What Kommersant reported

The goal is for AI to analyse the features of up to 70% of all blocked VPN services. In other words, the target refers to AI analysing the features of most services already being blocked (not 70% of all VPNs). Kommersant (a major Russian business daily) has not specified how ‘blocking effectiveness’ was defined (the share of detected services, the share of blocked connections, or classification accuracy). Citing a source familiar with the initiative, Kommersant attributed the idea to the Ministry of Digital Development (Mintsifry).

The Ministry of Digital Development responded cautiously. It said that the “current version of the draft national plan for the adoption of AI technologies contains no such information.” Kommersant’s source explained that government agencies proposed various measures for the national plan, and these measures “may never be implemented.” Roskomnadzor (RKN, Russia’s federal regulator for media, telecom, and the internet) did not respond to the newspaper’s request.

The document itself would help clarify the issue, but the draft national AI adoption plan has not been published anywhere. Kommersant is the only source. However, an approved document covers the same infrastructure: the Ministry of Digital Development’s work plan for 2025–2030 (Order No. 121). It sets targets for ASBI (the automated system for ensuring the security of the Russian internet segment), which is the system used to block VPNs. Still, the plan does not mention VPNs or circumvention tools. According to Kommersant, ASBI “consists of TSPUs installed on telecom operators’ networks.” In other words, traffic is filtered by the very technical means used to counter threats (TSPU, the DPI equipment Roskomnadzor installs on ISP networks). ASBI is the name budget and planning documents use for the system as a whole.

VPN blocking targets and funding

In May, we wrote that Roskomnadzor wants to block up to 92% of VPNs by 2030. More precisely, it aims to reach an “average level of effectiveness in restricting access to VPN circumvention tools through signatures.”

Are the 92% and 95% figures related? They definitely cannot be compared directly. In Roskomnadzor’s document, 92% refers to signature-based blocking. According to Kommersant, the 95% figure in the draft national plan refers to the effectiveness expected from AI-based analysis of VPN characteristics.

ASBI itself is set to expand. Kommersant reported in March on the Ministry of Digital Development’s activity plan for 2025–2030 (Order No. 121 of February 19, 2026). Under this plan, ASBI’s traffic-processing capacity is expected to increase approximately 2.5-fold, from 382.2 Tbps in 2025 to 953.9 Tbps in 2030. The plan sets the share of Russian internet traffic passing through ASBI at 98% in 2025 and 100% from 2026 onward. We wrote about this as well.

Meanwhile, funding for blocking systems continues to grow.

Kommersant cites the explanatory note to the new draft federal budget. According to the note, most of the more than 89.9 billion rubles (about $1.12 billion) allocated to the “Cybersecurity Infrastructure” federal project for 2026–2029 is to go to GRChTs (the Main Radio Frequency Centre, a Roskomnadzor subsidiary that operates the blocking infrastructure) as subsidies for ASBI. By our calculations, the same draft budget for 2027–2029 allocates 19.9 billion rubles (about $247 million) to the blocking system in 2027. A year earlier, the government had planned 9.9 billion rubles (about $123 million) for that year. Another 1 billion rubles (about $12 million) is set aside for a backup data centre. The “Artificial Intelligence” federal project, by contrast, shrinks from 9.1 billion rubles (about $113 million) in 2026 to 8.7 billion rubles (about $108 million) in 2027.

Roskomnadzor is developing a machine-learning-based traffic filtering system.

In January 2026, Forbes reported that Roskomnadzor intends to build and deploy a machine-learning-based traffic filtering mechanism and spend 2.27 billion rubles (about $28.2 million) on it.

It is not entirely clear how this will play out. One of Kommersant’s sources familiar with the situation noted that the agencies’ plans “may never be implemented.” But even if the current idea of cutting off VPN access with AI stays on paper, we know that Roskomnadzor still wants to continue cracking down on circumvention tools, including with the help of AI.

How VPNs are currently detected using indirect indicators

TSPUs on telecom operators’ networks analyse traffic using deep packet inspection (DPI). VPN detection methods have changed over the past year. In November 2025, Roskomnadzor blocked VLESS (one of the protocols that disguise circumvention traffic as ordinary encrypted connections) using signatures, that is, characteristic bytes in the connection. On February 17, 2026, the agency switched from direct signatures to indirect indicators. Since August, it has been blocking entire subnets of hosting providers. Judging by differences in VPN access, TSPU updates reach different networks unevenly.

The blocking of Delta Chat shows what indirect indicators look like in practice. The TSPU system suspends a TLS connection for 120 seconds if three conditions are met:

• the server’s IP address belongs to a “suspicious” subnet or autonomous system,
• the client’s TLS fingerprint looks suspicious,
• there were more than three parallel connection attempts to the same SNI (Server Name Indication) within the last 60 seconds.

Kommersant claims that traffic analysis currently relies on “intelligent algorithms” rather than AI. It does not explain what these “intelligent algorithms” are. Meanwhile, machine learning (which Forbes wrote about in the winter) is generally considered a form of AI.

Our research

We are independently testing how VPN filtering works now, before AI is possibly introduced. We are checking whether current VPN filtering is rule-based, as Kommersant wrote, and what will change if AI is added. We are taking a “baseline snapshot” and recording how blocking works today. Repeat measurements will then let us notice a shift to a statistical model, if one happens.

