stories
August’s VPN crackdown in Russia ran on data the country’s own apps had already collected on their users
Source: Meduza
Pavel Bednyakov / AP / Scanpix / LETA
In early August, Russia experienced one of its most sweeping waves of VPN blocking yet. Leonid Volkov, a senior figure at the Anti-Corruption Foundation (FBK), called the attack “the biggest in history.” Meduza asked representatives of four VPN services — Liberty VPN, Amnezia VPN, Paper VPN, and BlancVPN — how this attack differs from previous ones and whether Roskomnadzor, Russia’s federal censorship agency, is following any logic in its decisions.
— Can this attack really be called the biggest ever? How many services did it hit, how did it differ from previous ones, and were you able to deal with it completely?
Liberty VPN
— This attack barely touched us — we saw only minor effects, more like a ramping-up of a pattern we’d already seen. We first ran into it about two months before the August wave, in mid-June. It looks like we were picked at random, simply as test subjects for a new playbook. I don’t buy the theories that anyone gets deliberately “singled out.”
It was an unpleasant experience: usually when something this large happens, services start messaging each other in chats, sharing information, and together they find a solution faster. This time it hit only us, so we didn’t get the usual solidarity from colleagues in the industry. On the other hand, by the time the wave reached everyone else, we already knew the drill: we’d had time to figure out how it worked and to build an automated system that fends off this kind of attack in real time. So when everyone else keeled over, we held up — but there’s a huge element of chance here. Any other service could have been in our place.
The attack itself isn’t exactly new — everyone had long warned this was coming. What’s different is that, apparently for the first time, the attackers used data collected through Russian apps and services: Yandex, VK, the messaging app Max, and the job site HeadHunter. They took the entire trove they’d accumulated — IP addresses, links to social media accounts, entire subnets registered to specific companies — and fed it into Russia’s internet traffic filtering system, known as TSPU. We can’t say exactly how we handled it.
What matters about this attack isn’t the mechanism — it’s the scale and the automation. In the past, Roskomnadzor did much of this by hand: it would pull addresses in batches from a paid data feed, which took time, and only then block them. Now it’s working out how to scale that up. IP addresses go into blocklists in batches, roughly every six or 12 hours, by some logic that isn’t entirely clear. All of your addresses get blocked at once, even ones that were never exposed anywhere — if you have, say, a social media account or a hosting provider’s subnet, the whole thing gets swept up and added to the blocklist. Because of the data they’ve accumulated — and, apparently, are now pulling from third-party Russian apps in real time — this attack was far bigger.
Meanwhile, TSPU systems have started going up at the network exit points of Russian data centers that had somehow gone without them until now. That alone slows down the internet — traffic passes through the node and loses milliseconds, adding to latency. And when blocks get added, every company hosted in that data center takes the hit.
They can’t sacrifice everyone to blocking — they have to take certain interests into account, and sometimes they even roll back the blocks. In recent weeks we’ve seen them testing blocks on GitHub, the App Store, and app stores in general. Technically, they can certainly block them — all it takes is adding an entire subnet, like Apple’s — but so far they haven’t brought themselves to make it permanent.
We don’t know exactly how many services were affected, but it looks like a lot — the chats were full of the usual messages: “ours went down too, got blocked too, we’re looking into it.”
Paper VPN
— I wouldn’t call it the biggest attack, because there’s no way to measure that. It affected services that used certain hosting providers, as well as some users who relied on those same providers for personal VPNs. What set it apart is that it most likely drew on a large store of data collected in advance, and it hit a range of services, including small ones.
We managed to deal with it by reorganizing our infrastructure.
BlancVPN
— It’s hard to compare this round of blocking to earlier ones, because there isn’t much information about them. Many in the industry share the theory that Roskomnadzor spent some time collecting data from the TSPU system and then processed it centrally, which would mean only some of the servers got caught — newer ones, for instance, may have been left out. We know this wave affected even small VPNs, including tiny self-hosted services.
