Category Archives: Digital Security

Context — How “Russia blocks WhatsApp” went from scenario to real threat

2022 — Meta labelled “extremist”, WhatsApp spared

In March 2022, shortly after the full-scale invasion of Ukraine, a Russian court declared Meta an “extremist organisation”. Authorities blocked Facebook and Instagram in Russia. However, one detail immediately attracted attention. The ruling explicitly stated that it did not apply to WhatsApp, which remained the main messaging app of the Meta group in Russia.

A messenger embedded in everyday life

At that time, WhatsApp permeated Russian society. Families, small businesses and local administrations relied on it. Schools, universities and some public services also used it to coordinate day-to-day information. A brutal ban would have disrupted the daily lives of millions of people. At that stage, no credible domestic alternative could fully replace the app.

The rise of the Russian sovereign Internet

Gradually, however, the technical and political context shifted. On one side, the architecture of the Russian sovereign Internet (Runet) took shape. Telecom operators deployed Deep Packet Inspection equipment and centralised routing capabilities. They also implemented technical mechanisms able to isolate the Runet from the wider Internet when the state decides to do so. On the other side, political discourse hardened around “information warfare”. Authorities increasingly invoked “extremism” and the fight against allegedly hostile foreign platforms.

2025 — From call restrictions to an explicit “Russia blocks WhatsApp” threat

On 13 August 2025, Russia crossed a new threshold in this gradual strategy. Roskomnadzor announced restrictions on audio calls via WhatsApp and Telegram. Officials justified the decision by referring to the fight against fraud and terrorism. Text messages remained technically possible. Nevertheless, in many regions, users already experienced a degraded service and unreliable voice calls.

A few months later, Roskomnadzor publicly mentioned the option of a complete ban on WhatsApp in Russia if the app did not adapt to Russian law. The regulator framed the situation as a binary choice. Either WhatsApp complies with Russian requirements on data and decryption, or it accepts disconnection from the Runet.

A political turn, not a simple technical incident

In other words, the phrase “Russia blocks WhatsApp” no longer describes a distant scenario. It now points to a political horizon that Russian authorities assume and openly discuss. In this context, it becomes important to analyse the legal foundation that makes this scenario plausible. That foundation also reveals the deeper logic behind the confrontation with WhatsApp and the trajectory chosen by the Russian state.

Legal framework — The laws that let Russia block WhatsApp

To understand why Russia can threaten a complete WhatsApp ban, we need to look at the legal architecture built over the past decade. This architecture rests on three complementary pillars.

Data localisation — Keeping personal data “within reach”

First, the data localisation law requires that Russian citizens’ personal data stay on servers located inside Russia. Services that refuse localisation face fines and, ultimately, blocking. Roskomnadzor maintains a list of offenders and orchestrates technical sanctions.

For a global messaging service like WhatsApp, this requirement already creates a serious constraint. The infrastructure of the app is distributed and designed for an Internet without hard borders. Forcing a strict separation between “Russian data” and “non-Russian data” means challenging the very design of the platform.

Yarovaya package — Mass storage and decryption obligations

Next comes the Yarovaya package, adopted in 2016. It requires telecom operators and “organisers of information distribution” to:

• store the content of communications for several months,
• retain metadata for a longer period,
• and, crucially, provide security services with the means to decrypt communications, including handing over encryption keys.

In plain language, any messenger used at scale in Russia must at least in theory deliver the content of conversations in cleartext when authorities request it. This requirement collides directly with genuine end-to-end encryption, where the provider holds no decryption keys.

Sovereign Internet — DPI and central control over the Runet

Finally, the Sovereign Internet law completes the framework:

• ISPs must install Deep Packet Inspection (DPI) equipment under Roskomnadzor’s control;
• the state can redirect, filter, throttle or cut specific services;
• the Russian Internet segment (Runet) can be isolated from the global network in case of crisis or political decision.

