VPN provider HideMy.name appeals out-of-registry blocking in court

VPN provider HideMy.name filed a lawsuit against Roskomnadzor demanding to remove the blocking of it, carried out without inclusion in the register of prohibited sites. Access to the service in Russia has been restricted more than once, and in 2019 he managed to get the court blocking the site lifted. The plaintiff’s representatives hope that the outcome of the case in their favor will help the owners of other resources blocked using a similar method. But it will be difficult to prove that VPN operation is disrupted on the equipment installed by operators, experts say.

Kommersant got acquainted with a copy of the statement of claim in the Tagansky Court of Moscow, filed by the public VPN service HideMy.name (legal entity – hidemy.network Ltd. from Belize) against Roskomnadzor. The plaintiff asks that the blocking of the HideMy.name website, carried out since July 2023 through TSPU (technical means of countering threats – equipment that operators must install on networks according to the law on the “sovereign RuNet” from December 2021), be declared illegal. The plaintiff notes that TCSPs are legally designed to prevent threats to communication networks, and the VPN service “is just a client application and cannot pose a threat to anything.”

HideMy.name confirmed to Kommersant that the claim had been sent. The interests of the plaintiff in court are represented by the lawyer of the Moscow CCA “DBA and Partners” Ekaterina Abashina and the Roskomsvoboda project (declared a foreign agent) Sarkis Darbinyan, representatives of the project told Kommersant. Ms. Abashina clarified that the claim was filed on October 3 in electronic form; at the time of preparation of the material, information about its registration was not displayed in the card index of the courts of general jurisdiction of Moscow. Roskomnadzor did not respond to Kommersant’s request.

In 2017, access to the service’s website (then called HideMe.ru) was already blocked due to the input line placed on it, which made it possible to visit Internet resources through an anonymizer, without installing additional programs. After the service removed this line, it was unblocked, but in 2018 it was blocked again by decision of the Medvedevsky District Court of Yoshkar-Ola. The reason for this, according to the local prosecutor’s lawsuit, was extremist materials allegedly posted on the service’s website. HideMy.name managed to challenge the blocking in court; in June 2019, Roskomnadzor excluded its site from the register of banned sites. Now HideMy.name is also trying to challenge the blocking in Kazakhstan.

Roskomnadzor is resorting to blocking not only the HideMy.name website, but also the addresses of its VPN servers, service general director Markus Saar told Kommersant: “We were blocked, but were not included in the register, and were not warned about the violation. Any other regulations were not followed.” According to him, a positive outcome for the service “will be at least inclusion in the register in accordance with all the rules and laws.”

If the court sides with the plaintiff, the owners of other sites that have been subject to off-registry blocking “can, in theory, take advantage of the decision when challenging it, citing the principle of uniformity of judicial practice in similar circumstances,” notes Ms. Abashina. She adds that Roskomnadzor compiles a “list of threats” – that is, reasons for using TSPU – based on the results of exercises, monitoring and research: “But how they are carried out is not clear. Logically, they should be followed by documents with justifications, but their placement in the public domain is not provided.”

As an argument for the off-registry blocking of the site, the plaintiff cites the expertise of Ilya Yakovlev, a specialist at Center for Digital Forensics and Law LLC: he recorded the absence of the site in the register of prohibited sites, its accessibility from other countries, as well as the blocking of the server’s response when accessing it from Russia. However, this may not be enough to prove to the court the fact of blocking specifically through the TSPU, says Evgeniy Altovsky, head of the information and analytical service of the Information for All Organization. Technically, this can be proven by tracing the connection (obtaining information about all Internet nodes through which a network request passes) from the client to the server and vice versa: “But the plaintiff will have to explain to the court in layman’s terms what tracing is, and most importantly, prove that the session is terminated precisely when passing through the TSPU equipment.” In his opinion, this does not follow from the text of the claim.

Yuri Litvinenko