We got through this round of blocking, just as we got through all the previous ones. BlancVPN is running reliably and is constantly building out its infrastructure — for obvious reasons, we can’t disclose how.
Amnezia VPN
— It’s hard for us to comment, since this wave of blocking didn’t affect us at all. For some reason a lot of media outlets wrote that Amnezia was also hit in early August. That’s not true.
— Volkov described a method Roskomnadzor allegedly uses to obtain users’ IP addresses: many Russian apps won’t open while a VPN is running, and when someone turns off their VPN to use them, their real IP address gets logged and then blocked. Is that actually how it works?
Liberty VPN
— Something’s a bit mixed up here. Roskomnadzor has no reason to block a user’s own Russian IP address; it works differently.
To figure out which VPN you’re connecting from, there’s no need to block your access to a site at all. When you visit a site through a browser, the site picks up a lot of information about your device. The first signal is the IP address the request is coming from — not your personal one, but the exit IP of the router nearest to you, meaning the VPN’s exit IP. If that turns out to be a known hosting network, there’s a 99% chance it’s a VPN, whether commercial or corporate.
The second signal is response time. The site knows how much time passed between the moment your page refreshed and the moment the IP address handling the connection received the command. If that gap shows you aren’t physically located where the router claims to be, it’s a VPN. That’s enough to flag the address as a VPN and hand it to Roskomnadzor — and we know for a fact that this happens.
I’ll tell you a secret about one Russian service. Six months ago its team was given two tasks involving user data collection. The first was to gather data from Apple, response times, and so on, and send it to Roskomnadzor via Gmail. The second was to send all of that to Russia’s Federal Security Service (FSB) automatically, with no flags of any kind, along with the device model and account data — a first and last name, passport details, or the fact that the account belongs to an organization, where any of that exists. According to a source, the FSB even provided its own API for the purpose. So we’re confident this is exactly how it works.
Paper VPN
— We can’t confirm this method with certainty. From our colleagues’ investigation, we know that some Russian apps have built-in code that checks whether a VPN is in use and can log a user’s IP address, then store it, send it to the censor, or both. Whether that was what happened this time, or whether they gathered the data by statistical means, we can’t say for sure.
BlancVPN
— Roskomnadzor can obtain VPN services’ IP addresses through Russian apps. We assume the apps at the very least log IP addresses, and at most hand them straight to the censor.
Amnezia VPN
— We have no information that Roskomnadzor is collecting users’ real IP addresses — telecom operators have those anyway. Maybe what’s meant is that Roskomnadzor is trying to work out the IP addresses of the VPN servers themselves? That it could well be doing. It’s already been established that apps like Max send telemetry data, including the addresses from which they see user connections. If a one-hop VPN is in use, those addresses are precisely the VPN servers’ addresses.
— Do all Russian apps hand data over to the state? Are there any that don’t? And how can VPN services, or people themselves, get around this kind of data collection?
Liberty VPN
— As far as we can tell, all of them hand over data — even completely unremarkable civilian products have been pulled into this. But I can’t say for certain; nobody’s been caught red-handed, and this is just my personal belief.
There’s practically no working tool today that lets you get around this data collection, whether from the service side or the user side. I’ll explain using Max as an example. The first thing every VPN service did was build so-called routing — split tunneling, where rules are set at the service level so that .ru domains and certain Russian sites bypass the VPN and go directly from the device. But Roskomnadzor and these companies employ technically savvy people. With Max, you can see exactly how they get around it: they query the IP for one domain, then another, compare several addresses, and spot that one IP is Russian — the user’s — while the other isn’t.
On top of that, smartphones have an operating-system-level flag showing whether a VPN is on, and the app can see it. They see your IP either way. So even with split tunneling, nothing stops them from running a double query across .com and .ru domains, the way Max does — and that, apparently, is exactly what happens. There’s no way around it.
