Battle for Runet

How the Russian authorities manipulate information and control us all.
Origin source
The Sakharov Prize has been awarded to Russian journalists since 2001. The nominations include materials that become a continuation of the authors' position in life, consistently embodied in the highest professional level of work. Journalists who now defend the same values ​​as Andrei Sakharov.

Andrei Soldatov is a Russian journalist and editor-in-chief of website. Previously he worked for the newspapers "Segodnya," "Izvestia," "Versiya," "Moskovskie novosti," and "Novaya Gazeta," as well as cooperated with the radio "Echo of Moscow."

In November 2002, after the publication of the report on the seizure of "Nord-Ost", the Federal Security Service of the Russian Federation opened a criminal case into suspicions of divulging state secrets. On the publication date of an editorial report in "Versiya," FSS employees came and took Soldatov's computer and the editorial server. In December 2002 the criminal case was dismissed.

Irina Borogan is a Russian journalist and deputy editor-in-chief of Agentura.Ru website. She has worked for the newspapers "Segodnya," "Izvestiya," "Moskovskie novosti," "Novaya Gazeta," and cooperates with "Foreign Policy" and "Foreign Affairs."

She together with Andrei Soldatov was a co-founder of the project Agentura.Ru. As a co-author with Soldatov she released the book "The New Nobility. Essays on the history of the FSS." The book is published in Russia, France, Estonia, Finland, China.

In September 2010, the publishing house PublicAffairs (Perseus Group) issued a book by Andrei Soldatov and Irina Borogan "The New Nobility: The Restoration of Russia's Security State and the Enduring Legacy of the KGB." Later the book was published in France, Russia, China, Estonia and Finland.

The Internet has been censored in Russia since November 2012. But the all-Russian filtration system created for this is primitive and not very effective. Unlike the Chinese great Firewall, it does not involve filtering by keywords, it's just a blacklist of prohibited sites that should be blocked.

Sites can be blocked by IP-address (for example,, by URL of a specific page, for example,, or by domain name -
The Federal Service for Supervision in the Sphere of Communications, Information Technology and Mass Communications, or simply Roskomnadzor was appointed responsible for filtering the Internet. Roskomnadzor creates a blacklist and checks how well providers implement its censorship.

The head of this agency was Alexander Zharov, courteous and pleasant in communication, but an extremely ambitious official. A doctor by training, he worked as an anesthesiologist at a regional hospital in Chelyabinsk, then began writing articles for the magazine "Family Doctor" and soon moved to Moscow and became deputy editor-in-chief of the magazine.

Then he became involved in public affairs, worked as a spokesman for the Minister of Health and in 2004 received the position of press secretary of the unobtrusive Russian Prime Minister Mikhail Fradkov, who led the government in 2004-2006.

All this time, Zharov actively established contacts in the power vertical and became close with Igor Shchegolev, a former TASS correspondent in Paris, who in 2008 was appointed minister of Сommunications and Mass Media. They understood each other well, almost equals in age and with a similar background, Shchegolev used to work as a press secretary for the prime minister, not Fradkov, but Primakov, and later served in the presidential administration.

Shchegolev also had direct access to Putin. When he suggested Zharov to become his deputy, he agreed, and both then went to work in the gray building of the Central Telegraph on Tverskaya Street, where the Ministry of Communications is located.

When in May 2012, Putin returned to the Kremlin for a third presidential term, he took Shchegolev from the ministry, appointing him as his assistant on Internet issues. On May 3, 2012 Alexander Zharov, who has long been considered Shchegolev’s man, became the head of Roskomnadzor.

Soon, Roskomnadzor, previously known only by communication operators and the media, because it was responsible for issuing licenses, became famous throughout the country. With Zharov, the agency turned into a powerful, semi-independent agency, only formally part of the ministry, with 3,000 employees, including regional offices.

If there were tensions between Putin and Medvedev, Zharov always was closer to Putin's people. When in 2012 Roskomnadzor was instructed to take control of Runet, Zharov found himself on the forefront of the struggle and with the full support of presidential adviser Shchegolev.

Three weeks after the launch of the Internet filtering system, Zharov came on the television channel "Dozhd." For an hour he answered the tart questions of journalists about the black list of sites. According to his version, the only purpose of the new law was to fight against pornography and drugs propaganda, and he was just an official executing the law. At the end of the interview, he said that the blacklist is updated every hour and at the moment it includes 591 sites. A professional in PR, Zharov spoke calmly and with restraint, but he was well aware that his tricky role as Internet censor could have a downside. Therefore, he did what the leaders usually do in that case he found a subordinate ready to take up the delicate work. 39-year-old Maxim Ksenzov, deputy head of Roskomnadzor, looked like a straightforward person and not very sophisticated. He was a military engineer by training, he began his career at the Research Institute under the Ministry of Defense, then worked in the field of information technologies. In 2004, he came to the civil service in Rosokhrankultura, and after the merger of this agency with Roskomnadzor stayed to work in a joint agency. He became  Zharov’s deputy in July 2012.

Initially, Ksenzov adhered to the official line, they are officials and only fulfill the law. He even tried to explain anxious Internet providers' filtering methods and patiently answered questions from the audience on different web platforms.

But soon Zharov and Ksenzov realized how powerful the weapon was in their hands.

When Roskomnadzor asked the operators to close access to the controversial film "The Innocence of Muslims" even before the court's decision, the three largest Russian communication operators Vimpelcom, Megafon and MTS blocked the video on YouTube in the North Caucasus. Only MTS was able to block the video itself, Vimpelcom and Megafon simply turned off access to the entire service in the whole region.

