On October 2, 2026, Roskomnadzor (RKN, Russia’s telecom and media regulator) added Apple and Microsoft to the registry of information dissemination organizers (ORI). The news surfaced in the media on October 28.

Everyone on the ORI registry is required by law to store users’ messages and audio and video messages for six months, keep message transmission logs for three years, and hand over all of this to law enforcement on request. This includes giving the FSB (Federal Security Service) the means to decrypt messages, that is, encryption keys.

For Apple and Microsoft, the ORI registry lists only their main domains: apple.com and microsoft.com. The registry entries say under “Access” that it is “not restricted,” but we understand this is a formality. Right now, Apple and Microsoft services are technically accessible and not restricted. That can change later.

Timeline: how Apple ended up in the registry and what came before

Date	What happened
04.12.2025	RKN blocked FaceTime
01.04.2026	Mobile operators were banned from topping up Apple ID balances from phone accounts
03.06.2026	Apple removed the MAX messenger (developed by the state-affiliated company VK) from the App Store, and its notifications stopped reaching iPhones
25.06.2026	A magistrate’s court fined Apple 500,000 rubles (about $6,170) for failing, for a second time, to notify RKN that it operates as an ORI (Part 1.1 of Article 13.31 of the Administrative Code). On 21.07, Apple filed an appeal against this decision
01.07.2026	The Federal Antimonopoly Service (FAS) demanded that Apple preinstall MAX and RuStore and add a search engine choice by July 15. It threatened a fine of up to 4 billion rubles (about $49.4 million)
16.07.2026	First disruptions of apple.com and the App Store in Russia. RKN denied blocking them, but blocking most likely took place. Our tests showed connections dropping at the TLS stage, unevenly across operators and regions
03.08.2026	FAS opened a case against Apple for refusing to preinstall MAX and the RuStore app store. By then, Apple had added the option to choose a Russian search engine in iOS
02.09.2026	A district court rejected Apple’s appeal, and the June 25 the fine took effect
20.09.2026	Another spike in App Store blocking. For some users, the store opened only through a VPN
02.10.2026	Apple was added to the ORI registry

Since July 2024, RKN can add a company to the registry on its own if there is a court decision in force for a repeated failure to fulfill this obligation. In December 2024, RKN added 12 messengers to the registry at once, including WhatsApp, which had earlier been fined under the same part of the article.

What is happening with Apple services in Russia

Apple service	Functions	Current status
iMessage	Messages	Working as of October 29
FaceTime	Audio and video calls	Blocked by RKN since December 4, 2025
iCloud, including mail	Data storage, mail	Sync working as of 28.10.2026
App Store	App store, not related to messaging	Blocked in July and September 2026. Apple removes apps at RKN’s request under Article 15.1

What falls under the ORI requirements

Although the registry lists specific domains, the law applies to services: an ORI is defined as any entity that facilitates user messaging. On the other hand, iMessage messages are protected by end-to-end encryption. Apple does not store them and cannot decrypt them (and if a user has turned on the Advanced Data Protection option, the corporation won’t be able to decrypt the synchronized user backups in their iCloud as well). It is unlikely that Apple will alter this architecture to comply with Russian law enforcement demands.

A few more examples

Service	Added to the ORI registry	What happened next
Viber	Never	RKN blocked Viber in December 2024 for violating the ORI requirements, even though it was not on the registry at the time.
WhatsApp	19.12.2024, by decision of RKN	Eight months later, in August 2025, calls were blocked. In November 2025, RKN began blocking messages
Cloudflare	21.02.2025, by decision of RKN	Three and a half months later, starting June 9, 2025, Russian ISPs began letting through only the first 16 KB from websites behind Cloudflare. Hetzner, DigitalOcean, and OVH were also affected
Google Meet	26.01.2026, by decision of RKN	Blocking began before the registry listing, in August 2025. Problems occurred only in Russia, and the service worked through a VPN. RKN denied restricting it

At the same time, Apple and Google comply with some orders from the Russian authorities. For example, they remove VPNs from their app stores. Google does so after a court decision, and Apple does so without waiting for one. We published a detailed analysis of this problem.

What the authorities have already done to Microsoft

They are putting pressure on GitHub. In May 2026, the service was hard to open. Since the beginning of the year, 61 GitHub pages have been added to the registry of prohibited information. In July, RKN said it was not restricting access. Yet on July 14, there were targeted blocks of GitHub, Google, and Apple at the same time.

