Russia’s VPN Ban Turned Out To Be Dud

It has been three months since the Russian law restricting VPNs services and anonymizers came into effect. But until now, no actual curtailment measures have taken place.  “As of today, there have been no requests from investigators and state security regarding anonymizers and VPN services,” said a Roskomnadzor spokesperson when asked about the implementation of the law and its efficacy in meeting its objective. While some VPN service providers and anonymizers native to Russia have openly declared that they are ready to comply with the law, foreign VPN service providers have taken a staunch opposition stand to the law and have said that they will continue providing their services to people no matter where their location is.

Russia’s VPN Ban Turned out to Be Dud

What Does the Law Say?

According to the legal provision put in place by the Russian government on November 1st, 2017, all VPN service providers must block and stop traffic from Russian servers on to sites which are banned by the Federation. The Roskomnadzor has the legal imperative to issue compliance requests to service providers which are currently offering access to banned sites and their native resources.

However, it is the Federal Security Service which has the onus of identifying which service providers need to be issued the compliance notice and brought under the legal communication umbrella called the Federal State Information System (FGIS). In the event that any identified service that has been issued the compliance notice does not do so within 30 days of receiving the notice, their entire repertoire of services will be blocked.

Despite this quite obviously far-reaching declaration, there have been no ground-level efforts to curtail and contain any VPN service providers or anonymizers. As it stands, people and businesses are freely using VPN services to access data not usually available through normal online channels. Whether the VPN law is good or bad is up for debate. But a greater question has been raised on the efficacy of the legal move itself.

Why the VPN Law Might Be Ineffective

First of all, it is estimated that over a quarter of the total number of people in Russia using the internet use VPN facilities. So limiting the internet usage of this vast number of people might prove to be more difficult than the Russian government authorities have anticipated.

What compounds the situation further is the fact that the overwhelming majority of VPN service providers and anonymizers in Russia are not based in the country itself. Out of these, most have said that since they have not based their operations in Russia, they are under no obligation to implement the laws governing the nation. Some have said that they will continue to provide these services in Russia but if necessary, they are willing to give up the servers originating from the country.

The Commercial Aspect

Many companies and corporate enterprises make use of VPN services to secure their data. As of now, there is no way to differentiate between the VPNs being used by commercial entities and those being used by private individuals. The bill’s effective implementation could mean putting at risk the valuable data and digital assets of thousands of corporations.  Many people working in this field have raised doubts over the effectiveness of the bill and cited this as the major reason why it should be reconsidered.

These doubts and concerns were raised by the Association of European Businesses. Many members of the association operate in Russia and have a considerable stake in the local, regional, and national economy.

However, since the bill has had no real effect on the working of either the organizations or private individuals, the question now being asked is what will Roskomnadzor do to ensure that business activity is not hampered just to prohibit any number of individuals from accessing restricted online resources?

Whatever the ultimate modification or implementation of the bill might entail, it is certain that the current version of it is unwelcoming to business process and thus, will inevitably be forced into reconsideration.