On October 27, 2026, subscribers around Okhotny Ryad, Kitay-Gorod, Arbat, and the Garden Ring could only open services from the “allowlist,” Kommersant (a major Russian business daily) reported. The day before, on the evening of October 26, the Ministry of Digital Development (Mintsifry) announced in its channel on the MAX messenger (a state-backed Russian messaging app) that mobile internet in Moscow inside the Third Ring Road (TTK) might be restricted on October 27–29. According to the announcement, restrictions could apply “during the day” from 11:30 on October 27 and 28 and from 9:30 on October 29.

The ministry linked the restrictions to security at the 8th summit of the Gas Exporting Countries Forum (GECF) and the 3rd Russia–Africa summit. It promised that “the most popular and socially important services and websites from the ‘allowlist,’ as well as voice calls, home internet, and Wi-Fi will continue to work normally.”

Starting this year, operators must cut off communications at the request of the FSB (Federal Security Service) and the FSO (Federal Protective Service, which guards top officials). Operators bear no liability to subscribers for these shutdowns.

Restricting mobile internet has become a routine security measure for events in Moscow

As it did prior to May 9, the Ministry of Digital Development announced the restrictions in advance and cited security. This time, the ministry even said when and where communications would be cut. Moreover, during the May holidays, Moscow’s mobile internet was restricted completely. Now residents were left with the “allowlists.”

Restrictions on October 27–29: what was announced and what actually happened

Notably, in its post the Ministry of Digital Development called the restrictions possible and did not say when they would end or which operators they would affect. Journalists working in Moscow reported that on October 27, mobile internet did not work in the city center and inside the Garden Ring and the Third Ring Road, except for allowlisted websites.

The outage tracker Sboy.rf counted 640 complaints in Moscow on October 27 between 12:30 and 15:30. Journalists from the “Ostorozhno, Moskva” (“Careful, Moscow”) channel measured connection speeds via Speedtest at the same time: 225.47 and 12.13 Mbps. However, they did not specify the operator or the exact time. According to the outlet, the complaints coincided with the announced restriction period, “but the cause of each specific slowdown has not been confirmed.” Users in central Moscow complained to Business FM (BFM, a business radio station) about delayed payments. They also said that in some places they could not rent Whoosh scooters: the app reported that “you cannot take a ride in this zone.” The Chekhov Moscow Art Theatre asked audience members to print their tickets “due to possible internet restrictions.” Taxi fares rose by a factor of 1.5 to 2.

On the afternoon of October 28, journalists from RBC (a major Russian business media outlet) recorded slower mobile internet in several Moscow districts and found that the network was running in “allowlist” mode. Restrictions were reported near the Shosse Entuziastov, Shabolovskaya, Savyolovskaya, and Novokuznetskaya metro stations, among other places. Beeline even sent text messages to subscribers: “Internet may be temporarily restricted: security measures are in effect in your region.”

On the afternoon of October 29, the restrictions returned but were less severe. In many parts of central Moscow, websites outside the “allowlist” opened without problems.

Apart from Beeline’s text messages, operators have still made no public statements.

Our measurements and open data on network outages

Our in-house tools check the availability of 33 websites about every five minutes from five data center vantage points. One is in Moscow outside the Third Ring Road, one each in St. Petersburg and Novosibirsk, and two are in Germany. We currently have no mobile or home vantage points in Moscow. Data center vantage points are apparently not representative for “allowlist” mode: the mode applies to mobile subscribers, and a data center server is not connected to a mobile network.

We compared the announced hours on October 27–29 with the same hours on October 22. Our Russian vantage points have no earlier records, so that day serves as the baseline. There is no single published “allowlist,” so we tested our own list of 11 domains. At the Moscow vantage point, websites from this list opened in 71.3% of checks during the restriction hours and in 71.6% of checks on October 22. Control websites opened in 99.9–100% of checks. Values below 100% are expected: some of the listed websites do not respond to data center vantage points on ordinary days either. Nothing changed for the data center server, and this was expected, since the restrictions targeted mobile subscribers.

At the other vantage points, the share of successful checks also barely changed. In St. Petersburg, Novosibirsk, and at one of the German vantage points, it shifted by less than one percentage point. At none of the vantage points did we find an hour that looked like “allowlist” mode or a shutdown. This is consistent with the vantage points being in data centers rather than on a mobile network.

We cross-checked these observations against public IODA (Internet Outage Detection and Analysis, a project that detects internet outages) signals for MTS, MegaFon, Beeline, T2, the Moscow region, and Russia as a whole. BGP (Border Gateway Protocol, the protocol networks use to tell each other which addresses are behind them) routes during the announced hours matched the baseline period within 0.1%. Active probing metrics (IODA sends requests to addresses and counts the responses) differed by no more than 4.3%. T2 is the exception: it has so few responding address blocks that a single block accounts for −11.1%. So routes and responses from mobile operators’ networks did not change during the restriction hours. This rather suggests that the networks were not shut down entirely and that traffic inside them was filtered instead. Such filtering is invisible from outside.

