Putin's digital Iron Curtain: Russia bypasses sanctions, buys equipment to block YouTube and Telegram

What is “protocol-based” blocking?

For the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor), it is crucial to learn how to block and slow down websites not only based on IP addresses but also based on protocols. A protocol is a set of rules governing the exchange of data between computers and servers. For example, there are protocols for email transmission, distinct from those used for messaging in Telegram or WhatsApp. The MTProto protocol, designed for Telegram, enables messages to reach the recipient even under very unstable connections. There are protocols for streaming video and audio, utilized by programs like Skype. Special data transmission protocols are employed by YouTube and other video services. To block or slow down data transmission from any of these services TSPU “filters” are used.

The equipment used by Roskomnadzor comprises server infrastructure (“customs checkpoints”) at various segments of the internet across Russia and a software package (“customs rules”). Until recently, the regulatory authority did not possess the technical capability to filter traffic based on protocols. Following the mass blocking of VPNs this summer, we learned that this capability is now available to the regulator. Moreover, thanks to the leak of data from the Main Radio Frequency Center (GRChTs, from Russian «Главный радиочастотный центр»), The Insider revealed the specific equipment used by Roskomnadzor. We've discovered the capabilities it provides for internet blocking in Russia, how many “customs checkpoints” have been established by Roskomnadzor on the networks of Russian telecommunications operators, and who manufactures and imports this equipment into Russia.

The war on VPN

The first casualties of the “protocol-based” blocking were VPN services. In early August and late September, VPNs were massively blocked in Russia using “protocol-based” techniques, made possible by deep packet inspection (DPI). Previously, when Russian users experienced disruptions in their VPN applications, it was usually due to the blocking of specific IP addresses used by the services. One way to bypass those “dumb” blockings was to constantly change the IP addresses the service connected to, a tactic successfully employed by Proton, Red Shield, and other applications, allowing them to resume functioning. Some VPN services, typically less popular and not in the focus of Roskomnadzor, continued to operate uninterrupted. However, in April and June 2023, MegaFon and MTS reportedly attempted to block the most popular protocols — methods of data transmission between users' computers and VPN servers — specifically OpenVPN and WireGuard. In early August, operators suddenly began blocking all traffic going through VPN applications, causing most applications to stop working for users in Russia.

After a few days, the services partially restored their functionality, and the blockings ceased. However, at the end of September, they resumed. Experts believe this was an unprecedented move by Roskomnadzor. “We were living carefree. It wasn't a digital war, but a spreading of mucus on the walls with a crutch. And now, it's war!” wrote Filipp Kulin, who runs the Usher II project for monitoring blockings, in his blog.

Roskomnadzor blocks internet access via VPN protocols in the following manner: traffic filtering equipment is installed on operators' networks, officially referred to as “technical means to counter threats” (TSPU, from Russian «техническое средство противодействия угрозам»). Roskomnadzor directly oversees and controls this equipment. When a decision is made to block something, such as one or more VPN protocols, a command is sent to the device by specialists from Roskomnadzor's subsidiary organization, the Federal State Unitary Enterprise GRChTs, and the blocking occurs. The operator is not directly involved in this process.

During the August blockage, consideration was given to the fact that VPN protocols route traffic to foreign servers – no domestic networks were blocked. For instance, users of the VPN Generator project experienced a loss of approximately 10% of their traffic during the protocol-based blockage — connections to foreign proxy servers simply couldn't be established. VPN Generator uses the WireGuard protocol, but the blocking affected all popular protocols. Commercial services like Trust.Zone and PaperVPN told The Insider that they only lost a small portion of their traffic due to their ability to provide connections through various protocols and use other technical solutions to bypass Roskomnadzor's prohibitions.

According to VPN Generator's customer support, the blockages barely affected home internet users, primarily impacting mobile operators' customers. This implies that Roskomnadzor has not yet implemented TSPUs across all telecommunication operators' networks; the focus has been on mobile operators. The reason is that it's technically easier to achieve; besides, mobile operators have a larger subscriber base.

