report TSPU and You: Architecture, Blocking Behaviours, and Implications for Tool Development October 2026
Russia’s TSPU (Technical Means of Countering Threats) is a centrally managed internet filtering system deployed within operators’ networks. This technical advisory examines its architecture, documented blocking behaviours, and implications for circumvention tool development, network measurement, and digital security training.
Drawing on independent measurements, operator accounts, technical documentation, and regulatory sources, the report explains inline deployment, the hardware and software stack, and controls across DNS, network, transport, and application layers. It examines protocol detection, traffic fingerprinting, throttling, approved-access restrictions, and the relationship between filtering, surveillance, and network-security functions. Throughout, it distinguishes advertised capabilities, reported practices, and observed behaviour.
The advisory translates these findings into considerations for tool design and deployment, including protocol diversity, infrastructure exposure, configuration updates, user onboarding, and measurement across different networks. It also identifies public sources for tracking the system’s development. Protocol assessments reflect the evidence available for this edition and require continued testing as filtering changes.
