Russia's Digital Controls Before Victory Day

Russia's Digital Controls Before Victory Day: Drones Are the Alibi

Russia shut mobile internet, SMS and even 'whitelisted' sites in Moscow on May 9, 2026 — a security pretext being used to stress-test the tools of a permanent sovereign Runet.

The Kremlin cut mobile internet, SMS and even the government's own "whitelisted" websites across Moscow and roughly 40 other regions in the five days ending May 9, 2026, ostensibly to blunt Ukrainian drone strikes on the Victory Day parade. It is not really about drones. Under cover of the annual parade, Russia's Federal Security Service (FSB) is running a full-scale rehearsal of the whitelist-only internet it intends to make normal before September's Duma elections — and the March 2026 dry run in Moscow already cost the capital's businesses an estimated 3–5 billion rubles in five days, according to Kommersant reporting cited by Al Jazeera. The parade is the theatre. The infrastructure is the point.

What Moscow actually did on May 5–9

The Digital Development Ministry ("Mintsifry") announced on May 7 that mobile internet, SMS and access to whitelisted resources would all be suspended in Moscow on May 9 "to ensure security during Victory Day celebrations," a scope broader than any previous Russian restriction, Meduza reported. Sources close to Rostelecom told BBC Russian that Moscow's mobile network would be blocked from 5:00 to 12:00 on May 7 and 5:00 to 13:00 on May 9 — the parade rehearsal and the parade itself — with the restrictions extending inside the entire MKAD ring road, not just central Moscow.

Vending machines stopped working. Taxi apps failed. Some ATMs would not dispense cash. According to The Moscow Times, residents of 38 other regions — mostly in the Southern, Central and Volga federal districts — received SMS notifications that mobile internet would be restricted for the entire May 5–9 window; sites on the official whitelist were "supposed to remain accessible, but were also unavailable in reality." Novaya Gazeta Europe counted at least 21 regions in which telecom operators and banks pre-warned users of expected outages.

The military justification came from the top. In late December 2025, Deputy State Duma information committee chair Andrey Svintsov told TASS that mobile internet "can be turned off on any night, including New Year's Eve" if the Defence Ministry flags a drone risk, calling it "today's reality." President Vladimir Putin, at an April 2026 meeting cited by the Carnegie Endowment, ordered the government to work with the FSB to keep "critical services" running during future shutdowns — implicitly conceding that shutdowns themselves would continue.

Why the drone story does not hold

Ukrainian long-range drones do sometimes use Russian SIM cards for command-and-control, and switching off local base stations near a target can, in theory, disorient them. But the pattern of shutdowns is not the pattern you would expect if the goal were counter-drone defence.

Ulyanovsk Oblast, which does not border Ukraine and lies well outside Ukrainian drone range, imposed indefinite mobile-internet restrictions in November 2025 that will run "until the end of the special military operation." Krasnoyarsk, more than 3,000 km from the front, lost mobile internet citywide for three days in July 2025, the BBC reported. Vladimir, 200 km east of Moscow, had two of three districts offline for nearly a month. Belgorod governor Vyacheslav Gladkov — running the region most exposed to actual Ukrainian attacks — publicly called for Roskomnadzor to be "put on trial" over the outages, according to Al Jazeera. Even the March 2026 Moscow blackout lasted 19 days with no parade to protect.

The Chatham House view is blunt: the outages are "part of Moscow's broader campaign to cut off independent sources of information and horizontal networks of communication," not a counter-UAV programme, analyst Mathieu Boulègue writes. Sarkis Darbinyan, co-founder of the digital-rights group Roskomsvoboda, told The Moscow Times that GPS alone is enough for drone navigation and that the geography of the blackouts "certainly has nothing to do with countering UAVs."

The whitelist is the machine

The real project is architectural. Since autumn 2025, according to a December 2025 report from Poland's OSW Centre for Eastern Studies, Russian authorities have been operating a nationwide "whitelist" — a positive list of state-approved websites and apps that stay online when everything else is dark. By December it covered 57 of Russia's 80-plus regions, limited only by uneven deployment of the deep-packet-inspection hardware needed to enforce it.

The legal spine was installed years ago. The 2019 "sovereign internet" law obliged every Russian ISP to install state-controlled TSPU equipment — "technical means of countering threats" — capable of centrally filtering, throttling, blocking or rerouting traffic. In a July 2025 investigation, Human Rights Watch documented that the associated EcoSGE software, developed by a state-owned company and approved by Roskomnadzor, already contains a function to "block all traffic that goes anywhere but 'whitelisted' websites." That capability was dormant. It is dormant no more.

