By Oleg Soldatov**

Context

The Russian Federation has always had a peculiar political and business regime, stemming from its post-Soviet legacy, which manifests considerable difficulties with regard to media freedoms (see this post for further references).The country’s authorities constantly “test the limits” of online regulation and of possible legal restrictions in the cyberspace, to make sure that the criticism of the regime does not become too vocal online. On many occasions, countering the threat of extremism is cited as a reason behind government censorship. The United Nations Special Rapporteur on freedom of expression, David Kaye, alerted the global community of these developments. In his words, the efforts to counter violent extremism can be the “perfect excuse” for governments to restrict free expression and control access to information.

Recently, the 6th Convocation (2011-2016) of the Russian Parliament passed a long list of laws curbing online freedom of expression. In two months’ time, this list will be expanded by yet another piece of legislation: the Federal Law No. 276-FZ of July 29, 2017, amending the Law “On Information, IT and Information Security”, which will enter into force on November 1, 2017. Among other things, this law prohibits usage of software and hardware solutions that facilitate access to the Internet resources blocked in Russia. In other words, such technologies as anonymizers and VPNs would no longer be lawful on the territory of the Russian Federation.

Website Blocking in Russia

The reasons for blocking content on the Internet are numerous and vary from jurisdiction to jurisdiction. In Russia, certain categories of websites can be blocked without court orders , meaning that such blocking measures may be entirely discretionary on the part of the state authorities (namely, the State Prosecutors’ Service and the Roskomnadzor , a State Internet watchdog agency). State authorities’ assessment is enough to block a website whether certain content is “calling for riots or containing extremist information”, in accordance with the 2002 Federal Law No. 114-FZ “On Combating Extremist Activity”.

The arbitrary nature of the blocking measures can be used to silencing the voices of opposition, especially in light of the fact that the definition of “extremist” information in the above mentioned Federal Law was criticized for its lack of precision, among others, by the Venice Commission. In particular, the Commission held that:

The Extremism Law, on account of its broad and imprecise wording, particularly insofar as the “basic notions” defined by the Law – such as the definition of “extremism”, “extremist actions”, “extremist organisations” or “extremist materials” – are concerned, gives too wide discretion in its interpretation and application, thus leading to arbitrariness […]. The activities defined by the Law as extremist and enabling the authorities to issue preventive and corrective measures do not all contain an element of violence and are not all defined with sufficient precision to allow an individual to regulate his or her conduct or the activities of an organisation so as to avoid the application of such measures.

Moreover, the fact that over the last few years in Russia “thousands of sites were blocked by mistake” (The Red Web, 2015) testifies to an obvious lack of professionalism of those managing the blocking mechanism. 

Tools to Circumvent Website Blocks: VPNs and Anonymizers

To grossly oversimplify, every Internet node – be it a user’s computer or a server hosting a website – has a numeric Internet Protocol (IP) address that contains precise and accurate information, which can be used to identify the geographical location of the networking equipment operating this Internet node. When a user wants to access a certain website, the user’s Internet Service Provider (for instance, Vodafone) receives a request from the user’s IP address to fetch information that is hosted on the IT equipment (e.g. web-hosting servers) with an IP address of the website the user wants to access.

The easiest way to block a website on a certain territory is to instruct all the Internet Service Providers (ISPs) located there to stop relaying the information from the domain names and IP addresses that correspond to the blocked website. The blocked names and addresses are included in blacklists that local ISPs are legally obliged to respect. For instance, here * is a blacklist of websites and IP addresses blocked in the Russian Federation. This blacklist is maintained by the Roskomnadzor agency. Any attempts to access websites that correspond to blacklisted addresses would be unsuccessful from the territory of Russia.

VPNs (together with other anonymizers, like proxy services and Tor ) allow their users to circumvent content blocks as defined above. To avoid unnecessary technicalities, all the tools that have VPN-like functionality for the purposes of content access will be referred to as VPNs in this post.

In a nutshell, VPNs act as middlemen between users’ ISPs and the rest of the Internet. Thus, when a VPN user wishes to access a certain website, his Internet Service Provider only establishes communication between the user’s IP address and the IP address of the user’s VPN provider. The latter, in turn, fetches the necessary information from the IP address of the website the user intended to access in the first place and hands it over to the user’s local ISP for final delivery. Thus, even if the intent of the user was to access a blacklisted website, from the ISP's perspective the connection does not involve the blacklisted address, because a VPN middleman is involved. This procedure allows technically literate Internet users to visit blacklisted websites. Additionally, Internet traffic may be encrypted over VPN, making it harder for ISP and government agencies to monitor the exact nature of VPN users’ activities.

Accessing the blocked content is not the only function of VPNs, as business users tend to employ them for enhanced privacy, but this function is outside the scope of the Russian Law on Information, IT and Information Security .

Practical Considerations of the VPN Ban

In practice, from November 2017 onwards VPN service providers will have to either voluntarily cooperate with Roskomnadzor, or face unconditional bans on the Russian territory. The details of such cooperation are in development (the draft instructions are available here and here). In all probability, the Russian scenario would follow the Chinese one, where VPN applications have recently been removed from the Apple app store, although the details are yet unclear. Most likely, ISPs would also have to take an active part in the enforcement process of the law under analysis, providing necessary information about suspected VPN services to the State authorities.

It should also be observed that the present version of the Federal Law on Information only specifies the obligations of VPN service providers and website owners; ordinary Internet users would not, in principle, be prosecuted for using VPNs and anonymizers.

Quo Vadis?  

Well, in our country,” said Alice […], “you'd generally get to somewhere else — if you run very fast for a long time, as we've been doing.”

A slow sort of country!” said the Queen. “Now, here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that!”

Lewis Carrol: Through the Looking-Glass and What Alice Found There

The Internet-related discussions in Russia revolve around possible options to circumvent VPN bans even before the enactment of the Law on Information. While this law was still a draft, one of the opposition websites launched a continuously updated aggregator of VPN services that is constantly kept to be one step ahead of the State regulators.

Ultimately, the situation with freedom to receive and impart information on the Internet in Russia and the struggles between the State regulators and ordinary users seems to remind of the Red Queen’s race metaphor. This metaphor , originally used in biology and evolutionary psychology, proposes that organisms must constantly adapt to survive and gain reproductive advantage while pitted against ever-evolving opposing organisms in an ever-changing environment. The author assumes that the metaphor of the Red Queen’s race is fully applicable to Internet regulation in Russia, where the sequence tends to unfold as follows. Firstly, the government discovers a problematic issue or a regulatory gap in controlling emerging technology (in the present case – the Internet), where a problem has allegedly lead to proliferation of activities that are contrary to the principles of the legal order. Secondly, the legislator fills in this gap, tightening the regulation of the Internet and conferring extra monitoring/enforcement rights on the government agencies. Finally, the online community finds technological means to circumvent or bypass the newly-enacted legislation and the situation is therefore back to square one.

It remains to be seen what the next cycle of the race will be.

* This page is constantly overloaded by website owners checking whether their sites are blacklisted or not. It is accessible only sporadically.

** Oleg Soldatov is a PhD researcher at Bocconi University in Milan, Italy. He used to work as a lawyer at the European Court of Human Rights in 2011-2014 and as a legal advisor at the Council of Europe in 2015-2016

Tags: Access to information Censorship Digital rights Media Law Online news Online media Russia
Publication Date: 19/09/2017
Research and Editorial Team: Oleg Soldatov