Taken together, these three pillars (“data localisation”, “Yarovaya”, “sovereign Internet”) converge towards a model where, on paper, no mass communication service remains out of reach. This applies to hosting, to encryption and to network routing.

Within such a normative universe, a global messenger with end-to-end encryption like WhatsApp becomes a legal and technical anomaly. This anomaly largely explains why the sequence “Russia blocks WhatsApp” does not simply reflect a passing mood. Instead, it expresses a deep conflict between two philosophies of encryption.

WhatsApp — End-to-end encryption at the heart of the “Russia blocks WhatsApp” conflict

A technical model built around end-to-end encryption

Once we understand the legal framework, we can return to WhatsApp’s technical model. The messenger relies on end-to-end encryption (E2EE). Concretely:

• the app encrypts messages on the sender’s device;
• only the recipient’s device can decrypt them;
• Meta has no direct access to cleartext content, only to metadata.

A Russian demand incompatible with WhatsApp’s design

We can now compare this model with Russian legal requirements. In an E2EE system, laws that demand providers to submit keys or plaintext content cannot be satisfied without a deep redesign of the service. The tension does not simply come from political refusal. It arises from a design incompatibility between the messenger and the Russian legal environment.

Three theoretical outcomes for WhatsApp in Russia

To become compliant with Russia, WhatsApp only sees three realistic options:

1. Introduce a backdoor or client-side scanning. In this scenario, the app would scan messages on the device before encryption, detect prohibited content or behaviour and send reports to servers that authorities can query.
2. Abandon end-to-end encryption for all or part of Russian users. The service would then revert to a model where servers can read messages and hand them over to security services.
3. Refuse and accept a full ban, thereby becoming a niche app mainly used via VPNs and technical workarounds.

Two irreconcilable models of sovereignty over communications

So far, Meta publicly defends E2EE as essential for protecting private communications. As a result, the phrase “Russia blocks WhatsApp” functions less as a rhetorical threat and more as a collision point between two security models. One model treats encryption as a strong shield, including against states. The other rejects the idea that a mass-market service might escape state surveillance.

From this point on, it becomes useful to place this impasse within a clear timeline. That timeline retraces Russia’s previous attempts to control encrypted messengers.

Programmed escalation — Telegram, Meta, then WhatsApp

To gauge the significance of the current threat, we must look back at previous episodes and see how they prepare the ground.

Attempted Telegram ban (2018–2020)

In 2018, Russian authorities tried to block Telegram after the company refused to hand over encryption keys. Roskomnadzor ordered the blocking of millions of IP addresses, including infrastructure that belonged to Amazon and Google. Collateral damage proved massive, while Telegram remained largely accessible through mirrors and circumvention tools. In 2020, the regulator officially abandoned the ban.

This failed attempt revealed two important lessons. First, without a fully operational sovereign Internet, blocking a popular messenger remains technically difficult and politically costly. Second, regulatory pressure alone does not suffice when the state lacks a credible alternative platform to propose.

Meta as “extremist”, WhatsApp tolerated (2022)

In 2022, Russia took a new step by declaring Meta an “extremist organisation”. Authorities blocked Facebook and Instagram. Yet the court ruling explicitly spared WhatsApp. This choice reflected a form of pragmatic realism: target social networks that the Kremlin viewed as politically sensitive, while preserving the messenger that much of the population relied on.

Sovereign Internet, legal hardening and call restrictions (2024–2025)

Between 2024 and 2025, the landscape changed again. DPI equipment became widespread. The notion of “extremism” broadened. New provisions criminalised even the online search for content branded “extremist”. In parallel, lawmakers increasingly targeted the use of VPNs to access such content.

On 13 August 2025, Roskomnadzor announced targeted restrictions on audio calls via WhatsApp and Telegram, once again justified by “anti-fraud” and “anti-terrorism” arguments. In practice, voice communications deteriorated to the point of becoming unusable in many areas, while text messages continued to function.