The custodianship also changed. Reporting by the independent outlet The Bell, cited by Carnegie's Andrei Soldatov, places responsibility for Runet oversight inside the FSB's Second Service — the Service for the Protection of the Constitutional System and the Fight Against Terrorism, whose director was sanctioned by Washington, London and Ottawa for the 2020 Navalny poisoning. Its reflex is prohibition, not maintenance. Since the handover, Carnegie's analysts write, the Runet has entered "the worst period" of its existence, with total web filtering, complete blocks on WhatsApp and Telegram, criminal penalties for reading "extremist" material, and a running war on VPNs.

Who wins, who loses inside the elite

There is a fight inside the Kremlin about this — and the security services are winning it.

The economic bloc knows what shutdowns cost. OSW puts business losses in Moscow at roughly 1 billion rubles a day, about $12.5m, during the March 2026 blackout. IT and digital services accounted for 36% of Moscow's gross regional product in 2024, per city authorities cited in the same OSW analysis, and small and medium enterprises — Moscow's most fragile taxpayers — are the least able to migrate to wired backups. Cash in circulation has jumped almost fivefold in three months, Izvestiya reported, because card terminals need mobile data.

Political managers dislike shutdowns for a different reason: they cannot run a parliamentary campaign inside the whitelist. Duma Deputy Speaker Vladislav Davankov of the Kremlin-aligned New People party filed a petition against the blackouts, Carnegie noted. Officials in the presidential administration need Telegram to reach voters ahead of September 2026.

They lost. At his April 2026 meeting Putin did not order shutdowns to end — he ordered the government and FSB to make them work more smoothly. The concessions were procedural: a delayed introduction of paid VPN traffic until after the elections, and a July 1, 2026 deadline for Prime Minister Mikhail Mishustin and FSB director Alexander Bortnikov to jointly designate protected "critical services." The security establishment, Carnegie concludes, "prevailed." The shutdowns are now normalised policy, not emergency measures.

The parallel that reframes it

The instructive comparison is not Iran's throttling or China's Great Firewall. It is Belarus in August 2020, when Alexander Lukashenko cut mobile internet for three days during the post-election protests and discovered that a national blackout was easier to impose than to lift. Russia is scaling that lesson to a country of 143 million.

The Freedom House Freedom on the Net 2025 report recorded Russia's internet freedom score falling to a new low, driven precisely by the sovereign-internet tests and Victory Day shutdowns. Access Now data cited by Carnegie shows Russia now running an average of 2,000 shutdowns a month — more than the rest of the world combined in all of 2024. The Finnish Institute of International Affairs, in a May 2026 briefing paper by Margarita Zavadskaya, argues Russia has entered a fourth stage of digital authoritarianism defined by "systemic degradation" — the state is now willing to break banking, taxis and its own Gosuslugi public-services portal in order to hold the plumbing.

That is the point Sarkis Darbinyan made in The Moscow Times: the holidays are a "convenient test period" during which the FSB can measure how much economic disruption Russian society will absorb before it pushes back. So far, the answer is: a great deal.

Diplomat View

The forecast: Russia's whitelist system will be operational nationwide before the September 2026 Duma vote, and the Kremlin will use the elections themselves — not drone threats — to justify the next major shutdown wave. Watch for a "foreign interference" narrative to appear in state media between mid-August and the September 20 polling window; that will be the political cover for turning selective whitelisting into the default connectivity mode across all federal districts.

The falsifiable conditions: this call is wrong if (1) the government publishes a binding decree exempting Moscow and St Petersburg from election-period shutdowns, (2) the FSB's Second Service loses its Runet portfolio in a Kremlin reshuffle before September, or (3) the July 1, 2026 Mishustin–Bortnikov "critical services" agreement carves out a legally protected always-on tier for banking and Gosuslugi that meaningfully constrains Roskomnadzor. Absent one of those three, the trajectory is set. The March 2027 amendments giving Roskomnadzor unilateral power to disconnect the Runet from the global internet — flagged by the BBC's Russian service — will land in an infrastructure already primed for it.

The wider lesson for Europe, per the FIIA paper: Russia has shifted from controlling content to controlling connectivity. That capability, once built, is exportable — to Belarus, to the Central Asian states, and to any regime willing to buy the Russian TSPU stack.

What to watch next:

• July 1, 2026 — deadline for the joint Mishustin–Bortnikov order defining "critical" always-on services during shutdowns.
• August 2026 — expected extension of whitelist coverage from 57 to all 80+ regions as remaining ISPs complete DPI installation.
• September 20, 2026 — Duma election day; the first electoral test of the sovereign-Runet architecture.
• March 1, 2027 — statutory amendments granting Roskomnadzor unilateral authority to sever the Runet from global networks take effect.

The Bottom Line

Russia's Victory Day internet blackout was not a counter-drone measure; it was a nationwide field test of the whitelist-only Runet the FSB intends to normalise before the September 2026 Duma elections. The Kremlin has already decided it can absorb the economic damage — over $12 million a day in Moscow alone — because the political payoff, an election held inside an internet Moscow controls end-to-end, is worth more. The parade ended on May 9. The infrastructure it rehearsed is not going away.