In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

Apple's 2025 App Store Transparency Report disclosed that 2,045 apps were removed globally due to government takedown requests, with Russia accounting for 1,213 removals and China mainland for 196. Russia's count increased dramatically from 171 in 2024, 12 in 2023, and 7 in 2022 — a roughly 7× year-over-year increase — while Access Now reported that 2025 saw at least 313 internet shutdowns across 52 countries, the highest number recorded since tracking began in 2016.

§6 (Apple App Store section) and §7 (Access Now section) policy

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

§8 (InterSecLab / WIRED section) detection

LetsVPN (快连) announced termination of China mainland operations on April 28, 2026, stating the team had attempted adjustments 'almost every hour' for 20 days before concluding the connectivity problem was unsolvable. A follow-up announcement on May 8 declared 'resumption of global standard operations' but explicitly stated it could not guarantee China mainland availability.

§3 (快连 / LetsVPN section) deployment

Russia's Roskomnadzor confirmed in February 2026 that it had blocked 469 VPN services used to bypass censorship. Starting December 2025, Russia began blocking the three most commonly used VPN protocols, and from 2025 onward began imposing penalties for promoting VPN services.

§5 (Human Rights Watch section) deployment

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Russia's TSPU (Технические средства противодействия угрозам) is the national censorship infrastructure operated by Roskomnadzor, deployed inline at Russian ISPs. Technical documentation of its architecture and operating principles has been made publicly available via YouTube presentations by Russian-language researchers. The system is evidently not classified, so circumvention researchers can study its detection logic from these materials rather than relying solely on empirical measurement; a 2021 presentation documents TSPU performing in-path filtering and traffic redirection rather than relying on endpoint-level DNS alone.

2026-viktor45-russia-architecture-operating Abstract dpiip-blockingthrottling

Geedge co-founder Fang Binxing—named 'father of the Great Firewall' in company documents—explicitly linked Geedge's international expansion to China's Belt and Road Initiative in a 2024 speech, and a Geedge job advertisement sought candidates willing to travel to Pakistan, Malaysia, Bahrain, Algeria, and India. This confirms BRI as an institutional channel for GFW-derived censorship infrastructure export, not merely bilateral commercial deals.

2025-wkrp-leak-geedge-networks body dpiip-blockingthrottling

A September 2025 leak of 100,000+ internal documents from Geedge Networks—co-founded by Great Firewall architect Fang Binxing—confirms export of GFW-derived Tiangou Secure Gateway (TSG) to Myanmar, Pakistan, Ethiopia, and Kazakhstan, providing those governments with DPI-based filtering, throttling, VPN blocking, and internet-blackout capabilities previously unavailable to them. Pakistan's deployment replaced Sandvine's Web Monitoring System infrastructure after Sandvine was sanctioned and exited in 2023, with Geedge apparently utilizing existing Sandvine hardware. Kazakhstan was the first client, from 2018, and Geedge claims more than 40 global service providers as clients under the Belt and Road Initiative framework.

2025-wkrp-leak-geedge-networks body dpiip-blockingthrottlingtraffic-shape

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking