Russia's Internet Sovereignty Model: Technical Architecture, Geopolitical Implications, and Global Lessons

Full report

On this page

The architecture of the global internet was fundamentally designed around principles of decentralization, resilience, and open routing. Originally conceptualized to survive catastrophic node failures, the network of networks relies on mutual trust and open protocols to transmit data across borders. However, as digital infrastructure evolved into the primary medium for global commerce, political discourse, and civil mobilization, authoritarian states recognized this unrestricted flow of information as a direct threat to regime stability. Among the most sophisticated and legally comprehensive efforts to re-engineer this open architecture is the Russian Federation's pursuit of a "sovereign internet." Russia's sovereign internet model represents a paradigm shift in state-level digital control. Unlike earlier forms of censorship, which relied on crude IP blocking or pressuring private internet service providers to filter content, the Russian approach legally and physically embeds state-controlled hardware directly into the nation's critical telecommunications infrastructure. Driven by a combination of domestic control imperatives and geopolitical paranoia, this hybrid approach blends sweeping legislative mandates, localized hardware dependency, and advanced deep packet inspection technologies to grant the state granular, centralized control over a decentralized network. This report provides an exhaustive analysis of Russia's internet sovereignty model. It dissects the technical layers of the public internet to demonstrate how censorship is enacted at the infrastructure, routing, domain, and application levels. It traces the evolution of Russian legislation and examines the institutional apparatus tasked with executing this vision. By analyzing the deployment of specialized filtering hardware and comparing the Russian architecture with models in China and Iran, this report explores the critical differences between genuine cybersecurity resilience and infrastructure engineered for political information control. Finally, the analysis explores how civil society and technology providers adapt to these constraints, concluding with actionable recommendations for democratic governments seeking to secure their infrastructure without building mechanisms that could be repurposed for authoritarian censorship.

The Architecture of the Public Internet and Mechanisms of Censorship

To fully comprehend the magnitude of Russia's sovereign internet project, it is essential to understand the technical architecture of the public internet. The internet is not a single entity, but a layered stack of protocols and physical infrastructure. Censors can intervene at multiple layers, with each intervention presenting unique technical challenges, collateral damage risks, and resource requirements.

Infrastructure and Physical Cable Level

At its foundational layer, the internet relies on physical infrastructure, including fiber-optic cables, submarine lines, and terrestrial backbones. Traffic crosses national borders through international gateways and Internet Exchange Points (IXPs). At this level, a state can physically sever connections, power down IXPs, or order internet service providers (ISPs) to drop all traffic traversing international gateways. This is the ultimate kill switch. While highly effective at stopping the flow of information, it is an indiscriminate weapon that inflicts massive economic damage, disrupts banking, and halts essential services. Consequently, full infrastructural blackouts are usually reserved for extreme crises or localized suppression rather than sustained national policy. The vulnerability of this physical layer has recently been highlighted by geopolitical actors; for example, Chinese state-affiliated vessels and deep-sea submersibles have been implicated in severing critical submarine cables in the Baltic Sea, demonstrating that physical infrastructure remains a prime target for hybrid warfare and state disruption1.

ISP and Routing Level (IP and BGP)

Above the physical layer, the internet routes data packets using Internet Protocol (IP) addresses and the Border Gateway Protocol (BGP). BGP functions as the postal system of the internet, allowing different Autonomous Systems (AS)—such as ISPs, universities, and tech companies—to announce which IP addresses they control and the most efficient paths to reach them. Governments can mandate that local ISPs block requests to specific IP addresses. However, modern websites often share IP addresses through Content Delivery Networks (CDNs) or cloud hosts. Blocking a single IP to censor one dissident blog might inadvertently block thousands of unrelated commercial websites. Furthermore, a state can manipulate BGP by forcing ISPs to intentionally announce false routes for banned IP addresses, redirecting traffic meant for a foreign news site into a digital black hole or to a state-controlled warning page. Because BGP was built on trust and lacks inherent security, it is highly vulnerable to this type of route hijacking2.

The Domain Name System (DNS) Level

Humans navigate the web using domain names, which the Domain Name System (DNS) translates into machine-readable IP addresses. Historically, DNS queries were sent in cleartext, meaning they were unencrypted. State censors can easily intercept these queries and implement DNS poisoning or DNS spoofing. When a user types a banned URL, the censor’s DNS server returns a false IP address, preventing the user from reaching the actual site and effectively filtering the internet without breaking underlying connectivity.

