On September 24, 2026, Human Rights Watch published a report on Russia's escalating campaign against censorship-circumvention tools. It says authorities had blocked at least 469 VPNs under the 2017 VPN law by February 2026. In August 2026, bulk IP blocking disrupted 20 VPN providers. In April, the Ministry of Digital Development told more than 20 major internet companies to detect and deny access to users connecting through VPNs. HRW estimates that about 57 million Russians, roughly 40% of the population, use them. That makes this a mass-market fight, not a niche one.
The strongest case for the state
The Russian government's argument deserves a fair statement. Every state has a legitimate interest in enforcing its own laws online. If content is illegal under domestic law, a tool that lets everyone bypass the block makes enforcement optional. Governments also worry about resilience: a country whose traffic depends on foreign infrastructure is exposed to outages and sanctions. The stated rationale for the 2019 sovereign internet law was that the Russian internet should keep working under external threat.
That case is coherent. It is also not what the record shows.
What the law actually built
Federal Law 90-FZ of 1 May 2019 was approved by the Duma on April 16, signed on May 1 and in force from November 1, 2019, according to the Council of Europe's audiovisual observatory summary. The published text requires internet access providers to install "technical means to counter threats" and lets the federal oversight body carry out "centralized management of the public communications network" when it decides a threat to stability, security or integrity exists. The Council of Europe summary adds that the equipment is deep-packet-inspection hardware supplied to providers at no cost, and that Roskomnadzor decides what counts as a threat.
That is a resilience mandate in name and a control architecture in function. A network that can be centrally steered can be centrally filtered. Roskomnadzor did not need to invent new machinery to block VPN protocols at scale; the machinery was already installed inside operator networks.
Layer upon layer
The legal stack has grown around that hardware. Federal Law 276-FZ, adopted on July 29, 2017 and effective November 1, 2017, required VPNs and other "anonymisers" to restrict access to sites banned in Russia. Roskomnadzor could block any that refused, and operators had to comply, as Gowling WLG's analysis describes. That law did not ban VPN use outright. Its logic was a compliance regime.
HRW's report describes what came after. In 2025, VPN advertising was banned, fines were introduced for "intentionally" searching for extremist content, and VPN use became an aggravating circumstance for certain crimes. In February 2026, Google was fined 22.8 million rubles (about $300,000) for failing to remove VPN apps. In March 2026, Apple removed several VPN apps after Roskomnadzor demands. According to HRW, Apple told the organization in July 2026 that it must "follow the law everywhere we operate" and that non-compliance could cost it the ability to run the App Store in Russia.
The move from "VPNs must filter" to "companies must detect VPN users" is the significant step. The April order reportedly also involved collecting data on client VPN use. Detecting VPN traffic means observing which citizens are trying to avoid observation.
Collateral damage is the design
Bulk IP blocking is a blunt tool. HRW describes blocking of entire subnets allocated by hosting providers, which sweeps in unrelated services sharing the address space. The June action against Amnezia VPN combined bulk IP blocking with phishing of employees and DDoS attacks, and restoring service took about a month and a half, according to HRW. When a regulator responds to an evasion tool with attacks on its staff and hosting, it has moved beyond enforcement of a content rule.
The proportionality problem is straightforward. VPNs are used for privacy from criminals, for remote work, for protecting sources, and for reaching lawful foreign services. A regime that treats the tool itself as the offence cannot separate these uses. HRW cites the 2015 UN Special Rapporteur on freedom of opinion and expression, who said anonymity and encryption are key for freedom of opinion and expression.
A pro-innovation reading
There is also an economic cost. Firms cannot build reliable services on a network where any provider might be dropped by subnet, where app stores delist tools at a regulator's request, and where platforms must profile their own users' connections. Russia's approach substitutes discretionary permission for predictable rules, which is corrosive to any digital sector. The lesson for other governments tempted by "sovereignty" legislation is that resilience and control are different goals. Resilience means redundancy, open peering and multiple exchange points. Control means a single switch.
Proportionate alternatives exist: targeted, court-reviewed orders against specific unlawful content, with narrow remedies and published criteria. They do not require every operator to run state-supplied inspection devices.
What to watch
The open question is whether Apple, Google and other platforms keep complying as demands escalate. Each removal legitimises the next demand. The 469-VPN figure is an as-of-February count, and the August disruptions suggest the pace has not slowed. As long as the 2019 infrastructure stays in place, the practical limit on blocking is political appetite, not technical capacity.