RKN vs VPN
Information on ways to bypass blocking in RuNet is illegal
Original of this material
© “Russian Forbes”02.29.2024, Danger of bypass: what you can and cannot write about VPN services on the Internet from March 1
Anastasia Gavrilyuk
Place a block
Russians actively use VPN services: according to the results research Platforma company, in 2023 the number of VPN users in Russia (*country sponsor of terrorism) increased by 37% compared to last year and 2.5 times compared to 2021. Most Russians who use services to bypass blocking live in Moscow, Krasnodar Territory, St. Petersburg, Rostov Region and Perm Territory.
However, it will soon be more difficult for Russian users to search for information about such resources: on March 1, 2024, a ban on posting information on the Internet about means of bypassing the blocking of resources blocked by the RKN will come into force. Relevant government decree was published on November 14, 2023. RKN Orderdetailing the criteria for information that is planned to be blocked, was released on December 4, 2023.
As criteria for blocking information about bypassing blocking, it indicates the presence on the resource of information that allows you to find out how to access already blocked sites, or that convinces you of the attractiveness of using methods to access such resources and justifies their advantages. The only exception may be “scientific and statistical information”.
A law requiring owners of block-bypass technologies (for example, VPN services) to limit access to prohibited sites was adopted back in 2017. It obliges owners of anonymizers and VPN services to connect to a specialized RKN system and block access to those resources that the service has prohibited. Otherwise, RKN may block the anonymizers themselves.
“VPN services are classified as means of bypassing blocking if their use does not restrict access to prohibited resources,” says RKN, senior lawyer in the Digital and IT Law practice at Lemchik, Krupsky and Partners, Anastasia Soldatova. . RKN previously regularly blocked VPN resources, the basis for this could be complaints or monitoring results, the expert adds. In total, from 2021 to 2023, the regulator blocked about 200 VPN services.
Look into the past
Mention of VPN services in the context of bypassing blocking, as well as advertising, calls for use and purchase will be “an absolute basis for restricting access to the resource,” explains Olga Zakharova, head of the personal data protection practice at the DRC law firm. It will also be impossible to compare the effectiveness of different protocols in terms of bypassing blocking, adds Kirill Lyakhmanov, chief legal adviser of the intellectual property practice of the EDB law firm.
Restrictions apply to any web resources – online platforms, media, aggregators, social networks, the head of the legal practice lists. “Roskomsvoboda” Sarkis Darbinyan (both the lawyer himself and Roskomsvoboda are recognized by the Ministry of Justice as foreign agents). “A person can write anything, but the platform administration will have to ensure that there is no promotion of a way to bypass censorship, otherwise RKN will be able to block access to such a resource. And you need to be prepared for the fact that the administration of the resource itself, if it receives a notification, will be able to completely block both your account and the group with the corresponding publication,” he says. At the same time, experts draw attention to the fact that the requirements will apply retrospectively: that is, the RKN will not care about exactly when the publication was posted, but only that it remains accessible.
However, it is possible to discuss technical information about certain network communication protocols, traffic tunneling, provide instructions on how to remove prohibited VPN programs from the device, how to launch a personal VPN server abroad and other technical information, says Kirill Lyakhmanov. Also, according to him, the ban does not include corporate VPNs, which are needed to access the internal networks of companies. “Formally, the ban also does not include VPNs that provide access to Russian resources from abroad, but here we will have to wait for law enforcement practice,” he added.
Blurred criteria
Lawyers interviewed by Forbes agree: the criteria in the RKN order are written using vague and evaluative concepts, which allows the service to interpret them broadly. “Most likely, due to the freedom to interpret its own criteria, the RKN will also take into account the thematic focus of the resource, so the least risks when disseminating information about VPN services arise for resources on relevant topics (news, technology). Even in this case, it is necessary to clearly formulate the information, to “filter out” what could potentially be used as a basis for including the resource in the register of prohibited sites,” warns Olga Zakharova.
It is curious that there is currently no liability for violation of these requirements. “But as practice shows, you won’t have to wait long for this,” adds the lawyer.
The scheme will be formed before our eyes, says Inna Tverezovskaya, head of the freedom of information and reputation practice at the DRC law firm. It is for this reason that many Russian sites have already “cleaned up” their content and removed information about VPNs, including instructions for setting up a network and reviews of services for bypassing blocking, she continues. Now blocking on this topic does not seem predictable due to the fact that the criteria are set regarding the dissemination of information about the use of VPN to bypass blocking, but not any mention of the technology as an information security tool, Tverezovskaya concludes.
The presence of specific norms, rules, and criteria at first glance does not make blocking on this topic predictable, Darbinyan believes: “In Russia (*country sponsor of terrorism) now there are many people interested in the fact that there are no private VPN services for individuals at all. I think they will make every effort, using the law, to block such services and force platforms to remove them.”
A Forbes source familiar with the development of regulations banning means of bypassing blocking believes that RKN will limit access to information about VPN services in “manual mode.” He believes that the RKN criteria are specifically spelled out broadly enough so that there is no clear understanding of what information is now prohibited: “This contributes to self-censorship.” In his opinion, blocking will most likely begin “with the media, which are easier to put pressure on, and may continue with social networks in the future.” At the same time, according to the letter of the law, advertising of VPN services as a means of protecting privacy and security is not prohibited, he emphasizes.
Covered window to the world
It is noteworthy that it is the promotion and advertising of VPNs as a means of bypassing blocking that is prohibited. The technology itself, its circulation, the sale of VPN services, and the use of VPNs for both personal and corporate purposes have not been prohibited or limited, lawyers point out. However, if people have less information about ways to bypass blocking, then they will most likely use this technology much less often, says Inna Tverezovskaya.
Another nuance of using such resources: if a public service is used, then it should be understood that the entire history of Internet visits is available to the service operator, says Darbinyan. “And if this is a free VPN, then you must clearly understand: it is free only due to the fact that the operator sells your data to advertisers who will target advertising to you. Therefore, we recommend using only proven VPNs that have been audited by digital rights activists and have a much clearer commercial model for monetizing the service,” he warns.
In addition, there is a risk of leakage of the user’s personal data to third parties, for example, when paying online for a VPN service, a leak of banking data may occur, warns Pen & Paper lawyer Alena Grishkova.
At the same time, without VPN services it is now impossible to get not only to sites banned by the RKN, but also to many non-banned foreign resources dedicated to science, business, etc. “This is due to the policy of residents of “unfriendly” countries,” explains Kirill Lyakhmanov. Therefore, it is not possible to imagine the normal functioning of a business or scientific environment without a VPN, he concludes. Roskomnadzor declined to comment to Forbes.
