On September 30, 2026, the Russian government submitted the draft federal budget for 2027–2029 to the State Duma. The first reading is scheduled for October 29, so the figures may still change. We analyzed the version published on October 1 and compared it with the current budget law for 2026–2028. We focused on spending related to internet restrictions.

Our key findings:

• A year ago, the government planned to spend 9.9 billion rubles (about $118 million) on the blocking system in 2027 and 9.8 billion rubles (about $117 million) in 2028. The new budget allocates 19.9 billion rubles (about $237 million) for 2027, 19.8 billion rubles (about $236 million) for 2028, and another 19.9 billion rubles (about $237 million) for 2029. The government also allocated 20.0 billion rubles (about $238 million) for blocking in 2026.
• The budget also includes 1 billion rubles (about $12 million) for a backup data center for the system that allows Roskomnadzor (RKN, Russia’s federal regulator for communications, IT, and media) to manage the network centrally.
• The total for 2027 is 20.9 billion rubles (about $249 million). For comparison, Russia plans to allocate 8.7 billion rubles (about $104 million) to its federal Artificial Intelligence project in 2027.

Verstka (an independent Russian media outlet) was the first to notice the increase in blocking spending for 2027. Novaya Gazeta Europe calculated a total of about 60 billion rubles (about $715 million) over three years. Our own calculations for the blocking system match theirs.

Our calculations

We compared two documents:

• the current budget law for 2026–2028 (Federal Law No. 426-FZ, adopted on November 28, 2025);
• the draft budget law for 2027–2029 (bill No. 615-9), version of October 1, 2026.

Russia adopts its budget three years ahead. As a result, both documents contain figures for 2027 and 2028. We compared the following:

• How last year’s plans changed. How much the government planned for 2027 and 2028 last year, and how much the new bill allocates for the same years.
• 2026 vs. 2027. How much money the current budget allocates for 2026, and how much the government plans for 2027.

What we studied and how

• Documents and versions. Bill No. 615-9: the text, the explanatory note, Appendix 10 (departmental structure of expenditures, unclassified part), and Appendix 9 to the explanatory note. All files were posted on sozd.duma.gov.ru (the State Duma’s bill tracking system) on October 1, 2026. Law No. 426-FZ: the official publication on pravo.gov.ru (the official legal information portal) dated November 28, 2025, Appendices 11 and 16.
• Matching. We matched the lines of the two documents by budget classification code (the line’s “address”: agency, section, target item, and expenditure type) and by wording. The government’s figures for federal projects in Appendix 9 to the explanatory note almost exactly matched the unclassified part of Law No. 426-FZ.
• Network control spending. We count expenditures whose wording refers to traffic filtering or communications network management.

Escalating costs for the blocking system

One of the censorship expenditure items hides behind a long name: a subsidy to the federal state unitary enterprise Main Radio Frequency Center (GRChTs) for operating the internet security system. Here is what that means.

The Main Radio Frequency Center (GRChTs) is a state enterprise subordinate to Roskomnadzor (RKN).

The Automated System for Ensuring the Security of the Russian Internet Segment (ASBI) consists of two parts:

• technical means of countering threats (TSPU), the deep packet inspection equipment installed on telecom operators’ networks;
• a central management system that sends blocklists to the TSPU and collects data from them.

The 2026 budget already allocated 20.0 billion rubles (about $238 million) for blocking. The government had planned about 10 billion rubles (about $119 million) each for 2027 and 2028, but it now requests almost 20 billion rubles (about $238 million) per year. Notably, the original request for 2026 was also only 9.1 billion rubles (about $108 million). Lawmakers raised it to 20 billion rubles (about $238 million) in the second reading in November 2025.

Forbes reports on the planned modernization of ASBI through 2030. The authorities will replace previously installed TSPU units, deploy new systems at additional network nodes, purchase equipment, and develop new signatures for traffic recognition. According to Forbes, the Ministry of Digital Development (Mintsifry) did not comment on the spending increase.

Building a new data center

If the budget passes, GRChTs may receive a subsidy to build another data center for monitoring and managing the public communications network. The subsidy amounts to 1 billion rubles (about $12 million) in 2027 alone. The 2026–2028 budget does not contain such a line yet. Kommersant (a Russian business daily) reported on this earlier.

The Center for Monitoring and Management of the Public Communications Network is a division of GRChTs. Under a Roskomnadzor order, when “threats to the stability, security, and integrity” of the internet arise, the center issues instructions for centralized network management and monitors their execution. It stores the data in the “information system for monitoring and managing the public network.” According to Sostav (a Russian media and marketing outlet), the center also manages the TSPU and is building a system for monitoring traffic routes.

The budget does not explain why GRChTs needs another data center. We have two hypotheses.

1. A backup for the centralized network management mode. If the other data center fails, RKN will still be able to control routing, the national domain name system, and other infrastructure, up to and including isolating the Russian internet.
2. Expanding TSPU management. According to independent experts, the ASBI central management system already has two sites (a primary and a backup). As the number of TSPU units grows and older units get replaced, the system may need another management site.

