May 1, 2020 9:00 AM

The Russian Doll of Putin's Internet Clampdown

The Kremlin's path toward censorship, surveillance, and repression has many more layers than meets the eye.

One year ago today, Russian president Vladimir Putin signed into effect a major piece of digital legislation—popularly dubbed the domestic internet law. With it, Russia's internet and telecom regulator, Roskom, wrested further control of web servers, internet exchange points, and other essential web architecture. At its heart, the law included the right for Roskom to cut off the domestic internet in the event of a security incident.

The media frequently talks of the Russian government’s leading digital authoritarianism. We hear about its internet surveillance practices, its disinformation campaigns, both abroad and at home, and its efforts to replicate the Chinese government’s so-called Great Firewall in blocking political speech and restricting access to foreign news websites.

An easy conclusion from these headlines is that Russia’s path towards comprehensive state control of the internet is inevitable—an irreversible march towards censorship, surveillance, and online repression. Certainly, Russia’s internet isn’t getting any freer. But the reality of Moscow’s internet control is far more complex and far more uncertain, especially over the long-term—primarily due to challenges of technical execution.

It’s first important to have historical context. Predating modern questions of 1s and 0s in Russia is a notable history of the state controlling information creation and dissemination.

Vladimir Lenin believed strongly in molding public opinion through media control. The Communist paper Pravda, for example, wasn’t meant to provide factual reporting but—in the words of two scholars—to “convince the reader about the proper interpretation of the truth.” (Ironically, pravda means “truth” in Russian.) But where Lenin permitted some dissent in the press, Stalin virtually eliminated it, centralizing state control of radio and television broadcasters and criminalizing opposition views.

This tight-fisted approach to information flows didn’t relent after Stalin’s death. During the 1950s and onward, Soviet officials worked feverishly to keep abreast with radio news. They continued to consolidate influence over TV and the printing press. Government offices restricted access to official documents and copy machines, making it enormously difficult for even many state workers to do their jobs.

In the 1980s, there was a brief change of course as Mikhail Gorbachev instituted openness and transparency policies, or glasnost, which included limiting the Communist Party’s power and allowing a freer and more critical press. When the Soviet Union collapsed and Boris Yeltsin was elected president, the state’s grip over information further relaxed, and a free Russian press continued to blossom. Since Vladimir Putin ascended in 1999, this stopped in its tracks.

From typewriters to fax machines to Xerox copiers to radio to television, the Russian government has made a habit of working to control information flows within the country. Under Putin, the internet is no different.

In 2000, as the world recovered from Y2K panic, the Russian government published the Information Security Doctrine of the Russian Federation, citing inbound and foreign-originating information flows as a potential threat to regime stability. “Analysis of the state of information security in the Russian Federation shows that its level is not fully consistent with the requirements of society and the state,” the doctrine read. Around this time the Russian government started to bring the web into its clutches: centralizing state control of domain names, for example, and passing Order No. 130, which exempted the Federal Security Service from telling internet providers about data they were collecting.

Largely speaking, though, internet control was not matching pace with simultaneous efforts in Beijing. Even if Moscow could’ve thrown more weight behind internet filtering and control, the Kremlin arguably didn’t see cyber sovereignty issues—while undoubtedly important to certain elements of the intelligence and security services—as first-order national security priorities.

All that changed with a few major events. In 2008, online coverage of Russo-Georgian conflict highly concerned Vladimir Putin and other members of the siloviki, the military and intelligence elite. In 2010 and the couple years following, the Arab Spring’s “color revolutions” also worried Russian leadership: Blogs and social media platforms were horizontal organization tools for protesting authoritarian rule. For instance, “in Egypt in 2011, only 25 percent of the population of the country was online,” Zeynep Tufekci has written, “but these people still managed to change the wholesale public discussion.”

That such platforms were run by US firms was not lost on Vladimir Putin or his compatriots; thoughts of American conspiracy proliferated. Leaks by Edward Snowden soon thereafter, exposing US global surveillance programs, only cemented fears among top Kremlin leadership and provided further ammunition for internet crackdowns.

Since then, Russia’s legislature has passed laws criminalizing everything from counter-regime speech to information pertaining to LGBTQ individuals. Dissidents, journalists, and ordinary citizens who post kompromat—material on political and business elites that exposes activities like corruption and abuse of power—are particularly targeted. The Panama Papers would fall into this category, as their publication in 2016 exposed offshore accounts for powerful Russian figures and worsened fears about a free and open internet.

