It looks like Russia’s President Vladimir Putin is beginning to realize that sometimes it’s easier to table proposals for online censorship than it is to actually put them into practice.
Thousands of Russians have taken to the streets after Putin introduced proposals for a Cybersecurity Bill. There’s a chance (however miniscule) they might force a government climb down. If that happens, Russian internet users will need to know the implications, and how to respond.
This article will look into the history of Putin’s relationship with the web, what this new legislation could mean, and how Russians or visitors to the country can evade online censorship should the bill be passed as it stands.
A history of gradual restrictions of online freedom
The Cybersecurity Bill battle didn’t come out of nowhere. It’s the culmination of a process called online tightening (sadly, it’s a process that is not limited to Russia).
As recently as 10 years ago, this was far from the case. Most commentators saw Russia’s online landscape as rather unrestricted, and there was little state interference when it comes to what Russians could or couldn’t see.
As opposition to Putin grew from 2010 onwards, however, the situation changed. The internet came to be seen as an adversary of the government. Blacklisting was expanded to include political groups. However, this was far from total, and dissidents like Pussy Riot could still use the web to gain a mass following.
In 2018, the stakes rose again, with a nationwide ban on the messenger service Telegram. Anecdotal reports suggested that the state had also started to clock out 3G and 4G coverage in areas affected by opposition demonstrations. But demonstrations against the Telegram regulations still went ahead, as protesters and their paper planes (the Telegram corporate symbol) gained worldwide headlines.
However, as 2019 dawned, Putin saw scope for additional security measures. The government confronted increasing protests, and previous digital legislation had failed to quell online dissent. Will the new measures succeed, or spark even more opposition?
What does the 2019 Cybersecurity Bill mean?
Russia’s Cybersecurity Bill (aka the Digital Economy National Program) being proposed by Moscow essentially seeks to turn Russia into a completely separate digital region whenever the state deems it necessary. This would be very similar to the Great Firewall of China, which tightly regulates access to certain services and websites within Chinese borders.
Moscow states that this online wall of separation will be a valuable security tool that would provide protection for the domestic web should Russia be subject to a foreign cyberattack. However, experts and dissidents are dubbing these new digital borders an “Iron Curtain” that drastically cracks down on individual freedoms.
This may sound over-dramatic, but the implications of the measures are potentially far-reaching. Foreign news sources could be rendered off-limits, and citizens would not necessarily be able to email contacts abroad. Multinational streaming platforms would be subject to new restrictions, and anything being digitally transferred from overseas could be intercepted and tracked at the border.
In a nutshell, the Cybersecurity Bills is a recipe for pervasive online censorship and social control – which is exactly what Putin wants.
What effect would this have on Russian VPNs?
There’s another potentially dangerous side effect of Putin’s new online censorship drive: the demise of any Virtual Private Networks (VPNs).
When Telegram was taken down, millions of Russians adapted by using VPNs. That’s because VPNs offer a way around many forms of online censorship and were (initially at least) a very effective solution to the Telegram ban.
For those not in the know, VPNs encrypt all data you transfer via the internet and create secure tunnels between your device and international servers. When data is routed through these VPN servers, your original IP address is exchanged for an overseas address.
In theory, the mix of encryption and IP address anonymization can make users undetectable to state surveillance, making it extremely difficult to censor their activities. And that’s what we see in countries like China or Iran. Oppressive states genuinely struggle to lock onto savvy VPN users.
In China, Beijing keeps a register of “state-approved” VPNs and blocks others. However, the state has never been able to completely and fully restrict Chinese web users to approved providers. No country has managed to discipline all VPN providers.
Could Russia be the first to do so? That seems to be the plan.
Will Putin’s legislation succeed?
There seems to be very little doubt that Putin will get his way in the Duma (Russia’s parliament). As journalist Andrei Soldatov says, “The main thing – to give the government the option to isolate a particular region or the country in time of a crisis, is to be preserved, for sure.”
The question is whether this will work in practice. And there’s room for skepticism here.
First and foremost, Russia’s Cybersecurity Bill requires significant technical effort to make it possible. Moscow is placing the burden on domestic telecoms companies, who will need to create a server infrastructure wholly within Russian borders. Currently, a lot of traffic is routed via overseas servers, and this would need to be repatriated somehow.
DNS is another problem area. For a purely domestic internet to function, all accessible websites will need both Russian and conventional DNS addresses. These domestic addresses don’t yet exist.
Finally, Putin wants to create a central register of domestic websites – the so-called Roskomnadzor.
Telecoms will be expected to update the Roskomnadzor as soon as their network architecture changes. But since this happens constantly, they are not sure how they’ll able to handle registry updates and normal service provision as the same time.
None of this means that Putin and his government will back down. The cybersecurity and censorship agenda have become key parts of Moscow’s program, and the bill probably won’t be withdrawn. But implementation could be very tricky, and this is buoying activists somewhat.
How to bypass online censorship in Russia
Let’s assume that Putin succeeds, and government technicians manage to create a fully domestic version of the web. This would certainly give state officials actual levers to repress almost any online content they deem inappropriate. That said, all is not lost, at least from a digital freedom perspective. Here’s why.
As we noted earlier, VPNs are commonly used in China and Russia to render state censorship null and void. If Beijing had the capability, it would have blocked elite VPNs completely. But the Chinese have not been able to do so. Why should Moscow fare any better?
In 2017, Russia tried to block VPNs. And the effort was a complete failure. Within a year, millions of Russians embraced VPNs to retain access to Telegram, and the government had taken legal action against exactly zero VPNs. The legislation had utterly failed.
This means that should the new digital Iron Curtain come into effect, users may well be able to bypass its restrictions with the right VPN. However, as with China, not all providers will work. If you’ve ever used a VPN in China, only to experience constant connection failures, you’ll appreciate this.
Instead, users will need to choose a reliable, privacy-focused provider with a proven track record of circumventing online censorship.
What about worst case scenarios?
Before we finish, it’s important to remember that online freedom isn’t a certainty. Putin’s government could succeed in creating a separate Russian internet, and if this happens, VPNs may be far less effective.
If the Russian web is completely severed from the rest of the world, VPNs won’t be able to route traffic through overseas servers. They may be able to deliver encryption and a degree of anonymization, but their overall usefulness would be far lower.
Nevertheless, having a solid VPN as a fallback option makes sense. It’s highly unlikely that Russia will disconnect for prolonged periods. In fact, users will be more likely to require a VPN to evade conventional surveillance and censorship. As dissent grows and the government seeks to respond, that kind of protection could be a matter of life and death.