The IODA network telescope (it counts background traffic that arrives at unused addresses) showed −16% against the baseline for the Moscow region during the restriction window on October 28. However, it also showed −8% during the night of the same day, and on October 27 and 29 the window did not differ from the night. Google traffic for Russia dropped more at night than during the announced hours. These signals most likely show no decline tied specifically to the restriction hours.

As we wrote earlier, IODA shows whether a region’s networks respond to requests from outside. It does not show what subscribers see. In addition, operators’ networks are nationwide, so the effect in central Moscow gets lost in the overall traffic.

Our data neither contradicts nor confirms media reports about allowlist mode in central Moscow. Detecting such a mode requires vantage points on mobile networks inside the zone.

Who had the authority to shut down the internet in Moscow at all?

We have examined the registry of socially important services (the allowlist) many times. The Ministry of Digital Development compiles and approves this list, and each operator configures access to the services on its own side. There is no complete published list. Operators have some versions of their own lists, and we cannot claim that they include everything.

The FSB, the FSO, and Roskomnadzor (RKN, Russia’s federal regulator for media, telecom, and the internet) can restrict communications.

The FSB received these powers in early March 2026. Before that, the agency could demand internet shutdowns only where a counter-terrorism operation regime was in effect.

The FSO can demand communication shutdowns “during security operations, especially important works, and special events” under a new protocol of the State Commission for Radio Frequencies (GKRCh), published in September 2026. In addition, since 2011 the Law on State Protection has allowed the FSO to shut down anything that creates “radio interference with communications for the needs of state authorities.”

The GKRCh decision covers IMT-2000/UMTS 3G networks in the 1935–1980 MHz, 2010–2025 MHz, and 2125–2170 MHz bands. According to analyst Alexei Boyko, quoted by Forbes, operators now use these frequencies in fourth-generation Long-Term Evolution (LTE) networks and in fifth-generation (5G) networks. So the restrictions may affect more than what remains of 3G networks.

Roskomnadzor also received the power to pull the switch in March of this year, through a government resolution. RKN’s orders are carried out by the Center for Monitoring and Management of the Public Communications Network (TsMU SSOP), which we have written about before.

Roskomnadzor can reroute traffic, throttle or block access to specific resources, and, as a last resort, fully isolate the Russian segment of the internet. It acts in coordination with the Ministry of Digital Development and the FSB.

We did not find a published presidential act implementing Law No. 33-FZ. The GKRCh protocol and Government Resolution No. 1667 do not name specific events. In its October 26 announcement, the Ministry of Digital Development stated only the goal (summit security). It did not say whose demand the operators were carrying out or on what legal basis.

Therefore, based on public documents, the October restrictions cannot be attributed to any of the three legal mechanisms.

It is also unclear who sent the demands in previous cases. On May 5, the Ministry of Digital Development said it was coordinating with law enforcement and the security services on the possibility of opening the “allowlist.” The March internet shutdowns in Moscow were ordered by the FSB’s Scientific and Technical Directorate.

On October 27, according to Kommersant and Mediazona (an independent Russian media outlet), the “allowlist” was active in the city center. According to Artem Denisov, managing partner at the law firm Genesis, the FSO’s authority applies to specific base stations. If base stations in that zone had been shut down, we would expect subscribers to lose all connectivity rather than be limited to the “allowlist.”

So we cautiously assume that traffic was filtered and base stations were not shut down. However, either the FSB or Roskomnadzor could have demanded the filtering, so the question of who asked to restrict communications remains open.

Signs of escalation: regularity, procedure, scope

We test our claim that restricting mobile internet is becoming a routine security measure for events in Moscow against three indicators. For each one, we give the conclusion and what could refute it.

Restrictions in Moscow are becoming regular. Confirmed. There have been at least three such episodes in eight months. In March 2026, mobile internet in central Moscow stopped working for almost three weeks. On May 9, mobile internet in Moscow was shut down completely, including the “allowlist.” On October 27–29, restrictions were in effect inside the Third Ring Road, and the “allowlist” worked.

The restrictions now have a procedure and a legal basis. Confirmed. Previously, there were no laws for such restrictions. This year, as we described above, official grounds for pulling the switch were created for everyone at once: Roskomnadzor, the FSO, and the FSB. On April 23, at a meeting with government members, Putin explained that while operational work to prevent terrorist attacks is underway, “broadly informing the public in advance may damage the operational investigation.” Restrictions began to be announced in advance. According to Verstka (an independent Russian media outlet), the Ministry of Digital Development warned about the May 9 restrictions in advance. It announced the October restrictions on October 26, this time with a zone (the Third Ring Road) and hours.