A few months later, the threat of a full WhatsApp ban in Russia entered the public debate. Consequently, the sequence “Russia blocks WhatsApp” does not fall from the sky. It extends a gradual escalation, technically prepared and politically deliberate.

This escalation only makes sense because, in parallel, a domestic alternative was already under construction: the Max superapp, designed to replace WhatsApp within the Russian sovereign Internet ecosystem.

Max — Domestic superapp and WhatsApp replacement

An “all-in-one” superapp at the heart of the Runet

As Russia turns up the pressure on WhatsApp, another key piece already sits on the board. This is the Max superapp, developed by VK Group and promoted as the “national messenger”.

VK presents Max as an “all-in-one” application:

• one-to-one and group messaging;
• payments, digital wallet and transfers;
• access to selected government services (Gosuslugi);
• planned integration with digital identity and electronic signatures.

Limited encryption and structural compatibility with the sovereign Internet

Two features weigh heavily in the balance. The first concerns encryption.

Public information and independent analyses indicate that Max does not provide verifiable end-to-end encryption. At best, the app encrypts traffic in transit. In practice, the operator can still read messages and deliver them to authorities when required. This design makes the superapp structurally compatible with the requirements of the Russian sovereign Internet.

Mandatory pre-installation and growing dependency

The second feature concerns distribution. From 1 September 2025, Russian regulations require Max to be pre-installed on all smartphones and tablets sold in the country. At the same time, several administrations already encourage or impose its use for communication with parents, schools and public services. Step by step, Max becomes a compulsory gateway to digital everyday life.

From WhatsApp to Max — An assumed substitution strategy

In this context, the phrase “Russia blocks WhatsApp” does not simply describe a punitive measure. It forms part of a broader substitution strategy.

The more painful or risky the use of WhatsApp becomes, the more Max imposes itself as the default channel. It turns into the unavoidable hub to communicate, pay and interact with the state. As a result, the potential WhatsApp ban and the rise of Max reinforce each other.

This dynamic forces analysts to examine Moscow’s narrative that justifies this shift — fraud, terrorism, extremism. Understanding that discourse helps to see how the sequence “Russia blocks WhatsApp” also serves a wider project of social control.

Fraud, terrorism, extremism — Official narrative vs reality

An official storyline centred on fraud and terrorism

In its press releases, Roskomnadzor claims that WhatsApp and Telegram have become central tools for:

• mass fraud and financial scams;
• recruitment for terrorism and sabotage;
• coordination of criminal actions and “extremism”.

At first glance, this narrative appears consistent with public-security concerns. However, official data paint a more nuanced picture.

The Central Bank of Russia tells a different story

Reports from the Central Bank of Russia highlight another reality. They show that:

• traditional phone calls still represent the main fraud channel;
• encrypted messengers remain only one vector among many;
• restrictions on WhatsApp/Telegram calls mainly triggered a rebound in classic voice traffic rather than eliminating fraud.

In other words, the “fraud” angle operates as a legitimising narrative at least as much as a technical justification. This gap opens the way to a second, more political shift.

An ever-expanding definition of “criminal behaviour”

At the same time, constant references to “criminal activities” and “extremism” play a structuring role. By 2025, these categories in Russia cover:

• organisations linked to Alexei Navalny, labelled “extremist” and then “terrorist”;
• the international LGBT movement, classified as an extremist organisation;
• numerous NGOs, independent media and human-rights organisations;
• many anti-war expressions and criticisms of the army.

Gradually, the boundary between actual criminality and political dissent becomes blurred. The language of criminal law then reshapes public space instead of merely addressing precise offences.

From anti-fraud measures to an embedded political police

Within this context, demanding that WhatsApp “exclude criminal activity” means several concrete things:

• proactively censoring conversations on sensitive topics;
• identifying people who participate in these exchanges;
• and sending data to the relevant security agencies.

