TSPU and DPI: how technical infrastructure turns into censorship
TSPU (ТСПУ) are “technical means of countering threats”: hardware systems installed on the networks of Russian telecom operators. They are managed centrally by Roskomnadzor (Роскомнадзор), and their operation is based on DPI (deep packet inspection) technology — deep analysis of traffic packets. If SORM is a channel for access to content, then TSPU is a channel for controlling what passes through the network at all.
Deployment began under the 2019 “sovereign internet” law. Today, TSPU systems are installed at most large operators and providers. They are used to block specific websites and services, slow down traffic (as happened with Twitter in 2021), and disable entire protocols (for example, a number of VPNs). Control is targeted: the same resource may be available on one operator and blocked on another, depending on how the filters are configured on a specific TSPU.
Below is a neutral breakdown of how the system is technically built, what tasks it solves, and where its capabilities run into physical limits.
In brief
- TSPU is equipment on operators’ networks, managed centrally by Roskomnadzor.
- DPI (deep packet inspection) is real-time analysis of packet headers and contents.
- It can block websites, slow down traffic, and disable specific protocols.
- It was used to slow down Twitter (2021) and to block a number of VPN protocols (since 2024).
- It does not “remove” the internet — it manages the priorities and availability of individual services.
What TSPU is and how DPI works
It is useful to understand the two components separately: TSPU is “where it was installed,” DPI is “how it analyzes.”
TSPU as hardware
Technical means of countering threats are server racks with a software and hardware system installed on operators’ networks at traffic exchange points. The equipment is centrally managed by Roskomnadzor: the operator has no right to change its settings independently. Under the “sovereign internet” law (Federal Law No. 90-FZ of 2019), operators are required to route all their traffic through TSPU.
DPI as a technology
Deep packet inspection is analysis not only of packet headers (IP addresses, ports) but also of their contents. Using characteristic indicators (SNI in TLS, protocol patterns, packet sizes, time intervals), DPI determines what kind of traffic is passing through: HTTPS to a specific site, a specific VPN protocol, video streaming, P2P. After the traffic is identified, a policy is applied to it: allow, slow down, or block.
What TSPU can do
Basic operations: blocking by IP address, blocking by domain name (through SNI in TLS), blocking by protocol signature, throttling (artificially reducing bandwidth to a level at which the service becomes unusable). The granularity of settings is the key feature: one service can be slowed down without touching the others.
Where the capabilities hit limits
DPI does not decrypt TLS traffic — it only sees the metadata of an encrypted connection. Modern circumvention protocols (Shadowsocks with masking, V2Ray with TLS over WebSocket, Cloak) look like ordinary HTTPS traffic to legitimate websites, and basic signatures do not trigger on them. TSPU is retrained, but it always lags behind circumvention: this is an “arms race.”
Types of TSPU intervention
| Type of intervention | How it appears | What happens technically |
|---|---|---|
| Blocking by IP | The resource is completely unavailable | Packets to a specific IP are dropped |
| Blocking by SNI | The site is unavailable, but other sites on the same IP work | Analysis of the server name in the TLS handshake |
| Slowdown (throttling) | The service “lags”; images and videos do not load | Artificial bandwidth limitation |
| Blocking a VPN protocol | A specific VPN stopped working on your operator | Signature-based filtering by protocol characteristics |
| Targeted interference | It works on one operator and not on another | Different configurations on different TSPU systems |
| Regional blocking | The service is unavailable in one region and available in a neighboring one | The TSPU configuration is tied to the operator’s node |
How to check right now
A simple check of TSPU operation is available to any user. Open several services that previously worked (Twitter/X, Facebook, Instagram, individual VPN apps): if they are unavailable or sharply slowed down, this is a visible result of TSPU operation. Comparing mobile internet from different operators or a home provider shows the difference in settings: it works on one and not on another.
If the task is to understand not censorship in general but your own risk, checking through Wanted Radar against the MVD wanted list database and through official registers (minjust.gov.ru, fedsfm.ru) provides a starting point for individual legal risks.
Warning signs vs false alarm
A warning sign in the context of TSPU is not the fact of blocking itself, but possible legal consequences for circumvention. Since 2024, the Code of Administrative Offenses has provisions for “searching for extremist materials” and distributing information about ways to circumvent blocking. Using a VPN by itself is not an offense for a private individual, but distributing instructions is a separate risk.
A false alarm is equating “the site loads slowly for me” with “I am personally being targeted.” Slowdown works at the protocol level, not at the subscriber level: it is the same for all users of that operator.
What to do next
- Understand that blocking is an attribute of the operator and region, not your account; changing providers may change the picture.
- Do not treat circumvention as universal protection: TSPU is retrained and blocks outdated methods.
- Keep in mind that blocking individual VPNs does not mean blocking all VPNs — the market is constantly changing.
- Do not distribute instructions for circumventing blocking in public — this is a separate legal risk.
- Use only licensed VPN applications; pirated and phishing VPN clients are a separate threat, unrelated to state censorship.
- At elevated risk, consult a lawyer rather than relying only on technical tools.
Disclaimer: this material is for informational purposes and is not legal advice. For a specific situation, contact a lawyer. Regulation of TSPU and liability for searching for/distributing prohibited information changed in 2019–2026; for the current version, check consultant.ru or pravo.gov.ru.
Conclusion
TSPU and DPI are not an “internet kill switch,” but an infrastructure for managing traffic priorities. They allow specific services and protocols to be restricted in a targeted way, but they run into modern cryptography and the constant emergence of new circumvention techniques. For the user, the practical effect is a different set of “what works” depending on the operator and time, while the legal risks lie not in the mere fact of using a VPN, but in publicly distributing circumvention instructions.