The failed attempt to block Telegram in April 2018 showed Russian authorities that the old model of internet censorship, based mainly on IP blocking, no longer worked as intended. The restrictions hit millions of addresses and disrupted Amazon, Google, Microsoft, Spotify, Netflix, and other services, while the messenger itself continued to work for many users.
After that, the state accelerated implementation of the “sovereign internet” law. Telecom operators were required to disclose the structure of their networks to Roskomnadzor and allow the installation of TSPU, technical means of countering threats. The equipment is placed at network nodes, but it is controlled by the regulator’s staff, while operators are left only to provide power and physical protection.
According to researchers and technical experts, the core element of TSPU is a DPI filter that analyzes traffic and decides whether to allow, slow down, or block it. This system can identify which site a user is trying to access and whether they are sending an email, downloading a file, or using a messenger. At the same time, as eQualitie coordinator Leonid Yuldashev explained, the filter may detect that a Telegram message is being sent, but not its content.
Available evidence suggests that blocking works through several layers: some devices are installed closer to end users, while others sit on backbone routes. The overall system is managed by Roskomnadzor and the affiliated GRChTs, which is believed to operate regional traffic-control centers.
Yuldashev says official claims that TSPU covers the entire network appear overstated: because Russia has so many operators, filtering remains uneven, and older IP-based blocks are still used alongside DPI.
In his view, TSPU capacity is limited, so attempts to block specific services often slow down the wider network and disrupt unrelated platforms. At the same time, censorship is becoming harder to evade: VPN developers and authors of circumvention tools say the system is increasingly successful at recognizing popular traffic-obfuscation methods.