Russia banning the use of VPNs

Russia appears to be banning the use of virtual private networks (VPNs) with effect from 1 November 2017 when the new bill adopted by the Russian parliament will come into force. However, the scope of the ban is unclear, since the bill so has been passed very quickly and without much consultation with the business community.

The main target of the bill are obviously notorious anonymizers like Tor. However, the ordinary business can also be affected.

One of the main questions which is yet not entirely clear is whether VPNs used by businesses would also be restricted from use. The bill contains an exemption which one can read like if there is a VPN tool used by an entity, this entity needs to define who are the users of this tool (e.g. what employees can use the tool – e.g. in an internal IT policy) and use it only for the purposes of its business. If this understanding is true, then this exemption may be useful for the business community. However, it is unclear whether the “owners of such tools” may also mean private persons or this refers to state and municipal authorities and operators of state information systems only.

Actually, the bill does not restrict the possibility of continuing to use VPNs, provided that certain conditions are met. According to the bill the prohibition to use a particular VPN would not be automatic. The bill provides for a certain procedure of restricting access to VPNs.

Roskomnadzor (the Federal Services for the Supervision in the Sphere of Communication, Information Technology and Mass Communications, which is also the Russian data protection authority) will create a register of VPNs. VPN operators would be required to register and to ensure blocking of web addresses which are contained in various registers of prohibited information (e.g. suicide websites, IP infringers, child porn websites, personal data protection infringers, etc.). If the VPN owner cooperates, then the VPN service will be allowed to continue working (except for the mentioned limitations). However, if the VPN owner rejects cooperation Roskomnadzor will request communication operators to technically block access to servers which are used by the VPN.

The above procedure is still very general. Roskomnadzor will develop more detailed procedures before 1 November 2017. Currently, it is difficult to predict how the bill will operate. We will keep monitoring the authorities for any guidance or indications on how it will be enforced in practice.