An end-to-end encrypted messenger cannot deliver this programme without sacrificing its security model. Adding such functions would effectively turn the app into a tool for political surveillance.

Therefore, the sequence “Russia threatens to completely block WhatsApp” acts as a revealing moment. The state asks a global tool to become an embedded political-police device, which WhatsApp neither can nor wants to be. This observation leads directly to Roskomnadzor’s pivotal role as legal enforcer, technical orchestrator and official narrator of the confrontation.

Roskomnadzor — Technical and political hub of the Runet

A regulator at the core of the sovereign Internet

To understand Roskomnadzor’s role, we must look at its operational responsibilities. The agency cumulates several key functions within the Russian sovereign Internet:

• it maintains the central blocklist of sites and online services subject to restriction;
• it monitors compliance with data localisation obligations;
• it supervises the roll-out of DPI equipment at ISPs;
• it coordinates throttling or cut-off operations on foreign services (social networks, VPNs, video platforms, analytics tools, etc.).

In other words, Roskomnadzor does not merely issue rules. It also orchestrates their technical enforcement within the Runet’s infrastructure.

Technical arm of a progressive Runet lockdown

In the official narrative, Roskomnadzor acts to “protect citizens” and ensure “infrastructure stability”. In practice, however, it has become the technical arm of a policy aimed at progressively locking down the Runet. Its statements on WhatsApp therefore carry significance far beyond the messaging app itself. They signal the overall direction of Russian digital policy.

The threat of a full ban as strategic signalling

The threat of a full WhatsApp ban illustrates this signalling role particularly well. It fits into a coherent pattern of actions and messages:

• pressure on foreign services that the state labels as “non-cooperative”;
• active promotion of the Max superapp as a “patriotic” alternative;
• constant reminders of data-sharing, localisation and decryption obligations.

Each statement by Roskomnadzor therefore goes beyond a warning to a single platform. It contributes to redefining what remains tolerated within the Russian digital space.

A triptych that redefines freedom of communication

The triptych “Russia blocks WhatsApp”, “Max as national superapp” and “sovereign Internet” sketches a new model. Under this model, freedom of communication becomes conditional on alignment with the surveillance architecture. Mass-market messengers appear legitimate only if they fully integrate into this control framework.

The next step consists in projecting this model into the future through several realistic scenarios. These scenarios help evaluate how far Runet lockdown and the marginalisation of global encrypted services might go.

Prospective scenarios — What future for the Russian Internet?

Starting from the current situation, we can outline several realistic trajectories for the relationship between Russia, WhatsApp and the sovereign Internet.

Scenario 1 — Progressive de facto ban

In the first scenario, the state does not announce a brutal “ban”. Instead, authorities organise a slow erosion of WhatsApp usage.

• call restrictions remain in place for the long term;
• file transfers are throttled or intermittently disrupted;
• new accounts sometimes struggle to register;
• official discourse describes the service as “unreliable” or “dangerous”.

In such a scenario, WhatsApp does not fully disappear from the Runet, but its use concentrates among:

• more tech-savvy users, able to manage VPNs and circumvention tools;
• cross-border communications with the diaspora and foreign partners.

Consequently, “Russia blocks WhatsApp” becomes a day-to-day reality without a single spectacular decision. At the same time, Max automatically gathers mass-market users.

Scenario 2 — Opaque deal with client-side surveillance

The second scenario revolves around a discreet compromise. WhatsApp remains accessible in Russia, but only at the price of client-side scanning or specific integrations.

For example, authorities could demand:

• automatic analysis of selected content on the device before encryption;
• mandatory reporting of patterns associated with “extremism” or fraud;
• enhanced logging of metadata for domestic security agencies.

This trajectory would not formally break end-to-end encryption, yet it would seriously weaken its substance. Security would then depend less on cryptography and more on the integrity of control mechanisms imposed by the Russian state.

