China spent years making VPNs rare. Russia spent years making them ordinary. That is the trap Moscow is in now, and it is a trap the Kremlin built for itself.

In a 2026 Carnegie Politika commentary, journalist Maria Kolomychenko argued that Russian authorities accidentally ran one of the most successful digital literacy campaigns on earth. They did not set out to teach tens of millions of people how to hop a firewall. They set out to block more of the internet. The lesson stuck anyway.

A tool for specialists became small talk

An April 2026 survey by the independent pollster Russian Field found that more than half of Russians aged eighteen to forty-five said they used a VPN. Seventy-four percent of Russians overall said they knew what a VPN was. In March 2026 alone, people in Russia downloaded VPN apps more than 9 million times.

Those are not dissident numbers. They are household numbers. Even pro-Kremlin voices have admitted that VPNs are now understood by people who used to struggle with the internet. Which service still works this week has become the kind of chat you overhear on a bus.

That is a very different picture from a sealed national intranet. It is also the reason the state’s later crackdown keeps missing. You can hunt a niche. You cannot easily hunt a habit.

The state taught the country to switch the tunnel on

Russia began systematic online censorship in 2012. Officials assumed only a small group of determined readers would bother to get around the blocks, and that those people would find a way regardless. For a while that bet held. Blocking a political site or two did not change how ordinary people lived online.

The bet collapsed after the full-scale invasion of Ukraine in 2022, when the regime moved against platforms tens of millions actually used: Instagram, Facebook, YouTube. People who had never cared about circumvention suddenly cared a great deal. A VPN stopped being a specialist gadget and became a consumer product. People who were not technical learned to install an app, pay for a subscription, switch protocols, and follow Telegram channels that posted the week’s working setups.

Many users now turn a VPN on before they open the internet at all. The simplest proof that the campaign “worked” is the one the censors cannot stand: Instagram and YouTube, blocked for years, have remained among the most popular sites in the country.

Once a government trains that reflex, it does not get the old internet back by issuing a memo.

First they blocked the easy VPNs. Then the hard ones showed up.

By early 2023, the Kremlin could see how widespread the practice had become. The response was patchy. Roskomnadzor, the communications watchdog, periodically blocked VPN websites and IP addresses, pushed apps out of the App Store, and even labeled one service, HideMyName, a “foreign agent.”

That scattershot pressure did have an effect, just not the one the state wanted. Popular foreign VPNs built mainly for privacy — Windscribe and Cloudflare WARP among them — became unreliable inside Russia. Those products were not designed as censorship-evasion tools. When the filter tightened, they broke.

What replaced them was worse for the censors. Specialists, many of them IT workers who had already left Russia, started shipping services built specifically to survive Russian blocking. After each new wave, updates followed. The cat-and-mouse game moved from “Can I find a VPN?” to “Which protocol still looks like normal web traffic?”

A 92 percent target and a protocol that will not sit still

In 2025 the regime tried to look more serious. Roskomnadzor was told to develop signatures that could filter VPN traffic and to hit 92 percent blocking effectiveness by 2030. Kolomychenko notes that a round number like that is classic bureaucracy: it lets an agency show that money was spent on the assigned mission, whether or not the mission is actually winnable. The money is real enough — several billion rubles a year.

On paper, the filters can spot VPN use by protocol fingerprints, IP addresses, mismatches between claimed location and real location, and similar tells. In practice they struggle with modern setups such as VLESS, which is built to hide inside ordinary HTTPS. Reports have also said Roskomnadzor’s existing filtration gear is already stretched. The agency is looking at machine learning to keep up. The other side is not waiting. VLESS has been paired with XTLS and REALITY, which make the traffic even harder to pick out of the regular web.

This is the part of the story that gets lost in “VPN banned” headlines. A privacy VPN that announces itself as a VPN is relatively easy to knock over. A tunnel that looks like a normal encrypted website is a different problem. Every ruble spent on last year’s signatures buys less of this year’s traffic.

When the tech stalls, the paperwork multiplies

The authorities can see the technical ceiling. So they have reached for administrative levers.

In mid-2025 Russia banned ads for VPN services, and using a VPN was made an aggravating circumstance for some crimes. After the state slowed Telegram in early 2026 — which only sent more people looking for tunnels — the ideas kept coming. Mobile operators were told to cut off Apple ID payments, a common way to buy a VPN subscription. Russian companies were pushed to lock VPN users out of their own sites. There was a proposal to charge extra for the “foreign traffic” a VPN generates. Operators were made to pledge not to expand links with Europe. Fines for users have been floated as well.

None of that is a coherent strategy. It is a pile of tactics. Ban the ads. Break the payment. Punish the user. Wall off the shop. Tax the bytes. Each move treats a symptom. Together they advertise panic. They also create the same contradiction other governments have hit: if you make a VPN a reason you cannot pay a bill or open a bank site, you train people to toggle it off for errands and back on for everything else. You do not unteach the tool. You make it part of the daily choreography.

The censors are no longer fighting a website. They are fighting a habit.

Kolomychenko’s core point is the one that matters for anyone watching internet control in 2026. Roskomnadzor is not mainly fighting opposition media or Western platforms anymore. It is fighting the everyday routines of tens of millions of people the state itself trained.

That is a harder opponent than a blocked domain. A blocked domain is a list. A habit is a population. People who learned to install an app, swap a protocol, and check a Telegram channel for this week’s working config will not go back to a smaller internet because an agency published a KPI.

Neither side is likely to get a clean win. The near term looks like attrition: better filters, then better camouflage, then another filter, then another workaround. The urgency may fade when the Kremlin’s attention moves somewhere else. The skill will not. Once a country knows how to open a private tunnel, that knowledge sits on millions of phones, waiting for the next block.

What this looks like from the other side of the wall

There is a blunt lesson here, and it is not that every government that blocks a site immediately creates a VPN nation. China shows the other path: squeeze the tools early, license the leftovers, and keep unsanctioned use to a sliver. Russia shows what happens when you block the apps people already live in, then spend years shrugging at the bypass.

A VPN is not magic. A noisy, easy-to-fingerprint service can be disrupted. A state-issued tunnel can be watched. Payment blocks and site lockouts can make the day-to-day annoying. None of that changes the deeper fact Kolomychenko is describing. If the open internet is useful, people will keep reaching for it. If the government is the one that made the open internet scarce, it is also the one that taught the workaround.

If you can still choose a VPN without a license, that choice is the point. Use a service you picked, not one a regulator assigned. Prefer modern protocols that do not advertise themselves. Keep more than one option ready. Do not confuse a connection that merely works with a connection nobody can inspect.

Moscow wanted a quieter internet. It got a country that talks about protocols in line at the shop. That is not a glitch in the censorship machine. That is the machine teaching people how to walk around it.