What about drones?

On May 5, the Ministry of Digital Development’s press office told Interfax that targeted shutdowns in the regions are introduced when there are security threats, including from drones. It added: “This makes it possible to reduce the guidance accuracy of drones and counter attacks.” On April 23, at a meeting with Putin, Minister of Digital Development Maksut Shadaev spoke about mobile internet disruptions in towns near the border with Ukraine and near strategic facilities: “these are periodic shutdowns due to the danger of drone attacks.”

As far as we could find, nobody publicly cited this reason for Moscow in October, and the October announcement does not mention drones. So we built this counterargument from statements made in April and May. On October 27, Moscow Mayor Sergei Sobyanin reported downed drones in posts at 16:39, 17:50, and 18:31, that is, within the announced window. So the facts of that day do not contradict this explanation.

The largest attack came at night. According to Sobyanin, 613 UAVs flew toward the Moscow region between 20:30 on October 28 and 7:00 on October 29, outside the daytime restriction hours. We found no reports of restrictions that night, but there is no systematic data about it. In our analysis of September 18, we also found no link between drone alerts and allowlists, although that analysis covers a different period. The timing of the night attack and the wording of the announcement fit better with summit security, but public data does not allow firm conclusions.

Restrictions go beyond the announced limits. Disputed for now: there is little data. On October 28, near the Shosse Entuziastov station (outside the Third Ring Road), the network stopped working normally at 11:15, before the announced 11:30, according to RBC. However, this is a single observation by journalists rather than a detailed study. Inside the zone on October 29, the picture was uneven, according to MSK1 (a Moscow city news site). At Taganskaya, most services would not open for a journalist, while near Yaroslavsky railway station the internet worked without interruptions. We found no reports of restrictions extended beyond October 29. So far, there is no reason to believe that the restrictions systematically went beyond the announced zone and timeframe. But we also have no systematic data from outside the Third Ring Road.

It is also important that the restrictions were less severe this time. On October 27, the allowlist worked for subscribers in the center, while on May 9 everything was cut off, including the allowlist. Mediazona points this out. In our analysis of May 5, we cited MSK1 data showing that allowlists did not work that day. But the milder mode is not new either. According to a TASS report (Russia’s state news agency) of March 26, allowlisted services, voice calls, and SMS remained available at the time, although allowlisted services had disruptions in March. In October, the Ministry of Digital Development promised to keep voice calls working, but we found no public tests of voice calls and SMS.

Positions of the Ministry of Digital Development, operators, businesses, and experts

The Ministry of Digital Development promised that the “allowlist,” voice calls, home internet, and Wi-Fi would keep working. It gave no further explanation. It did not name the legal basis, whose demand the operators carried out, or which operators carried it out. We found no public comments from the Kremlin on the October 27–29 measures. We also found no statements about these restrictions from MTS, MegaFon, Beeline, or T2, apart from Beeline’s text messages on October 28 mentioned above.

BFM on its website identifies Alexei Petropolsky as head of the bureau for the protection of entrepreneurs’ rights at Opora Rossii (an association of small and medium-sized businesses) and owner of the Take & Wake coffee shop chain. He says: “we treat internet shutdowns as a business risk that will recur systematically.” The piece was published on October 27, the first day of the restrictions.

Yuri Bryukvin, CEO of the information and analytics agency Rustelecom, told Kommersant that companies often prepare for restrictions at the last minute: “Not all taxi services, delivery services, and couriers manage to do it, and they remember that they need to withdraw a small cash reserve.” According to him, “there is growing demand for fixed internet connections…” Bryukvin advises planning for the worst case: “You need to prepare, let’s say, for the worst, for mobile internet service being unavailable altogether.”

Leonid Konik, a partner at ComNews Research, told Forbes that unity of command among the security agencies could break down if Roskomnadzor, the FSO, and the FSB send operators conflicting demands. In his view, it would therefore make more sense to route all network shutdown demands “through a single window,” that is, through Roskomnadzor. According to Konik, this would matter for the FSO in particular: “By directly demanding that all (at least four) mobile operators shut down base stations in certain places, the FSO would inadvertently reveal the locations and expected arrival times of protected persons, creating additional risks for them.” Judging by the article, Forbes sent requests to the FSO and the Ministry of Digital Development, but the article contains no responses.

Recommendations for circumvention tool developers

These recommendations are for teams that build clients and server-side components of circumvention tools. They cover only restrictions on the Russian side. They rely on the facts in this article and on two levels of filtering: by domain name and by IP address (Internet Protocol, the numeric addresses of network hosts) and autonomous system. We have explained how TSPU (technical means of countering threats, the DPI equipment Roskomnadzor installs on ISP networks) filter traffic at the DNS (Domain Name System), IP, and SNI (Server Name Indication, the site name a client sends when setting up a secure connection) levels. That analysis only mentions protocol signatures briefly.

