The law banning the use of vpn services. Access zone: the law on anonymizers came into force in Russia

And although not everyone believed in such stories, the number of people who started using proxies and VPNs increased dramatically. As the owners told the BBC three services to bypass blocking, at least half of Telegram users (about 8 million people) continued to use the messenger through their services after the official blocking.

It is not yet known exactly how many people began to use circumvention tools after Roskomnadzor began massively blocking IP addresses, but on April 12, cybersecurity specialist Alexander Litreev told Vedomosti that his proxy service alone had a client base that grew from nine thousand up to one and a half million. Also, according to Kommersant, the number of entries from the territory of Russia to the TOR network has increased by 20 percent.

However, some users began to have questions: is it legal at all to use means to bypass blocking.

Mary

The question is quite reasonable, because back in November 2017, a ban on bypassing blocking via VPN, TOR and anonymizers came into force. However, it has its own nuances. This law prohibits the owners of such services from providing access to blocked resources. For refusal to obey, VPN services promised to block, which happened in early March. Then the RKN blocked 18 servers with which it was possible to use Telegram.

Can users be held liable for bypassing blocking? Not yet. The law, passed in 2017, states that the responsibility for providing access to prohibited sites lies with the "owner of the software and hardware access means", that is, the owners of VPN and proxy services. They are threatened with blocking for failure to comply with the law. As for TOR, according to experts, it is almost impossible to block it (although they are trying in Belarus).

For the average user, this law can be compared to the law banning the sale of cigarettes to minors. If a teenager buys cigarettes, the seller will be punished, not the buyer.

That ordinary users do not plan to prosecute for the use of blocking bypass services, on April 16 said the head of Roskomnadzor Alexander Zharov, who, according to him, installed a VPN on his smartphone, according to Rossiyskaya Gazeta.

When it comes to VPNs, you can't block them all. In Russia, there are hundreds of thousands of them, both commercial and self-made. Is it possible to block individual VPNs - definitely possible. We will see what they are using, whether they are massively used, whether it makes sense to restrict access to VPN. But VPN, like any other Internet program, has a set of characteristics, IP addresses.

The fact that ordinary users will not be punished for using circumvention means was also told to RIA Novosti by a lawyer and specialist in criminal law Alexey Sinitsyn.

For users, liability for the use of such services and networks is not provided for by Russian law.

Before the “war” with Telegram, the law banning blocking bypass services was generally called useless. Despite the fact that the FSB was supposed to monitor the owners of the services and suppress the provision of access to prohibited resources, in the three months since the document began its validity, the special services have never applied to Roskomnadzor with a demand to restrict the work of anonymizers, wrote

One of the priority areas of development information space The President of Russia, in a decree of May 9, 2017, called the preservation of traditionally Russian spiritual and moral values \u200b\u200band the observance of the norms of behavior based on them. To implement the planned programs, the state uses various means, including making lists of prohibited sites and obliging providers to block access to them. Recently, at the legislative level, there has been a ban on bypassing the blocking of prohibited Internet resources.

VPN ban introduction

Since November 1, 2017, Russia has a law that prohibits the use of means of bypassing blocking sites from the "black list" of Roskomnadzor. According to this Law, VPNs that provide access to prohibited resources through servers in other countries or through link changes are subject to blocking. The same applies to Tor and anonymizers, which also now cannot allow Russian users to access prohibited sites.

Amendments to the Federal Law “On Information, information technology and on the protection of information ”, prohibiting the use of VPN, were initiated by deputies Kudryavtsev, Ryzhak and Yushchenko. The FSB will monitor compliance with the Law. If it is revealed that the VPN service continues to provide access to prohibited sites, it may itself be blocked by the ISP.

According to the authors of the bill, VPN services and anonymizers should be connected to the FSIS (federal state information system), which stores the data of prohibited resources. The owners of services, networks and programs must independently block such resources.... About 100 thousand sites are ranked as unreliable, including Grani.ru, Kasparov.ru, sites of LGBT communities and opposition political groups.

