21.9.2017

What Should Businesses Know About Russia’s New VPN Law?

In recent years, Russian authorities have done much to prevent Internet users located within the country from accessing illegal online content. As of 1 November 2017, a new law will close some backdoors to the ‘forbidden fruit’.

Not surprisingly, the new rules may jeopardize the use of corporate VPN connections of international companies. How can a business keep its VPN running even if Russian employees want to see more than they are allowed to by the state?

Corporate VPNs Feared to be a Backdoor to Illegal Content

There are several types of online content that are illegal and subject to ban in Russia.  They include, among other things, war and suicide propaganda and extremist materialsBanning procedures vary depending on the nature of the illegal information, but the result is always the same – access restriction to a relevant website.

The Russian Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) keeps records of websites and their network addresses and demands that website owners and hosting providers ban illegal content. If they fail to do so, all Russian Internet service providers (ISPs) will be required to block users’ access to the forbidden content. That is why the ban can be easily bypassed if users access a website through a non-Russian ISP.

Here is where online VPN services step into the breach and assist Russians in moving Internet traffic through exit nodes beyond Russian borders. Corporate VPNs work in the same way, but for a different purpose, as they help establish secured connections between all parts of a corporate network.

In the meantime, Russia-based employees of international companies may enjoy uncensored Internet via their corporate computers.

New Rules to Prevent Access to Illegal Content

On 29 July 2017 the Russian President signed amendments to the IT Law[1]  introducing the following rule:  owners of information and telecommunications networks and/or information resources (Internet websites and webpages, information systems and computer programs) that are used to provide access to information resources and information and telecommunications networks banned in Russia, are prohibited from allowing the resources and networks they own to be used in such a way as to allow access to banned resources and networks in of Russia (the Prohibition).

The law touches upon both online VPN services intended for private users and business solutions such as corporate VPN clients.

According to the amendments, an ‘owner of information and telecommunications networks and/or information resources’ (i.e., a VPN owner) will have to connect to the federal state information system which contains a list of information resources and networks access to which is restricted in Russia (the State Database).

The State Database will be maintained by Roskomnadzor and will filter all censored content. In case of non-compliance, Roskomnadzor may deny access to VPN through Russian ISPs. As of today, the Prohibition is primarily targeting publicly available VPNs, but corporate networks also fall under the Prohibition according to its literal reading. For this reason, the amendments provide for two exceptional cases.

Exceptions to VPN Restrictions

The Prohibition will not apply to state and/or municipal networks and also will not apply in situations where two conditions are fulfilled:

(a)    the users of the VPN that allows access to illegal content banned in Russia are predetermined and

(b)    VPN is used for technological purposes of supporting operations of the person using it.

The law does not elaborate on these two conditions which leaves them open for interpretation.

At this point, it is clear that a VPN owner should list all Russia-based employees using the VPN in order to meet the first condition. According to a common business practice in Russia, the list should be prepared in writing and adopted by the CEO of the company. However, determining which company needs to prepare the list in a group of companies may prove to be difficult.

The Russian IT Law knows no distinction between the parent company, which usually owns the VPN tools, and its subsidiaries and affiliates, the employees of which use the corporate VPN. Another thing to consider is guest networks which may share the same VPN connection with corporate networks. If that is the case, the company should keep a record of visitors using the guest network to comply with the requirements of the Prohibition.

As to the second condition, the actual scope and limits of ‘technological purposes’ seem unclear. The company should somehow ensure that its Russia-based employees do not use the VPN for any purpose other than the ‘technological purposes’. It is also uncertain whether the ‘person using’ the VPN (as specified in the original legal text of the amendments) means the employee or the company. Whatever ‘technological purposes’ are they surely do not include personal needs of the staff.

International Companies Should Prohibit Personal Use of VPNs

Based on Russian business practice, the most feasible approach for Russian subsidiaries of international companies is to amend the local IT policies or release a separate VPN policy prohibiting any personal use of the VPN and corporate computer systems connected with VPN as well as any other use aiming at bypassing local (Russian) laws.  Such policies must be amended/adopted in a formal procedure according to the Labour Code of the Russian Federation.

It will be clear whether or not these measures are sufficient only after the amendments enter into legal force and Roskomnadzor begins their enforcement. That is why we should keep an eye on Roskomandzor’s next steps regarding the Prohibition.

[1] Federal Law No. 276-ФЗ On Amendments to the Federal Law  On Information, Information Technology and Protection of Information dated 29 July 2017

Latest references

We advised Valio Oy in its acquisition of Raisio Oyj’s plant protein business, related fixed assets and the Härkis® and Beanit® fava bean brands. The fixed assets include, among other things, the production equipment of the factory that makes plant protein products in Kauhava. The transaction supports Valio’s strategy to grow from a dairy company to a food company. This business acquisition will make us an even more significant developer and producer of plant-based protein products. The demand for these products will grow in the long term, and a great deal of growth potential still remains. In 2022, we acquired the Gold&Green® business and, since then, we have been carrying out strong product development and renewed the brand. Following successful product launches, sales in the last quarter of 2024 increased by about 50% from the previous quarter. With this acquisition, we are building our own production capacity. The production equipment of the Kauhava factory is just right for our needs and situation. says Kimmo Luoma, Valio’s Senior Vice President. Valio is a Finnish dairy and food company founded in 1905 and owned by Finnish dairy cooperatives. Valio has subsidiaries in Sweden, Estonia, the United States and China. In 2023, the Group had a turnover of EUR 2 278 million and more than 4 000 employees.
Case published 14.2.2025
We advised WithSecure Corporation in the sale of its cybersecurity consulting business to Neqst. WithSecure is a global cyber security company (listed on NASDAQ OMX Helsinki). Neqst is a Swedish investment firm, focusing on technology companies. The closing of the transaction remains subject to customary conditions and regulatory approvals.
Case published 24.1.2025
We assisted Smarter Contracts Ltd in the process where the Finnish Transport and Communications Agency Traficom confirmed it to be an EU-recognised data intermediation service. Non-EU companies must have a legal representative in some EU country so that they can offer data intermediation services in accordance with the Data Governance Act. Smarter Contracts is based in Great Britain and selected Finland for the task. Smarter Contracts is the first non-EU data intermediation service registered by Traficom. Wayne Lloyd, Founder & CEO of Smarter Contracts, remarked:  The support from the Castrén team was exceptional from start to finish. Pioneering new territory is never without its challenges, and as the first non-EU data intermediation service provider, we faced significant legal uncertainties. Despite these complexities, the Castrén team expertly guided us through each step with remarkable efficiency, providing the certainty we needed. Smarter Contracts leverages its proprietary Pulse Permissions Protocol® to deliver advanced consent and access rights management services. This milestone highlights Castrén & Snellman’s proficiency in navigating intricate regulatory landscapes, whilst recognising the relevance of Smarter Contracts’ innovative approach to secure, compliant data management.
Case published 11.12.2024
We assisted Pharmaca Health Intelligence in its acquisition of Mediaattori Ltd’s PODIUM Connect® and PODIUM Visits businesses. Through the acquisition, Pharmaca Health Intelligence strengthens its extensive service offerings in medical information, data-driven management, and education for both healthcare and pharmaceutical companies. Pharmaca Health Intelligence is a pioneer in digital medical information and a reliable partner for wellbeing services counties, the private healthcare sector and pharmacies. The company invests in the development of technology and service solutions related to pharmaceutical information, also on an international scale.
Case published 5.12.2024