Policies to entrench state control over the internet advanced further still. Now, the state can block websites with harmful internet content, and it requires that certain data, like encryption keys, be stored within Russian borders. Russian intelligence services also built out SORM-3, an internet-monitoring hub that can log everything from IP addresses to email activity to smartphone GPS coordinates.

To many, passage of the domestic internet law in 2019 was a culmination of these events: codification of the Kremlin’s work to cement its permanent handle on the Russian web, soon to be followed by technical changes to internet architecture itself. Yet the reality is far more complicated. Where the Russian government wants to charge full-steam ahead, the train keeps hitting technical roadblocks.

For example, the roll-out of the domestic, isolated internet hasn’t gone as planned. Disconnection tests were announced and then postponed last April and again last October. Authorities claim a limited-scope test was executed last December, the outcomes of which “showed that government agencies and communications operators are ready to respond effectively to threats.” But the state’s claim that ordinary users wouldn’t have noticed the changes is grounds for skepticism.

Related to that, Moscow has also struggled to block internet traffic, like with routine failure to prevent access to the encrypted messaging application Telegram—a case study of the large gaps, sometimes overlooked, between Beijing’s internet-control capabilities and those in Moscow.

Officials attempted to firewall connections to Telegram in 2018. But collateral effects resulted, as Russian authorities inadvertently blocked access to several other sites and services as well: voice calls on the messaging service Viber, cloud apps for Volvo cars, and apps for Xiaomi video cameras. The problems originated from blocking websites based on their internet protocol address, which often affects other (nontargeted) sites hosted at the same address.

Telegram is still widely used in the country, with millions using the encrypted service to communicate with friends and share illegal or otherwise frowned-upon content, including government-critical speech, in Telegram channels. Following its ban in 2018, even multiple Kremlin officials were quoted as still using the service—not a great look for the bureaucrats charged with technologically operationalizing the ban.

In response to these issues, Moscow continues to experiment with deep packet inspection, a more fine-grained technique for internet filtering. DPI could also help effectuate the internet isolation law. Yet it remains experimental and nascent; high financial costs, technical challenges, and other bureaucratic hurdles all stand in the way of successfully using it to block apps like Telegram.

All the while, Russian citizens’ opposition to internet control continues. Some use VPNs to browse the web or spread politically sensitive information on Telegram channels. Last March, thousands of Russians protested the domestic internet law in the streets of Moscow. It was one of the largest public demonstrations in the last decade.

None of this means the Kremlin has thrown in the towel on internet control. Far from it, Putin has put growing emphasis on extending national sovereignty into the digital domain. Recently, for instance, powers were augmented for internet and media regulator Roskom, a body of snowballing importance. Russian courts, to use another example, keep fining American social media firms who don’t locally store information per Moscow orders.

Where online crackdowns have failed, offline coercion remains a viable option for the government. Journalists can still be intimidated or even killed, and bloggers can still be forced to register with the government. Telegram channel administrators, who circulate information unfavorable to the Kremlin, can still be arrested. Electronics manufacturers can still be forced to install tracking software on their devices. Other surveillance programs—i.e., the facial-recognition systems whose use is ramped up during the Covid-19 outbreak—can likewise help officials pin down citizens not toeing the line.

Envisioning digital control is one thing. Actualizing it is another matter entirely. For all Moscow’s work to strengthen its hold on the internet, some online behaviors continue to slip through the state’s fingers, and it must frequently turn to offline enforcement measures as it continues impeding online freedoms.

Politically, citizen resistance to digital control persists. Economically, questions remain about the viability of data localization policies, especially as many foreign social media companies just ignore local data storage rules. Perhaps most of all, technologically, the Russian government has many obstacles ahead to implementing a domestic internet and technically blocking access to websites and apps. Whether it can successfully pull off a technique like deep packet inspection for app blocking—and in a timely manner—is a big question with many moving parts.

The Russian government’s internet control is growing, and it’s definitely not giving up. Yet watching the future of Russia’s internet in a black-and-white light ignores these important areas of gray.

WIRED Opinion publishes articles by outside contributors representing a wide range of viewpoints. Read more opinions here. Submit an op-ed at opinion@wired.com.