On February 10, Russian authorities used the National Domain Name System (NDSI) to block YouTube for the first time. The video hosting service's domain was simply erased from the database. This precedent is very important: the state has used the 'address book' of the Runet as a tool of censorship for the first time. By February 11, according to the 'Na Svyazi' project, at least 13 popular resources were removed from the NDSI — including Facebook, Instagram, WhatsApp, as well as media outlets. Why is any domain in the .ru and .rf zones now under threat, and how is the government testing the possibility of a complete disconnection from the global internet? 'Novaya-Evropa' spoke with IT specialist Leonid Yuldasev, coordinator of eQualitie projects in Russian. Photo: Maxim Shemetov / Reuters / Scanpix / LETA. YouTube was already working poorly. Is it now 'slowed down' even more or completely blocked? Since the summer of 2024, when YouTube came under state censorship, the service has been working worse and worse, IT specialist Leonid Yuldasev told 'Novaya-Evropa.' Initially, YouTube was only 'slowed down,' the expert recalls: videos in Russia opened with difficulty, in low quality, and after a long download. Then the 'slowing down' intensified to the point where YouTube essentially stopped working entirely, and at one point there was an actual blocking of YouTube, Yuldasev noted. The blocking was uneven across regions: some users retained access, while others lost it, partly because providers implemented the requirements differently. Russians continue to use VPN services to access YouTube. The platform opens with them, albeit with interruptions: Roskomnadzor continues to block more and more methods of bypassing restrictions. YouTube was artificially 'slowed down' using TSPU (technical means of counteracting threats, Roskomnadzor equipment on provider networks). Now, the supervisory agency has begun blocking YouTube using the National Domain Name System (NDSI). What has already been blocked using NDSI? According to the 'Na Svyazi' project, as of February 11, at least 13 popular resources have been removed from NDSI. Among them are Facebook, Instagram, and WhatsApp, owned by Meta, recognized as an 'extremist' organization in Russia, as well as the websites of independent media outlets. Additionally, APKMirror was added to the list — a popular service for downloading installation files, often called an alternative to Google Play. The VPN service Windscribe and Tor, used for anonymization and bypassing blocks, were also removed from NDSI. — YouTube (www.youtube.com) — WhatsApp (www.web.whatsapp.com) — Facebook (www.facebook.com) — Instagram (www.instagram.com) — Facebook Messenger (www.messenger.com) — Windscribe (www.windscribe.com) — Apkmirror (www.apkmirror.com) — Tor (www.torproject.org) — BBC (www.bbc.com) — 'Current Time' (www.currenttime.tv) — Deutsche Welle (www.dw.com) — 'Radio Liberty' (www.svoboda.org) — The Moscow Times (www.themoscowtimes.com) As Yuldasev noted in his conversation with 'Novaya-Evropa,' this is a new method of blocking undesirable sites that has not been used before. 'We have repeatedly pointed out that Russia is building the infrastructure of a sovereign internet. And this is significantly more dangerous in the long term than simple blocking. Although, to be fair, the user generally doesn't care how access is blocked,' Yuldasev said. How does blocking through NDSI work? The Russian National Domain Name System (NDSI) essentially duplicates the global DNS server system (DNS — Domain Name System) — the mechanism by which a device (e.g., a computer or phone) sends a request to the internet to find a specific website. NDSI is effectively the state's 'address book' for the internet. If there is an entry (URL) in it, the browser receives the IP address and opens the site, but if there is no entry, the system cannot find the address, and the site does not load. Such a system was implemented in 2021 after the adoption of the 'sovereign Runet' law. The authorities justified this by stating that DNS is not under the control of Russian authorities and that the US could allegedly disconnect Russia from this address book. 'But this is not true: all key elements of the internet are, as it were, hanging in the air. They are equidistant from states, corporations, and even activists,' Yuldasev noted. Now, Russian providers are obliged to connect to NDSI, which supplements the global DNS and, according to the law's authors, is intended to ensure the operation of the domain system within the country if necessary. The latest news is that the YouTube domain has been removed from NDSI. Now, when a user tries to access the platform, Roskomnadzor's system cannot find the required digital address and returns an error. 