VPN service owners must independently block prohibited resources

The law was adopted ambiguously: the document was criticized by Dmitry Marinichev, who is responsible for the observance of human rights in the Internet, as well as the human rights organization Amnesty International.

How the ban is executed

The text of the Law states that Roskomnadzor must send a notification to the provider with the requirement to provide data on programs and information systems that provide access to websites prohibited in Russia. Within three days, the provider must fulfill this requirement and over the next 30 days ensure the blocking of such sites. If this requirement is not met, these VPN services and anonymizers themselves will block. In addition, search engines such as Google or Yandex are prohibited from posting links to blocked resources.

Google and Yandex search engines are prohibited from posting links to blocked resources

Penalty for non-compliance

In the spring of 2018, the State Duma adopted amendments to Chapter 13 of the Administrative Code, according to which the use of different ways bypassing blocking on the Internet is now considered an administrative offense. The penalty for failure to provide Roskomnadzor with information about resources that allow bypassing locks will be (rubles):

• 10-30 thousand - for individuals;
• 50-300 thousand - for legal entities.

For search engines issuing links to prohibited sites, the amount of the fine is (in rubles):

• 5 thousand - for citizens;
• 30-50 thousand - for officials;
• 500-700 thousand - for organizations.

Video: on sanctions for violating the ban on VPN and anonymizers

How effective is the ban

It turned out to be quite difficult to implement the adopted law. Roskomnadzor stated that during the first few months of the ban, not a single request was received from the FSB and the Ministry of Internal Affairs about the revealed violation. Roskomnadzor showed some activity in April 2018, when the "war" with Telegram began and a law was passed to block this messenger and a number of other sites discrediting anyone's honor and dignity.

Among the resources banned in Russia, the blocking of which cannot be bypassed - Telegram messenger

Russia is not the first country to resort to the practice of blocking Internet resources. China has a Golden Shield program that filters content world wide web and restricting access to foreign resources. It is interesting to note that the "Golden Shield", one of the goals of which was to reduce the Western influence on the national culture, was developed by Western companies, including Yahoo, Cisco, IBM. The bans have led Chinese users to adopt VPNs and other blocking circumvention tools and use them successfully in practice. The retaliatory measures were not long in coming: in January 2017, the Beijing authorities reported on the closure of several dozen VPN services that provided access to prohibited sites.

They will not be able to copy the Chinese model of combating VPN in Russia due to its high cost and radically different topology of the Russian segment of the Internet.

Karen Ghazaryan

https://lenta.ru/news/2018/02/20/kaktak/

The ban turned out to be the use of the Tor browser to access prohibited sites

Which networks the law does not apply to

The ban on the use of blocking bypass tools does not apply to state information systems, municipal and state bodies, as well as corporate networks that have a limited number of users, the list of which is defined.

Is it safe to bypass the ban

Law No. 276-FZ dated July 29, 2017 does not mean a complete ban on VPNs, anonymizers and other similar technologies: you cannot use them to access prohibited sites. Most experts believe that the VPN ban in Russia is easy to get around for the following reasons:

• in most cases, it is impossible to determine which VPN services are used for commercial purposes and which ones are used to access prohibited resources;
• the law provides for liability for the owners of VPN services, but not for the users of these services;
• it is possible to use a double VPN when a connection is made to a server located, for example, in the USA, and through it a connection is established with a server in Germany (or any other country). At the same time, both servers work quite legally, and the user enters the site banned in Russia as a representative of the United States, where this resource is allowed;
• tor browser will work even if blocked. Tor's performance is easily restored by adding a list of constantly updated servers to it.

A few days ago, a rather important event took place - in the first reading, the State Duma of the Russian Federation adopted a bill "banning anonymizers and VPN". After the introduction of the register of prohibited sites and blocking of various resources, many wondered - how soon will the schemes bypass these blockings be banned? It turned out that it took not so much time - only some 5 years.