Application and Transport Level (TLS and SNI)

When a user connects to a website, the data is typically encrypted using Transport Layer Security (TLS), preventing intermediaries from reading the contents of the communication. However, the initial connection handshake traditionally included the Server Name Indication (SNI) in cleartext, revealing the exact domain the user was requesting. Censors use Deep Packet Inspection (DPI) to monitor passing internet traffic in real-time. By reading the cleartext SNI, the DPI equipment can detect if a user is trying to access a banned site, even if it is hosted on a shared CDN IP, and sever the connection by injecting TCP Reset packets. This allows for surgical censorship without the collateral damage of broad IP blocking4.

Platform, App Store, and Hosting Level

Beyond the network itself, the modern internet relies heavily on centralized platforms and app ecosystems. Instead of technically blocking traffic, states increasingly apply legal and economic coercion against these gatekeepers. Governments threaten to fine, ban, or arrest local employees of foreign tech companies unless they remove dissident apps, delist banned websites from search results, or silence specific accounts. This pushes the burden of censorship from the state's technical infrastructure onto private corporations.

User-Account and Authentication Level

Virtually all modern digital services require account creation, often verified via a One-Time Password (OTP) sent over SMS. States that control the domestic telecommunications grid can block the delivery of international SMS OTPs. By preventing users from receiving verification codes, the state effectively blocks citizens from registering for foreign secure messaging apps or Virtual Private Networks (VPNs), forcing them onto domestic platforms where surveillance is absolute5.

Evolution of Russia's Internet Control System

The Russian internet, often colloquially referred to as the RuNet, evolved as a largely free and globally integrated network throughout the 1990s and 2000s. Unlike China, which implemented its Great Firewall at the very inception of its internet connectivity, Russia allowed organic, decentralized growth. The country features over 5,000 independent networks, many of which obtained their IP allocations directly from the Réseaux IP Européens Network Coordination Centre (RIPE NCC), the regional internet registry for Europe, the Middle East, and parts of Central Asia6. This robust, decentralized topology made retroactive censorship incredibly difficult.

The Era of Passive Surveillance: SORM

The foundational element of Russian state control was surveillance rather than censorship. The System for Operative Investigative Activities (SORM) was introduced in 1995 to monitor analog telephony, known as SORM-1. It was subsequently updated in 2000 as SORM-2 to monitor internet traffic, and again in 2016 as SORM-3 to collect metadata and monitor encrypted traffic7. Under SORM mandates, ISPs are legally required to install equipment that provides the Federal Security Service (FSB) with direct, real-time access to user communications without judicial oversight7. However, SORM is fundamentally a passive surveillance tool designed for intelligence gathering; it was not natively built to filter, block, or throttle traffic in real-time9. The installation of SORM typically relies on a network splitter or port mirroring, creating an out-of-band copy of the data for authorities while the original data continues to its destination9.

The Yarovaya Laws and Data Localization

In the mid-2010s, following domestic protests and geopolitical tensions, the Russian state began expanding its legal framework to control digital information. The 2016 Yarovaya Laws introduced sweeping data retention mandates, requiring telecommunications providers to store the metadata of all user communications for three years, and the actual content for up to six months10. Furthermore, data localization laws required companies processing the personal data of Russian citizens to store that data physically within the borders of the Russian Federation. This legislation granted domestic security services significant leverage over both domestic and international tech firms, establishing a legal precedent for state interference in private network operations10.

The Sovereign Internet Law (90-FZ) of 2019

The turning point in Russia's digital architecture was the passage of Federal Law No. 90-FZ in 2019, universally known as the Sovereign Internet Law11. The official justification presented by the Kremlin was cybersecurity resilience: the law ostensibly aimed to protect the Russian internet from external threats, specifically the hypothetical scenario of the United States or its allies disconnecting Russia from the global root servers11. In reality, the law provided the legal scaffolding for total infrastructural centralization. The legislation mandated the creation of a national Domain Name System and required all ISPs, owners of technological communication networks, and traffic exchange points to alter their physical topologies11. Most critically, the law mandated the installation of Technical Means for Countering Threats (TSPU) on the networks of all ISPs6. While ISPs physically host the TSPU equipment, they have no control over it; Roskomnadzor, the state communications regulator, manages the devices remotely6. The law grants Roskomnadzor the authority to assume centralized control over all internet routing during a declared emergency, granting the state the power to isolate the RuNet from the global internet and tightly manage internal traffic13.