'They are not just blocking YouTube. Now we have also 'forgotten' about its existence,' Yuldasev noted. Photo: Alexander Zemlianichenko / AP / Scanpix / LETA. Has such a blocking scheme been used before? This is the first instance where the national domain name system has been used to block a service unwanted by the authorities, Yuldasev told 'Novaya-Evropa.' However, two years ago, Roskomnadzor already tested NDSI. At that time, a disruption provoked by the authorities effectively paralyzed the network within the country: users from Russia could not access sites in the .RU zone and complained about problems accessing banks, marketplaces, and other popular services. How does NDSI differ from previous access restriction methods? In his conversation with 'Novaya-Evropa,' Yuldasev listed other blocking methods that Russian authorities have already used. First, blocking by domain through Roskomnadzor's registry: providers receive a list of prohibited sites and redirect the user to a placeholder page. Such blocks have long been common in Russia: for example, content with LGBTQ themes or anime sites are often blocked this way. Second, blocking through Deep Packet Inspection (DPI) — inspection of data packets on the network. Roskomnadzor uses these as part of its Technical Means of Counteracting Threats (TSPU). With DPI equipment, providers can see not only the site address (e.g., youtube.com) but also the traffic type (e.g., video, voice, or files). If the system detects 'forbidden' traffic, it either blocks it entirely or artificially delays data transmission. For example, Discord and VPN services were blocked this way, and likely YouTube in 2024. With DPI blocking, a site may not even appear in Roskomnadzor's public registry, Yuldasev noted. He stated that this is often done with media and human rights resources, while, for instance, casinos, as well as fraudulent resource and crypto exchange sites, are blocked through the registry. Finally, in some cases, Roskomnadzor may block the IP address of the server hosting the site. What risks does the use of NDSI pose to the Runet infrastructure? A significant danger, according to Yuldasev, is that this same technology can be used to substitute addresses: 'For example, you open 'Meduza' or 'Novaya-Evropa,' type in the address, press Enter — and you end up on [state agency] RIA Novosti. Because it's an address book: it can redirect you elsewhere,' Yuldasev describes. This is an example of a classic man-in-the-middle attack, where an attacker secretly intercepts the communication channel between two parties, for example, for phishing or credential theft. Suppose a user visits a regular, unblocked site, sees a fake one, enters their email and password, and goes through two-factor authentication. As a result, all data can be sent to attackers. If the state applies such a scheme, security risks increase. 'I am not sure the Russian state will behave like attackers. But it's important that this system gives them such a capability,' says the interlocutor of 'Novaya-Evropa.' The gap between global DNS and the Russian system (NDSI) will only grow, predicts IT expert Mikhail Klimarev. In his opinion, sooner or later, Russia will form its own, isolated version of the internet, which by definition cannot be trusted. 'I have no solution on how to make Roskomnadzor stop doing this. It is obvious that they will do it without regard for any international norms or 'rules of good conduct.' They couldn't care less about either,' he wrote. Photo: Anatoly Zhdanov / Kommersant / Sipa USA / Vida Press. What does the transition to such a blocking mechanism actually mean? The ultimate goal of the Russian authorities is not to block YouTube specifically, but to test the blocking system, Yuldasev asserts. YouTube was already effectively inaccessible for most users in Russia. So, in terms of service availability in February, nothing fundamentally changed. NDSI has been built for years under the rhetoric of protection against disconnection by the US: in particular, Vladimir Putin warned in 2014 about the insecurity of the internet, as it 'originated as a CIA special project and continues to develop that way.' But in reality, its value for the authorities lies not in defense, but in managing the Runet. Yuldasev emphasizes: the Russian authorities have created an 'address book,' obliged providers to use it, and are now finding out how it works in practice. Moreover, the state now has a tool with which it can not only block a site but completely erase it from the 'address book.' 'Essentially, a small technical change has occurred. They tried to remove the address from the national domain name system. And we see that the internet has not fallen apart. For the user, this means nothing in itself. The nature of the blocks has not changed. It has not gotten worse. Means of bypassing blocks continue to work. Perhaps the sovereign internet has become closer by three days — figuratively speaking. But we are not firmly sure of that,' Yuldasev muses. What are the ways to bypass the blocks anyway? The main method remains using VPN services to stay connected despite the blocks. It is better to use at least two different services, as Roskomnadzor will block the most popular bypass protocols. Thus, by the end of 2025, the agency began to more actively combat SOCKS5, VLESS, and L2TP. Experts advise having not only free but also paid VPNs. Free services can be easily blocked by the authorities, and they may also have poor connection quality. Paid VPNs usually have updated servers and customer support in case of problems. In addition to VPNs, there are other methods, such as the Ceno and Tor browsers. They allow you to watch YouTube or open the web version of Telegram. 'Novaya-Evropa' has compiled instructions on how to deal with restrictions and studied the list of VPN services recommended by cybersecurity experts. Yuldasev urged to pay closer attention to the actions of the Russian authorities in the sphere of blocking: 'Because if they really pull the switch — it will be no joke. The sovereign internet has gained one point. But this does not mean you should be afraid of anything,' the interlocutor of 'Novaya-Evropa' concluded.
