A fascinating story with pictures: how the site of the VPN service twice got out of illegal blocking

A few weeks ago on Habré the news was published that the HideMy.name VPN service was able to judicially remove its website from blocking . It was not easy. Earlier, a detailed interview with the head of the company Marcus Saar was also published, in which he talked about the reasons for the first blockages and the motives of the prosecutors.



In a new article, we combined disparate materials, compiling a chronology of events, added comments from participants from HideMy.name and Roskomsvoboda, which helped fight locks. And they added new facts about locks, interesting cases related to the current situation and forecasts for the future.

When did the service appear and what happened to its website?

The timeline is compiled according to information from CEO HideMy.name:



2006

Active development. The first users appear even before the official release, learning about the beta version through word of mouth.



2007

Launch on the hideme.ru domain on January 4, 2007. Initially, the project developed as a completely free anonymizer / proxy service, having managed to become popular in a short time with virtually no investment in advertising.



A little later experimentally added VPN. Even then, the service team saw the future in this technology. Nevertheless, the VPN itself was almost not interested in: there were few search queries, discussions on the Internet - only in highly specialized forums. Ordinary users had to explain with infographics why VPNs are better than anonymizers and proxies.



Users got used to the new service, began to use it more and more often. Despite the fact that the setting was not at all friendly: there was no own software, the configs needed to be downloaded and transferred to the OpenVPN client source folder. And many more different manual manipulations.



2012

For 5 years, the site and services just worked. In 2012, a registry of banned sites appeared, and the VPN request began to grow noticeably every day. There are users who can no longer be classified as geeks. It took a cross-platform application to connect in a couple of clicks.



2016

Adopted the "Spring Law", there are even more users. In addition to Russia, censorship and deep filtering are being actively introduced in China, and Arab countries turn off social networks and instant messengers.



2017

The first blocking of the site on the hideme.ru domain in January 2017. Before blocking, Roskomnadzor is trying to agree on filtering sites into VPNs, which is refused. And even the remote form of the anonymizer does not save from blocking the site.



Previously planned rendering in HideMy.name had to be accelerated and urgently moved to a new domain.



Four months later, the hideme.ru domain was unblocked after complaints to higher authorities about the abuse of authority by Roskomnadzor.



2018

The second blocking of the site by Roskomnadzor, already on the hidemy.name domain, July 2018. The reason is again the "anonymizer", which by that time was already missing on the site.



No explanation can be obtained. A warning letter about the need to “eliminate the violation”, which is not there. Lock in three days.



Repeated attempts to remove the lock through appeals on the agency’s website lead only to template unsubscribes. Court.



2019

Unlawful court decisions to block canceled. The prosecutor, in the review of the case, simply refuses his claim. The case is being closed.

What is the peculiarity of the second lock?

The second time the court blocked the site in the complete absence of the events described in the court decision on it. Namely, the anonymizer forms and the possibility to get “access to the Mine Kampf book” through this form.







As indicated in the court ruling , the prosecutor was able, with the help of an anonymizer, to find and read the book “Mein Kampf,” which is on the list of extremists.

“In fact, the entire court’s decision is based on the absurd argument of the prosecutor’s office only - if using the service you can access the Mine Campfoo banned in Russia, then the service itself is illegal. With this logic, of course, it would be possible to block all search engines in Russia, many social networks and indeed the entire Internet in Russia without any sovereign Internet laws there. But not even that is depressing. It is foolish to demand from a regular judge from the hinterland and the village prosecutor specific knowledge regarding the work of network technologies. The court that issued the decision and the prosecutor not only pulled the substantive right to a very dubious plot, but completely ignored the provisions of the procedural law, which requires the involvement of all persons whose rights and legitimate interests may be violated by the adopted judicial act. Obviously, the site owner belongs to such persons and must be involved in the process, ”commented Sarkis Darbinyan, the leading lawyer of Roskomsvoboda.

Here is a screenshot of the site made by the prosecutor. A screenshot was added to the case file as the only evidence of a violation.







Having looked at this screen, where there is a description of the term “anonymizer,” but there is no form of anonymizer itself, the court accepted the prosecutor’s arguments that the site contains prohibited information. Perhaps the cat with the beard seemed dangerous.



Pay attention to the tabs of the taskbar, which probably accidentally fell into the screenshot of the prosecutor: “extremism”, “lawsuit against anonymizers”, Paint.







Another interesting point is a snapshot of two important documents by domain. At the first meeting, where they had to consider the restoration of the appeal period, the prosecutor brought a WHOIS statement about the third level domain hidemy.name.ru, which does not belong to the service and is not even registered. Why .ru if the VPN service owns the second level domain hidemy.name?



