By Lucy Papachristou
LONDON (Reuters) – When Antony Rudkovsky was about 15, he began to teach himself how to build virtual private networks (VPNs) to access Internet content unavailable in Russia.
At first, the young programmer just wanted to listen to music on the Spotify streaming app in his bedroom in Nizhny Novgorod, a city roughly 270 miles (430 km) east of Moscow.
Three years later, Rudkovsky, now 18, snagged $1,200 – the biggest share of the prize money – at a competition last month organised by a civil society group to design a VPN to evade Russia’s censors.
He’s part of a growing ecosystem of freelance programmers and VPN companies involved in what some of them describe as a “cat-and-mouse” game with authorities to bypass controls on what Russians can access online.
“I’m not a very political person by nature, but I don’t think that violating basic human freedoms – the freedom to express oneself and get information – is the right thing,” Rudkovsky said in an interview from Gdańsk, Poland, where his family moved shortly before the war began. “People will get further and further from reality.”
Reuters spoke to six programmers who are preparing for tougher blocks on VPNs in Russia, some of them employing techniques learnt from Chinese hackers’ efforts to evade the even more stringent ‘Great Firewall’ there.
Many of the programmers now work from abroad due to safety concerns: coordinating in group chats, at virtual hackathons and on collaborative web development platforms. Several would not disclose their location to Reuters, and others asked to be referred to by their first names in order to speak freely.
Russian internet regulator Roskomnadzor has been putting opposition media websites on blacklists and has banned several foreign social media platforms in a crackdown it casts as part of an information war unleashed by the West following Russia’s invasion of Ukraine in February 2022. The Kremlin accuses some Western news and social media sites of spreading negative propaganda about Russia to stoke discord in the country and ultimately overthrow the government.
VPNs create an encrypted “tunnel” through which a device can access the internet – hiding sensitive data, like a person’s location or what they’re viewing online. Demand for such services in Russia skyrocketed after Moscow’s invasion of Ukraine sent millions searching for independent information.
An estimated 33.5 million people downloaded a VPN in Russia in 2022, up from 12.6 million the year before, according to a global index maintained by Atlas VPN, a service provider.
Some programmers are gearing up for what they expect to be an era of tighter controls after President Vladimir Putin secured a mandate until at least 2030 with a landslide win at elections last month. Pro-Kremlin lawmakers want to restrict internet access further as part of a broader fight to protect what Putin refers to as Russia’s “traditional values” – based on family, nation and Orthodox Christian faith.
Kremlin spokesman Dmitry Peskov, asked about the government’s stance on the use of VPNs, said he was not aware of any planned sanctions. “Roskomnadzor is making efforts to block certain VPN services, and these efforts will continue in order to reduce the possibility to circumvent blocks,” he said.
Roskomnadzor currently blocks about 150 popular VPNs, Evgeniy Zaitsev, its head of department for control and supervision of electronic communications, was quoted by state media as saying at an internet safety forum in Moscow this week. The regulator did not respond to a request for comment for this story. It has long said it wants to eliminate VPN services altogether.
There are signs that the crackdown is gaining strength.
Last month, Russia banned the advertising of VPNs used explicitly to access “blocked or illegal content,” and Roskomnadzor has so far blocked roughly 700 webpages that spread such “propaganda”, Zaitsev said.
One Russian VPN provider as well as a civil society organisation that helps rights groups access VPNs told Reuters their clients were reporting problems with services that worked fine a year ago. Both sources asked to remain anonymous as they still have staff or exposure in Russia.
Many Russians use VPNs to access banned U.S. social media sites such as Facebook and Instagram – both owned by Meta Platforms Inc – to post photos online and keep in touch with friends and family at home and abroad.
Russia branded Meta an “extremist organisation” in 2022 after it temporarily allowed Ukrainian users to post messages in opposition to the invasion, such as “death to the Russian invaders”. Meta has defended its content policies.
While nearly all Russian-language independent media are blocked, Western news sites are not. Irina Borogan, a non-resident senior fellow at the Center for European Policy Analysis (CEPA) who co-authored a book on Russian digital censorship, said that so few Russians speak other European languages that there isn’t a need to restrict such content.
The vast majority of people who speak just Russian and don’t have a VPN can only access Kremlin-controlled news, Borogan said.
FOOLING THE CENSORS
Several programmers are building on anti-censorship tools developed in China and the United States to stay ahead of Roskomnadzor.
One developer, who asked to be referred to only by his first name, Evgeniy, has developed a simplified version of a well-known Chinese circumvention tool, Xray. His “easy-xray” application diverts web traffic to a rented server abroad via a complex process that he says masks user traffic from Roskomnadzor.
Up to 20 people at a time can comfortably share one virtual server, which users can rent for a few dollars a month, he said.