The Landing Law and Hostage Diplomacy

Recognizing that much of the internet relies on foreign platforms utilizing advanced encryption that TSPU cannot always easily decipher, Russia introduced the Landing Law, which went into effect on January 1, 2022\. This legislation mandated that any foreign tech company with a daily audience of over 500,000 Russian users must establish a physical branch or representative office within the Russian Federation17. While framed as a regulatory compliance measure, the strategic utility of the Landing Law is hostage diplomacy. By requiring Apple, Google, Meta, Telegram, and others to have physical assets and local executives in Russia, the state acquired direct leverage. If a platform refuses to remove content, unblock state propaganda channels, or hand over user data, the Russian government can impose extortionate fines, arrest local employees, or degrade the platform's traffic20. This effectively shifts the burden of censorship from the state's technical hardware onto the platforms themselves, forcing them into a state of compelled compliance.

Institutional and Technical Architecture

The execution of Russia's digital sovereignty model requires a complex integration of bureaucratic institutions, private contractors, and highly specialized hardware deployments.

Roskomnadzor and the CMU SSOP

The primary executor of Russian internet censorship is Roskomnadzor. Following the 2019 Sovereign Internet Law, Roskomnadzor's mandate expanded from a regulatory body managing frequency allocations and media licenses into an active, militarized network operator7. To operationalize this new power, Roskomnadzor established the Center for Monitoring and Management of Public Communication Networks (CMU SSOP) through its subordinate agency, the Main Radio Frequency Center (GRFC)23. The CMU SSOP functions as the central nervous system of the sovereign RuNet. It is responsible for continuously monitoring routing data, identifying threats, operating the National DNS, and pushing real-time blocking commands to the thousands of TSPU devices deployed across the country2.

The TSPU Architecture: Deep Packet Inspection

The core technical enabler of Russia’s modern censorship is the TSPU. TSPU relies on sophisticated Deep Packet Inspection technology7. Unlike traditional firewalls that only look at a packet's header, DPI opens the packet to examine its payload, identifying the specific application, protocol, or content being transmitted. In contrast to the out-of-band monitoring of SORM, the TSPU is installed directly inline. Traffic must physically pass through the TSPU hardware before it can exit the ISP's network and enter the broader internet9. This active interception model allows the state to silently drop packets, throttle connections, or inject resets without the ISP's involvement. Diagram: Inline TSPU vs. Out-of-Band SORM Deployment \[End User\] \<---\> \[ISP Access Network\] \<== INLINE \> \[ TSPU (Active DPI) \] \< SPLITTER \==\> \[Global Internet / IXP\] | | v v \[Roskomnadzor / CMU SSOP\] \[FSB SORM Servers\] (Remote Management & (Passive Surveillance) Real-time Blocking) As detailed in technical literature, the system utilizes a hardware tap method. A bypass switch is integrated to fail-open, ensuring that if the TSPU hardware crashes, network traffic continues uninterrupted, thereby avoiding catastrophic internet outages9.

Hardware and Software Composition

The Russian state relies on a highly specified blend of domestic software and imported hardware to run the TSPU nodes. Investigative reports from 2023 reveal the primary components of a standard TSPU installation7:

Decentralized Deployment, Centralized Control

Academic analyses of the TSPU network, such as those conducted by the Censored Planet project, have characterized the Russian architecture as a model of decentralized deployment, centralized control8. Because Russia’s internet evolved organically with thousands of ISPs, building a massive centralized border firewall was architecturally impossible without severely degrading network performance. Instead, Roskomnadzor deployed over 6,000 TSPU devices deep within the edges of individual ISP networks8. While the hardware is geographically and topologically decentralized, the control plane is strictly centralized at the CMU SSOP. This allows Roskomnadzor to bypass uncooperative ISPs entirely. The regulator can unilaterally inject blocking rules, throttle specific services, or partition specific geographic regions without ever issuing a takedown request to the ISP itself. Failure to install these devices now results in severe fines and the revocation of ISP operating licenses2.

Advanced Filtering, Protocol Fingerprinting, and Routing Manipulation

With the TSPU network fully operational, the Russian state has moved beyond simple URL blocking into dynamic traffic shaping, protocol fingerprinting, and application throttling, demonstrating a sophisticated approach to information control.

Throttling and Application Degradation

Rather than outright blocking a popular service—which can provoke widespread public backlash and economic disruption—Roskomnadzor frequently utilizes TSPU to throttle traffic. By intentionally dropping a high percentage of packets associated with a specific service, the DPI system makes the application frustratingly slow and practically unusable. This tactic was famously used against Twitter in 2021 and has been documented by network measurement organizations like OONI in the systematic throttling of YouTube26. Throttling serves a strategic dual purpose: it suppresses the dissemination of unapproved information while plausible deniability is maintained, allowing the government to blame the foreign company for poor server performance or a refusal to pay for local CDN caching.