Let's say they made a mistake, it happens. But the Kilemara court accepted this certificate as convincing evidence that the hidemy.name domain did not belong to the company at the time of the court decision. Based on this, he refused the VPN service to restore the appeal deadline and become defendants in the case.



They managed to get a judicial decision only in a republican court, where the prosecutor admitted his mistake with a certificate. The owners of the VPN service were recognized as full defendants, and the illegal decision of the Kilemarsky district court was canceled with a referral.



Commenting on this situation, Sarkis Darbinyan stated that “small-town prosecutors who file lawsuits in defense of an indefinite circle of people in district courts at their location” usually fight with anonymizers and other blocking bypass tools. Often the prosecutor’s office and the court are in the same building, so the prosecutor simply goes down to the floor, submits documents to the court, a very quick trial is held, the judge decides whether the information is illegal. After this comes the turn of Roskomnadzor and the black list.

How did you manage to unlock the site?

Together with the lawyers of Roskomsvoboda, representatives of HideMy.name prepared an appeal. On January 11, 2019, the team appealed to the Medvedevsky District Court of the Mari El Republic with this complaint.





^{Medvedevsky District Court of the Mari El Republic Source: medvedevsky.mari.sudrf.ru}



The complaint presented the following arguments:



a) the site owner was not involved in a court case, the decision on which affects his rights and legal interests. Consequently, the case was examined with gross violations of procedural law in an improper court;



b) decisions that are grounds for restricting access to sites on the Internet that contain information the dissemination of which is prohibited in the Russian Federation are made by courts of general jurisdiction in administrative proceedings as part of mandatory judicial control over the observance of human and civil rights and freedoms, rights organizations when implementing certain administrative power requirements for individuals and organizations (part 3 of article 1 of the CAS of the Russian Federation), that is, a statement by the prosecutor of the Kilemarsky district of the Mari El Republic It should be considered in a different judicial order.



As a result, on May 23, the Mari El Supreme Court quashed the decision of the lower court, referring the case for a new trial . On June 11, hidemy.name was removed from the registry of resources blocked in the Russian Federation .

That's all?

Not. The court sent the case back for reconsideration, and the prosecutor's office re-filed the same lawsuit. The reason for reviewing the case for the second time was the inspection certificate of the HideMy.name website, dated 2017. Based on the same document, a previous decision was made to block the site.



On July 5, a new trial was held at the Yoshkar-Ola court, after which the prosecutor’s claim against the organizers of the resource was withdrawn.

“After the appearance of us as defendants in the case, the prosecutor’s office completely lost interest. And she didn’t even bother to make a new lawsuit: she resubmitted the old one from 2017. Of course, there was no evidence base in this lawsuit, except for one single screenshot of the main page of the site. On which, however, no violations were displayed. The final closure of this case was only a matter of time, ”said Markus Saar, head of HideMy.name after winning the court.

Will it be better next?

Almost all forecasts come to the conclusion that no. According to Sargis Darbinyan, in the future there will be no transparency in issues of blocking sites.



After the so-called “Law on Sovereign Internet” comes into force, Roskomnadzor will be able to block any information, website or application from a single center using specialized DPI tools. The equipment in question is planned to be installed on the nodes of all telecom operators. And then even the operator himself will not be able to find out what and how Roskomnadzor is blocking before the blocking itself.

What to do?

Network users can continue to use tools to gain access to private resources.



The situation is more difficult for online business owners. Marcus Saar suggests that they follow these tips so that they don’t get excruciatingly painful:

• Do not keep domains in Russian zones.
• Regularly check for court cases on your sites. For example, on sudact.ru and court decisions.rf. This will give you extra time to appeal the illegal decision before it is enforced by Roskomnadzor.
• Have a prepared algorithm of actions in case of blocking: mirrors, redirects, proxy CDNs for changing the IP addresses of a website, etc., based on the specifics of your resource.
• Verify accounts in the panels of the Google / Yandex webmaster for an accelerated change of the domain in the search results, if you need to move to the mirror.
• Prepare customer alert tools.
• Sign an agreement with specialized lawyers.
• Find out if your registrar can provide an original certificate with a blue seal on domain ownership. Whois prints are not suitable for a Russian court.
• If possible, focus on foreign markets.

UFO Care Minute

This material could cause conflicting feelings, so before writing a comment, refresh something important in your memory:

How to write a comment and survive

• Do not write offensive comments, do not get personal.
• Refrain from obscene language and toxic behavior (even in a veiled form).
• To report comments that violate the rules of the site, use the "Report" button (if available) or the feedback form .

What to do if: minus karma | blocked account



→ Code of authors Habr and habraetiket

→ Full version of site rules