Russia’s Expanding Internet Controls Raise Surveillance and Operational Risks

Oct 15, 2026 · Original article ↗

Summary

Recorded Future assesses that Russia is expanding internet restrictions, surveillance and shutdowns while pursuing greater control over digital infrastructure. The report outlines risks to organizations and recommends mitigations, while judging a fully sovereign Russian

Key points

Recorded Future assesses that Russia has intensified restrictions on VPNs, messaging platforms and internet access since mid-2025, alongside expanded surveillance requirements.
The report assesses that state-managed shutdowns and allowlists are likely being used to test the ability to isolate Russian networks, though technical and political constraints make a fully sovereign internet unlikely in the near term.
Russian authorities have blocked or throttled VPN services and messaging platforms, and have directed domestic applications to reject traffic associated with known VPNs.
The report identifies risks including surveillance and exposure of sensitive data, emergency-communication failures, disruption to corporate tools, supply-chain interruptions and potential sanctions violations.
Independent analysts cited in the report assess that the state-owned Max messaging app lacks end-to-end encryption for chats and shares user metadata and identifiers with Russian authorities.
For organizations with exposure to Russia, the report recommends measures including isolating local networks and resources, using temporary travel hardware, preparing out-of-band communications and auditing vendors.
Recorded Future assesses that passive collection is the primary near-term risk; it says network-level traffic injection is plausible but unlikely in the near term.

Article Details

Publisher: Recorded Future
Report Period: 2025–2026, with historical context
Scope: Russian internet restrictions, surveillance infrastructure, and operational risks for public- and private-sector entities with direct or indirect exposure to Russia.
Key Statistics: Roskomnadzor reportedly blocked 258 VPN services as of October 2025 and 460 by early 2026, an increase exceeding 70%.
Estimated regional mobile or broadband disruptions increased from 69 in May 2025 to more than 655 in June 2025.
Independent trackers reported more than 37,000 cumulative hours of internet blackouts during 2025, affecting nearly 80% of Russia’s territory.
According to independent Russian trackers, 74 of Russia’s 83 regions had introduced allowlists of government-approved sites.
Recommendations: Provide traveling personnel with sanitized temporary devices containing no administrative logins, sensitive contact lists, or unnecessary credentials.
Establish satellite or other secure out-of-band communications for emergency use during regional internet blackouts.
Separate Russia-based networks and cloud resources from global corporate infrastructure, and use dedicated isolated devices for domestic allowlisted platforms.
Enforce ephemeral data retention and regularly remove sensitive customer, financial, and employee information from local hardware.
Audit vendors for Russian state software use, reroute critical supply-chain data away from Russian telecommunications dependencies, and sandbox Russia-based developers’ code with multi-person approval before production merges.