Russia Passes Measures to Restrict the Use of VPNs and Similar Technology

Russian President Vladimir Putin has recently signed into law certain amendments to Federal Law No.149-FZ on Information, Information Technologies and Protection of Information (the “IT Law”). The measures introduced by Law on Amendments to IT Law No.276-FZ, dated July 29, 2017 (the “Law on Amendments”) grant significant powers to Russian regulatory authorities to potentially pursue persons/entities on the Russian territory who utilize or provide access to information systems and resources which, in turn, facilitate access to information and resources that are otherwise restricted or prohibited in Russia. The most popular technology that can, and often does, facilitate access to restricted information is a virtual private network (VPN). But companies and individuals also use VPNs and the like extensively to ensure the secure exchange of information and access to sensitive proprietary information, and for those users the new regulations raise legitimate concerns. 

The purpose of the new provisions, however, is not to completely outlaw VPNs for users located in Russia. The Law on Amendments supplements the IT Law with a new Article 15.8, which does not restrict the use of VPNs and similar technology per se, but seeks to prevent instances when such specialized technology is used as a means of accessing restricted or prohibited information and web resources. To this end, the Russian communications supervisory authority Roskomnadzor is working on setting up a public register where it will place information resources that are deemed restricted in Russia. Once the register is operational, Roskomnadzor will have the authority to reach out to and require cooperation from hosts of such sites and other persons on whose resources Roskomnadzor identifies VPNs (or similar technology) which facilitate access to restricted information placed on the register. This in turn would allow the Russian authorities to identify the owners of VPNs and demand that they cease providing access to restricted information through their virtual networks. Thus the Law on Amendments works primarily to establish legal grounds for Russian authorities to block VPNs which are used as access points to websites and resources that are otherwise restricted or prohibited in Russia (and as such included in the register). 

To ease concerns of legitimate users of VPNs, the Law on Amendments expressly provides for an important carve-out in Article 15.8(17), namely that the restrictions on VPNs will not apply to Russian state actors or to those owners or operators of VPNs who grant access to their virtual networks only to specific groups of users, provided that those VPNs are being used as technological support for their owner’s/operator’s business. This exception should provide a safe harbor for those corporations and individuals who, for example, set up VPNs to safely and securely transfer sensitive information or to provide remote access to corporate servers because, in these cases, only a set number of authorized users would have access to such virtual networks (in other words, a random unauthorized user is unable to access those VPNs) and their use should be regarded as a component of the technological means used to protect sensitive information during the regular course of business. Under these circumstances, the Law on Amendments should not restrict the ability of companies present in Russia to continue using VPNs. 

While the Law on Amendments has already taken effect, its provisions and restrictions concerning VPNs come into legal effect as of November 1, 2017, and the register of restricted information should become operational by that date as well. We will monitor how the Law on Amendments will apply in practice once all restrictions become effective. If you require assistance with implementing policies and procedures to address the use of VPNs, please contact the lawyers listed below.