June 8, 2017 - it was on this day that it was officially decided to make Runet look like a Chinese network segment. Despite the fact that the law has not been formally adopted and a number of procedures must go through for its adoption, there is no doubt about the final result. Carthage will still be destroyed, and users who want something strange in the form of finding a job on LinkedIn or communicating with their clanmates on some MMORPG from South Korea in Line will not be able to do this if they wish. In general, remember this tweet (s).

So, what have the legislators prepared for us? They prepared us a bill for a couple of dozen pages entitled "On Amendments to the Federal Law" On Information, Information Technologies and Information Protection "". It was introduced by three deputies from different parties, but their and even party affiliation does not play any role. Recently, laws that, in one way or another, limit the network space, have been adopted almost unanimously.

It will take effect 90 days after its entry into force, so that a new reality after passing all 3 readings and the president's signature will come quickly enough.

How it will be

The bill introduces a new key article numbered into the law on information 15.8 ... Officially, the article bears a long and obscure title "Measures to counter the use of Russian Federation information and telecommunication networks, information systems and programs for electronic computers to gain access to information resources, including sites and (or) pages of sites on the Internet, access to which in the Russian Federation is restricted in accordance with this Federal Law. "In fact, this article describes exactly the prohibition of blocking bypass means and how this the ban is planned to be implemented.The article consists of 17 parts, written by a seasoned office clerk, so without a bottle we cannot figure it out, we have simplified everything to the terms that are used in the industry.

The first part of the article right off the bat prohibits any service that operates in Russia from providing access to information that is prohibited on the territory of Russia in accordance with the law. In order to stop attempts to circumvent the bans, a number of new functions will be entrusted to Roskomnadzor:

First, the supervisory service will create and maintain a list of resources prohibited in the country. Note that such a list is already underway, so nothing has changed in this regard.

Secondly, Roskomnadzor will have to develop and approve a methodology in accordance with which it will monitor the network space in order to search for services that offer the opportunity to gain access to blocked resources.

Thirdly, having found such resources, Roskomnadzor will have to identify the hosting providers (or any other persons) who have hosted these resources.

Fourthly, after defining hosters, requests are sent to them (in Russian and english) with the requirement to issue information that will help identify those who contain services to bypass blocking. What information we are talking about is not explained. Most likely, for individuals it will be the full name, address of residence, and the like, and for legal entities - the name of the company, location, possibly bank details. The date of such a request will be fixed.

Here we digress a little and allow ourselves to note that if hosters in Russia have to fulfill all the requirements, then foreign hosters will hardly fulfill the requirements of Roskomnadzor like this. For it is one thing when companies themselves give their data to the register of organizers of information dissemination, and quite another when a hoster will have to give out their client's data to the government of other countries. In addition to the fact that such "openness" will lead to a catastrophic decline in reputation, the hoster will violate the law on personal data of his own country.

After the hoster has received the corresponding request, he provides Roskomnadzor with all the data requested by him within the next three days. After that, Roskomnadzor, on the basis of the data received, within three days sends a request to the block bypass services themselves, demanding that they stop violations and disable the ability to bypass blocking in Russia.

Having received the requirements of Roskomnadzor about the restriction, the services to bypass the locks independently (options):

1. Restrict access of all Internet users to their functions (voluntarily close, if in a simple way).
2. Restrict access to their functions on the territory of Russia (they voluntarily ban on the Russian Internet, that is).
3. They send a statement to Roskomnadzor with a request to provide access to the register of prohibited sites and independently begin to block resources from this register.

What if we disagree?

If someone wants to show adherence to principles and refuses to comply with the requirements of Roskomndazor to block prohibited resources, then its end will be sad - he himself will be blocked on the territory of Russia in 30 days. Within 24 hours Roskomnadzor will send a message to telecom operators with a list of the "dissenting" addresses that need to be blocked. Operators, in turn, enter addresses in the block list within 24 hours after receiving such a message.

In general, the standard blocking mechanism, only this time will have to block VPN services, anonymizers and other similar sites.

We already agree, what to do?