• Deliver updates, configurations, and lists of entry points before the restriction window starts. As described in the “Signs of escalation: regularity, procedure, scope” section, the Ministry of Digital Development announced restrictions one or two days in advance (October restrictions on October 26, May restrictions on May 7). In October, the announcement already named the zone (the Third Ring Road) and the hours. During the window, only allowlisted services open, and on May 9 even the allowlist did not work. So everything the client needs during the window must already be stored on the device. For restrictions without prior announcement, as in March, such a reserve matters even more.
• Teach the client to recognize allowlist mode on a mobile network and to suggest switching to Wi-Fi. Here is how to recognize the mode: on the mobile network, preselected allowlisted websites open, but the entry point and control addresses outside the list do not, while everything is available over Wi-Fi. According to the Ministry of Digital Development’s announcement, home internet and Wi-Fi continue to work normally, but we could not verify this ourselves.
• Plan for a complete loss of connectivity. As Artyom Denisov said, the FSO’s authority applied to specific base stations for the duration and in the area of an event. Such a demand would most likely cut off all mobile connectivity, not just websites outside the list. The client would then be unable to connect, so decide in advance what it can do offline. Whoosh offers an example: according to its press secretary, the company introduced technology in the spring that lets people ride scooters without mobile internet. For circumvention tools, the equivalent is a working configuration stored on the device and an automatic connection as soon as any network appears, including Wi-Fi.
• Distinguish three outcomes in diagnostics: no network at all; a network where only allowlisted websites open; a network where everything opens except the entry point. To do this, the client checks separately whether the phone is registered on the mobile network, whether an address known to be on the allowlist responds, and whether the entry point responds. For each outcome, it shows the user a specific message. Do not assume that the allowlist will always be available: on May 9 in Moscow, it did not work either.
• Do not rely on a single list or a single operator. Operators’ versions of the list differ (we compared them in our analysis of October 27). The Ministry of Digital Development only compiles the list, and each operator configures access itself, so different websites may open on different operators at the same hour. Take test addresses for recognizing the mode from several lists and save the result together with the operator of the SIM card (Subscriber Identity Module, the card a phone uses to join an operator’s network).

Recommendations for censorship researchers

This section is for those who measure censorship on Russian networks. The recommendations follow from the limitations of our own measurements, described above.

• Set up mobile vantage points inside the Third Ring Road, with SIM cards from different operators, and turn them on according to the calendar of protected events. According to media reports, allowlist mode was in effect in central Moscow on October 27. You can only observe it yourself with a subscriber SIM card. But one card is not enough: there are at least four operators, and their lists differ (we compared them).
• Foreign SIM cards are not suitable for such observations. As we wrote, Russia started filtering the traffic of foreign SIM cards roaming in the country the same way as the traffic of Russian operators. According to Izvestia (a pro-government Russian daily), which we cited in the same analysis, filtering in practice depends on the operator, and some services open on some cards: the restriction applies to resources blocked in Russia. In addition, as we noted in the same July analysis, since October 6, 2025, foreign SIM cards have their mobile internet and SMS blocked for 24 hours when they first connect to a Russian network.
• Do not interpret flat graphs from data center vantage points and IODA as an absence of restrictions. As shown in the “Our measurements and open data on network outages” section, these sources do not register allowlist mode. Such data works as a control, but not as evidence that the mode was not in effect.
• Record not only website availability but also the phone’s network registration and signal strength. This lets you tell base station shutdowns from filtering. Remember, the FSO’s authority applies to specific base stations, while either the FSB or Roskomnadzor could have demanded filtering. This distinction will help answer the question of whose demand the operators were carrying out, although it will not give a complete answer.
• Test voice calls and SMS during restriction windows. The Ministry of Digital Development promised to keep voice calls working, but we found no tests of this promise. The ministry itself confirmed SMS restrictions on May 9. Our monitoring does not measure voice calls or SMS, so this requires regular test calls and messages, including between SIM cards of different operators.
• Save copies of Ministry of Digital Development announcements and GKRCh protocols immediately after publication. Check the date in the document itself rather than in the page URL: the URL of protocol No. 26-89 contains “August 31,” although the protocol itself is dated September 28. The ministry’s MAX channel is hard to archive automatically, so it needs a separate archiving method.
• Compare observations inside the Third Ring Road with observations outside it at the same hours. This comparison distinguishes a restriction in the zone from a general outage at an operator. According to media reports, the October 27 disruptions were inside the Third Ring Road, but there is no systematic data from outside it.