On 31 August 2026, Meduza reported, citing RBC, that Russia's Digital Development Ministry has written to hosting providers, web protection services and CDN providers. It asks them to move the IP addresses of "white list" resources into separate subnets. White lists are the sites that must stay reachable during mobile internet shutdowns. The stated aim is to stop sites without approval, including those carrying VPN advertising or other banned content, from borrowing white-listed addresses.
The problem the ministry describes is real, and it is a problem of the system's own design. Per the RBC account relayed by Meduza, sites are vetted when they connect, but can later change what they publish. The example given is a site that registers as an online store and afterwards adds a VPN advertisement.
The strongest case for the measure
A state running a whitelist has a legitimate integrity interest. If the list is meant to keep banking, government services and delivery apps working during an emergency, then a gray-market site riding the same IP range undermines the list's purpose. Shared hosting and CDNs make this worse, because one IP address can front many unrelated sites. Separating approved addresses into dedicated subnets is a technically coherent way to stop that leakage, and by itself it is a modest network-hygiene request rather than a new statute.
What the letter reveals about the architecture
The context matters more than the letter. Russia's "sovereign internet" law, Federal Statute No. 90-FZ, was passed by the State Duma on 16 April 2019, signed on 1 May 2019 and entered into force on 1 November 2019, according to the Council of Europe's audiovisual observatory. It added a chapter 7-1 to the law "On Communications", gave Roskomnadzor control over routing, and required operators to install deep packet inspection equipment. The Internet Society notes that the regulator can change traffic routing and close or reserve communication lines when an emergency is declared, and that operators must give it routing information and remote access to the equipment.
That design assumes the state can identify, at network level, what is permitted. The white-list letter is an admission that identification at the IP layer is leaky. Approval is granted to a resource at one moment, but an IP address carries no memory of the promise made when it was approved. Content is mutable; a subnet is not a guarantee.
The obvious next step is more verification: recurring content audits, more liability for hosts and CDNs, and probably more pressure on providers to police clients. The letter already routes responsibility to intermediaries. This is the pattern the open-internet community has long warned about: infrastructure providers pushed into a gatekeeping role over content they do not author.
The cost of living on a list
The white list began as an emergency device. Meduza reported on 7 August 2025 that the ministry and operators had agreed a system to keep essential services running during mobile shutdowns, at a time when the monitoring project Na Svyazi recorded at least 2,099 shutdowns in July 2025, up from 69 in May. A report by Intellinews argues the mode has since become a standing feature. It says services generally must host their servers inside Russia and block users from hiding their IP address or using proxies, and that no transparent selection process or open application route has been described. It also cites Vedomosti data that national mobile data use fell about 22% in the first half of 2026, and Vigo data showing only about 49% of mobile sessions in Moscow and its region unrestricted in July 2026.
The same report describes unreliability even for listed services: CNews found Sberbank would not load on any of the four largest operators' networks by late July, despite being on the list. A list that is opaque, unevenly implemented and now subject to subnet segregation is a fragile foundation for a modern economy.
An evidence-based reading
What can be said with confidence is limited. We have one news report of a ministry letter, via RBC, and we have not seen the letter itself. The reporting does not specify a deadline, penalties for hosts that do not comply, or how many addresses are affected. We could not reach the official texts: the rkn.gov.ru site did not respond when we tried it. Claims beyond the reported facts should be treated as inference.
Within those limits, the policy lesson is clear. Shutdown-plus-whitelist regimes create a scarce privilege: reachability. Scarce privileges attract arbitrage, which attracts enforcement, which then extends further into hosting, CDN and content decisions. Each layer of control produces the need for the next. Proportionate regulation would instead keep networks open by default and target specific harms with narrow, reviewable tools. A regime that treats connectivity itself as a permission cannot stop managing who deserves it.
What to watch
- Whether the ministry sets deadlines or sanctions for hosts and CDNs that fail to segregate addresses.
- Whether foreign CDN operators and hosts serving Russian clients are pulled into compliance.
- Whether recurring content audits of listed sites are introduced, and who performs them.
- Whether the subnet separation reduces failures like the Sberbank outage, or adds new ones.
For users and businesses, the practical conclusion is that reachability in Russia now depends on a list whose boundaries the state is still redrawing, and on intermediaries who have just been told to help redraw them.