Russia Blocks Access to GrapheneOS, a Secure Android Alternative

Last week, several reports emerged from Russia indicating that local regulators had begun blocking IP addresses and services operated by Google and Cloudflare. These services are used, among other things, to conceal information about the websites users visit from their internet service providers.

Members of Russia’s technology industry also suggest that an allowlist-based internet could become the country’s new standard. Under this model, all open web traffic is blocked by default, with access permitted only to websites and applications approved by the authorities.

GrapheneOS, an Android-based mobile operating system with enhanced privacy and security features, confirmed that the Russian authorities are tightening internet censorship by blocking entire segments of online infrastructure.

This approach now appears to be becoming the norm. Using an allowlist of approved websites and services, Russia is indiscriminately blocking servers that are not included. The restrictions affect even entirely harmless websites if they rely on infrastructure belonging to blocked providers. According to the GrapheneOS team, this is precisely what happened to its services.

GrapheneOS does not provide any VPN services. However, the project rents server capacity from cloud hosting providers, making it collateral damage in Russia’s campaign to tighten internet censorship.

Russia initially began blocking IP space belonging to the hosting provider DataPacket. GrapheneOS then moved its services to infrastructure operated by another provider, Cherry Servers. When that provider was also blocked, the project switched servers again and moved to Zare in London.

The current solution is working, meaning GrapheneOS services remain accessible in Russia for now. However, the project’s team does not expect the situation to remain stable.

“That’s the final of our sponsored servers in Europe we can use, so we’ll need to fall back to Xenyth Toronto if they filter it. We’re using our own IP space in Toronto, so it should work unless they specifically block us,” the GrapheneOS team said in a post on X.

Because GrapheneOS fully controls this range of IP addresses, it would theoretically be much more difficult for the Russian authorities to block it accidentally along with the infrastructure of a major cloud provider. Regulators would have to deliberately and directly target GrapheneOS itself.

However, the project acknowledges that this does not change the broader situation. Even if Russia does not specifically blacklist GrapheneOS, the operating system’s services are unlikely to be added to the country’s allowlist.

“We don’t think we’ll be blocked directly, but we’re also unlikely to get placed on the allowlist. That means our services are gradually going to become inaccessible in Russia via the IP space of major cloud services,” the developers said.

The GrapheneOS team also stressed that blocking the infrastructure of entire hosting companies, rather than restricting access to specific websites, is far more aggressive than the methods currently used by China.

“Their allowlist is worse than China’s filtering. Our services are fully accessible in China without any workarounds,” the GrapheneOS post reads.

The developers noted that increasingly restrictive internet filtering is an official Russian policy that government representatives have repeatedly discussed in public. At the same time, regulators have not disclosed specific details about which resources they are blocking, the technical methods they are using, or how they intend to expand the restrictions.

“Russia’s internet filtering is definitely an official policy, with many public statements related to it. There aren’t specific public details on exactly what they’re blocking, how they’re doing it, or how they intend to continue expanding it. It’s more aggressive than China, though.”

Despite the tightening restrictions, developers continue to create new technologies capable of offering greater resistance to censorship. These include decentralized VPN services.

Users can also switch to another encrypted DNS provider. Another possible solution is to route DNS requests through a VPN. Using unencrypted DNS may restore basic connectivity, but it also reduces user privacy.

The Kremlin has long been increasing pressure on VPN providers and other tools used to circumvent online restrictions. The Russian authorities have also demanded that major technology companies, including Apple, remove VPN applications from their app stores.

According to media reports, Roskomnadzor has set a goal of blocking 92% of VPN services in Russia by 2030. By that time, the Russian authorities also aim to effectively complete the creation of RuNet, the country’s so-called sovereign internet.