Protocol Fingerprinting and the ECH Conflict

As censorship deepened, Russian citizens increasingly turned to Virtual Private Networks to bypass the TSPU filters. In response, Roskomnadzor weaponized the DPI capabilities of the TSPU to fingerprint and block common VPN protocols like OpenVPN, IPsec, and standard WireGuard. Because these protocols have distinct cryptographic handshake signatures and static packet sizes, the TSPU can identify and sever the connections even if it cannot read the encrypted payload4. A more severe escalation occurred in late 2024 regarding Transport Layer Security. In standard TLS 1.2 and earlier iterations of TLS 1.3, the Server Name Indication is sent in plaintext, allowing TSPU to see exactly which website a user is visiting. To enhance global privacy, Cloudflare and other major tech entities began widely deploying Encrypted Client Hello (ECH)29. ECH encrypts the SNI, blinding DPI boxes and preventing censors from distinguishing between a connection to an innocuous commercial site and a banned opposition news portal hosted on the same CDN30. Recognizing that ECH would effectively neutralize the TSPU's ability to surgically block content on shared infrastructure, Roskomnadzor took aggressive action. In late 2024, the regulator blanket-blocked thousands of Cloudflare-hosted websites utilizing ECH32. The state issued directives demanding that Russian website operators disable ECH or migrate to domestic CDNs, framing the privacy technology as a violation of Russian law33. This action demonstrates that authoritarian regimes will willingly sacrifice network efficiency and broader cybersecurity to maintain information dominance.

BGP Manipulation and the Sovereign RPKI

The routing layer of the internet represents a unique vulnerability for authoritarian states seeking autonomy. If a malicious actor announces a false route, traffic can be hijacked. To combat this globally, the internet community relies on Resource Public Key Infrastructure (RPKI), a cryptographic method of verifying that an Autonomous System is authorized to announce a specific IP prefix2. RPKI certificates are issued by Regional Internet Registries, such as the RIPE NCC2. However, reliance on a European entity for cryptographic routing trust is fundamentally incompatible with Russia's sovereign internet doctrine. This geopolitical tension was exacerbated following Russia's invasion of Ukraine, when Russian telecommunications entities expropriated IP address blocks belonging to Ukrainian ISPs in occupied territories. Because RIPE NCC adheres to European laws and neutrality principles, it froze the registration of these stolen resources, sparking severe friction with the Russian state and exposing Russia's reliance on external governance38. In response, Roskomnadzor announced the creation of a domestic RPKI infrastructure, allocating 59 billion rubles to modernize its systems by 20302. By acting as its own certificate authority for IP routing, Russia seeks to usurp the RIPE NCC’s authority within its borders2. This domestic RPKI system is designed to allow the CMU SSOP to centrally validate or invalidate routes. This serves two strategic purposes: it protects the sovereign RuNet from external BGP hijacking attacks, and it provides the state with an unchallengeable, cryptographic mechanism to enforce its own internal route hijackings and digital blockades, further fragmenting the global internet into a localized splinternet2.

Comparative Analysis of Authoritarian Internet Models

Russia's sovereign internet is just one paradigm of digital authoritarianism. Comparing it to the models employed by the People's Republic of China and the Islamic Republic of Iran reveals distinct architectural, strategic, and philosophical approaches to network control42.

China: The Great Firewall

China's Great Firewall (GFW) is characterized by massive centralization at a limited number of international exchange points. Because the GFW was constructed as the Chinese internet grew, the state never had to retroactively corral thousands of independent ISPs. The GFW relies on an enormous human workforce combined with highly sophisticated DPI, active probing (where the firewall dynamically connects to suspected VPN servers to test their behavior), and strict keyword filtering. Recent analyses indicate that even advanced Chinese Large Language Models are subjected to strict, character-level keyword filtering rather than semantic analysis, demonstrating the rigid, pervasive nature of the system across all new technologies5. Furthermore, China extends its control to the physical layer, actively testing deep-sea cable cutting devices and operating vessels implicated in severing international submarine infrastructure, indicating a willingness to physically degrade global connectivity1.

Iran: The National Information Network

Iran’s internet sovereignty is defined by its National Information Network (NIN), a state-controlled intranet explicitly designed to insulate the regime from civil unrest and foreign cyber operations44. The NIN operates on a hybrid model of a bifurcated internet. Domestic internet traffic is highly subsidized—sold at a 50% discount compared to international traffic—creating an economic incentive for citizens to remain within the monitored digital borders44. When protests erupt, Iran does not merely block websites; it executes a staged infrastructural shutdown. Recent data from the 2025 Iranian shutdowns revealed that rather than withdrawing BGP routes—which instantly alerts global network monitors—Iran enforces forwarding-plane null-routing at its highly centralized borders, combined with strict protocol whitelisting5. Furthermore, Iran weaponizes account recovery by blocking international SMS OTPs, preventing citizens from activating circumvention tools and forcing them onto the domestic Siam surveillance architecture5. While Russia uses DPI to surgically remove unwanted content from a largely connected internet, Iran uses the NIN as a digital fortress, willingly severing international ties to ensure regime survival5.

Asymmetric Power Dynamics: Government Control vs. Individual Autonomy

The transition from a decentralized internet to a sovereign, centralized network fundamentally alters the balance of power between the state and the individual. Historically, the internet favored the asymmetric power of the individual; a lone dissident with a blog could reach millions, and the decentralized nature of routing meant that if a government attempted to block a site, traffic would simply find a route around the damage. The sovereign internet model reverses this asymmetry. By placing DPI hardware inline at the ISP level and centralizing command at the CMU SSOP, the state eliminates the structural advantages of decentralization9. This technological dominance breeds a profound psychological impact, leading to pervasive self-censorship49. When citizens know that SORM-3 is retaining their metadata and TSPU is filtering their real-time requests, the perceived risk of engaging in prohibited digital behavior skyrockets8. The state does not need to arrest every dissident; it merely needs to automate the friction of accessing independent information to a level that exhausts the average citizen. Furthermore, by passing the Landing Law, the state extends this power asymmetry to multinational corporations. By holding local executives hostage to exorbitant fines and the threat of criminal prosecution, the state coerces platforms with billions of dollars in resources into acting as proxy enforcers of state censorship, effectively deputizing the private sector in the restriction of civil liberties20.

Adaptations, Evasion, and the Censorship Arms Race

Despite the overwhelming resources of the state, censorship is essentially a continuous arms race. Citizens, researchers, and technology companies continually adapt to sovereign internet architectures, developing tools that exploit the technical limitations of state hardware.

Conceptual Evasion Mechanisms

While TSPU systems are highly capable, they are fundamentally bounded by the rules of network protocols. Because the TSPU must process millions of packets per second, it cannot afford to hold and reassemble every single packet to read its full context without introducing catastrophic latency. Circumvention tools like Zapret or GoodbyeDPI operate on this exact vulnerability4. These tools are not VPNs; rather, they manipulate the packets leaving the user's computer. By fragmenting packets at specific byte intervals, altering the case of HTTP headers, or manipulating the TCP window size, these tools trick the TSPU's DPI engines4. The DPI box sees fragmented, seemingly nonsensical data and allows it to pass, whereas the destination server, which has the resources to reassemble the packets, correctly interprets the request. For encrypted tunneling, traditional VPNs are easily fingerprinted by their static packet sizes and predictable handshake sequences. To evade this, developers have created obfuscated protocols. Tools like AmneziaWG modify the standard WireGuard headers to avoid signature detection28. More advanced frameworks like XRAY or XTLS Reality completely camouflage the proxy connection, making the VPN traffic statistically indistinguishable from a standard, innocuous TLS connection to a permitted website28. During the 2025 Iranian shutdowns, measurement data showed that while standard Tor usage collapsed, tools utilizing multi-protocol architectures and dynamic A/B testing of port obfuscation successfully sustained millions of concurrent users, proving that adaptable software can circumvent even highly centralized hardware controls5.

The Corporate Dilemma

For international technology companies, operating in a sovereign internet environment forces a stark choice between compliance and total exit. When Cloudflare rolled out Encrypted Client Hello, it fundamentally prioritized global user privacy over compliance with Russian DPI mandates29. By refusing to disable ECH globally, Cloudflare forced Roskomnadzor to choose between blocking vast swaths of the commercial internet or allowing secure connections to persist33. While Russia chose to block the ECH traffic, this dynamic highlights that widespread adoption of privacy-by-default protocols raises the economic and technical cost of censorship for authoritarian regimes, forcing them to inflict collateral economic damage upon themselves to maintain control34.

Technical and Legal Design Choices Impacting Censorship

The ease or difficulty of implementing a sovereign internet depends entirely on the underlying technical and legal design of the network. Design Choices that Facilitate Censorship:

• Cleartext Protocols: Protocols that transmit metadata in the clear, such as unencrypted DNS or standard SNI, allow DPI boxes to easily identify and block specific traffic flows without decrypting the payload.
• Centralized Gateways: A network architecture that relies on a handful of international IXPs creates natural chokepoints where state hardware can be easily deployed.
• Data Localization Laws: Legal requirements forcing companies to store data domestically grant the state immediate physical leverage over the network and its operators10.
• Domestic CDNs and DNS: Relying on state-controlled Content Delivery Networks and National DNS infrastructure allows the state to silently manipulate traffic routing and resolve queries to state-approved IP addresses.

Design Choices that Hinder Censorship:

• Encrypted Metadata: Technologies like ECH, DNS over HTTPS (DoH), and Oblivious HTTP encrypt the routing metadata, blinding DPI systems and forcing censors to block entire IP ranges if they wish to censor a specific site30.
• Decentralized Infrastructure: A diverse ecosystem of independent ISPs, coupled with decentralized cloud hosting and peer-to-peer networks (like the Ceno Browser, which saw significant growth during Iranian blackouts), creates a resilient topology that is difficult to centrally throttle5.
• Obfuscated Proxies: Open-source development of protocols like XTLS that mimic standard web traffic severely degrades the efficacy of state protocol fingerprinting28.

Cybersecurity Resilience vs. Political Information Control

Authoritarian states universally justify the construction of sovereign internets under the guise of national security and cybersecurity resilience. The argument posits that centralized control over routing, such as a domestic RPKI, and physical infrastructure protects the nation from foreign cyberattacks, Distributed Denial of Service campaigns, and the threat of being disconnected by hostile foreign powers2. However, technical analysis reveals a stark difference between genuine cybersecurity resilience and infrastructure engineered for information control. Genuine resilience is built on decentralization, redundancy, and cryptographic trust frameworks maintained by independent bodies like the Internet Engineering Task Force and Regional Internet Registries3. Russia’s sovereign internet achieves the exact opposite. By forcing all traffic through state-controlled TSPU bottlenecks and centralizing BGP routing commands at the CMU SSOP, the state is introducing massive single points of failure9. If the CMU SSOP is compromised, or if a centralized routing update contains a critical error, the entire national network can cascade into failure. Furthermore, mandating the removal of privacy protocols like ECH natively weakens the cryptographic security of the entire population, leaving citizens, businesses, and government entities more vulnerable to interception by both domestic cybercriminals and foreign intelligence services31. The architecture is not designed to protect the network from external failure; it is designed to protect the regime from internal discourse.

Policy Recommendations for Democratic Governments

The proliferation of the sovereign internet model poses a strategic threat to the open, interoperable global internet. Democratic governments must navigate a complex path: they must secure their own critical infrastructure against legitimate hybrid warfare and cyber threats without inadvertently building the legal or technical mechanisms of a centralized censorship kill switch54.

1. Preserve Decentralization in Infrastructure Policy: True cybersecurity resilience comes from decentralized, redundant networks. Governments should incentivize diverse ISP markets, multiple international cable landings, and decentralized IXPs. Legislation that mandates centralized routing chokepoints, internet kill switches, or state-managed DPI under the guise of national security must be categorically rejected, as these architectures are mathematically indistinguishable from censorship tools and inevitably lay the groundwork for future misuse54.

2. Safeguard Global Internet Governance Institutions: Authoritarian regimes are actively attempting to undermine independent, multi-stakeholder bodies like the Regional Internet Registries. Democracies must robustly defend the neutrality of RIRs, such as the RIPE NCC, to ensure that IP addressing and BGP routing remain governed by technical consensus, not geopolitical extortion38. Sanctions policies should be carefully crafted to avoid inadvertently forcing RIRs to balkanize the IP registry system, which only empowers the sovereign internet narratives of authoritarian states38.

3. Promote and Standardize Privacy-Enhancing Protocols: Democratic states and standard-setting bodies should accelerate the universal adoption of protocols that defeat DPI and metadata surveillance by default. Technologies like TLS 1.3, Encrypted Client Hello, and DNS over HTTPS strip censors of the visibility required to surgically block content30. If privacy is heavily baked into the foundational protocols of the internet, authoritarian states are forced to choose between complete isolation, which is economically devastating, or accepting the free flow of information.

4. Resist Data Localization and Landing Law Frameworks: Democracies must push back against the normalization of data localization and mandatory physical presence laws. Trade agreements and international tech policy should penalize states that use physical hostage diplomacy to coerce technology companies into enforcing state censorship10.

5. Support Open-Source Circumvention Research: Rather than engaging in an unwinnable game of whack-a-mole with authoritarian firewalls, funding should be directed toward the continuous development of obfuscated protocols and packet-manipulation tools. By supporting the academic and open-source communities that build tools like XTLS and GoodbyeDPI, democracies ensure that citizens trapped behind digital iron curtains maintain asymmetric technical leverage against state censorship4.

Works cited

1. The Internet Is Fragmenting \- Most of the People Who Should Notice, https://circleid.com/posts/the-internet-is-fragmenting-most-of-the-people-who-should-notice-arent-looking

2. Autonomous Sovereign Internet in Russia \- TAdviser, https://tadviser.com/index.php/Article:Autonomous\_Sovereign\_Internet\_in\_Russia

3. Internet Way of Networking Use Case: Interconnection and Routing, https://www.internetsociety.org/resources/doc/2020/internet-impact-assessment-toolkit/use-case-interconnection-and-routing/

4. GoodbyeDPI: Deep Packet Inspection circumvention utility, https://news.ycombinator.com/item?id=32199468

5. Findings \- circumvention-corpus \- Lantern, https://corpus.lantern.io/findings/

6. Russia's 'Sovereign Internet' Law \- Internet Society, https://www.internetsociety.org/resources/internet-fragmentation/russias-sovereign-internet-law/

7. Russia's Sovereign RuNet – A Challenge to the Cybercrime, https://www.cybercrimediaries.com/post/russia-s-sovereign-runet-a-challenge-to-the-cybercrime-underworld

8. Russia: Freedom on the Net 2023 Country Report, https://freedomhouse.org/country/russia/freedom-net/2023

9. Russia's ICT-infrastructure and its development prospects in the, https://puolustusvoimat.fi/documents/1951253/2815786/15\_Niskanen.pdf/cbaf50be-e7b8-6802-7c57-495c52943a9c?t=1696849366521

10. Russia: Growing Internet Isolation, Control, Censorship, https://www.hrw.org/news/2020/06/18/russia-growing-internet-isolation-control-censorship

11. Main changes in Russian IT legislation in 2019, https://sila.ru/ch/content/main-changes-russian-it-legislation-2019

12. Sovereign Internet Law \- Wikipedia, https://en.wikipedia.org/wiki/Sovereign\_Internet\_Law

13. Deciphering Russia's “Sovereign Internet Law” \- dgap.org, https://dgap.org/en/research/publications/deciphering-russias-sovereign-internet-law

14. RuNet Law: New Russian Law Could Significantly Impact Telecom, https://www.globalprivacyblog.com/2019/05/runet-law-new-russian-law-could-significantly-impact-telecom-and-internet-providers-and-social-media-platforms/

15. Russia: Freedom on the Net 2019 Country Report, https://freedomhouse.org/country/russia/freedom-net/2019

16. Runet 2025: Sovereignization and Degradation \- RKS Global, https://rks.global/files/research/censorship\_review\_2025\_en.pdf?v=2

17. \#LeaveRussia: Telegram is Doing Business in Russia as Usual, https://leave-russia.org/telegram

18. Guide to Russia internet censorship (2026) | VPN Russia \- Stay secure, https://proprivacy.com/guides/russia-privacy

19. Law on Landing in Russia (Digital Residency) \- TAdviser, https://tadviser.com/index.php/Article:Law\_on\_Landing\_in\_Russia\_(Digital\_Residency)

20. Big Tech in Spotlight as Russia Censors News of Ukraine War, https://www.etcentric.org/big-tech-in-spotlight-as-russia-censors-news-of-ukraine-war/

21. Russia: Internet companies must challenge 'landing law' censorship, https://www.article19.org/resources/russia-internet-companies-must-challenge-censorship-under-new-law/

22. Apple's Russia's App Store :: Apple Censorship Report, https://reports.applecensorship.com/russia/apple-russia-app-store/

23. Public Communication Network Monitoring and Management Center, https://tadviser.com/index.php/Company:Public\_Communication\_Network\_Monitoring\_and\_Management\_Center

24. RUSSIA: Internet censorship and freedom of religion or belief, https://www.forum18.org/archive.php?article\_id=2934

25. Russia: Freedom on the Net 2024 Country Report, https://freedomhouse.org/country/russia/freedom-net/2024

26. Internet censorship in Russia \- Wikipedia, https://en.wikipedia.org/wiki/Internet\_censorship\_in\_Russia

27. Viral invasion: Russia restricts Twitter usage with eyes on Facebook, https://www.cityam.com/viral-invasion-russia-restricts-twitter-usage-with-eyes-on-facebook-next/

28. Let me explain the situation with the internet and bypassing blocks., https://www.reddit.com/r/Neurath/comments/1ofz1hs/%D0%BF%D0%BE%D1%8F%D1%81%D0%BD%D1%8F%D1%8E\_%D0%B7%D0%B0\_%D1%81%D0%B8%D1%82%D1%83%D0%B0%D1%86%D0%B8%D1%8E\_%D1%81\_%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82%D0%BE%D0%BC\_%D0%B8\_%D0%BE%D0%B1%D1%85%D0%BE%D0%B4%D0%BE%D0%BC/?tl=en

