A Blocking List Built From Everyday Apps
In early August 2026, Roskomnadzor carried out what Leonid Volkov, a senior figure at Alexei Navalny's Anti-Corruption Foundation, called "the biggest [blocking wave] in history" on his Telegram channel. More than 20 popular VPN services — including Amnezia, Paper VPN, VPN Legend, GaMMa VPN, and FoxyBot — reported mass disruptions as Russia's Technical Means of Countering Threats (TSPU), the deep-packet-inspection hardware installed at every ISP under the 2019 Sovereign Internet Law, blocked entire subnets belonging to hosting providers rather than individual IP addresses (Meduza).
What made this wave different, according to Meduza's follow-up reporting, wasn't the blocking mechanism — it was the intelligence feeding it. Volkov argued, and Meduza's sourcing with VPN providers corroborated, that Roskomnadzor's targeting improved because domestic Russian platforms — Yandex, VK, the new state-linked messenger Max, and the job site HeadHunter — had already logged users' IP addresses, device fingerprints, and linked social accounts in the ordinary course of business. That trove, plus subnet data registered to specific hosting companies, was fed into TSPU's filtering rules. One VPN operator, Liberty VPN, told Meduza that "the FSB even provided its own API for the purpose," describing automatic transmission of device models and, in some cases, passport details (Meduza).
The Legal Scaffolding Was Already in Place
This wasn't improvised. Federal Law No. 281-FZ, signed by Vladimir Putin on July 31, 2025 and effective September 1, 2025, added Article 13.53 to the Code of Administrative Offences, criminalizing the mere act of "deliberately searching for" content on Russia's extremist-materials registry — including via VPN — with fines of 3,000–5,000 rubles. The same law raised penalties for advertising VPN services to as much as 500,000 rubles for legal entities, and made VPN use an aggravating factor in unrelated criminal cases (Meduza; Zona.Media). By February 2026, Roskomnadzor's own tally had climbed to 469 VPN services restricted nationwide (Izvestia) — up from roughly 400 the previous October — while Russia's broader censorship apparatus has blocked an estimated 25,000 sites since the 2022 invasion of Ukraine under military-censorship statutes (The Moscow Times). The August wave is the point where two existing tracks — mass site-blocking and mandatory data retention by "information disseminators" — visibly merged into one targeting pipeline.
Steelmanning Moscow's Case
It would be dishonest to pretend Russia's argument has no coherent form. Every state asserts some authority to police its own networks: the EU requires platforms to retain data for law enforcement under the e-Evidence Regulation, and data-localization rules resembling Russia's 2015 law (152-FZ) exist from Brazil to India. Regulators everywhere argue that VPNs, alongside legitimate privacy uses, also shield fraud, child exploitation material, and terrorist coordination from lawful interception — a real cost of near-universal encryption and tunneling. If the state's only tool were narrowly targeted judicial warrants against specific bad actors, this would be an unremarkable extension of existing law-enforcement data-sharing.
Where the Justification Breaks Down
But that is not what Article 13.53 and the August blocking wave do. The law criminalizes searching, not just distributing — a threshold so low it reaches ordinary curiosity, journalism, and academic research, with no judicial warrant required before Roskomnadzor repurposes Yandex search logs or HeadHunter's employment records as a censorship input. There is no independent court authorizing subnet-level blocks that necessarily sweep in unrelated, lawful hosting customers who happen to share a data center with a targeted VPN provider. And the FSB-API detail matters: it means data collected for commercial purposes — a job application, a taxi ride, a messenger login — flows into a surveillance system with no notice, no opt-out, and no proportionality review. That is the difference between a state regulating its network perimeter and a state converting its entire commercial internet sector into an involuntary intelligence apparatus.
The practical effect will likely mirror past Roskomnadzor campaigns: VPN providers rotate infrastructure and protocols (TSPU already blocks VLESS and other obfuscation protocols), ordinary users lose access for days at a time, and the state claims a propaganda win regardless of long-term efficacy. The deeper cost is structural. Once domestic app data becomes a default input to state censorship infrastructure, every Russian company operating a login system is conscripted into surveillance — a precedent that chills the very digital economy the Kremlin claims to be building toward technological sovereignty, and one other governments watching Russia's playbook should be wary of importing.