Telecom operators have published “lists of socially significant services” (“Allowlists”) — those that remain available when mobile internet is disconnected. We reviewed four lists, compared them, and examined their legal basis. Interestingly, the mechanism predates its legal basis by several years, which doesn’t prevent it from working.

What is on the list

Until autumn 2026, the only way to piece together the contents of the allowlist (the list of services that stay reachable during mobile internet shutdowns) was from press reports. Now MegaFon and T2 (two of Russia’s largest mobile operators; T2 was formerly Tele2) have published their full versions, broken down by category. This is the first chance to see exactly what the state considers essential for its citizens.

Shopping and food	Ozon, Wildberries, Megamarket, Pyaterochka, Magnit, Dixy, Auchan, VkusVill, Azbuka Vkusa, METRO, Samokat, Kuper, Detsky Mir, Vkusno i Tochka (the successor to McDonald’s in Russia), Burger King
Transport	Russian Railways (RZD), Aeroflot, S7, Pobeda, Tutu.ru, Aeroexpress, 2GIS, the car-sharing services Delimobil, BelkaCar and Citydrive
Finance	Alfa-Bank, VTB, Gazprombank, Promsvyazbank, T-Bank, Mir (the national payment card system), Moscow Exchange, the Central Bank
Government and politics	Goskey (the state e-signature app), the websites of the government and the Presidential Administration, the Federal Tax Service, the Interior Ministry, the Emergencies Ministry, mos.ru, the remote electronic voting platform, Vybory (the elections portal), GIS ZhKKh (the state housing and utilities information system), “Direct Line with Vladimir Putin”
Television	Channel One, NTV, TNT, STS, REN TV, Match, Zvezda, Spas, RT, Duma TV, Solovyov Live
Entertainment	Kinopoisk, Dzen, Rutube, VK Video, Okko, Ivi, Premier
Media	TASS, RIA Novosti, Izvestia, Rossiyskaya Gazeta, Kommersant, RBC, Lenta.ru, Gazeta.Ru, Komsomolskaya Pravda, Argumenty i Fakty, Moskovsky Komsomolets, Rambler, RT, Obyasnyaem.rf (a government explainer portal). MegaFon’s version adds Vedomosti and Parlamentskaya Gazeta.
Education	Ruwiki (a state-friendly fork of Russian Wikipedia), the Znanie Society

Notably, Sber is missing from the lists. The country’s largest bank, with the biggest customer base, is not included, even though VTB, Alfa-Bank and T-Bank are. Industry reviews attribute this to Sber’s failure to meet the technical requirements for content delivery infrastructure. Mintsifry (the Ministry of Digital Development) has given no official explanation.

Naturally, the allowlists do not include foreign messengers and platforms (Telegram, WhatsApp, YouTube), Google services, or independent media.

Who owns what

We categorised about 130 entries from the two published lists by owner. The result reveals the ownership structure.

The state directly owns 33 entries: agency websites, Gosuslugi (the state services portal) and state information systems. Another 15 are state TV channels and news agencies: Channel One, VGTRK (the state TV and radio holding), the Defence Ministry’s Zvezda, TASS, RIA Novosti, Rossiyskaya Gazeta, RT and Obyasnyaem.rf.

Next come four private holding companies with ties to the state.

Yandex has 17 entries, the largest block after the state. T2 even gives the holding’s services their own category: Taxi, Search, Eats, Lavka, Music, Navigator, Maps, Travel, Pay, Pro, Edadeal, Telemost, Disk, Books and Mail, plus Kinopoisk and Auto.ru in other sections. That is one in every eight lines of the list.

Gazprom-Media has eight resources: TNT, TV3, Pyatnitsa, Match TV, MUZ-TV, Rutube, Premier and Yappy.

VK has six: VK, Odnoklassniki, Mail.ru, the Max messenger, VK Video and Dzen (a former Yandex service that the holding took over in 2022).

Sber’s bank is absent, but Sber has four other entries: Megamarket, Kuper, Rambler and Okko.

Finally, National Media Group has three: REN TV, Channel Five and Izvestia.

In total, the state or these four holdings own 86 of the 131 entries, or two-thirds of the list.

Mintsifry head Maksut Shadayev has said that popularity is the main selection criterion. But in Russia, popularity and belonging to a large ecosystem almost coincide. So a formally neutral criterion produces a list of assets owned by a handful of groups. Bingo!

