Russia isn't censoring the internet. It's redesigning dependence.

Summary

Russia is not just filtering content. It is engineering a new kind of dependence — one where state-approved services stay available while everything else becomes friction, cost or risk. The whitelist is not a technical tool. It is a power model. And it is working exactly as intended: not by cutting the line, but by making the approved world more reliable than the open one.

Outside the presidential administration in Moscow, dozens of Russians are queuing to hand in a complaint directly to Putin. They want the internet restrictions stopped.

Yulia owns a catering company. She made the trip to the Kremlin because she is scared and desperate.

"We are losing money every time there is a blocking of the internet, a blocking of Telegram and WhatsApp. My business is entirely on the internet. Without internet access, in this form it will not exist."

— Yulia, catering business owner, to Steve Rosenberg — BBC

In Rostov-na-Donu, a young woman described to Mediazona how the shutdowns keep moving earlier in the day. They used to start at seven or eight in the evening. Now they can begin at four in the afternoon. Taxis become unavailable. Bus apps stop working. Messages do not arrive.

In Bryansk, a teenager posted a TikTok video shouting into the dark: "Give us back our internet!"

These are not dissidents. These are not activists. These are ordinary people trying to live inside a digital infrastructure the state itself told them to depend on — now discovering that this infrastructure can be restructured by decree.

"The idea is to separate Russia from the outside world"

That is not my framing. It is the words of Andrej Kolesnikov, a columnist at opposition paper Novaja Gazeta, speaking to the BBC about what Russian authorities are actually building — driven, he says, by the belief that "this world is poisonous to the minds of Russians."

BBC's Moscow correspondent described the development as a digital iron curtain.

I think that is accurate. But I also think the mechanics of it deserve more precise attention than the metaphor allows. Because what Russia is building is not quite a curtain. It is something more calculated than that.

This is not censorship. It is a different thing entirely.

I want to be exact about the language here, because I think most of the coverage is still not.

What Russia is constructing is a whitelist.

A list of approved services that continue to function during shutdowns. According to Vedomosti via VG, it was created in September 2025 with 57 sites. It has since grown to more than 500. The list includes state news agencies, major banks, the government portal Gosuslugi, domestic social network VKontakte, and the state-backed messaging service MAX.

During shutdowns, only these survive.

Everything else — WhatsApp, Telegram, the wider internet — becomes unstable, restricted or simply unreliable enough to stop depending on.

You could call what Russia is doing a whitelist of approved services. You could also call it what it actually is: a blacklist of the rest of the world. The result is identical. The framing is just more honest.

A whitelist is not a neutral technical tool. It is a power model.

First the security excuse, then the architecture

I have seen this pattern enough times to recognize it as a method, not a coincidence.

First the restrictions are framed as emergency security measures. Reuters reported the Kremlin saying internet restrictions were necessary for security reasons. Putin himself acknowledged the situation this week, describing it as related to "operational work to prevent terror attacks" and saying broad advance information could damage that work "because criminals also hear and see everything."

Then the "temporary" exception starts hardening into infrastructure.

Massive mobile internet shutdowns have become routine across large parts of Russia — including regions far from any front, and including central Moscow, where the mobile network was reportedly down for close to three weeks in March. And according to VG, the shutdowns were not ordered by the Ministry of Digitalization. They were ordered by the FSB.

That detail matters. Because it tells you who is actually in charge of the architecture.

The MAX manoeuvre

This is where the strategy becomes most visible — and most damning.

As Russian authorities systematically tighten their grip on WhatsApp and Telegram — blocking voice calls since August 2025, threatening a full WhatsApp ban in December — they are simultaneously pushing a state-backed alternative: MAX, built on the Russian VK platform.

After a presidential decree in June 2025, MAX has been systematically rolled out across Russian society. According to Mediazona, both university and school students are being pressured and threatened if they refuse to install the app.

The mistrust is not limited to ordinary Russians. According to Faridaily, which spoke to around a dozen sources inside government and state companies, officials, Duma deputies and state-bank managers are buying themselves separate "clean" SIM cards and dedicated devices — purely for MAX. They call them maxophones. The maxophone is for MAX. The real phone stays in the pocket.

"Everyone considers installing MAX on their phone to be the same as handing the device to the FSB."

— Source close to the government, via Faridaily

A top manager at a state bank, when asked why he had registered for MAX, explained his situation plainly. He was in Dubai at the time. "I downloaded it to make calls with colleagues in Moscow," he said. "When I get back — I'm deleting it the hell out."