If someone at first wanted to show integrity, but then realized that it costs him too much, he can take measures to block prohibited sites and report this to Roskomnadzor. After that, Roskomnadzor checks the accuracy of the information within 24 hours, and, if the resources are indeed blocked, starts the unblocking procedure. During the day, telecom operators will be required to provide access to the "cut" VPN.

How will the interaction go?

The procedure for interacting with VPN services, anonymizers, technological networks and other resources that will block prohibited information is to be developed by Roskomnadzor. The supervisory service will be obliged to provide access to the list of prohibited information to everyone who agrees to its requirements in accordance with the developed interaction procedure. In turn, the resources themselves will have to block prohibited information, and observe this order of interaction.

Search engines

Separate parts of the article provide for the obligations of the operator search engine... He, like block bypass services, will gain access to the list of blocked sites and will be obliged to exclude links to prohibited sites from search results. Interestingly, the punishment in the form of blocking search engines has not yet been clearly spelled out - it only applies to services to bypass blocking. So Google will remain available, unless, of course, the norm is corrected. But instead of blocking the search engines, fines were prescribed. If the operator of the search engine does not filter search results, or did not want to get access to the register of prohibited sites, this will result in the imposition of an administrative fine:

1. for citizens in the amount of five thousand rubles;
2. for officials - fifty thousand rubles;
3. for legal entities - from five hundred thousand to seven hundred thousand rubles.

Work, and we will give you your salary with a VPN!

Apparently, having heeded the warnings that VPN is used not only to read and watch "prohibited", legislators have left the opportunity to use services for companies. They, as before, will be able to use their own technologies for bypassing access denials, but only in cases where users have entered into labor agreements with them.

So now, if you want to use some kind of VPN, you will have to not only pay for access, but also conclude an employment contract with its owner. Such is the new kind business. At the same time, unemployment will decrease.

Everything has already begun

Despite the fact that the prohibition of anonymizers and VPNs has yet to be introduced into the legal field, in fact, anonymizers are already de facto prohibited. The prohibition mechanism is very simple - the prosecutor's office files a claim with the court, and the latter makes a decision to prohibit the anonymizer, since it can be used to access prohibited information. On this basis, in 2016, "Chameleon", the Hideme.ru website and a number of others were blocked.

While writing the material, another piece of news came: Roskomnadzor, the Ministry of Internal Affairs, Rospotrebnadzor and the Federal Tax Service issued an interdepartmental order that allows you to block any means of bypassing the blockages without a court decision. The justifications are also very simple - through these resources you can play in an illegal casino, which is prohibited on the territory of Russia. Officially, everything sounds like this:

The presence on the page of the site on the Internet and (or) a program for electronic computers that allow access to the site on the Internet, the page of the site on the Internet, which contains prohibited information that meets the criteria specified in paragraphs 4.1.1.-4.1.6 of these Criteria included in the Unified Register.

Naturally, everything that gives access to prohibited information, including VPN, falls under this description. Interestingly, the order itself was registered on June 27, and released on May 18. Considering that such documents are not prepared in a day, the decision to block the VPN was made much earlier.

A few days ago, the supervisory service sent out to telecom operators updated recommendations on blocking Internet resources. Nothing special from old version the recommendations do not differ, they only contain a mention of the preferred methods of blocking in the form of DPI, open source software, and the purchase of already filtered traffic from an upstream provider.

Implications for the industry

For telecom operators, the changes will be minimal. Well, a few more addresses will be added to the blocking list, no big deal. There are thousands of them already. But for Runet, as a phenomenon, everything will be much more serious. In fact, a separate space is created, in which not only it is impossible to gain access to some resources, but it is impossible even to know that these resources exist. Of course, you can argue that there are ordinary sites, forums, foreign google versions, where you can find information, links and distributions.