Identifying the owner also has its nuances. Ownership structures of Russian assets are often deliberately tangled. In May 2022, the online cinema Okko passed from Sber to JSC Novye Vozmozhnosti, a company with an authorised capital of 10,000 rubles (about $120) controlled by an individual. We still count Okko in the Sber block. Otherwise, an asset moved out from under sanctions would end up in the same basket as genuinely independent players. Zvuk, SberCloud and several other assets went the same way: they dropped the “Sber” prefix from their names and kept operating without being removed from app stores. The reason is that Sber is under sanctions. By the same logic, Rambler’s media outlets, previously sold to Sber, are now registered to an individual. Our count therefore reflects actual membership in ecosystems rather than registry records.

One more detail. Yandex has a reason to be on the list that has nothing to do with the popularity of its services. The company’s cloud platform hosts state information systems. Excluding its addresses from the allowlist would bring down Gosuslugi itself.

Who decides what gets on the list

Mintsifry head Maksut Shadayev promised that the list would include “all resources needed for daily life”: marketplaces, delivery services, taxis. According to the minister, popularity is the main criterion, and the list will be “updated weekly.” Shadayev also claims that all websites go through verification by “other authorised bodies.”

The ministry’s reply to members of parliament makes clear which bodies these are. A resource gets on the list if it meets the security agencies’ requirements and has approval from the relevant ministries.

Sarkis Darbinyan, a lawyer and co-founder of Roskomsvoboda (a Russian digital rights organisation), noted in August 2025 that the government would decide who gets on the lists, and that the FSB (Federal Security Service) would welcome the measure: “Right now they have to deal with messengers that use end-to-end encryption, and it’s not always clear what to do about that.”

There is no public application procedure. Companies cannot ask to be included directly. They have to ask the relevant ministry to petition Mintsifry on their behalf.

The mechanism came before its legal basis.

The “sovereign internet” law (Federal Law No. 90 of May 1, 2019) contained no provisions on allowlists. The authorities began using the mechanism in individual regions in 2022–2023, and on a mass scale in spring 2025, when mobile internet shutdowns became routine.

Shutdowns existed as a de facto practice with no legal basis. Legislative changes in recent years have effectively legalised this practice:

• Government Resolution No. 1667 of October 27, 2025, which took effect on March 1, 2026, sets out the rules for centralised management of the public communications network (our analysis, another of our analyses).
• A law passed by the State Duma on February 17, 2026, and approved by the Federation Council the next day gave the FSB the right to demand that operators immediately disconnect a specific user on the grounds of a “threat to the security of citizens and the state.” The provision covers mobile and fixed-line internet, as well as telephone service.

The same law released telecom operators from liability for losses that subscribers suffer because of shutdowns. Now no one can file a claim. All for the convenience of citizens.

State Duma members from the Communist Party (KPRF) asked the government and the FAS (Federal Antimonopoly Service) to explain how it compiles the lists. Their argument is simple. Resources on the list keep working while their competitors do not, creating an economic advantage granted by the state.

In the words of their appeal, resources on the lists gain the ability to monopolise the market. For example, it is unclear why Avito made the list while its competitor Yula did not. The FAS did not say whether the allowlist complies with competition law. Perhaps the reason is that the law “On Communications” now includes amendments that allow departures from competition rules for security reasons.

It all works badly, and even officials say so

According to the Internet Protection Society (a Russian NGO), by mid-2026 the share of successful connections in allowlist mode did not exceed 10%. The reason is technical. The equipment has to inspect every data packet and check it against the database of permitted addresses, which creates a huge load. Experts also point to another problem. By the time a new address pool for a bank or a major service gets approved and added to the filters, it may already be outdated.

The most telling assessment came from Vyacheslav Gladkov, governor of the Belgorod region. He quoted residents’ complaints (the allowlist is only partially functional, and the drones keep flying just as before) and said that he fully agreed with all of them. Nobody has published any research showing that shutdowns improve security.

Fixed-line internet: not yet, but technically ready

In March 2026, press reports claimed that Moscow home internet providers had started rolling out allowlists. Mintsifry called this fake news. Its reasoning was technical: drones do not use wired technologies, so there is simply no need to restrict them. Rostelecom (Russia’s largest state-controlled telecom operator) also did not confirm the reports. Later, however, reports appeared that the company was ready to switch home internet to allowlists if Mintsifry decided to. These reports never went beyond rumours.

Notably, resolution No. 1667 covers the public communications network as a whole, without separating mobile and fixed-line networks. The only thing protecting fixed-line internet today is the drone argument. If that argument stops working, if the threat is reframed, or if the authorities get tired of pretending, no legal obstacles will remain.