To block all protocol-based VPNs altogether, a significant amount of computational resources is required, which Roskomnadzor currently lacks. When the internet is being filtered, each packet's protocol and destination address are checked. However, a blanket approach cannot be employed, as VPNs are widely used in Russia for remote connections of offices, ATMs, point of sale terminals, corporate networks, and electricity meters. If traffic is blocked across all protocols, all these services will stop functioning, making it impossible for people to make purchases in stores or withdraw cash from ATMs.

How GRChTs and Usmanov will “filter” the Russian segment of the Internet (Runet)

After unsuccessful attempts to block Telegram in 2018, Roskomnadzor came up with the idea of installing DPI equipment at all providers' facilities, at the government's expense. By mid-2019, the plan was formalized into the “sovereign Runet” law. Within the GRChTs, a specialized division was established for this purpose — the Center for Monitoring and Managing Public Communication Networks. It was led by Sergey Khutorstsev, a former Federal Protective Service (FSO) officer according to Meduza. Alexander Zharov, who was heading Roskomnadzor at the time, likened the technologies that were to be legally used and applied to isolate the Runet, to nuclear weapons.

Approximately 20 billion rubles ($200 million) were planned to be allocated for the implementation of the “sovereign Runet” concept. However, the rollout of the DPI equipment encountered challenges. GRChTs consistently missed program deadlines, and the quality of communication suffered. Additionally, operators faced complaints from both subscribers and Roskomnadzor since the installed equipment still allowed access to blocked websites. The head of one of the mid-sized telecommunication operators complained to ComNews:

“We paid for the installation of the TSPU, we have to pay for the electricity consumed by these devices on a regular basis and rent a channel of no less than 100 Mbps to connect the TSPU to the central system. But what's the point of all these expenses if these TSPUs clearly don't work.”

To implement traffic filtration systems, a company named “Data Processing and Automation Center” (DTsOA, from Russian «Данные — центр обработки и автоматизации») was established. Almost immediately, a 49% stake in it was transferred to Anton Cherepennikov's “Citadel” conglomerate. It remains unknown who controlled the remaining share of the company's capital and who currently controls the company after Cherepennikov's passing in 2023. These details are concealed in the Russian company register. “Citadel” provided DTsOA with a 281 million ruble ($2.8 million) loan for the first few months of operation (see document), which the newly created company quickly repaid.

Experts noted that Cherepennikov's company effectively invested in a project created to fulfill a task set by the government. In 2020, USM, a company owned by Alisher Usmanov (see document), became the main beneficiary of “Citadel”.

According to RBC sources, employees of companies within the “IKS Holding”, also owned by Cherepennikov, took part in the pilot project for implementing state-run DPI. “IKS Holding” was later sold to USM but reverted to the founder after the start of the large-scale invasion. “IKS Holding” and “Citadel” emerged as major beneficiaries of the control systems' installation (SORM, from Russian «система технических средств для обеспечения функций оперативно-разыскных мероприятий») in accordance with the “Yarovaya Law.”

The Insider uncovered a contract (see document) between the GRChTs and DTsOA. It specifies the types and quantity of traffic filtering equipment that should be supplied to the GRChTs and installed on telecommunication operators' networks in Russia. This equipment and software are partially produced in Russia from foreign components and partially imported. One of the main elements of the system is manufactured by a company within “IKS Holding”, previously owned by Alisher Usmanov's USM; Cherepennikov regained control over it after the start of the war with Ukraine.

The contract provides for the supply, installation, and subsequent operation of TSPU. The contract price for 2020, which included the first phase of creating the system and supplying equipment for it, was 4.3 billion rubles ($43 million). For the years 2022-2024, almost 24.7 billion rubles ($247 million) were planned to be spent.

What equipment is used for the Russian “Cheburnet”?

The equipment for the “Cheburnet” consists of several key components, according to the contract between GRChTs and DTsOA:

• EcoFilter (a trademark owned by RDP.Ru, a subsidiary of Rostelecom) - DPI equipment. The complex includes the EcoDPIOS-DU software package developed in-house by the company and Yadro's Vegman N110 servers. The hardware is produced by Yadro, a Skolkovo company which became part of Cherepennikov's “IKS Holding” shortly before the adoption of the law on the “sovereign internet.”
  