The most careful officials do not even sync their contacts between their personal phone and their maxophone. The maxophone is a quarantine device. Something you touch when you have to, then put down.

And here is the detail that should end the debate about what MAX actually is.

Kremlin press secretary Dmitry Peskov — the man who speaks for Putin daily, who has promoted and defended the internet crackdown in press briefings — has not registered in MAX using his own longtime work number. The number everyone in Russian journalism knows. The number attached to his Telegram account. He has not put that identity into MAX.

The person responsible for telling Russians the restrictions are necessary and temporary does not trust the state's own messenger enough to use his real identity in it.

That mistrust is well-founded. A technical analysis published on the Russian tech forum Habr found that MAX sends traffic to third-party servers — and actively checks whether the user has VPN active on their device.

A state-pushed messaging app that detects whether you are using a tool to escape state surveillance, and reports it. That is not a messaging app. That is a surveillance instrument wearing the interface of one. And the people who built the system around it know exactly what it is.

The VPN crackdown completes the picture

At the end of March, Russia's Minister of Digitalization set an effective deadline of April 15th for new VPN restrictions. Telecom operators were ordered to impose fees on customers using more than 15 gigabytes of international mobile traffic per month — a threshold that in practice targets VPN users.

At the same time, major internet companies including Yandex, VK, Sberbank and Ozon were instructed to block users detected using VPN. Companies that fail to comply risk losing both their rights and their place on the government whitelist.

According to the Apple Censorship project, Apple has removed 761 VPN apps from the Russian App Store at Roskomnadzor's request.

This is the complete architecture:

Push people off open messaging apps.
Offer an approved alternative that monitors VPN usage.
Tax those who route around it.
Pressure companies to enforce the same restrictions.
Remove non-compliant companies from the whitelist that keeps them viable during shutdowns.

That is not censorship in the traditional sense. That is a closed loop.

The mobile network: a progression worth reading carefully

The SIM card developments tell the same story in miniature — and the chronological progression matters.

In October 2025, The Moscow Times reported that Russia had started imposing a 24-hour data blackout on foreign SIM cards the moment they first appear on Russian networks. The stated justification was security.

By November 2025, the same logic was being extended inward: plans emerged to apply similar 24-hour blackouts to domestic Russian SIM cards returning from roaming or simply inactive for several days.

Then the temporary became permanent.

Swedish telecom operator Comviq now warns its customers explicitly that Russia has blocked mobile data services and SMS for foreign operator subscriptions — not as a 24-hour quarantine, but as a standing policy. Not just data. Not just messaging apps. Ordinary SMS is blocked.

SMS is not an app. It cannot be routed through a VPN. It does not require an internet connection. It is the oldest, most basic layer of mobile communication — and it no longer works for foreign SIM cards on Russian networks.

In plain terms: If you travel to Russia with a foreign SIM card, you cannot send or receive text messages. Not because of a technical fault. Because the network has been instructed not to carry them.

The progression runs in one direction only: first foreign data, then foreign SMS, then domestic SIM cards returning from abroad. Each step is presented as temporary, narrow, justified by security. Each step becomes the new baseline.

What we tested — and what it showed

Before writing this, I ran some tests of my own. Not because the journalistic evidence needs technical reinforcement — it does not. But because understanding where the blocking happens changes how you understand what Russia is building.

The DNS layer

DNS is the address book of the internet. When you type a domain name, your device asks a DNS resolver where to find it. If the resolver lies — or refuses to answer — you cannot reach the site.

The obvious first question: is Russia blocking at the DNS level?

I queried Yandex's public DNS resolver from Norway, asking for navalny.com, meduza.io, pravda.com.ua and novayagazeta.ru. All of them resolved correctly. No refusal. No redirect. Comparing against Google's public resolver showed no manipulation — just geographic routing differences.

That appeared to be the end of it. Until I dug further.

Using DNSChecker.org, I queried ukraine.ua across 26 resolvers worldwide simultaneously. Every single one — US, Europe, Asia, Africa, Australia — returned the same two Cloudflare IP addresses: 104.18.6.16 and 104.18.7.16. That is where ukraine.ua actually lives.

The Yandex resolver in St. Petersburg returned something entirely different: 8.47.69.0 and 8.6.112.0. Those addresses belong to Level 3 / Lumen — not Cloudflare. Not the site. A different destination entirely.

Twenty-six resolvers. One outlier. The outlier is inside Russia.

