Russia to Mandate Gosuslugi Authentication for Hosting Providers, Further Reducing Anonymity in Runet
The Russian Ministry of Digital Development (MinTsifry) has resumed efforts to tighten control over hosting providers by proposing mandatory client identification through the Gosuslugi portal. The initiative would apply not to selected services but to virtually all hosting offerings, requiring every customer to authenticate via a confirmed ESIA account.
Under the proposed rules, each allocated IP address must be tied to a specific individual with a verified government-linked profile. Current identification methods—such as email addresses, bank cards, or other indirect verifications—are considered insufficient by regulators seeking greater transparency across the Russian internet segment known as Runet.
This policy builds directly on measures introduced in September for domain registrations. Owners of domains in the .ru, .рф, and .su zones must now confirm their identity through ESIA both when registering new domains and when renewing existing ones. Regulators intend to extend the same verification standard to hosting services.
Reactions within the hosting industry remain sharply divided. Turbo Cloud supports the change, arguing that mandatory identification will help combat phishing attacks and fraudulent schemes. The company has already integrated ESIA authentication and states that the associated expenses remain manageable for providers.
Other companies express more cautious or negative views. Runity estimates that preliminary implementation costs will reach at least 5 million rubles. RUVDS warns that the new requirements could severely damage the retail segment of the market, particularly affecting students, independent developers, and private individuals who may find the additional Gosuslugi verification step overly burdensome.
According to RUVDS assessments, providers could lose between 20% and 35% of such retail customers. These users are expected to migrate not to offline alternatives but to foreign hosting providers operating outside Russian jurisdiction.
A separate concern involves foreign clients. Without an alternative identification mechanism, non-Russian users may lose access to hosting services, servers, and domains. Overall, the push for greater transparency risks accelerating both the decline of online anonymity and the outflow of clients beyond Russia’s borders.
Related articles
Why Russia Needs Specialized Circumvention Tools Beyond Standard VPNs
The developers of Tunnel Kitten explain why another circumvention project is necessary despite the availability of numerous VPN services and solutions like AmneziaWG. A prolonged outage affected many long-term users, damaging trust and requiring ongoing fixes. Standard VPNs do not address the core issue: creating and maintaining tools to bypass internet blocks has been criminalized in Russia. This legal asymmetry makes public VPN services and self-hosted solutions risky or insufficient for users facing state-level censorship. Tunnel Kitten positions itself as a project focused on a different task that accounts for these legal realities. The team emphasizes that the problem is not merely technical but tied to the criminalization of circumvention efforts.
US Presidential Memo Authorizes Selected Private Companies to Join Federal Cyber Operations Against Foreign Criminal Groups
The United States government has established a formal program allowing vetted private-sector companies to participate in offensive cyber operations targeting foreign criminal organizations. Signed by President Donald Trump on August 12, 2026, the presidential memorandum places the initiative under the National Coordination Center with joint oversight from the Department of Justice and the Department of Homeland Security. Participating firms will operate exclusively under government contracts, direction, and supervision, with strict requirements including technical evaluations, financial guarantees of at least one million dollars, and pre-approval for every operation. The program focuses on disrupting ransomware, phishing, financial fraud, and other schemes affecting American citizens while imposing clear limits to prevent unintended harm to US persons or escalation to prohibited levels of force. In contrast to Brazil’s ongoing policy discussions, the US move formally recognizes that advanced offensive capabilities now reside primarily in the private sector and creates a regulated mechanism to access them. Operational rules must be published within 60 days, marking a significant shift in how governments integrate private expertise into state-directed cyber actions.
Russia to Require Independent Lab Testing of Sovereign AI Models for Legal and Traditional Values Compliance
The Russian Ministry of Digital Development is discussing a certification scheme under which developers can submit large generative AI models to accredited independent laboratories. These labs will verify compliance with Russian legislation and traditional spiritual-moral values defined in presidential decree No. 809. Only models seeking official national or sovereign status, which unlocks state support, data access and priority procurement, will undergo the process. Developers must first conduct self-testing according to a risk-oriented methodology and supply architecture details, filtering mechanisms and other documentation. Accredited laboratories will then run benchmarks, attempt prompt-injection attacks and produce evaluation reports, while the final decision remains with MinTsifry. Separate security assessments for government systems will be performed by the FSB and FSTEC Russia. Experts have called for transparent, reproducible tests and periodic re-certification after model updates.
Why Separate Corporate and Personal Email Accounts: Risks of Mixing Work and Private Communications
Mixing corporate and personal email accounts creates serious security, compliance, and operational risks for both employees and organizations. When employees forward contracts or client data to personal mailboxes to bypass size limits or convenience, copies proliferate beyond company control in phones, backups, and cloud services. After termination, the employer loses any ability to revoke access or audit the data, while personal accounts often lack multi-factor authentication and strong password practices. Russian legislation including Federal Law No. 152-FZ on personal data, the Labor Code, and Federal Law No. 98-FZ on trade secrets requires proper protection of sensitive information. Using work email for shopping, banking, or password recovery exposes the corporate domain to phishing and leaks, while the reverse creates dependency on private accounts for business continuity. The recommended practice is strict separation with unique passwords, MFA on both accounts, and approved corporate channels for file transfer.