As a result, centralized network management stops depending on a single data center, and blocking becomes harder to circumvent.

What did not get funding

Blocking expenditures are part of the national project “Data Economy and Digital Transformation of the State.” This large budget block combines public services, the government cloud, artificial intelligence, cybersecurity, and other digital projects. The government is cutting the national project itself. Against this backdrop, the growth in cybersecurity spending (primarily ASBI) stands out.

Only cybersecurity spending grew noticeably: by 11 billion rubles (about $131 million) in 2027 and by 10 billion rubles (about $119 million) in 2028 (this item includes ASBI costs). The government removed the federal project on internet access infrastructure from the national project.

Funding for artificial intelligence is also shrinking. Under the 2026 vs. 2027 metric, the federal Artificial Intelligence project drops from 9.1 billion rubles (about $108 million) to 8.7 billion rubles (about $104 million). Funding for breakthrough research by AI research centers drops from 3.5 billion rubles (about $42 million) to 2.6 billion rubles (about $31 million). According to The Bell (an independent Russian business outlet), the budget allocates twice as much to the blocking system as to all of AI. Our calculations confirm this: 19.9 billion rubles (about $237 million) for blocking versus 8.7 billion rubles (about $104 million) for AI development in 2027.

Other upcoming expenditures

Beyond blocking, the budget includes expenditures that expand surveillance of what people write online and give security agencies more access to their data.

The state pays the Center for the Study and Network Monitoring of the Youth Environment to monitor what people under 35 write online. The center was created in 2018 on Vladimir Putin’s orders. According to Mediazona (an independent Russian media outlet), prosecutors file administrative offense reports on online comments based on the center’s materials. In 2024, Meduza described how the center’s system, called “Profilaktika” (“Prevention”), tracks more than 540 million social media profiles of teenagers. Each teenager’s profile dossier notes whether they belong to opposition communities and whether they have liked posts criticizing the authorities. The system uses this data to calculate an “opposition coefficient.” According to Meduza’s source at the Ministry of Education, the center can identify a teenager even if they post under a pseudonym and can pass the data on to law enforcement. Since March 2026, authorities in the Sverdlovsk region have been monitoring 4.6 million schoolchildren’s profiles. As DOXA (an independent Russian media outlet) reports, citing 66.RU (a Yekaterinburg news site), the regional Ministry of Education signed a contract with the center to search for relevant content.

According to SecurityLab, the budget of the Center for the Study and Network Monitoring of the Youth Environment will grow by 26% compared with the amounts already planned for 2027 and 2028.

Recommendations for developers of circumvention tools

1. Check server availability on all major operators, not just one. Authorities install and update TSPU equipment unevenly, so blocking may work on one operator and not on another. Run a probe script on the main home internet providers (Rostelecom, MTS, ER-Telecom, Beeline) and on two or three mobile operators. Set it up to send failure alerts, for example via a private Telegram bot. See our analysis of the attack on VLESS for a detailed setup.
2. Test with a series of requests over 10–15 minutes, not with a single request. According to the TSPU documentation, protocol blocking works in two stages. The filter recognizes the protocol and sends the data to the central system, which compiles a list and sends it back out. The full cycle takes 5–15 minutes. A short test may finish before the blocking kicks in.
3. Measure packet loss and speed, not just whether the server is reachable. The TSPU can degrade a protocol instead of blocking it by dropping packets with a set probability. The connection still gets established, but it becomes almost unusable. Example measurement:
   
   curl -sS -o /dev/null -w 'connect=%{time_connect} tls=%{time_appconnect} speed=%{speed_download}\n' https://your_server/test_file
   
   Compare the result with a measurement taken from abroad.

4. Expect more frequent signature updates. Give users backup configurations with different masking domains (SNI) and client fingerprints. Distribute them via a single subscription link so that replacing a configuration does not require sending it out manually. See our analysis of VLESS for details.
5. Maintain a fallback option compatible with allowlists. In this mode, users can reach only addresses on the allowlists, and any protocol running on an address outside them stops working. We explained how this works in a separate review, and we described ways to bypass blocking without a VPN here.
6. Check your equipment for the risk of blocked management connections. We covered how this already happened with MikroTik routers in a separate review.

For hosting providers serving users in Russia

1. Monitor whether your subnets are reachable from Russia. Roskomnadzor periodically blocks hosting providers’ subnets, together with clients who have nothing to do with VPNs.
2. Give clients a fast way to move to an address in a different subnet (/24). This is the fastest response to subnet-level blocking, and some hosting providers already do this on request.
3. Be transparent with clients about blocking. If your range gets blocked, a status page listing the affected operators and regions will save time for both you and your clients.
4. Keep track of hosting regulation. We analyzed the proposed amendments on hosting VPN infrastructure separately.