Routing caught on in the end, but not for that reason — it’s there so users don’t get a warning pop-up and can use whatever app or site they need without any hassle.
Paper VPN
— We know some Russian apps are capable of transmitting this kind of data, but we don’t know for sure whether they actually do.
VPN services can get around this kind of data collection by separating the entry and exit addresses. In that case it’s most likely the exit address that gets blocked, which wouldn’t affect service. But blocking is never carried out just one way — it’s a combination of methods.
We don’t have any specific recommendations for users here, beyond using a separate phone for Russian apps that detect VPNs. For obvious reasons, most users aren’t willing to do that, so we’re working to solve this problem at the infrastructure level.
BlancVPN
— We don’t think commercial services want to hand information over to Roskomnadzor, but at the authorities’ request, they’re required to provide it, including the IP address. A service has to retain user information for anywhere from six months to three years if it falls under the legal status of an organizer of information dissemination.
There’s no 100% protection against this, but for Russian apps you can use either a separate phone or the split tunneling in a VPN service’s app. BlancVPN, for one, already has it built into its app.
Amnezia VPN
— Most of them. There’s no way to use a VPN to get around this kind of data collection — it’s the apps themselves sending the data. The only thing you can do is keep your VPN servers from being blocked by using a two-hop VPN, so the entry address differs from the exit address. All the major and mid-sized VPNs have used this approach for a long time.
— Sources told the Russian business news outlet RBC that Russia’s Digital Development Ministry wants to tighten control over the IP addresses of corporate VPNs that are approved for use in Russia. Is the new wave of blocking connected to this initiative, and what might tighter control over these IP addresses lead to?
Liberty VPN
— We’re already seeing what it leads to. Getting around the “whitelists” is only getting harder — far more complex and expensive than simply getting around ordinary blocks.
Every service has its own threshold for how much effort it’s willing to invest, and some may simply drop out — which is exactly what all these measures are for. But this is a market, not a planned economy, so the IP addresses people need will still be there. They’ll just keep getting more expensive.
The most recent thing we heard: “white” IPs were being offered for 10 million rubles (about $120,000) a month. We don’t have that kind of money — but the mere fact that offers like this are showing up on the market is an important signal.
This has nothing to do with the August wave of blocking, though — that targeted foreign IP addresses, not Russian ones. Tightening control over “white” IPs is a separate process that’s already well underway. Since information about it is leaking out, they’ll probably push it harder.
Paper VPN
— No, I don’t think it’s connected. Tighter control could make it harder to get around blocks, if any of our colleagues were using that method.
BlancVPN
— We don’t think the blocking is connected to corporate VPN networks in any way. The registry of corporate VPNs has existed for several years now, and all major companies have been trying to get their IP addresses listed in it as trusted.
Amnezia VPN
— They’ve already tightened it. They’re already blocking, sending letters to providers, and hunting down “whitelisted” servers being used for VPNs. The most recent wave of VPN blocking, in August — which didn’t affect us — is partly connected to exactly this. What it will lead to is VPNs getting more expensive.
— How likely is it that Russians will use a state VPN on a large scale, if one ever appears?
Liberty VPN
— We effectively already have legitimate VPNs — telecom operators built them a long time ago. MTS, one of Russia’s largest mobile operators, even built an entire system around a “legal VPN,” I think. Any existing service can become legal at any moment, and it’s simple: you file an application with Roskomnadzor under federal law — which, in fact, every service was supposed to do from the day it launched. The agency sends you its API documentation, you connect, and blocking rules get applied to your traffic in parallel. That’s the whole “legal VPN.”
But for most people who use a VPN, especially those who pay for it, a VPN means Telegram, YouTube, Instagram, and independent media outlets. And here the authorities were too late. For something like this to work, it had to launch in March or April 2022 — getting people hooked on a “legal” system while banned sites were blocked slowly and gradually. Instead it went the other way: the authorities never offered an alternative in time, never bothered to solve their fellow citizens’ problem, and someone else solved it for them. And that someone solved both the problem created by international companies and the one the government itself created.
