Russia Criminalizes VPN Use: Article 274.3 and the New Era of Legal Persecution for Circumvention Tools

In July 2025, Russian President Vladimir Putin signed a sweeping legislative package that fundamentally altered the legal landscape for internet users in Russia. The amendments, which came into force on September 1, 2025, introduced criminal liability for the use of VPNs, proxies, and virtual PBX systems under specific circumstances. This represents the most significant escalation in Russia's war against circumvention tools since the 2017 VPN law, shifting the focus from administrative penalties on service providers to criminal prosecution of users and organizers.

The New Legal Framework: What Changed

The legislative package introduced several new articles to the Criminal Code of the Russian Federation and amended the Code of Administrative Offenses, creating a multi-layered system of penalties for VPN-related activities. The centerpiece is Article 274.3, which criminalizes the illegal use of subscriber terminals for traffic transfer or virtual telephone exchanges (VPN and proxy solutions) when used to commit another crime or when causing serious consequences.

The penalties under Article 274.3 are severe: fines up to 300,000 rubles, compulsory labor for up to two years, or imprisonment for up to two years. In cases of particularly serious consequences, the penalties escalate to imprisonment for up to six years and fines of up to 2 million rubles. This marks a dramatic shift from the previous approach, which focused primarily on blocking VPN services and imposing fines on their operators.

Additionally, Article 63 of the Criminal Code was amended to include the use of VPN terminals and proxies as an aggravating circumstance for any crime. This means that simply using a VPN while committing an offense — even one unrelated to internet activity — can result in a harsher sentence. The legal message is clear: in the eyes of Russian law, VPN usage is now inherently suspicious.

Administrative Penalties: The First Line of Attack

Alongside the criminal provisions, the new law significantly expanded administrative penalties under Articles 13.52 and 13.53 of the Code of Administrative Offenses. These articles target multiple layers of VPN-related activity:

• Advertising VPN services: Individuals face fines of 50,000 to 80,000 rubles, while companies can be fined up to 500,000 rubles.
• Searching for extremist materials: Individuals using VPNs to search for banned content face fines of 3,000 to 5,000 rubles.
• Refusing to cooperate with authorities: VPN service owners who fail to interact with Roskomnadzor face fines of 50,000 to 80,000 rubles for individuals and 200,000 to 500,000 rubles for legal entities.
• Transferring SIM cards and registration data: Fines of up to 200,000 rubles for individuals.

The law also introduces Article 274.4, which criminalizes the organization of a black market for SIM card numbers, with penalties including fines up to 700,000 rubles and imprisonment for up to three years. Article 274.5 establishes similar liability for transferring login credentials and other data for registration and authorization in internet services.

Technical Enforcement: The TSPU Infrastructure

The legal framework is backed by Russia's extensive technical censorship infrastructure. All Russian internet providers are required to install TSPU (Technical Means of Countering Threats) equipment under the 2019 Sovereign Internet Law. These Deep Packet Inspection devices analyze all passing traffic in real-time, identifying and blocking VPN protocols including WireGuard, OpenVPN, L2TP, SOCKS5, and VLESS.

In 2026, Roskomnadzor reported blocking 469 VPN services, up from approximately 150 in 2023 and 300 in 2024. The regulator has also invested 2.3 billion rubles in an AI-based traffic analysis system that can recognize obfuscated traffic disguised as regular HTTPS. This technical arms race means that even as the legal penalties increase, the technical ability to detect VPN usage is also improving.

The Impact on Ordinary Users

For the average Russian internet user, the new law creates a climate of uncertainty and fear. While the State Duma has officially stated that a complete VPN ban is not being considered and that ordinary users will not be fined for merely connecting to a VPN, the reality is more complex. The criminal provisions of Article 274.3 are triggered when VPN use is connected to another crime or serious consequences, leaving significant room for interpretation by law enforcement.

Legal experts note that the aggravating circumstance provision in Article 63 is particularly concerning because it applies to any crime committed while using a VPN. This could theoretically mean that a minor offense committed while connected to a VPN for legitimate purposes — such as accessing a work server — could result in a harsher penalty.

The law has also had a chilling effect on VPN advertising and distribution. With penalties of up to 500,000 rubles for advertising VPN services, many websites and influencers have stopped promoting circumvention tools. The black market for SIM cards and registration data, which had become a workaround for platform restrictions, is now also subject to criminal prosecution.

Corporate and Business Implications

The new legal framework has significant implications for Russian businesses. Corporate VPNs, which are officially not banned, have increasingly fallen under technical blocks, causing operational disruptions. The Russian Union of Industrialists and Entrepreneurs reported that 85% of surveyed companies described internet restrictions as critical or significant for their operations.

Businesses now face a dilemma: corporate VPNs are essential for secure remote work and data protection, but the legal and technical environment is increasingly hostile. The law provides for corporate VPN connections to be added to whitelists, but this requires coordination with Roskomnadzor, creating bureaucratic hurdles and potential surveillance concerns.

International Context and Comparisons

Russia's approach to VPN criminalization follows a pattern seen in other authoritarian states. China's Great Firewall remains the gold standard of internet censorship, with VPN use technically illegal but widely tolerated for personal use. Iran has also criminalized VPN use, with penalties including imprisonment. Turkmenistan, one of the most restrictive internet environments in the world, actively blocks VPNs and has been reported to have government officials selling VPN access on the black market.

What distinguishes Russia's approach is the combination of legal criminalization with sophisticated technical enforcement. The TSPU infrastructure, combined with AI-based traffic analysis, creates a comprehensive system of control that few other countries can match. The investment of 20 billion rubles annually in building a permanent VPN censorship system signals a long-term commitment to suppressing circumvention tools.

What Still Works: Circumvention Strategies

Despite the escalating legal and technical pressure, circumvention tools continue to evolve. The most effective strategies in 2026 include:

• Obfuscated protocols: AmneziaWG 2.0, which randomizes packet headers and sizes to evade DPI detection, has shown high effectiveness in Russia.
• Self-hosted solutions: Running personal VPN servers with custom configurations reduces the risk of being caught by mass blocking systems.
• Protocol diversity: Using multiple protocols and rotating between them makes it harder for DPI systems to maintain consistent blocking.
• Router-level VPN: Configuring VPN at the router level rather than on individual devices can be harder to detect and block.

The technical reality is that no censorship system is perfect. The 40% VPN adoption rate in Russia demonstrates that demand for circumvention tools remains strong, and the technology to bypass blocks continues to evolve faster than the systems designed to stop it.

Conclusion: The Future of Internet Freedom in Russia

Russia's criminalization of VPN use under Article 274.3 represents a new phase in the country's internet censorship strategy. The combination of criminal penalties, administrative fines, and sophisticated technical enforcement creates a comprehensive system of control that goes far beyond simple website blocking.

However, the history of internet censorship suggests that legal prohibition and technical blocking are rarely fully effective. The 40% of Russians who currently use VPNs represent a massive, decentralized network of circumvention that the state cannot fully suppress without causing significant economic and political damage. The cat-and-mouse game between censors and circumvention developers is entering a new, more dangerous phase — but it is far from over.

For users in Russia and other countries with similar restrictions, the lesson is clear: the technology to maintain internet freedom exists, but using it now requires greater technical knowledge and awareness of legal risks than ever before. The arms race continues.

Source: Roskomsvoboda: Criminalizing VPN and Extremist Content Access