Roskomnadzor Deploys 2.27 Billion Ruble AI Traffic Filter: Known Facts and Expert Speculations
Russian communications regulator Roskomnadzor has incorporated a machine-learning traffic filtering system into the Automated System for the Security of the Russian Internet Segment (ASBI). The deployment, budgeted at 2.27 billion rubles, was first reported by Forbes on 13 November 2026 and subsequently covered by Meduza, 3DNews and SecurityLab.
Documented Details from the 2026 Digital Transformation Passport
The only primary source is the official passport of Roskomnadzor’s departmental digital transformation programme for 2026 and the planning period 2027–2028. According to the document, the system runs on a Russian-trained model hosted in the regulator’s own infrastructure and is integrated with TSPU equipment deployed on operator networks. TSPU devices already perform deep packet inspection to restrict websites, throttle connections and block protocols.
Additional funding lines in the same programme include 3.99 billion rubles for installation and modernisation of TSPU equipment and 6.2 billion rubles for hardware procurement. The identity of the contractor and detailed technical specifications have not been disclosed.
Intended Capabilities According to Reporting Outlets
3DNews states that the system is designed to detect circumvention tools, including VPN services, and websites hosting prohibited content. SecurityLab describes a possible detection approach that evaluates connections using indirect statistical features such as packet size and timing, session length, inbound-to-outbound traffic ratios and server characteristics, without decrypting payload data.
These descriptions remain expert interpretations; the regulator has not published an official functional specification or test results.
Unknown Factors and Expert Concerns
- Detection accuracy – false-positive and true-positive rates have not been published.
- Performance impact – specialists warn that real-time inference at current internet speeds could introduce latency.
- Operational placement – it is unclear whether the model analyses traffic on the fly or merely generates signatures later applied by TSPU devices.
- VPN effectiveness – no official assessment of the system’s effect on popular VPN protocols has been released.
Background and Timeline
Plans to develop such a capability were first mentioned in January 2026. In October 2026 the Ministry of Digital Development proposed using AI specifically to locate and block VPN services, prompting early warnings from experts about erroneous blocking of legitimate corporate traffic. In May 2026 media speculated that the platform Astra AI from Group Astra might be involved, but the November passport does not name any specific product.
As of 14 November 2026, Roskomnadzor has issued no official statement confirming the system’s capabilities or deployment status. Observers are monitoring for the release of performance measurements and any future technical disclosures by the agency.
Related articles
MinTsifry Proposes Requiring Telecom Operators to Install SORM Equipment Before Obtaining Licenses
The Russian Ministry of Digital Development plans to introduce legislation obligating telecom operators to deploy SORM surveillance systems prior to receiving operating licenses. Under the proposed rules, companies will only be permitted to begin serving subscribers after the equipment has been installed and handed over to law enforcement agencies. Non-compliance could result in license revocation through an extrajudicial administrative process. Current regulations allow operators to obtain licenses with a network diagram that merely indicates planned or existing SORM components. The change aims to close loopholes exploited by unscrupulous providers that repeatedly register new legal entities to operate without surveillance capabilities. Industry experts note that the minimum cost of a basic SORM complex starts at 5 million rubles, which could disproportionately affect smaller local providers without a transition period or scaled requirements.
GOST R 57580 Compliance: Defining Assessment Scope to Verify Real Protection in Financial Organizations
Financial institutions often maintain extensive documentation on information security yet still fail GOST R 57580 assessments due to mismatches between documented processes and actual infrastructure. The standards GOST R 57580.1-2017 and GOST R 57580.2-2018 set distinct requirements for protection levels and evaluation methodology. Correct application begins with identifying the organization's regulatory category under Bank of Russia rules such as Regulation 851-P for credit institutions or Regulation 757-P for non-credit financial organizations. Defining the precise assessment boundary is critical, including systems, remote access channels, virtualization components, and third-party interactions. Organizations must also distinguish between the full assessment scope and the representative sample selected for verification. Evidence collection requires both policy review and technical confirmation that controls function as intended across the evaluated environment.
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.