Why a full block of these services is unlikely

App push notifications depend on Apple

Only Apple delivers push notifications to iPhones. An iPhone keeps a persistent connection to Apple’s servers: the *.push.apple.com addresses on TCP ports 5223 and 443. According to the company’s documentation, the server of any app (a bank, a messenger, or any other app) sends a notification to api.push.apple.com, and Apple delivers it to the phone over this connection.

The MAX messenger case showed what happens when this channel closes. Since June 4, the day after the app was removed from the App Store, MAX push notifications no longer reach iPhones, although the messages themselves still arrive in the app. Apple revoked MAX’s push notification token and disabled its notifications.

If RKN blocks the addresses of Apple’s push servers, notifications will disappear for all apps on iPhones in Russia at once, including Russian apps. So as long as Russian apps and their users remain on iPhones, such a block would hit them first.

FaceTime is easier to restrict than iMessage

A FaceTime call uses separate UDP ports: 3478–3497, 16384–16387, and 16393–16402. Such a stream is immediately recognizable in traffic as a call, and it can be throttled or cut off without affecting anything else.

iMessage runs through the same APNs (Apple Push Notification service) as notifications from all apps and uses the same TCP ports 5223 and 443. iMessage traffic cannot be isolated from standard push notifications based solely on IP addresses or ports. At least for now, we see no way to tell its traffic apart from push notification traffic.

What breaks if the App Store is blocked

Apple has no alternative app stores or ways to install apps outside the App Store in Russia, as we wrote in July. In February 2025, Apple shut down its enterprise program (Apple Developer Enterprise Program, ADEP) to Russian developers. Companies had previously relied on it to deploy internal apps on employees’ devices without the App Store. So blocking the App Store would stop updates for all apps on iPhones in Russia, including Russian ones.

Where developers depend on Microsoft

Microsoft is a key part of the entire digital infrastructure. The company’s servers deliver Windows updates and activation (list of addresses), VS Code editor extensions (documentation), and .NET packages from NuGet. JavaScript web apps download ready-made libraries during builds from npm, the main repository of such libraries. Since 2020, npm has belonged to GitHub, which means it also belongs to Microsoft. The attempts to block GitHub in May showed that the authorities are already trying. But a full block would hit software builds and updates inside Russia, which is probably why they are not doing it yet.

What is at risk?

Below are three scenarios. Each one is based on what has already happened to Apple or similar services.

1. They restrict individual features, as with FaceTime

For WhatsApp, eight months passed between its forced listing in the registry and the restriction of calls. FaceTime was restricted even before Apple was added to the registry. Features that are easy to single out in traffic are the first to be restricted.

2. They degrade access to the App Store and apple.com

This already happened in July and September 2026. The Cloudflare story developed the same way after its forced listing.

Signs to watch for:

• spikes in complaints on Sboy.rf (a Russian outage tracker) and OONI (Open Observatory of Network Interference) anomalies for Apple domains,
• access works through a VPN, while Apple’s status page shows no incidents.

3. They block Apple’s addresses entirely

Technically, this can be done through TSPU (technical means of countering threats, the DPI equipment Roskomnadzor installs on ISP networks) by IP address. Since August 2026, RKN has been blocking entire hosting provider subnets this way, and the whole 17.0.0.0/8 address block belongs to Apple. This is the harshest scenario, and for now it does not serve Russia’s interests.

Recommendations for developers

1. Do not rely on push notifications alone in critical scenarios. If RKN blocks APNs, push notifications will stop reaching iPhones. Make the app fetch new messages from your server every time it opens, and use push only as a signal. Duplicate important notifications (for example, login and payment codes) by email.
2. Check how and from where your server sends push notifications. The server connects to api.push.apple.com on port 443 or the alternative port 2197. In July 2026, access to Apple was blocked from Russian data centers. If your backend is in a Russian data center, regularly test the connection with a full TLS handshake and keep a backup sending node outside Russia:

openssl s_client -connect api.push.apple.com:443 -alpn h2

3. Keep copies of dependencies and code on different services, not only on Microsoft’s GitHub. Set up a package proxy repository (for example, Nexus or Verdaccio) that stores the libraries you download from npm and NuGet. This ensures your build pipelines won’t break if Microsoft’s servers become unavailable in Russia. Mirror your GitHub repositories to a second remote on another hosting service or on your own server.
4. Do not count on ADEP as a backup channel for distributing iOS apps. The program has been closed to Russian developers since February 2025. If your app is removed from the App Store, TestFlight remains. We examined it in August.