Russia’s Digital Iron Curtain Is Starting To Take Shape

This weekend, I started to notice ominous posts from my Russian friends on Instagram. 

One by one, I saw my mutuals from the country writing formal goodbyes to their followers. Others expressed doubts about reliably accessing the app after the Kremlin announced it would begin blocking the platform.

“I don’t know if this will be my last post here,” wrote a fashion model from Moscow who normally posts pictures of their cute cyberpunk-style outfits. One commenter reported getting “weird glitches” on the app and became suspicious that they were due to having a Russian-sounding name. 

“Be a russian hacker, use a VPN,” the model replied, with a sunglasses emoji.

“I guess now it’s VPN because I’m not using VK,” wrote a Moscow-based cosplayer in a story post, referring to the state-controlled Russian social network formerly known as Vkontakte. Before going dark, several of the accounts I follow had previously posted cryptic messages that included the phrase “NO WAR.”

Russia’s Instagram ban, which affected nearly 80 million users, took effect late Sunday evening, in response to parent company Meta relaxing its policies on violent threats. The new policy allows users to call for the deaths of Russian invaders, carving out a rare exception in response to the war in Ukraine (Meta later clarified that the policy would not allow users to issue threats against Vladimir Putin, although it has temporarily allowed users to do so for other world leaders in the past). Russia had also previously banned Facebook and limited access to Twitter within the country.

Experts suspect that the bans are intended to funnel more Russian users onto platforms which are less secure—or under the Kremlin’s direct control. This is being called the "Digital Iron Curtain," "Silicon Curtain," or "Internet Iron Curtain" by various news outlets.

One platform that remains accessible is Telegram, the messaging app where millions of Russians and Ukrainians get their news. Telegram was founded in Russia but was moved to Dubai in part because of pressure from the Russian state against its founder, Pavel Durov.  The app remains extremely popular in Russia and Ukraine, although privacy experts are still unsure whether Durov agreed to cooperate with Kremlin investigations after Russia removed its ban on the platform in 2020. VK, which was also owned by Durov before being taken over by the Russian state, also reported a large jump in users after recent social media bans, claiming its number of daily users had increased by 4 million. 

Despite their popularity, neither of the services are particularly secure; Telegram supports end-to-end encryption, but requires users to opt-in with a “secret chats” option that is not available for groups, and that most people don’t use.

“You can assume that anything that happens on VK is absolutely not safe from the Kremlin,” EFF director of cybersecurity Eva Galperin, who studies Russian surveillance and censorship, told Motherboard. While many Russians will continue to use banned social platforms through a VPN, experts like Galperin suspect the Kremlin’s strategy is to close off easy access to other services so that people filter onto platforms it can better control. 

Still, she argues, Russians and Ukrainians aren’t going to stop using apps like Telegram, and the best solution is for users to take steps to secure their communications—for example, by turning on the “secret chats” option and enabling 2-factor authentication. This has become especially crucial in recent weeks, as the Kremlin continues to crack down on protesters who speak out against the war. New laws passed by the Russian state Duma also promise harsh prison sentences to anyone disparaging the war—or even calling it a “war” in the first place.

“[Durov] has also said that Telegram has never handed over any data to the Russian government, but there is no way of knowing if that is true,” said Galperin, noting that unlike many tech platforms the company has never published transparency reports. “Because most Telegram comms are not encrypted, he sure is sitting on a lot of data that governments could ask for.”

Social media isn’t the only place where the Russian internet is getting smaller. On Monday, leaked emails indicated that by the end of the week, Russia is planning to further centralize control over the country’s internet access with its “sovereign internet” project, RUnet. This would effectively relocate key internet infrastructure—including parts of the Domain Name System (DNS)—to servers on Russian soil. The DNS is the internet routing system that redirects users to websites from typed addresses like Vice.com, meaning that the change would require all connections to come through Kremlin-controlled gateways—at least for Russian government websites. 

Russia has also made moves to bypass sanctions by creating its own certificate authority—one of the entities that issues security certificates for securing web traffic. Web engineer Yan Zhu pointed out that this potentially breaks a security feature called “TLS pinning,” which ensures that the website encrypting your connection is the same one you’re trying to connect to. Without TLS pinning, it becomes much easier for the government to intercept web traffic by performing man-in-the-middle attacks, unless browsers begin to recognize the new Russian certificate as trustworthy. (So far, only the Russia-based Yandex browser has included the Kremlin’s credentials as legitimate)

All of this is causing experts to worry what precedents this might set for the internet as a whole. If a country can simply bow out of the global network and funnel people into siloed services and standards during times of conflict, it doesn’t bode well for the future of a neutral and decentralized internet.

“We still have instagram using vpn but every day more and more vpn services are getting blocked,” the cosplay model from Moscow told me in a private message, several days after their account stopped posting. “I think we’ll get other abilities to use instagram but now it’s hard … I have absolutely no idea what’s going on.”