Russia's 2030 TSPU Plan: 92% VPN Blocking

Russia's internet regulator Roskomnadzor (RKN) has set measurable targets for achieving near-total control over Runet traffic by 2030, according to newly published government subsidy documents. The plan calls for routing 98% of all Russian internet traffic through TSPU hardware and blocking 92% of VPN services using deep packet inspection signatures - marking a decisive shift from vague surveillance ambitions to concrete, state-funded milestones.

What Is TSPU and How Does It Work

TSPU (Tekhnicheskie Sredstva Protivodeystviya Ugrozam - Technical Means of Countering Threats) are hardware-software systems installed inline on provider cables across Russia. Crucially, they are controlled centrally from Moscow by the Main Radio Frequency Centre (GRFC), meaning individual ISPs have no authority over how the equipment operates on their own networks.

The core technology is Deep Packet Inspection (DPI). Unlike ordinary routing, which only reads packet headers to determine origin and destination, DPI analyzes packet content to identify specific applications, protocols, or websites. TSPU systems can block access to specific IP addresses and domain names, throttle traffic from targeted platforms (as was done with Twitter in 2021 and YouTube in 2024), and cut off specific tunneling protocols used for censorship circumvention.

The 2030 Targets: 98% Traffic Coverage and 92% VPN Blocking

Documents accompanying government subsidies for the Automated Internet Security System (ASBI, which manages TSPU) set three headline goals for the end of 2030:

98% traffic coverage - route virtually all Runet traffic through TSPU nodes
831 Tbits/s throughput capacity - expand node capacity to eliminate bottlenecks
92% average VPN blocking effectiveness via signature-based filtering

The signature-based approach targets the handshake phase of VPN connections. When a device initiates an encrypted tunnel using OpenVPN, WireGuard, or IPsec, it leaves a characteristic digital fingerprint in network traffic. TSPU scans real-time traffic for these signatures and drops packets before the connection can be established. Reaching 92% effectiveness will require enormous computational resources, since modern obfuscated VPNs such as Shadowsocks, VLESS, and Trojan deliberately disguise their traffic to resemble ordinary HTTPS.

Current State of TSPU Deployment

TSPU hardware is now mandatory at the vast majority of backbone and large regional ISPs, as well as all major mobile operators in Russia. The exact percentage of traffic currently passing through the system is not publicly disclosed for national security reasons, but the ongoing capacity expansion suggests the figure remains below the 98% target due to the continued growth in traffic volumes.

As of 2025, Roskomnadzor officially reported blocking 258 VPN services - separate from earlier protocol-level blocks. The regulator has previously blocked or throttled protocols including OpenVPN and WireGuard at the infrastructure level, forcing users toward obfuscated tools.

The Budget: 83.7 Billion Rubles

Achieving full traffic coverage requires massive investment in hardware and operations. The government has allocated 40 billion rubles specifically for ASBI operations - 20 billion rubles in 2026, and another 20 billion across 2027-2028. Total financing for the federal TSPU modernization project has grown to 83.7 billion rubles, an increase of 14.9 billion rubles from earlier plans, according to reporting citing Ministry of Digital Development documents.

Major TSPU hardware suppliers continue to receive substantial funding. Gradient/RDP.RU, one of the largest equipment manufacturers, raised approximately 12 billion rubles in loans in 2025 alone to expand production capacity for the program.

Expert Reactions: Ambitious but Costly

The announcement of measurable VPN-blocking KPIs has drawn significant expert commentary in Russia.

Denis Kuskov, CEO of TelecomDaily, called the 92% target extremely ambitious, estimating that achieving it would require not the allocated 40 billion rubles but hundreds of billions, given the need for continuous hardware upgrades to keep pace with rising network speeds and evolving circumvention tools.

German Klimenko, head of the Foundation for Digital Economy Development, proposed an economic approach as an alternative to technological filtering. He argued that making all foreign internet traffic paid - at roughly $1 per gigabyte - would economically push up to 70% of Russian users away from VPNs and foreign websites without requiring complex DPI infrastructure.

Journalist Maria Kolomychenko of The Bell highlighted the legal ambiguity of the metric: the documents do not clearly define what exactly the 92% figure measures - whether it refers to the share of VPN apps in app stores, or the share of users who avoid VPNs.

Digital rights groups including Roskomsvoboda have consistently noted that expanding TSPU infrastructure degrades connection quality for legitimate users, disrupts banking and business applications, and accelerates the isolation of the Russian internet from the global web.

What this means for VPN users in Russia: The 2030 targets represent the most explicit government commitment yet to systematic VPN elimination. While obfuscated protocols currently remain effective, the combination of signature-based blocking, substantial state funding, and centralized control of ISP infrastructure makes Russia's trajectory the most technically sophisticated censorship build-out in Europe. Users dependent on VPNs for privacy, work, or access to blocked content face a narrowing window before signature-free obfuscation becomes a necessity rather than a preference.

Conclusion

Russia's TSPU program has moved from infrastructure deployment to defining precise, measurable outcomes: 98% traffic coverage and 92% VPN blocking by 2030. With 83.7 billion rubles committed and centralized DPI hardware already embedded in the country's major ISPs, Roskomnadzor is building toward one of the world's most comprehensive national traffic filtering systems outside China. Whether the technical targets are achievable on the stated timeline remains contested - but the political will and financial commitment are now on the record.

Key takeaway: If you rely on a VPN to access the open internet from Russia, now is the time to ensure your provider supports modern obfuscation protocols (Shadowsocks, VLESS, Trojan, or Obfs4) - standard OpenVPN and WireGuard connections are already being actively targeted and are likely to become unreliable well before 2030.