• FusionServer 1288H servers manufactured by Huawei.
  
• Cross-connect equipment to connect to various telecommunication operators' networks. A crucial part of it includes bypasses produced by Israeli company Silicom Ltd, which it directly supplies to DTsOA. Switches are supplied by the Novosibirsk-based company Elteks.
  
• Kontinent - remote management equipment, manufactured by a Russian company “Kod Bezopasnosti”. It utilizes software developed by “Positive Technologies”, a sanctioned Russian company.

TSPUs are installed on cables at the junctions between the telecommunication operator's network and the internet.

EcoFilter serves as the primary equipment employed for internet filtering within Russia. The Ministry of Digital Development specifies its role as “filtering negative content.” In 2023, the Ministry of Industry and Trade published findings affirming that its server hardware, despite employing the Intel Xeon processor, is domestically manufactured in Russia by “KNS Group”, a company affiliated with Yadro.

From the EcoFilter manual, one can learn what Roskomnadzor plans to do with the internet — what rules may be applied at the “internet customs checkpoints.” It describes blocking based on protocols, on Roskomnadzor's registries, on the TsAIR (Center for Analyzing Internet Resources) database, which includes a function for blocking sites by categories (for example, an operator can block all sites mentioning “extremism” or anonymity or government in one click), as well as the ability for forced redirection from one site to another— for instance, Russians attempting to access an unblocked “mirror” of The Insider will be forcibly redirected to the RIA Novosti website, and operators will be powerless to stop it. Additionally, EcoFilter allows traffic slowdown and delivering additional content to subscribers, such as advertising banners.

It's important to understand that microprocessors and complex motherboards are not manufactured in Russia. Although equipment for TSPUs is supplied by Russian companies, all the basic components are imported. Local assembly and software installation are likely the only processes carried out on-site.

Therefore, in this project, DTsOA acts as a system integrator. The company consolidates disparate computer systems into a unified whole. The Insider analyzed the company's financial statements and government contracts and concluded that GRChTs is its main client. DTsOA plans the work, procures equipment and software, assembles, and maintains the complexes. The majority of DTsOA's equipment is purchased from Russian subcontractors. The company imports components directly from abroad, including GLSUN-branded components from China and Silicom-branded ones from Israel. The Insider has sent an inquiry to Silicom Ltd.

Unsanctioned “Russian” equipment from Taiwan, China, and Slovakia

RDP.ru (RDP.Ru LLC) is the primary supplier of equipment for internet filtering, the “customs checkpoints” that Roskomnadzor has been purchasing. Rostelecom gradually acquired 100% of this company between 2016 to 2021.

According to the contract, DTsOA planned to purchase 1,195 EcoFilter devices in 2022, and an additional 3,149 devices in 2023-2024.

RDP.ru itself only develops software, while all the hardware for Roskomnadzor's “customs checkpoints” is supplied by the Russian company Yadro. Previously, it had already contributed to the production of surveillance equipment for domestic use, endearingly called “SORMovitch,” and the implementation of the “Yarovaya Law.” Yadro produces data storage systems for the Kupol (Dome) complex, which telecommunication operators are required to purchase.

Yadro positions its servers as the “best in the national market” and actively advocates for a ban on the import of foreign servers into the country. Vegman servers, including the ones used in TSPUs, were included in the 2023 registry of products manufactured in Russia and received a localization assessment from the Ministry of Industry and Trade. However, although Yadro has been promising to start producing its own processors for several years, Intel processors are still used in their servers. This does not sit well with the Ministry of Industry and Trade. However, Russian server manufacturers insist that they should retain the ability to import motherboards, hard drives, processors, and other electronics into the country. The Insider has sent an inquiry to Intel.