Then I ran the query directly from Norway against Yandex DNS. Same result: the manipulated Lumen addresses, not Cloudflare. Query time: 157 milliseconds.

The traceroute to Yandex's servers shows a round-trip of roughly 65 milliseconds. The DNS answer took 157. The extra latency does not prove TSPU on its own, but it strongly suggests that the query is being processed or intercepted inside the Russian network before the manipulated answer is returned.

This is why it matters: Yandex DNS uses anycast. The same IP address (77.88.8.8) is physically served from different servers depending on where your traffic is routed. Norwegian Telia traffic to Yandex DNS travels via Stockholm and Helsinki into Russian infrastructure — confirmed by traceroute. That means a Norwegian user querying Yandex DNS is not hitting a European node. They are hitting a Russian node, subject to Russian filtering rules, from their living room in Oslo.

In plain terms: Yandex's public DNS resolver, queried from Norway on a standard Telia connection, returns manipulated IP addresses for ukraine.ua — pointing to Level 3 / Lumen infrastructure instead of the real site on Cloudflare. The answer does not look wrong. It is not a Russian IP. It is not a block page. It is a plausible-looking address from a large American network company. Automated systems will not flag it. Only someone comparing the answer against the rest of the world will see the discrepancy. And the extra latency — 90 milliseconds beyond what the network distance alone explains — is the fingerprint of the filtering layer processing the query before the false answer is sent back. The resolver appears neutral. It is not.

The deeper layer: what OONI shows from inside Russia

OONI — the Open Observatory of Network Interference — runs measurement probes physically located inside Russian networks. These probes test whether specific sites are reachable from inside the country, and how they fail when they are not.

I pulled aggregated OONI data for the period January to April 2026:

Domain	Measurements	OK	Anomaly	Confirmed blocked
navalny.com	3,385	26%	67%	4%
meduza.io	3,360	25%	69%	3%
bbc.com	98	97%	2%	0%
vk.com	23,615	97%	1%	0%

The contrast is stark. navalny.com and meduza.io fail on two thirds of connection attempts from inside Russia. BBC and VK succeed on 97%.

The more important number is the gap between "anomaly" (67–69%) and "confirmed blocked" (3–4%). OONI marks a measurement "confirmed blocked" when it detects a known block page or a DNS redirect to a censorship IP. The majority of Russian blocking produces neither. Instead, the connection simply resets. Or times out. No explanation. No page. Nothing.

In plain terms: When a Russian user tries to reach navalny.com, the connection is silently killed about two thirds of the time — with no message, no block page, no indication of why. From the user's perspective, the site simply does not load. From a technical perspective, that silence is a signature.

What produces that signature

Russia's TSPU system — Technical Means of Countering Threats, mandated by the 2019 Sovereign Internet Law — installs deep packet inspection hardware inline at every Russian ISP. The hardware inspects the SNI field in TLS connections: a fragment of the TLS handshake where the client announces which domain it wants to reach, sent in plaintext before encryption begins. When the SNI matches a blocked domain, the TSPU drops the connection. No response. No block page. A silent reset.

This is why OONI sees anomalies rather than confirmed blocks. The blocking does not announce itself. It is designed not to.

Research published at ACM IMC describes TSPU as operating statefully and in-path — it does not merely observe traffic, it sits inside the flow and terminates connections directly. Roskomnadzor controls the blocklist centrally, pushing updates to every ISP simultaneously.

According to reporting by The Bell via Meduza, operational control of the system has now shifted further: FSB's Second Service — the same unit linked to the attempted poisoning of Alexey Navalny — now runs Russia's internet blocking infrastructure.

The system is also being expanded. Russia's Ministry of Digital Development plans to increase TSPU capacity 2.5 times by 2030, to 954 terabits per second. The stated goal: processing 100 percent of all Russian internet traffic.

This is not a wartime measure being wound down. It is infrastructure being scaled up. The 2030 target is not a ceiling — it is a foundation. There is no trajectory here toward openness, toward less control, toward more transparency about what is being blocked and why. The direction runs one way only.

Russia also blocked OONI Explorer itself in 2024 — the platform that documents what is being blocked.

In plain terms: Russia has installed invisible filtering hardware inside every internet provider in the country. It reads your connection before encryption fully kicks in, identifies the destination from a single exposed field in the handshake, and silently kills the connection if the destination is on the list. You get no error message. The site just does not load. The unit now running this system previously tried to kill the man whose website it is blocking. And they blocked the tool that documents it.

