Russia stepped up VPN blocking right after its State Duma elections. Meduza reported on September 29 that ten VPN services had reported tighter restrictions in a single week. One major provider emailed users on September 25 that blocking had intensified since the start of the week. Another said restrictions began September 21 and that it had to replace eight servers in five days. Two services said Roskomnadzor had blocked all their foreign server locations and the IP addresses of all their servers.
This is not a new law. It is the operational end of a policy that has been building for months. What the surge shows is how far the tools of enforcement have drifted from any defensible purpose.
The strongest case for the state's position
A government can fairly argue that a sovereign state may decide what is lawful on its networks. It can also argue that anonymising tools shield real crimes, and that a foreign VPN operator is beyond the reach of domestic courts. Russia's 2017 framework, Federal Law 276-FZ, which took effect on November 1, 2017, was built on that logic. As a legal summary from the Russian Media Freedom resource hub explains, it required VPN providers to stop giving access to resources blocked in Russia. Providers that would not cooperate with Roskomnadzor faced blocking themselves. Ordinary users were not, in principle, the target.
That original design had a limit built in: providers who complied could stay. The current campaign has no such off-ramp. According to Meduza, some services have seen every foreign location blocked. A provider cannot comply its way out of a blanket IP block.
From targeted blocking to bulk blocking
VPN Guild chairman Alexey Kozlyuk called the post-election tightening an expected outcome. He said pressure had been building since early August and that the group sees it as a continuation and gradual intensification of that campaign, not a fundamentally new wave. Meduza also noted that some services saw no increase in pressure at all.
The August episode explains the mechanism. Meduza's reporting on the August crackdown says Liberty VPN described IP addresses going into blocklists in batches, roughly every six or 12 hours. Data collected through Russian apps such as Yandex, VK, Max and HeadHunter fed the system, according to that provider. Liberty VPN said entire subnets were swept up indiscriminately. These are the provider's own allegations and Meduza does not present them as independently confirmed. They do fit the pattern Human Rights Watch described.
Human Rights Watch's September 24 report says blocking waves increasingly target large IP blocks and whole subnets that hosting companies allocate to VPN providers. Restoring service afterward takes longer and costs more than with earlier, narrower blocks. HRW estimates about 57 million Russians, roughly 40% of the population, use VPNs, and says at least 469 VPNs had been blocked as of February 2026. It also cites a coordinated June 2026 attack on Amnezia VPN, which combined bulk IP blocking, phishing and DDoS.
Collateral damage is a legal problem, not just a technical one
Blocking by IP address cannot tell a VPN exit node from the lawful services sharing the same subnet. The European Court of Human Rights addressed exactly this in Vladimir Kharitonov v. Russia, judgment of June 23, 2020. It found an Article 10 violation where a site was blocked only because it shared an IP address with content the regulator wanted removed. The Court observed that millions of websites had remained blocked in Russia for that reason alone. Russia has since left the Council of Europe, so the ruling does not bind it in practice. It remains the clearest statement of why indiscriminate blocking fails a proportionality test.
The subnet-level blocking HRW documents applies the same logic to a larger target. When a hosting provider's whole range is blocked because a VPN operator rents part of it, unrelated businesses lose access. This works against the country's own economy. A blocking regime that punishes neutral infrastructure discourages the domestic hosting and technology investment that Russia says it wants.
Where SORM comes in
Blocking is only half the story. The other half is what users can see and what the state can see. In Roman Zakharov v. Russia, decided December 4, 2015, the Grand Chamber found that Russia's SORM interception system breached Article 8. The Court noted that SORM equipment installed by operators gave security services a remote terminal to start and stop interception. It noted that operators were not required to be shown a judicial authorisation first.
A population pushed off encrypted, audited VPNs and onto domestic alternatives is a population that is easier to observe. HRW reports that at least 30 major Russian apps gathered VPN-usage information. Meduza's August reporting says Russian services are legally required to retain user data for periods ranging from six months to three years. Taken together, this points to a system in which detecting circumvention and surveilling users are the same activity. That is an inference from these sources. No source establishes that the two are formally linked.
What this means for users and providers
For users, the practical outcome is a cat-and-mouse loop. A provider replaces servers, the blocklist catches up within hours, and users move to less accountable tools. The safest options are the ones that need infrastructure a small operator cannot easily rotate. Users who fall back on free or unaudited apps take on more risk than the censorship they were dodging.
For providers, the cost curve has flipped. Replacing eight servers in five days is sustainable only for well-funded operators. Small and volunteer-run services are the ones that disappear, and that concentrates the market in a few large providers that are easier for the state to pressure.
The policy answer is not complicated. Any restriction on a communications tool should be tied to a specific, adjudicated harm, and it should not silence lawful traffic that shares an address. Russia's approach does the reverse. It treats the ability to reach information as the offence, and it accepts the collateral damage to hosting, business and ordinary users as the price. The post-election surge shows the state believes that price is acceptable. Both the ECtHR case law and the economics of open networks say it is not.