29. The systematic suppression of independent media in Russia | OONI, https://ooni.org/post/2024-russia-report/

30. Cloudflare confirms Russia restricting access to services amid free, https://therecord.media/cloudflare-russia-restricting-access-crackdown

31. Russia Blocks Encrypted Messaging App Signal | PCMag, https://www.pcmag.com/news/russia-blocks-encrypted-messaging-app-signal

32. Risky Biz News: Russia blocks Cloudflare ECH connections, https://news.risky.biz/risky-biz-news-russia-blocks-cloudflare-ech-connections/

33. Russia's internet watchdog blocks thousands of websites that use, https://therecord.media/russia-blocks-thousands-of-websites-that-use-cloudflare-service

34. THE CHOKEPOINT STRATEGY — How Russia Is Squeezing, https://therealistjuggernaut.com/2025/07/01/the-chokepoint-strategy-how-russia-is-squeezing-cloudflare-and-the-free-web-from-the-inside-out/

35. Russia's Internet censor demands a break from Cloudflare after the, https://meduza.io/en/news/2024/11/08/russia-s-internet-censor-demands-a-break-from-cloudflare-after-the-american-company-enabled-new-privacy-tools-last-month

36. Cloudflare in Russia 2026: Blocks, Risks, and What Site… \- Enterno.io, https://enterno.io/en/articles/cloudflare-in-russia

37. RIPE NCC \- Russia Country Report, https://labs.ripe.net/media/documents/Russia\_Report\_Apr2019.pdf

38. Weaponization of stolen IP addresses \-- how Russia is exploiting, https://www.ukrinform.net/rubric-ato/4062588-weaponization-of-stolen-ip-addresses-how-russia-is-exploiting-ukrainian-digital-resource-in-its-war-against-ukraine.html

39. The RIPE NCC and Ukraine/Russia, https://www.ripe.net/membership/member-support/the-ripe-ncc-and-ukraine-russia/

40. An Open Internet Remains the Goal | RIPE Labs, https://labs.ripe.net/author/hans\_petter\_holen/an-open-internet-remains-the-goal/

41. Russia and the "Internet Disconnection" \- Ipregistry, https://ipregistry.co/blog/russia-internet-disconnection

42. Information Control in Comparison: Iran, China, Russia, North Korea, https://www.kriegsberichterstattung.com/id/21125/information-control-in-comparison-iran-china-russia-north-korea-how-authoritarian-states-track-isolate-and-control-information/

43. Bridging Barriers: A Survey of Challenges and ... \- Mailing Lists, https://lists.torproject.org/pipermail/anti-censorship-team/attachments/20240801/c546f158/attachment-0001.pdf

44. Anatomy of Iran's Internet \- Ryan Bagley, https://rb.ax/blog/anatomy-of-irans-internet/

45. The Digital Iron Curtain: How Iran Built the World's Most Invasive, https://myprivacy.blog/the-digital-iron-curtain-how-iran-built-the-worlds-most-invasive-surveillance-state/

46. The Russian Sovereign Internet and Number Resources \- RIPE Labs, https://labs.ripe.net/author/alexander-isavnin/the-russian-sovereign-internet-and-number-resources/

47. Iran: Freedom on the Net 2024 Country Report, https://freedomhouse.org/country/iran/freedom-net/2024

48. Iran's Internet Kill Switch: Regime Survival Through Digital Isolation, https://www.gotechinsights.com/blog/iranskillswitch

49. Censorship Without Borders: Deconstructing the Myth of West vs. East, https://navid-yousefian.medium.com/censorship-without-borders-deconstructing-the-myth-of-west-vs-east-18a4024ffa97

50. The Digital Redoubt: Iran's National Information Network and the, https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict/

51. A Multi-Perspective Study of the Internet Shutdown in Iran \- arXiv, https://arxiv.org/html/2605.00187v1

52. T-Mobile Russia VPN blocking survey: protocol survival ... \- Elrise, https://elrise.io/reports/t-mobile-vpn-blocking-survey-2026-07-28

53. Android 17 Hides Which Sites You Visit From Your ISP \- Gblock, https://www.gblock.app/articles/android-17-ech-encrypted-client-hello-2026

54. United States: Freedom on the Net 2021 Country Report, https://freedomhouse.org/country/united-states/freedom-net/2021

55. Write. Share. Ignite. \- KONSTANTINOS KOMAITIS, https://www.komaitis.org/write-share-ignite.html

56. The Myths and Realities of the Internet Kill Switch \- SMU Scholar, https://scholar.smu.edu/cgi/viewcontent.cgi?article=1173\&context=scitech