Scenario 3 — Assumed rupture and a full WhatsApp ban in Russia

The third scenario involves an openly total rupture with WhatsApp.

• the state blocks the messenger at network level;
• using VPNs to access it becomes criminalised or treated as suspicious behaviour;
• Max becomes the near-exclusive entry point for everyday communication, e-government and part of the payment ecosystem.

In this configuration, the Runet looks increasingly like a state intranet. Data flows are filtered, global services are replaced by local equivalents, and the remaining pockets of real encryption move to marginal, high-risk niches.

Whatever the scenario, one open question remains. How can encryption sovereignty survive when the messaging infrastructure lies under the control of a state that rejects the very idea of opacity? At this point, sovereign architectures outside mainstream platforms become crucial.

Weak signals — Balkanisation and control-oriented superapps

In the background, these weak signals suggest that answering the formula “Russia blocks WhatsApp” cannot remain a narrow debate about messengers. It must address the design of encryption architectures at the level of states, organisations and individuals.

Sovereign use case — Protecting messages beyond any future “Russia blocks WhatsApp” scenario

A textbook case: when the state controls the messenger and can block WhatsApp

Ultimately, the sequence “Russia blocks WhatsApp” raises a broader question. What happens when a state demands that a messaging provider hand over content, metadata or encryption keys? As long as security depends on a central platform, that platform becomes the obvious pressure point. It concentrates technical, legal and economic leverage.

In a centralised model:

• even encrypted messaging relies on servers and infrastructure that a state can compel;
• the provider may face pressure to add exceptions, backdoors or client-side scanning mechanisms;
• users do not control where their data resides or how it flows across borders.

In short, the promise of encryption remains fragile if the root of trust stays concentrated in a single actor.

Reducing trust in platforms with segmented-key HSMs

Architectures like DataShielder and CryptPeer start from a different premise. They aim to minimise the trust placed in platforms and networks, and to move the root of security as close as possible to the user.

• DataShielder NFC HSM and DataShielder HSM PGP: there is no decryption server and no central database. The system can operate 100% offline, without cloud or account. A hardware HSM (NFC HSM or HSM PGP) performs encryption. Keys (AES-256, RSA-4096 depending on the use case) are generated and stored locally. A system of segmented keys splits trust between the Main Operator and module holders.
• CryptPeer: end-to-end encryption occurs at the peers. A self-hostable, self-portable relay server only receives already encrypted data. It holds no encryption or decryption keys. The server simply forwards packets and cannot read content or reconstruct secrets shared between peers.

Encryption encapsulation — One encrypted message inside another

Even when users continue to rely on a mainstream messenger such as WhatsApp or Telegram, they can shift the balance by using encryption encapsulation.

Concretely:

• the user encrypts sensitive content locally inside an NFC HSM (for example, DataShielder NFC HSM);
• what travels through WhatsApp appears only as an opaque encrypted block;
• even if the messenger or network becomes compromised, the attacker sees nothing more than “encryption inside encryption”.

From a state’s perspective, demanding keys from the messenger provider then becomes ineffective. Critical keys are not held by that provider. They reside in sovereign hardware HSMs or cryptographic pairs managed at peer level, as with CryptPeer. Meanwhile, the relay server only sees encrypted data it cannot open.

Encryption sovereignty beyond WhatsApp and Max

In a world where “Russia blocks WhatsApp” may become a precedent, these architectures serve as demonstrators. They show that it is possible to:

• keep using mainstream messengers for ergonomics;
• make data structurally unusable without the HSM or peer key, even in case of seizure or blocking;
• remain compliant with export-control frameworks for dual-use encryption goods, such as the one that applies to DataShielder in Europe.

In other words, real sovereignty does not boil down to a choice between WhatsApp and Max. It lies in the ability to design systems where neither Moscow nor any other state can demand an exploitable central backdoor. This boundary separates nominal security from true operational encryption sovereignty.