Media: Russia sends IT companies guidelines to detect VPNs on users’ devices

The Russian Ministry of Digital Development has sent IT companies a manual on detecting VPN usage on clients’ devices. According to the document, catching iPhone users employing VPNs is more difficult than detecting Android users.

The departmental manual for Russia’s largest IT companies states that detecting bypass services on iPhones is “significantly limited” due to the specifics of the iOS operating system, RBC reports, citing a copy of the document.

The Ministry’s recommendations for internet companies outline a three-step process for checking users for VPN usage:

1. Identify the device’s IP address and compare it with Russian IP addresses, as well as with addresses blocked by the Russian Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor).

2. Check for VPN usage within the company’s own application.

3. Check for VPN usage on other devices (Windows, macOS, and others).

A mismatch between the user’s IP region and Russia will serve as a potential reason for blocking. However, this indicator must be confirmed through the following two verification steps. For Android devices, this procedure is feasible because the system allows apps to request active network parameters and report the use of bypass services. For iPhones, however, the check is much more difficult: “Access to system parameters on iOS is significantly limited.”

As the authors of the document explain, Apple’s operating system enforces isolation of third-party apps. Therefore, on iPhones, apps cannot collect or modify information stored in other applications. This limitation prevents platforms loyal to the Russian state — such as Sber, Yandex, VK, or Wildberries — from verifying users in accordance with the regulatory requirements set by authorities.

Earlier, ASTRA reported that in March, the Ministry of Digital Development held a series of meetings with Russia’s largest internet companies, with the main topic being the fight against VPNs. At one such meeting on March 30, Minister Maksut Shadayev reportedly demanded that participants restrict access for users with active bypass services. Failure to comply could result in companies losing their IT accreditation, which provides a number of benefits, including exemptions from military service for employees.

On April 3, alleged VPN restrictions reportedly caused a widespread failure in Russian internet banking systems. However, several media outlets and experts who initially linked the outage to anti-bypass measures later quickly retracted their statements.