This made it necessary to hurry to Roskomnadzor for explanations not only for Russian providers, but also global platforms like Google. A primitive locking system that disconnected entire services threatened their business. On November 24, three days after Zharov's interview with “Dozhd”, the IP address of the Google Blogspot platform appeared in the black list of Roskomnadzor. And, although it was quickly removed from the list, users began to complain that the operation of other services, Gmail, Google Drive and Google Play was broken.

It didn’t matter how primitive the blacklist was, it had become obvious that this was a powerful tool for pressure.

But so far many of the largest companies on the market still felt themselves independent enough not to be afraid to support opposition publications.


Evgeny Kaspersky, who during the protests did not immediately believe in DDoS-attacks on opposition sites in a similar situation in March 2013 behaved differently. When the opposition publication “Novaya gazeta,” obviously not the largest customer of Kaspersky Lab, suddenly fell prey to a giant hacker attack, he came to its rescue.

“Novaya gazeta” was just preparing to celebrate its twentieth anniversary. The editorial office suspected that someone would want to spoil the holiday, and turned to Aleksey Afanasyev, the head of the Kaspersky Lab's DDoS Prevention project, for help.

“Novaya gazeta” was never an easy client for “Lab”, but Afanasyev, who grew up during perestroika, liked this publication, one of shareholders of which was Mikhail Gorbachev. Afanasyev admired the bold reporters of the newspaper and was always ready to help them.

On the late evening of March 31, Afanasyev was returning home when a colleague called him and announced that the “Novaya gazeta" was being attacked. Over the next few hours, DDoS increased, but the site remained accessible to the readers of the newspaper thanks to Afanasiev and his team, which cut off the traffic of the attackers.

The next day the situation became worse. The volume of garbage traffic has increased dramatically, and hackers changed tactics. They launched a new type of attack - DNS Amplification (a popular form of DDoS, in which DNS service is subjected to garbage requests). The next two days the traffic that attacked the site of “Novaya gazeta” was a thousand times greater than usual. "The attack broke two data centers with our equipment for filtering incoming traffic," Alexei recalled.

Another call from a colleague caught Afanasyev in a computer store, where he bought some piece of iron. The news was alarming, the attack had become so powerful that it could bring down the entire Internet in Moscow. Then Afanasyev decided to cut off some of the traffic, so that only Moscow users had access to the site of "Novaya Gazeta".

By April 3, the attack reached unprecedented levels, 60 gigabits per second.
“Kaspersky Lab” asked the two large operators for help, asking for a special route for “Novaya gazeta” traffic inside the Moscow network. They agreed, and this helped to isolate the site from the attack. As a result, despite the unprecedented army of bots that produced a huge amount of garbage traffic and changed tactics several times during the attack, “Novaya Gazeta” was unavailable for only three hours at the peak of the attack.


In March 2013, Roskomnadzor first attacked social networks: Twitter received a demand to block five tweets and delete one account for propaganda of drugs and suicide. On March 15, Twitter reported that everything had been carried out. In this regard, Roskomnadzor issued a statement, where it noted that it was satisfied with the "constructive position" of Twitter. Two weeks later Roskomnadzor notified Facebook that if they did not delete the page "Suicide School" with jokes about suicide and caricatures, the service would be blocked. The service appeared on the Russian blacklist, and Facebook hurried to close the "Suicide School."

Gradually, the Kremlin expanded its control over the Internet, and it was a well-coordinated operation. Roskomnadzor led by Zharov and Ksenzov issued newer and newer warnings. At the same time, the Presidential Administration held backstage meetings with Internet companies, like the one to which Irina Levova was invited. State Duma deputies also joined in the development of repressive laws. On May 15, 2013, Ksenzov submitted to Roskomnadzor a report for the past year. According to the tone of the report it was obvious that Ksenzov was confident in the success of the chosen tactics. The resistance of Internet providers and users was weak. Only one thought worried Ksenzov: what if people learned how to circumvent censorship and were able to deceive the filtration system. After all, there are a number of ways to do this, "which are relatively easy to apply ..." However, he reassured himself: "The fact that it is technically possible for operators of websites and end users to bypass the blockage does not mean that in practice they will do it everywhere."

Zharov was even more optimistic. "Despite the loud and sometimes shocking attacks on these laws, in general, laws and work with them can be assessed positively," he said. And noted that "among the thousands of owners of these resources there was only a small number of those who publicly opposed the blacklisting. "There is only one case of going to court," he boasted, and then cited data from a public opinion poll according to which 82% of the polled Russians supported the law on blacklisting sites.

Zharov and Ksenzov had found an effective way of pressing the Internet companies, and they could not organize worthy resistance. Internet companies were not ready to oppose the policy of the authorities, as many years ago, when the state introduced SORM. Something with which Levenchuk first encountered repeated. Then the providers reconciled with the appearance of black boxes on their lines, now with the establishment of state censorship.

However, state censors soon had volunteer assistants. Since 2012, cyber cartels of the "League of Secure Internet" began to "patrol" the Network, searching for resources with banned information. "The League of Secure Internet" was founded by several Orthodox businessmen who considered censorship necessary to protect children from harmful content. Its initiation was approved by Shchegolev, then the Minister of Communications and Mass Media. In 2014, the League leader proudly announced that they had examined 37,400 complaints of malicious content.

Pro-Kremlin youth organizations were also drawn to internet censorship, which were useful as a recruiting base for patriotic hackers and trolls. In February 2013, the "Young Guard" the youth wing of Putin's "United Russia," launched a special project called "Media Guard." By March 2015, the volunteer army consisted of 3,699 people searching for sites with prohibited content. And with their help, 2475 web pages were blocked. The site of "Media Guard" even organized a special contest to see who could find the most sites for the Roskomnadzor blacklist. However, the main goal has become not the protection of children, but the search for sites with extremist content, which is often referred to as any information that the Kremlin does not like.