Russia:
Information Governance

As of 18 October 2026. Since the analysis closed in October 2025 the controls have tightened step by step, and abroad attribution still trails the effect. From September 2025 a list kept by the digital ministry decided which sites still loaded when mobile internet was restricted, from the state services portal and Max to the sites of the government and the president. In February 2026 the Duma approved a bill letting the FSB demand mobile shutdowns, and in March mobile internet in central Moscow was down for nearly three weeks. Over the year to August the authorities blocked WhatsApp, Telegram and FaceTime, Human Rights Watch reported, and the Kremlin pointed users to Max, “a national messenger”.

Abroad the answers came late. On 12 December 2025 Germany's Foreign Office formally attributed an influence operation to Russia for the first time, after a year in which the Storm-1516 network had aimed eight of its thirteen false claims about Germany at the chancellor, as DURCHD8's Zeitenende study records. On 11 October 2026 Prime Minister Andy Burnham confirmed Russian interference in the Brexit referendum, ten years after the vote, and his government added that the attempts had failed. The proposals Putin asked for on 14 October are the next marker. If they become law, the order the study found faces its next test.

The function rests on four instruments, all in force. A decree of December 2016 declares information a field of national security. The information law of 2006, amended again and again, lets the authorities restrict and block. The sovereign internet law of 2019 routes traffic through filtering equipment under the regulator’s hand, and the foreign agent law of 2012 attaches a label that is itself the penalty. Wherever the study can date the order, the practice came first: operations against Estonia and Georgia before the doctrines, deep packet inspection before the law of 2019, the censorship of 24 February 2022 eight days before the statute.

Inside this frame nobody needs daily orders. Broadcasters, services, the regulator and informal networks repeat the same three stories, and enforcement follows usefulness: what serves Moscow’s position abroad may stay even when it strains the facts. Cyber operations serve the story, as American indictments of 2018 trace from intrusion to a controlled leak through intermediaries to amplified coverage.

Moscow calls its laws information security, and Western readers who take them as defence compare them with the EU’s Digital Services Act or America’s foreign-agent statute. For those they designate they are a verdict with no right of reply. Abroad the study measures the effect in time. By persuasion, Russian narratives often fail. By how fast an open system can agree on what happened and act, they work.

Inside Russia people lose access: to messengers, to foreign news, to a mobile network the FSB can switch off by lists of base stations. Abroad, governments lose time. Fast, deniable operations meet answers that need deliberation, legal process and agreement among allies. The effect lands in the gap. Attribution comes afterwards, as a damage report, while protection and prevention would have to act before. In 2024 NATO's centre of excellence for strategic communications proposed attributing on patterns of behaviour, a step away from courtroom proof, which the study reads as an admission that the old standard is too slow.

How much evidence does a government need before it acts on a pattern, and can it gather that evidence within the days in which the effect lands?

Inside Russia the function has five carriers and no single commander. The presidential administration and the Security Council set direction. The FSB and the regulator Roskomnadzor run the civil side, from the foreign agent register to the filtering equipment, and military intelligence, the GRU, adds cyber operations with a message attached. State broadcasting, merged into Rossiya Segodnya by a decree of December 2013, speaks outward through RT and Sputnik, and networks of the Internet Research Agency type amplify. On 14 October Putin asked for closer coordination between the intelligence agencies, telecom operators, banks and internet companies.

Platforms stand between the state and its public. When Moscow moved to block WhatsApp in February, the company called Max “a state-owned surveillance app”, and into April Apple kept removing VPN apps from its Russian store at Roskomnadzor’s demand. On the receiving side stand parliaments, courts, police, regulators and alliance staffs. In 2024 the Voice of Europe network moved Russian money to members of the European Parliament, and the response stalled between national anti-corruption offices.

DURCHD8 published the case in four forms on 17 May 2026, with an analytical cut-off of October 2025. Russia’s Information Domain as a Governed Power Function is the full analysis of 43 pages, deposited at Zenodo. It builds the function from decrees, statutes, regulatory mandates and court records and admits secondary literature only where it reproduces such sources. It follows the function into practice and rates its ceiling: it can delay and wear down, and it cannot close a conflict on its own terms. An annex sets Russia beside China, which censors with more cost discipline, Iran, which works with borrowed Chinese hardware, and Belarus, which follows Moscow’s lead. Russia’s Governed Information Domain: A Structural Assessment condenses the argument, Russia’s Information Architecture and the Western Decision Cycle corrects six assumptions for senior staff, among them that the laws resemble the EU’s Digital Services Act, and Russia Governs Information as a State Function tells the case in plain words.

Each version names what would refute it: operations that stop once one actor is sanctioned, laws that bind the state as they bind those it names, a statute that came before the practice. Two of the three need no inside knowledge: the date of each new law and the names on the EU’s sanctions list will test them.