because if it did, so would the resources.

The “middle” scenario is economic pressure, rising telecom prices, and attempts to restrict VPN access — the same as the bad scenario, minus the show punishments. One form is a surcharge on international traffic. A user who used to pay only the carrier, and now pays roughly the same again for a VPN, could face a third charge on top — three times what internet access used to cost.

We may well be living in the good scenario right now: a permanent war, in which the services invent new protocols, the protocols get blocked, and the services invent more and move their users over somehow. The only improvement would be app stores refusing to remove VPNs at the authorities’ request.

The most realistic outcome, I think, is something between the middle scenario and the bad one. Unpopular measures will most likely be put off until the end of this year, once elections to the State Duma, the lower house of Russia’s parliament, are out of the way. In the name of national security, anything can be done. But the economy is there, so are approval ratings and elections, and the consequences have to be weighed.

Life with a VPN will cost you

David Frenkel, journalist at Mediazona

The harshest scenario is not so much a fight against individual VPN services as a shift toward near-total internet isolation: “white lists” applied to all traffic, not just mobile, and penalties for VPN use up to and including criminal prosecution. The authorities would have to ban connections to everything beyond their control, infrastructure servers included — like foreign DNS servers — because data can travel through them, too.

This doesn’t look impossible: cut all foreign traffic, and that’s that. I see no reason for it now — but if the war took a radical turn, why not? The problem is how to shut off VPNs without shutting off everything else, including what businesses need.

To solve that, the Russian authorities could introduce “white lists” of VPNs — the ones permitted for corporate use. But circumvention apps disguise their traffic as ordinary requests to Google or Microsoft, for example. Aggressive filtering could break ordinary services — it could stop, say, every Android device from working properly.

Choosing the bad scenario is a political decision. You have to ignore all the problems that follow and throw the switch.

The “middle” scenario requires nothing radical — just tightening the screws with the same force as now. There will be no single moment when “everything gets shut off.” It will build: one restriction today, another tomorrow, something else the day after. At some point you simply notice that using the internet has become much harder. Current anti-VPN methods may get more effective, and some form of liability may appear — not a serious one, but real. Fines, for example.

Technically, everything stays roughly the same: deep packet inspection, or DPI, blocks anyone who doesn’t work hard enough to hide. Then the targeted measures begin: blocking servers, getting apps to report suspicious logins from abroad, having Roskomnadzor buy up access keys.

Circumvention tools will keep working, but it will get harder for them, and they will have to hide better. Many of these apps will die; the ones left will be run by true believers. Life with a VPN will be expensive — people will run their own servers, maybe not on foreign hosting but in a friend’s apartment.

They will run those tools on separate devices that carry no apps capable of informing on them. A separate browser, no Russian sites. Maximum isolation, basically. Things keep getting worse — sooner or later, I think, that is the picture we will arrive at.

The good scenario is the situation freezing, somehow, exactly where it is now: blocks are widespread, but they are circumvented just as widely; no one is fined for using a VPN, and everyone has one installed.

On the technology side, I see no obstacle to making things worse; the economic costs are what apparently hold them back. Then again, those costs can largely be handled by using “white lists” or by cutting off foreign traffic.

Some restraints do exist. Unpopular measures are introduced reluctantly and slowly, and there has been no second, openly declared mobilization for the war. Do the authorities fear extra social tension? To some degree, probably. Russians have grown used to digital services and internet access making up for many of their problems. But that is exactly why I think the middle scenario will arrive on its own: people will get used to the gradual restrictions, and it won’t seem like such a big deal.

What decides which path this takes is socioeconomic. If nothing threatens the Russian government and it remains stable, the country will slide gradually into the “middle” scenario. If the government senses a threat it cannot suppress any other way, any radical measure becomes possible, up to complete isolation.

The Russian authorities have tasted censorship and learned its convenience

Maria Kolomychenko, investigative journalist at The Bell

Last year, lawmakers added a provision that treats using a VPN while committing a crime as an aggravating circumstance. Judging by what Minister Shadayev says publicly, someone above him is apparently pushing for administrative penalties for VPN use.

