How the Kremlin tightened control over Russians’ online lives after invading Ukraine

Since the start of Russia’s war on Ukraine in late February 2022, Russian internet users have experienced what has been dubbed the descent of a “digital iron curtain.”

Russian authorities blocked access to all major opposition news sites, as well as Facebook, Instagram, and Twitter. Under the new draconian laws purporting to combat fake news about the Russian-Ukrainian war, internet users have faced administrative and criminal charges for allegedly spreading online disinformation about Russia’s actions in Ukraine. Most Western technology companies, from Airbnb to Apple, have stopped or limited their Russian operations as part of the broader corporate exodus from the country.

Many Russians downloaded virtual private network software to try to access blocked sites and services in the first weeks of the war. By late April, 23% of Russian internet users reported using VPNs with varying regularity. The state media watchdog, Roskomnadzor, has been blocking VPNs to prevent people from bypassing government censorship and stepped up its efforts in June 2022.

Although the speed and scale of the wartime internet crackdown are unprecedented, its legal, technical, and rhetorical foundations were put in place during the preceding decade under the banner of digital sovereignty.

Digital sovereignty for nations is the exercise of state power within national borders over digital processes like the flow of online data and content, surveillance and privacy, and the production of digital technologies. Under authoritarian regimes like today’s Russia, digital sovereignty often serves as a veil for stymieing domestic dissent.

Digital sovereignty pioneer

Russia has advocated upholding state sovereignty over information and telecommunications since the early 1990s. In the aftermath of the Cold War, a weakened Russia could no longer compete with the U.S. economically, technologically, or militarily. Instead, Russian leaders sought to curtail the emergent U.S. global dominance and hold on to Russia’s great power status.

They did so by promoting the preeminence of state sovereignty as a foundational principle of international order. In the 2000s, seeking to project its great power resurgence, Moscow joined forces with Beijing to spearhead the global movement for internet sovereignty.

Despite its decades-long advocacy of digital sovereignty on the world stage, the Kremlin didn’t begin enforcing state power over its domestic cyberspace until the early 2010s. From late 2011 to mid-2012, Russia saw the largest series of antigovernment rallies in its post-Soviet history to protest Vladimir Putin’s third presidential run and fraudulent parliamentary elections. As in the antiauthoritarian uprisings in the Middle East known as the Arab Spring, the internet served as a critical instrument in organizing and coordinating the Russian protests.

Following Putin’s return to the presidency in March 2012, the Kremlin turned its attention to controlling Russian cyberspace. The so-called Blacklist Law established a framework for blocking websites under the guise of fighting child pornography, suicide, extremism, and other widely acknowledged societal ills.

However, the law has been regularly used to ban sites of opposition activists and media. The law widely known as the Blogger’s Law then subjected all websites and social media accounts with over 3,000 daily users to traditional media regulations by requiring them to register with the state.

The next pivotal moment in Moscow’s embrace of authoritarian digital sovereignty came after Russia’s invasion of eastern Ukraine in the Spring of 2014. Over the following five years, as Russia’s relations with the West worsened, the Russian government undertook a barrage of initiatives meant to tighten its control over the country’s increasingly networked public.

The data localization law, for example, required foreign technology companies to keep Russian citizens’ data on servers located within the country and thus easily accessible to the authorities. Under the pretext of fighting terrorism, another law required telecom and internet companies to retain users’ communications for six months and their metadata for three years and hand them over to authorities upon request without a court order.

The Kremlin has used these and other legal innovations to open criminal cases against thousands of internet users and jail hundreds for “liking” and sharing social media content critical of the government.

The Sovereign Internet Law

In April 2019, Russian authorities took their aspirations for digital sovereignty to another level with the so-called Sovereign Internet Law. The law opened the door for abuse of individual users and isolation of the internet community as a whole.

The law requires all internet service providers to install state-mandated devices “for counteracting threats to stability, security, and the functional integrity of the internet” within Russian borders. The Russian government has interpreted threats broadly, including social media content.

For example, the authorities have repeatedly used this law to throttle the performance of Twitter on mobile devices when Twitter has failed to comply with government requests to remove “illegal” content.

Further, the law establishes protocols for rerouting all internet traffic through Russian territory and for a single command center to manage that traffic. Ironically, the Moscow-based center that now controls traffic and fights foreign circumvention tools, such as the Tor browser, requires Chinese and U.S. hardware and software to function in the absence of their Russian equivalents.

Lastly, the law promises to establish a Russian national Domain Name System. DNS is the global internet’s core database that translates between web names such as theconversation.com and their internet addresses, in this case 151.101.2.133. DNS is operated by a California-based nonprofit, the Internet Corporation for Assigned Names and Numbers.

At the time of the law’s passing, Putin justified the national DNS by arguing that it would allow the Russian internet segment to function even if ICANN disconnected Russia from the global internet in an act of hostility. In practice, when, days into Russia’s invasion in February 2022, Ukrainian authorities asked ICANN to disconnect Russia from the DNS, ICANN declined the request. ICANN officials said they wanted to avoid setting the precedent of disconnecting entire countries for political reasons.