Russia's Internet Censorship: Technical Analysis and Circumvention Methods

Summary

Russia's sovereign internet law (federal law number 90-FZ) has established a sophisticated censorship system implemented by Roskomnadzor (RKN) through TSPU devices equipped with EcoFilter DPI technology. Unlike China's Great Firewall, Russia's system operates "in-path" and closer to users (approximately 5 hops away), allowing it to directly throttle connections rather than using reset injections. This makes Russia's censorship harder to detect as intentional blocking. The TSPU devices, manufactured by RDP.r, are technically impressive as they can process over 100 Gbps of traffic—significantly more than similar systems. The censorship primarily targets political content deemed destabilizing to the government, including sites like CNN, X (Twitter), Google, and Voice of America.

Key Technical Details

• Deployment Strategy: Russia's censorship system must be deployed "in-path" and closer to users due to the country's ISP ecosystem, which has an order of magnitude more autonomous system numbers than China and more regionally distributed ISPs.
• Blocking Method: The TSPU devices can throttle connections directly because they're in the traffic path, making censorship appear like legitimate network disruption rather than intentional blocking.
• Regional Specificity: This deployment approach allows Russia to implement more targeted, region-specific censorship compared to China's system.

Circumvention Techniques

• Server-side Bypass: Researchers discovered that "simultaneous open" exploits can bypass censorship by exploiting ambiguities in TCP connection tracking. This technique involves coordinating an internal client with an external server to establish a connection that confuses the TSPU's state tracking.
• Client-side Bypass: A "5-ACK" strategy was accidentally discovered that appears to disrupt the TSPU's internal state during TLS handshakes. This method