So there is a good chance some form of penalty for VPN use will be introduced, though perhaps not soon. And administrative liability is not far from criminal liability. They could do it the way they did with “foreign agents”: after a second citation, they open a criminal case.

The authorities clearly want people to stop using VPNs and stop getting around the blocks. So a criminal charge is probably the worst-case scenario.

There is a second possibility, also very bad: declaring VPNs “extremist.” I don’t know how that would work technically or legally, but they could start adding VPNs to the registry of “extremist” resources, the way they did with Meta. There have been reports that they are considering the same for Telegram.

If a service is labeled “extremist,” any payment to it exposes the payer to a criminal charge: financing an “extremist” organization. Either way, the user ends up facing criminal prosecution.

The “middle” scenario is a continuation of what is already happening. About a year ago, many popular Western VPN services — NordVPN among them — stopped working in the country. The ones still running were mostly built by Russian developers specifically to get around censorship. The situation now, as far as I can tell, is even worse. The service I used [while in Russia] now works only erratically. Roskomnadzor apparently lacks the technical capacity to block absolutely everything, so it is taking another route: threatening users with legal penalties instead. It is also trying to make VPNs expensive — to hit people in the wallet.

If this doesn’t escalate — if things stay as they are, with Roskomnadzor blocking certain protocols while developers keep improving their tools, masking traffic, and evading the blocks — then working VPN services will survive in Russia. Additional traffic fees or small fines would still fall within the middle scenario.

The situation will either freeze where it is or get worse. A good scenario is less likely. Short of pure fantasy, the regulation of the Russian internet can change only when the country’s politics do. What is happening to the internet reflects the nature of the regime. A totalitarian state does not have a free internet. If we are fantasizing, a rollback of the restrictions becomes possible after Russia’s war in Ukraine ends — somehow.

Still, in my view, the Russian authorities have already “tasted censorship” and realized how convenient it is for them. They have no reason to loosen their grip.

Any fight against VPNs shrinks the audience because you have to jump through hoops

Andrei Zakharov, investigative journalist

Which scenario we get will come down to a handful of factors:

• They may start going after payments — an obvious step, and long discussed. Cutting off the ability to pay in rubles would shrink the audience immediately. Only people with foreign cards or friends abroad would be left.
• They may add administrative measures — the authorities themselves are talking about it.
• It could develop as a combination: technical pressure, payment restrictions, and some form of liability.

The trouble is that too many factors bear on the decisions — how the economy is doing, how people react, how carriers and businesses behave. I think the authorities will probably take the harshest path: restricting payments, tightening technical blocks, and introducing some form of liability all at once. Even then, there is no guarantee every measure gets carried out.

The state is not monolithic. Who is the state? [Sergei] Kiriyenko, [the Kremlin’s first deputy chief of staff]? [Yuri] Kovalchuk? The FSB’s Second Service? The Digital Development Ministry? One group runs things today; tomorrow someone else gets to [Putin] first and tells him this is very harmful.

For some of the people making decisions, the internet is a source of ideological influence that the public has to be protected from. So they are willing to take measures that make no economic sense, and no common sense either.

And any fight against VPNs shrinks the audience, because you have to jump through hoops. The less accessible a VPN is, the more hoops there are. That takes motivation. The harder it gets — finding a card, working out how to pay — the fewer people will bother. The core audience will stay; the broad one could easily drop away.

But more people seem willing to do the hoop-jumping than the Kremlin expected, because the habits are already there. If a service is decent and has everything on it, why not use it? The Chinese use their own equivalents of Google and Facebook not because they are patriots, but because those are decent services.

At the same time, when the alternative works badly, people try to keep the services they are used to. Even the pro-government platforms are struggling. VK Video works poorly. If a service is bad, people won’t switch to it, even when it is forced on them.