The result was predictable. A person downloaded a VPN for YouTube, then remembered there was also Instagram, independent media, and plenty more — and got hooked all over again on ways of getting information they’d long since forgotten. So no, a state VPN simply won’t survive the competition. This is a market. We saw that with Max: they poured insane amounts of money into advertising it, and it changed nothing. Resources and money very often mean nothing in a market.
Paper VPN
— Users will welcome any fast and reliable method of getting around the blocks. But in this case, the main use will probably be access to large language models for people who need them for work. How widely it’s used can only be judged once such a service actually reaches the market.
BlancVPN
— A state VPN won’t provide access to services banned in Russia. It might serve certain purposes, but we don’t think it will be widely used as anyone’s main VPN.
Amnezia VPN
— A service like that won’t appear. Is there anything like it in China?
— Is there any logic behind Roskomnadzor’s waves of blocking, in terms of when they happen and why? Do you expect a crackdown ahead of elections to the State Duma, the lower house of Russia’s parliament?
Liberty VPN
— In most cases, there’s no logic to it. If anything, it’s reactive — sometimes they need to block something or step things up because of something else going on, but overall the blocking runs on its own separate schedule.
You have to understand: Roskomnadzor isn’t some outfit staffed by inscrutable robots — it’s an organization made up of people. People go to work, they have tasks to do, and they just do them, or else they don’t get paid. Someone writes new rules, network engineers push them out whenever they get around to it, and as soon as the rules take effect, another block happens. It isn’t tied to anything. It’s just a job. It immediately brings to mind the “banality of evil.”
But there’s always a crackdown around major events — we saw that around Victory Day on May 9, for example: intensified blocking and mobile internet shutdowns. So yes, ahead of the State Duma elections we expect crackdowns tied to specific events, and for the elections themselves, probably something along the lines of May 9. The justification will be the same as always — security, the “Kyiv regime” supposedly trying to interfere with a free vote. After that, the blocks won’t be rolled back all the way, if at all — maybe 50%, with the rest staying in place, and that will become the new normal. It’s their favorite tactic.
We’re going off data from [the Russian business daily] Kommersant, and honestly, we’re surprised the paper was allowed to publish it at all. The “whitelist” blocking regime in Russia isn’t even two years old, and in that short span the authorities have tightened the screws without most people noticing at all — in some regions mobile internet effectively doesn’t exist, but people keep paying 600 to 800 rubles (about $7 to $9) a month for something they don’t have, simply out of habit.
That’s how they’ll keep operating, both with ordinary blocks and with the “whitelists.” They’re boiling the frog slowly — boil it fast and it’ll realize something’s wrong and jump out, but on a low flame it won’t go anywhere. That’s exactly what we’re seeing with blocking in Russia.
Paper VPN
— They always happen in August, during vacation season, when work traffic is at its lowest. We think that’s meant to reduce the chances of breaking something that’s allowed and causing extra frustration among users.
We always expect intensified blocking, and we’re always preparing for it. That’s the reality we live in.
BlancVPN
— We expect intensified blocking both before and after the State Duma elections, especially after. It’s hard to say exactly when or why, because there’s no discernible logic to them — they probably happen whenever someone needs to report on how effectively budget money has been spent. But the overall trend toward heavier blocking continues, and Roskomnadzor keeps spending billions of rubles to expand the infrastructure it uses to tighten restrictions.
Amnezia VPN
— There’s only one logic to it: they’ve now gone after VPNs in earnest, and the phrase “wave of blocking” really applies only to an individual service, when an attack is aimed specifically at it. Otherwise Roskomnadzor doesn’t have “waves” as such — the staff work a standard five-day week and do something every day, rolling out changes whenever they’re ready.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at [email protected].
To read Meduza’s exclusive content in English, please subscribe to our newsletter.
Interviews by Mykyta Kuchynski