A few days after Russian regulators began blocking DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) servers, the privacy-focused mobile OS, GrapheneOS, says the censorship is worse than in China and suggests that its services will gradually become inaccessible in Russia.

Last week, multiple reports from Russia said that local regulators were now going after Google and Cloudflare IPs and services, used by Russians eager to hide information about the sites they visit from the authorities.

Insiders have also speculated that the “whitelist-first” internet – a system that blocks all open web traffic by default and only permits access to a government-approved list of websites and apps – is now going to be the norm in Russia.

GrapheneOS – a mobile OS focused on privacy and security, built as a hardened version of Android – has confirmed that the Kremlin is indeed tightening the censor’s noose by blocking entire “neighborhoods” of the internet.

It’s now the new default, it seems. By maintaining an “allowlist” of approved sites and services, Russia wholesale blocks servers that aren’t on the list, even if the actual website dependent on these servers is completely harmless – which GrapheneOS says it is.

Moscow doesn’t comment much on web regulations, but the country has been blocking VPN providers left and right to keep citizens away from independent news.

GrapheneOS doesn’t run any VPN services. But since it rents server space from cloud hosting providers, it’s now collateral damage of Moscow’s censorship campaign.

First, Russia began blocking a provider called DataPacker. GrapheneOS then switched to a different provider, Cheery Servers, and after that got blocked as well, switched again to Zare London.

For now, this is working, and GrapheneOS is still available in Russia. But the company isn’t optimistic about the near future.

That’s the final of our sponsored servers in Europe we can use so we'll need to fall back to Xenyth Toronto if they filter it. We’re using our own IP space in Toronto so it should work unless they specifically block us,

GrapheneOS said on X.

Since GrapheneOS owns that cache of internet addresses outright, it should, in theory, be much harder for Russia to block it without deliberately and specifically targeting GrapheneOS by name.

However, GrapheneOS admits this doesn’t change the bigger picture – even if Russia won’t bother specifically blacklisting them by name.

“We don’t think we’ll be blocked directly, but we’re also unlikely to get placed on the allowlist. That means our services are gradually going to become inaccessible in Russia via the IP space of major cloud services,” they said.

The GrapheneOS team also points out that this sort of blanket blocking of entire hosting companies rather than specific websites is a lot more aggressive than whatever China currently does.

“Their allowlist is worse than China's filtering. Our services are fully accessible in China without any workarounds,” the X post reads.

“Russia’s internet filtering is definitely an official policy with many public statements related to it. There aren’t specific public details on exactly what they're blocking, how they’re doing it or how they intend to continue expanding it. It’s more aggressive than China though.”

The silver lining is that even as regulators keep targeting more censorship workarounds, developers keep developing new ones that could offer better censorship resistance, including decentralized VPNs.

Users can switch to a different encrypted DNS provider, for example. Another possible solution might be routing DNS through a VPN. Using unencrypted DNS will restore basic connectivity, but you’d lose your privacy.

The Kremlin has been waging a war against providers of virtual private network services, ordering giants like Apple to remove VPN apps from their app stores.

Roskomnadzor, Russia’s communication regulator, has reportedly set an ambitious goal to block 92% of VPNs in Russia by 2030 and essentially establish RuNet, Russia’s “sovereign internet” by then.