Each test is tied to a specific claim in the article:

• Rules or a model. Kommersant writes that traffic is currently analysed by “intelligent algorithms” that are not AI. Whatever one calls them, the testable question is different: does the filter work on predefined rules or on a statistical model? If it uses rules, an identical connection from the same location will produce the same result every time. The thresholds from the filter reconstruction we described in the Delta Chat case will also be reproducible. Consistent variation in outcomes under unchanged conditions would be the first sign of a statistical classifier.
• Single indicators or multiple signals. According to Kudryashov, an AI model “aggregates dozens of weak signals,” while a rule triggers on specific conditions. We change one connection parameter at a time (the client’s TLS fingerprint, the server’s subnet, the number of parallel connections) and check whether changing any single one of them flips the outcome. If it does, the filter behaves like a rule-based system.
• Collateral damage. Kudryashov and Kommersant’s source in the networking industry both see blocking of legitimate traffic as the main risk. According to Kudryashov, corporate VPN traffic is “statistically similar” to circumvention traffic. We are checking whether filtering already affects “corporate” protocols now, without using AI. This gives us a “baseline” against which we can compare any rise in false positives.
• How “effective” blocking is in practice. We cannot measure the 92% or 95% figures the way the government calculates them, because the methodology has not been published. But we can show what share of connections over each circumvention protocol gets through from each geographic location, and how this varies by city and access type.

We will publish the results and conclusions in an update to this article.

What AI detection will change, and where it will get things wrong

Judging by our filter reconstruction and Kommersant’s data, TSPUs currently block VPNs based on a set of predefined conditions. AI detection works differently. A model is trained on traffic samples and decides whether a connection looks like circumvention traffic. The current equipment is not enough for this approach.

Sergey Kudryashov, a partner at the consulting firm Strategy Partners, told Kommersant that “DPI equipment at operators’ nodes alone will not be enough for AI detection of VPN services.” It would take “a separate computing platform on top of TSPU.” According to him, this platform needs three layers: “collection and storage of petabyte-scale telemetry,” a cluster for training and retraining models, and “a mechanism for delivering updated models to filtering nodes.” Kudryashov sees the main advantage of such a model in the fact that it “aggregates dozens of weak signals.” This lets it notice new services that are not yet on rule lists.

Kommersant’s source in the networking industry sees practical value in AI: “it makes it possible to respond faster to changes in network activity.” But at large traffic volumes, he says, even a small percentage of analysis and blocking errors “means a lot of blocked legitimate traffic.” He estimates the current error rate at 5–6%.

Kudryashov explains where such errors come from: “corporate VPN, cloud access, and voice traffic are statistically similar to circumvention traffic,” and “for businesses, the cost of an error is higher than letting a home VPN through.” He also refers to studies in which recognition quality drops sharply when some of the observed features are hidden: “Masking a single field in the TLS header reduced accuracy to about 38%.” Kommersant’s article does not say which studies he means.

Recommendations for circumvention tool developers

As Kudryashov describes it, a machine-learning classifier collects dozens of weak signals. The studies he cites show that accuracy drops when some features are hidden. So the developer’s task remains the same: minimise any differences between circumvention traffic and ordinary browser traffic.

• Client TLS fingerprint. According to the filter reconstruction we described in the Delta Chat case, a suspicious fingerprint can be a blocking condition. The fingerprint should match popular browsers and be updated accordingly. It should not stay static for years.
• Connection pattern. According to the same reconstruction, the filter may trigger on a series of parallel TLS connections to the same SNI within a short period. Test the number of simultaneous connections and the intervals between them as carefully as the packet contents.
• Infrastructure. Since August, Roskomnadzor has been blocking entire subnets of hosting providers. According to the same reconstruction, the filter may also treat an IP address that belongs to a “suspicious” autonomous system as an indicator. Distribute servers across multiple providers and autonomous systems.
• Backup configurations. In our analysis of VLESS blocking, we recommended giving users backup configurations with different SNIs and browser fingerprints. Distribute them through a subscription link so that the client fetches up-to-date settings on its own.
• Availability checks. In the same analysis, we advised checking TCP reachability and the full protocol handshake separately. Test with a series of requests over 2–3 minutes, because some blocks kick in with a delay. Monitor performance on several wired and mobile operators at once.

Recommendations for censorship researchers

The national plan has not been made public. So if AI filtering is rolled out, it will have to be detected through network behaviour rather than documents.

• Deterministic filtering. The filter reconstruction we described in the Delta Chat case relies on thresholds: more than three parallel connections within 60 seconds and a 120-second freeze. These values remain working hypotheses, so the first step is to check whether they reproduce the effect. If the thresholds do not reproduce and the blocking of identical connections looks probabilistic, that is a reason to test the hypothesis of a statistical classifier.
• False positives. Both Kommersant’s source and Kudryashov see blocking of legitimate traffic as the main risk. Measure not only circumvention tools but also corporate VPNs, cloud access, and voice traffic. This is where classifier errors will show up.
• Reaction speed. Kommersant’s source in the networking industry sees AI’s advantage in responding faster to changes in network activity. In every measurement, record the time between the appearance of a new protocol or configuration and the start of its blocking.
• Uneven rollout. We have already seen that TSPU updates reach networks unevenly. Take measurements across several regions and operators. Otherwise, a change affecting a single provider could easily be mistaken for a system-wide change.
• Documents and funding. The final version of the national plan, spending of the GRChTs subsidy for ASBI, and expenditures on the machine-learning filtering mechanism that Forbes reported on will show whether the task has moved from draft to budget.