“We tested easy-xray on two servers and saw no big problems during Russian blocking,” said Evgeniy, 38. The service isn’t commercially available yet.
Much of the programmers’ work centres around strengthening what are called “protocols,” or the set of rules that govern how data is transferred from a user’s laptop or smartphone to a VPN server.
Rudkovsky’s prize-winning VPN prototype switches users between two protocols in the event one of them is blocked, essentially “detecting blocks on the go,” he said.
Vitaliy Vlasenko, a 37-year-old programmer, has designed a similar system.
It works by dozens of Internet users installing his application, which he calls a “sensor,” onto their laptops or cheap microprocessors. These “sensors” then establish connections to many kinds of protocols, so that if one is blocked, others are available for use. The more people download the “sensor,” the more robust the system.
Vlasenko moved to Thailand in June 2022 from the Siberian city of Novosibirsk, where he had volunteered for the late Russian opposition leader Alexei Navalny. Born in the Ukrainian city of Dnipro, he said he left Russia because he could no longer live in a country “that is bombing my homeland.”
Vlasenko developed the “sensors” project last year at the same online hackathon in which Rudkovsky recently participated.
Called Demhack, the hackathon gives participants three days to solve a set of challenges related to internet freedom issues. Rudkovsky won for the design of a VPN for mobile phones.
Vlasenko says more collaboration like this is needed to combat rising censorship.
“Roskomnadzor’s methods have become much more technological. Now, hackathons are needed to find a solution; a simple installation of some VPN-client will not do.”
SHARING CODE FOR GREATER GOOD
Amnezia VPN is trying to foster just such a collaboration.
One of Russia’s largest free VPN services with 200-250,000 active users, at least two-thirds of them inside Russia, Amnezia is an open-source application, meaning anyone can copy and modify its computer code to build their own projects.
“I am shocked at how much the project has grown,” said operator Mazay Banzaev. “Hundreds of IT specialists and developers began to gather around us.”
In a group chat on the Telegram app called “Amnezia VPN Development,” over 400 programmers trade dozens of messages every day, sharing lines of code copied from Amnezia’s technology to test new ideas and troubleshooting together when problems arise.
“Friends, why is there such a low incoming speed?” one programmer asked in the group chat in March, requesting help with his VPN.
Another sought assistance to configure a type of protocol onto his phone, trading messages and lines of code back and forth with a chat member for over an hour until the two had solved the problem.
Banzaev’s team is working around the clock to develop its own protocol that will disguise VPN traffic and fool censors into thinking users are surfing the web normally.
“This whole cat-and-mouse game with VPNs will lead to regulators wanting to limit communication with the outside world at all costs,” he said.
Banzaev keeps an eye on China and Iran, where internet controls are much stricter than in Russia. He believes it is only a matter of time before Moscow follows suit.
“We aren’t waiting. We have begun to develop new VPN protocols that will be stable in these new conditions,” he said.
VPN usage is criminalised in Iran, while in China the state employs an army of human censors to excise anti-Communist content and uses artificial intelligence to monitor what people view online.
Western nations have comparatively few restrictions on access to the internet, experts say, although some governments are increasingly concerned over related issues including privacy, data security and sovereignty. The United States passed legislation this week to force TikTok’s Chinese owner to sell its U.S. assets or face a ban there, amid disquiet over possible Chinese access to Americans’ data.
Unlike China, Russia didn’t impose restrictions when it first constructed its Internet architecture in the 1990s, said Andrew Sullivan, president of the Internet Society, an American advocacy group that promotes online freedoms.
“Russia has a history of pretty good connectivity,” Sullivan said. “It’s been very painful to watch the Kremlin undermining that.”
RISKS FOR RUSSIA
Six experts say Moscow’s efforts to ban all VPNs would risk harming other functionalities of the internet – at least temporarily – such as government websites for tax payments or online banking services.
“The internet wasn’t invented to be filtered, to be dissected into sovereign parts,” said Borogan of the Center for European Policy Analysis.
“So when you try to ban something or block IP addresses, it means you can disrupt the whole system.”
In contrast to Iran, Russia maintains strong connections to the global economy, despite current Western sanctions, making it potentially risky to disrupt critical online services.
Aggressive blocking could also lead to more internet blackouts, of which there have been several in Russia in recent months, said Sullivan of the Internet Society.
“Russia has become increasingly willing to tolerate this type of internet degradation if it means preventing people from accessing certain information,” he said.
Some internet freedom advocates say developers need to think beyond VPNs and build other tools to evade censorship, like encrypted messengers or web browsers.
“There won’t be a golden bullet solution for everything,” said Natalia Krapiva, tech legal counsel at Access Now, a global digital rights non-profit. “We need to be thinking long term.”
(Reporting and writing by Lucy Papachristou; Editing by Mike Collett-White and Daniel Flynn)
Comments