Circumvention: what worked and why it stopped

The most common question about allowlists is whether some VPNs really can get through them. The short answer: they could, for about a year, and then that was shut down.

How did it work?

The filter lets through traffic to permitted addresses. So if you place a server at an address already on the list, traffic to it gets through.

That is exactly what people did. They rented virtual machines from Russian cloud providers whose address ranges made it onto the list along with permitted services. The connection first went to such an address inside the country and was then relayed abroad. To the filter, it looked like a request to an approved resource.

The method was described openly, with instructions. A scheme relaying traffic through a Russian cloud was posted on Habr (a popular Russian tech community site), and a GitHub discussion on it gathered hundreds of replies.

How was it shut down?

On January 24, 2026, many services simultaneously lost access to such servers. Kod Durova (a Russian tech news site) suggested that the authorities had ordered cloud providers to separate the addresses used by services on the list from all the others.

In online discussions, it looked mundane. The method worked for two weeks. Then the cloud addresses stopped responding, even though the provider’s own website still opened.

By that same January, Roskomnadzor (Russia’s internet regulator) reported more than 400 blocked circumvention services, a 70% increase over three months.

In short, allowlist circumvention exists as a series of temporary windows rather than a stable technique. The more widely people learn about a window, the faster it closes. One more detail gets less attention: services on the list can themselves restrict access if they see signs of circumvention. If a provider spots unwanted activity on its servers, it will quickly block access.

Be careful with catalogues of “working” VPNs

Along with demand came websites that publish rankings of services that supposedly bypass the lists, complete with uptime percentages and user voting.

Treat them with caution. By design, such a catalogue is a constantly updated map of what works right now and with which operator. This is exactly the information that the people doing the blocking need. Instead of searching for weak spots, they get them in a list, sorted by popularity.

Some of these rankings are trustworthy. Usually, though, you cannot say for sure who owns a service or whether the owner’s intentions are clean. We have no evidence that any of these rankings is a setup. But a model in which users themselves report which circumvention methods still work ultimately backfires, whatever the owner intends.

This general rule applies far beyond Russia: once a working circumvention method goes public, its lifespan shrinks.

What this means for developers of VPNs and circumvention tools

Here is the key difference from familiar blocking. A regular block bans specific resources, and everything else works. Allowlist mode works the other way around: everything is banned except what is on the list. This changes the problem itself.

By definition, VPNs do not work in this mode. Circumvention servers are not on the list and never will be. What’s more, a message that MegaFon sent to subscribers in March said that services on the list are available when the VPN is turned off, the account balance is positive, and an LTE connection is present.

The last condition warrants special attention: the list does not work on a weak signal. When speeds in a region are throttled down to EDGE, permitted services stop loading along with everything else.

Filtering happens at two levels: by domain name and, in the stricter version, by IP addresses and entire autonomous systems. The second level means that whole ranges get blocked, not just individual servers. In February 2026, a researcher under the handle 0ka scanned one provider’s network and found that 391 autonomous systems fell under the restrictions instead of the expected 72. That is more than 225 million addresses.

Practical implications

Transport solutions designed to disguise themselves as ordinary traffic do not help in this mode. There is nothing to blend in with, because there is no ordinary traffic and no connection. The goal shifts from “being indistinguishable” to “being inside a permitted range,” and that requires a completely different kind of engineering.

The story of relaying through Russian clouds also showed this approach’s limits. It works only until the permitted ranges are split into those that serve the list and all the others. Once providers were required to make that split, the method disappeared within a day.

Fixed-line connections remain the main route, which is exactly why the home internet story is worth watching. As long as it stays untouched, people have a channel that the restrictions bypass.

Prepare in advance. During restrictions, you can no longer download an app, set up a connection, or save maps and documents. Not every operator includes app stores on its list, and large downloads fail on a degraded connection.

Remember the value of measurements, too. The list changes weekly, operators implement it differently, and no public source exists. Any reachability measurements you take, tagged with time, region and operator, add to a picture that nobody else will put together. For a quick check of the mode, you can use our tool.

What we don’t know

• The full contents of the list. Estimates vary. The first version included 57 resources, and by spring 2026 the list had passed one hundred. The current estimate is around five hundred, but there is no official figure.
• The procedure for removal from the list. Shadayev said resources can be both added and removed, but we found no public examples of removal.
• Whether the contents differ by region: MegaFon publishes files broken down by region, but we couldn’t compare them.
• What will happen to fixed-line internet?
• Whether any working circumvention methods remain, the publicly described ones have been shut down, but that does not mean none exist.