However, the logic of events is relentless - there should not be any prohibited information on the Runet. So the further, the poorer the Russian segment will be. One by one, foreign services will leave the market or be blocked. Just someone earlier (like Line or LinkedIn), someone later. The vacated places will start to be occupied by Russian services, which are now appearing like mushrooms after rain. We will keep silent about their quality - there is an excellent example of Sputnik, which, even with powerful competitors such as Google and Yandex, is something from the late 90s. Without the ability to fully interact with the world industry, Russian telecom and IT will degrade (even now they look disapprovingly at the successful Kaspersky), and the further, the degradation rate will increase. After all, it's all some version of "Gwangmyeong".

On the other hand, in Africa there is no Internet at all, and no one really cares about it.

The law on restrictions for anonymizers and VPN services, obliging them to block websites prohibited in Russia, has been in effect for three months. However, no service is executing it yet.

Photo: Safron Golikov / Kommersant

As a representative of the Roskomnadzor press service told RBC, to date, the agency has not sent any VPN service or anonymizer a requirement to block users' access to sites that are included in the register of prohibited information.

The provisions of the law, according to which services for bypassing blocking on the Internet, including VPNs and anonymizers, are required to restrict users' access to sites prohibited in Russia, came into force on November 1, 2017. However, which service should obey the law is chosen by the Federal Security Service (FSB) or another body that carries out operational investigative activities and ensures the security of Russia. At the initiative of law enforcement officers, Roskomnadzor should send anonymizers a request to connect to the federal state information system (FSIS), which contains information about prohibited sites, and block access to these resources. If the anonymizer does not connect to the FSIS within 30 days from the receipt of the request from Roskomnadzor, it will be blocked itself.

“As of today, applications from members of the ORD (operational search activity. - RBK) and state security regarding anonymizers and VPN services have not been reported, ”a representative of Roskomnadzor told RBC.

Schrödinger's law

The fact that the law may not work, experts said at the stage of its adoption. “Roskomnadzor does not have leverage over most VPN services, and they cannot block them for non-compliance with the law either, since Roskomnadzor does not have ready-made technical solutions for this, and the law has not yet received the relevant bylaws. Russia will not be able to copy the Chinese model of combating VPNs because of its high cost and radically different topology of the Russian segment of the Internet, ”says Karen Kazaryan, an analyst with the Russian Association for Electronic Communications (RAEC). In his opinion, about a quarter of Internet users in Russia use VPN services and anonymizers, and their number is constantly growing.

Only some anonymizers with Russian roots, such as 2ip and Chameleon, have publicly announced their readiness to comply with this law, while representatives of most foreign services initially announced that they would not obey the requirements of Russian legislation, and continue to adhere to this position. “As a company focused on protecting privacy and freedom of information on the Internet, we will continue to support users without any censorship or blocking, regardless of where they are,” a spokesman for the American VPN service ExpressVPN told RBC.

A representative of another foreign service, PrivateVPN, said that since the company is not present in Russia, the laws of the country do not apply to it. The company has a server in Russia, but it is ready to abandon it if someone forces it to do so. “We have always supported freedom of speech and the right to free access to information, to confidentiality on the Internet, and we condemn any action aimed at restricting these rights in Russia and any other country,” said a representative of the CactusVPN service.

Friend or foe

Another feature that may make it difficult to enforce the law is the massive use of VPN technology in corporate networks for work needs. For example, Internet Ombudsman Dmitry Marinichev previously adopted the bill "madness" and doubted the possibility of its implementation due to the impossibility of distinguishing which VPNs operate for commercial purposes, and which ones - to bypass Internet blocking.

The Association of European Businesses (AEB), which includes Air France, Citibank, Volvo Cars, Deutsche Bank, Nokia and several hundred other European companies, at the end of October 2017 also this law, since many companies use VPN in corporate networks.

According to the lawyer of the Roskomsvoboda project Sarkis Darbinyan, Roskomnadzor has not yet prepared by-laws with information on how personal and corporate VPN services differ. “The law says it does not apply to corporate VPNs, but there is no way to distinguish them from services used for personal needs. It is possible that the first blockages will ultimately affect the commercial and banking sectors, ”Darbinyan said.