In reality, there isn't much Russian content in the “boxes” that filter the internet in Russia. As The Insider found from customs data, various parts of server equipment are imported into the country under the Yadro and Vegman brands, ranging from chassis to printed circuit boards and processors. These are produced by Taiwanese companies Innoflux (printed circuit boards, switches, processors, and electronic modules), MSI (motherboards and electronic modules), AIC Inc. (server and hard disk enclosures), and Majestic Technology Corporation (parts of server enclosures and chassis for module connectivity), as well as the Chinese-American company Parade Technologies (motherboards and electronic modules) and Chinese companies TALIAN (motherboards and printed circuit boards) and SuNPe (server and data storage casings).

The primary equipment supplier for Yadro's server production — and consequently for TSPU equipment — is the Slovak company Telperien s.r.o. According to the assessment by the Tebiz marketing agency, for many years, it has been one of the largest server suppliers to Russia. It imports equipment manufactured by Innoflux, TALIAN, and Majestic, on orders from the Russian “Kombit LLC”. Telperien is managed by individuals previously suspected of money laundering in the Czech Republic through fictitious contracts for telecom equipment supplies to Russia.

Yadro server cases are also manufactured in Taiwan and China, and they are imported into Russia by ”Retecomputers LLC”.

In February 2023, ”IKS Holding”, the parent company of the Yadro brand, along with several other companies within the conglomerate, fell under U.S. sanctions for their involvement in creating the SORM in Russia. These are comprehensive personal sanctions that, among other things, prohibit all American entities from engaging in any transactions with the sanctioned entities. Among those sanctioned is the Vegman server manufacturer, ”KNS Group”.

However, the other companies within the Yadro group were not subject to sanctions. This did not prevent them from concealing their details in the company register (as sanctioned entities are allowed to do). RDP.ru, the manufacturer and distributor of Russian DPI filters, is not subject to any sanctions either.

Intel's unintentional contribution to blocking the Runet

In addition to filtering equipment, the TSPU complex also includes two Huawei FusionServer 1288H servers in various configurations, which use Intel processors and chipsets. In 2022, Roskomnadzor purchased 965 such servers, and an additional 2404 servers were planned for 2023-2024. The cost of these servers, according to the commercial offer from DTsOA for three years, exceeds 4.8 billion rubles ($48 million).

Even before the adoption of the “sovereign internet” law, Huawei tried to profit from supplying equipment for the implementation of the “Yarovaya Law.” The Chinese manufacturer hoped to localize server production in Russia and entered into partnerships with Russian companies for this purpose, including ”Citadel” competitor, ”Norsi-Trans”. Eventually, Huawei's equipment became part of the TSPU.

After Russia's full-scale invasion of Ukraine, Huawei suspended new contracts in the country and eventually closed its corporate sales division. However, the company actively utilized parallel import schemes and directly imported equipment for smartphone supplies, according to customs data available to The Insider.

The Chinese telecom giant still uses Intel processors in its equipment, despite the U.S. attempts to restrict the use of American technologies in Huawei's products since 2019. To adapt to U.S. sanctions, the company is constructing secret factories to manufacture microchips. Currently, to purchase American chips, Huawei must obtain special permissions from the U.S. government. However, American politicians haven't given up on the hope of completely prohibiting Huawei from using American equipment.

In response to The Insider's request for a comment on Huawei's server supplies and its use of Intel technology, Michael McCaul, Chairman of the House Foreign Affairs Committee, stated:

“If this reporting is accurate, Huawei should absolutely be subject to secondary sanctions. American companies must reassess their business with companies directly tied to the Chinese Communist Party – especially Huawei. If we continue business as usual, we will only further inflame CCP ambitions and the enhancement of their military capabilities that will target US servicemembers.

Huawei overall is long overdue for stronger action by the US Government. This situation, paired with Huawei’s likely violation of U.S. export controls in developing their recent 5G phone, demonstrates a clear record of justification for tightened export controls and sanctions on the organization.”

The Insider has sent a request to the U.S. Department of Commerce regarding the use of Intel chips in TSPU equipment.

Most of the servers and components for them between 2019-2022 were supplied to Russia by Huawei itself. The British company Mykines Corporation LLP, which is known to have previously supplied electronics to Russia in circumvention of sanctions, remains a major supplier. However, it is unknown where exactly DTsOA procures the servers.