Russia’s internet watchdog blocks thousands of websites that use Cloudflare's privacy service

Russia’s media censor, Roskomnadzor, has blocked thousands of local websites that use an encryption feature from the U.S. company Cloudflare, designed to improve privacy and security for internet users.

According to local media reports, the websites were blocked overnight on Oct. 6. All of them use Cloudflare’s security feature called Encrypted Client Hello (ECH), which protects user information during the initial stages of a secure connection. ECH makes it more difficult for third parties to track which sites users are visiting.

In a statement on Thursday, Roskomnadzor urged Russian website owners to stop using Cloudflare’s Content Delivery Network (CDN) service, as the company recently enabled the default use of the ECH extension.

“This technology is a way to bypass restrictions on access to information that’s banned in Russia. Using it goes against Russian law,” Roskomnadzor said.

The Russian internet regulator also recommended local website owners switch to domestic CDN services, which are systems of distributed servers designed to deliver web content more quickly and efficiently.

“Domestic CDN services ensure reliable and secure operation of websites and protect them against cyberattacks,” Roskomnadzor said. The agency didn’t provide any details on the legal force of its “recommendation” or what would happen to companies that do not comply with it.

This is one of the latest actions by Russian censors to prevent citizens from freely accessing information. Earlier this year, Roskomnadzor reportedly asked the U.S. tech giant Apple to remove dozens of virtual private network (VPN) services from the Russian App Store, as they allowed citizens to access the web while bypassing government censorship.

The Russian government has also blocked most Western social networks and news media, as well as local opposition media outlets, from access through Russian IP addresses.

The new Cloudflare restrictions would further limit the information available to Russian citizens online. According to Meduza, a popular Russian independent media outlet banned in the country, Cloudflare’s security services enabled local users to access its website and bypass restrictions. Now, they must rely on other methods.

According to estimates by Russian experts, Cloudflare’s services hold around 44% of the market among CDN providers, so switching to alternatives will require time and incur additional costs.

When Russia invaded Ukraine, Cloudflare, unlike many other Western tech companies, did not terminate all its services inside the country. “Russia needs more internet access, not less,” the company said in a statement at the time.

“We’ve seen a dramatic increase in requests from Russian networks to worldwide media, reflecting a desire by ordinary Russian citizens to see world news beyond that provided within Russia,” Cloudflare added. 

However, to comply with U.S. sanctions, the company terminated service to customers tied to sanctions, including those linked to Russian financial institutions and influence campaigns.

Following the invasion, some Russian tech businesses stopped using Cloudflare services, as the company is based in a country deemed “unfriendly” by Russia. Others continued to use it to protect their websites against the rising number of distributed denial-of-service (DDoS) attacks, Russian experts said.

According to Roskomnadzor, Russia has its own national system for countering DDoS attacks. Launched in March, it has reportedly helped Russian organizations counter over 10,000 attacks.

Russia has long aimed to isolate its internet and replace foreign technology with domestic alternatives. However, while transitioning to homegrown hardware and software is appealing for an authoritarian regime, the implementation faces many obstacles, including high costs and a lack of suitable domestic alternatives, local tech experts told Recorded Future News in an interview last October.