The people paying for it are no longer abstract

This is what I think changes the political stakes for the Kremlin — possibly in ways it did not fully intend.

Rosenberg visited the town of Vladimir, 190 kilometres from Moscow, where activist Yulia Grekova had tried to organise a public rally against the restrictions. The local authorities rejected every proposed venue — citing street cleaning at all eleven locations on the requested date. They offered an alternative slot, then cancelled that too, citing the danger of Ukrainian drone attack. Then the police came to her workplace.

"They came to where I work. A police car and three people. They filmed me signing the official warning from the prosecutor. I felt like some kind of terrorist."

Similar applications were rejected across dozens of Russian towns and cities. In the Moscow region, authorities cited coronavirus concerns. Officials in Penza said a rally couldn't go ahead due to a roller-skating masterclass at the requested location.

The consequences on the ground are not abstract. In Vladimir, Rosenberg checked his phone: the taxi app worked and state media loaded, but Google searches were not functioning and independent news sites would not open. One resident, Denis, put it plainly: "Today I couldn't pay for petrol. And my satnav is glitching."

I am not writing about this from a distance. We had an office in Kyiv when this war began. The war now restructuring an entire country's internet is the same war that reduced it to rubble.

Celebrity blogger Victoria Bonya recently went viral with a video criticizing the internet shutdowns, watched tens of millions of times.

A screenshot from Victoria Bonya's video titled 'an appeal to Vladimir Putin' (Screengrab: Instagram/ bonya__victoria)

"There is a huge, thick wall between you and us, the ordinary people."

— Victoria Bonya, addressing Putin directly

Former parliamentarian Boris Nadezhdin told the BBC: "People are beginning to understand that there is a direct connection between their everyday problems — healthcare, food prices, internet problems — and Vladimir Putin's policy. This is a new situation in Russia."

New polling cited by the BBC suggests Putin's popularity has fallen to its lowest level since the full-scale invasion of Ukraine in 2022.

The discontent is not limited to the street. A source inside the Kremlin told Reuters that senior officials and bankers had lobbied Putin to moderate the crackdown — and that the mood inside the administration had shifted.

"Most of the Kremlin is grappling with this issue, holding meetings and drafting documents to argue that blocking is a bad thing. The situation is frustrating everyone, including loyalists."

— Source close to the Kremlin, via Reuters

When internet control starts breaking payments, logistics, bookings and ordinary business operations, it stops being something the state can contain neatly inside the language of "security." It becomes a daily tax on ordinary life. And a daily tax on ordinary life is politically harder to manage than a crackdown on journalists.

What this is actually called

Dependency engineering.

That is the phrase I keep coming back to. Not censorship. Not filtering. Not a blackout.

Russia is not primarily trying to suppress speech. It is trying to redesign which internet ordinary people can afford to rely on. The approved one functions. The open one becomes unreliable. Approved messaging apps survive shutdowns. Open ones do not. Companies that enforce the restrictions keep their whitelist status. Those that resist lose it.

Gradually — not necessarily dramatically — people, businesses and services adapt. They migrate toward what works. They internalize the friction as a feature of daily life, not as a political act.

A bank still works.
A state portal still works.
VKontakte still works.
MAX still works — and MAX reports whether you are using VPN.

The open internet is what starts looking risky.

This is a significantly more modern form of control than cutting the line. It does not require a total blackout. It requires only that the unapproved world become consistently less dependable than the approved one — and that the approved world gradually become more convenient to inhabit than the alternative.

Closing

Russia is not merely restricting access.

It is teaching people, through repeated friction and selective availability, which internet is safe to depend on. The approved one. The domestic one. The governable one.

Activist Yulia Grekova told the BBC: "It feels like we're going backwards, sliding back to the past."

I think that metaphor is slightly wrong. What is happening is not a slide backward. It is a construction project. A new kind of digital enclosure built not from absence but from selective availability — where ordinary digital life migrates, piece by piece, into the space the state has decided is safe.

The people paying for it first are not dissidents. They are shop owners, caterers and students standing in a queue outside the Kremlin, or shouting into the dark on TikTok, trying to explain that the internet being restructured was the one their lives were built on.

That is not a security measure. It is a redesign of everyday dependence.

And once that redesign is complete enough, the cost of reversing it will fall not on the state — but on everyone who learned to live inside it.

Yandex AI, asked whether the claims in this article are accurate, declined to respond. The article had been submitted to Yandex\'s index via IndexNow hours earlier.

Sources

Tags Privacy Infrastructure