Russia's draft 2027–2029 federal budget sets aside nearly 60 billion rubles for traffic filtering and blocking built on TSPU, the deep-packet-inspection boxes installed in every Russian network. According to Meduza's 8 October 2026 report, the money arrives as an annual subsidy of about 19.9 billion rubles to the Main Radio Frequency Center (GRChTs). The previous draft carried roughly 9.8–9.9 billion rubles a year. The money is only part of the package. Pending proposals would also bar VPN operators from Russian hosting, require companies to report corporate VPN use, and charge for international mobile traffic.
The strongest case for the state's position
Any government has a legitimate interest in stopping fraud, malware and content that is illegal under its law. A state facing sustained cyberattacks can reasonably argue that it needs visibility into its own network, and the 2019 "sovereign internet" law was framed as resilience against external disruption. Russian officials would also say that foreign VPN providers ignoring domestic law is a compliance problem, not a rights problem. That is a fair summary of the official rationale.
The design of the system does not match that rationale, however.
What the architecture actually does
Federal Law No. 90-FZ of 1 May 2019, published in the government newspaper Rossiyskaya Gazeta, amended the Law on Communications to require internet access providers to install "technical means of countering threats" in their networks. The regulator supplies the devices free of charge and sets installation requirements, and operators are shielded from liability for licence breaches caused by the devices' malfunction. The law took effect on 1 November 2019. A European Audiovisual Observatory analysis noted at the time that blocking could happen through direct government-ISP interaction, without court involvement and without transparency to third parties. It also noted that the law left the triggering "threat" to the stability, security and integrity of the internet undefined.
Operators therefore do not control the equipment that filters their customers' traffic, and the legal trigger for using it is left to the regulator's discretion. Zona Media's 2026 overview adds that only Roskomnadzor controls the devices, and that courts in Moscow and St Petersburg fined providers in March 2026 for letting blocked sites such as YouTube slip past TSPU. Every verdict it recorded found the provider guilty. Per Meduza, Roskomnadzor said in 2023 that all nodes were "100% covered by TSPU", so the new money is not about reach. It is about capacity and precision.
A decade of escalation with limited results
Meduza's timeline shows how the effort has widened. A 2017 law obliged providers to block resources banned in Russia, including through VPNs. In March 2019, Roskomnadzor told ten VPN providers to connect to the state blocklist registry. Only Kaspersky Secure Connection complied, and the agency's head said non-compliant services would be blocked. Mass VPN blocking began in 2021. By 2025, VPN operators faced fines of up to 80,000 rubles for individuals and 500,000 for companies, and VPN use became an aggravating factor in criminal cases. In April 2026, major platforms were told to detect VPN users and block them, and in June 2026 Russian hosting providers were barred from serving VPNs that bypass blocks.
Each step moves the burden from the state to someone else: platforms, hosts, mobile operators and, now, employers. Zona Media's reporting shows why this is needed. The ministry's own detection manual relies on IP databases and app-level checks, and the article lists the limits of those methods: iOS hides VPN status, developers can whitelist detection domains, and Android split tunnelling lets apps bypass a VPN. When network-level blocking cannot close the gap, the policy reaches into devices and billing.
The cost of the next layer
The pending proposals show where the policy is heading. According to Meduza, a new Roskomnadzor register would list people and companies using Russian servers to host VPNs, and those caught bypassing blocks could be barred from contracts with any Russian provider for a year. A draft bill would make companies notify Roskomnadzor about corporate VPN use, with the government and FSB jointly setting usage rules. For international mobile traffic, the March 2026 proposal set a 15 GB threshold. Kommersant, as cited by Meduza, now reports a 50 GB free allowance with charges initially on 5G only.
Corporate VPNs are the weak point of the whole approach. They protect trade secrets, link branch offices and secure remote access, and none of that is about evading censorship. A reporting regime that puts the FSB into that relationship raises security and competitiveness costs for ordinary businesses, in an economy that already depends on cross-border services. Charging for international traffic similarly penalises students, researchers, freelancers and exporters who need the global internet for entirely lawful work.
Where proportionality breaks down
A proportionate approach would target specific, defined harms, such as fraud and malware, through transparent legal processes with judicial review and published criteria. The TSPU model does the opposite: it builds a general capability first and leaves the rules for using it to administrative discretion. The effect on the open internet is a recurring cost, in the form of slower connections, collateral blocking and a shrinking tolerance for private encryption. Zona Media reports that Roskomnadzor's 2018 attempt to block Telegram, which meant blacklisting millions of IP addresses at Amazon and Hetzner, was abandoned. Kommersant reported in March 2026 a plan to raise TSPU capacity 2.5 times by 2030 to 954 Tbps, which shows that the state is choosing to pay for precision rather than blunt blocking.
The lesson for other governments is that a filtering capability, once built, invites an ever wider list of things to filter. The doubled subsidy should be read less as a technical upgrade than as a statement that the state intends to keep tightening, with ordinary users and businesses paying the price.
What to watch
The draft budget still has to pass the State Duma, and the VPN proposals remain pending, so the figures and thresholds may change. Watch whether the corporate VPN reporting bill and the mobile-traffic charge are adopted, and whether the 5G-first design survives. Watch also whether courts continue to find every challenged provider guilty. The measurable test of the spending is whether VPN use falls or merely moves to new protocols, as it did when VLESS was blocked in late 2025 and most providers simply reissued configurations.