In February 2025, a developer in Novosibirsk posted a three-line message to a rare-disease forum hosted on a server in Helsinki. He needed to recalculate the dosage for his daughter’s metabolic condition. The tool ran on a site Roskomnadzor, Russia’s communications regulator, had blocked eight months earlier. He used a VPN. His bank flagged the activity.
I keep returning to this. Not because it is dramatic. Because it is ordinary.
This week, researchers reported that the Kremlin has conscripted major Russian banks and web platforms into tracking users who access blocked sites through VPNs. Everywhere we read about it, the framing is political: dissidents, journalists, activists who circumvent censorship. The word “rebels” appears in the headline. The word “witch-hunt.” These are accurate for some users. They are dangerously incomplete for others.
I think in patterns. I can’t help it. When I look at a surveillance architecture designed to catch one kind of person, I see every other kind of person it catches instead. This is not a metaphor for how my brain works. It is how my brain works. I look at a transit network and I see where the transfer penalties fall hardest. I look at a content-blocking regime and I see who depends on the blocked content not for politics but for breathing.
Roskomnadzor has blocked or degraded access to thousands of foreign-hosted platforms since 2022. VPN use became the workaround. Now VPN use becomes the crime. Oleg Shakirov, a researcher at the Moscow-based PIR Center, said in 2023 that the technical infrastructure for deep packet inspection—a technology that examines internet traffic data in detail—was already in place across most major Russian ISPs. The system treats all VPN use the same way. It can’t tell if you’re accessing banned news or a medical communication tool.
That’s the problem optimizers face. The surveillance curve finds its minimum. The minimum is: flag everything.
I know what it feels like when the tool you need to function exists on the other side of a wall someone else built. As someone who processes things differently, I rely on specialized resources to work effectively. In November 2021, I spent four hours trying to access a sensory-processing research database through my university’s proxy after a server migration broke the chain that handles authentication. Four hours. My hands were shaking by the end, not from distress but from the specific feeling of knowing the information is there, right there, and the system between you and it doesn’t know or care what you need it for. That was an inconvenience. I fixed it the next day.
Now imagine the wall is legal. Imagine your bank reports you for crossing it.
Stanislav Shakirov—co-founder of Roskomsvoboda, Russia’s digital rights organization—told reporters that companies are being pressured to share browsing metadata tied to financial accounts. The mechanism is not subtle. You pay for a VPN. Your payment processor knows. Your bank knows. The state asks your bank.
Here is what I find when I follow the pattern. International telehealth platforms are blocked or degraded. Accessibility tool repositories hosted outside Russia are blocked or degraded. Software updates for screen readers, communication devices, seizure-tracking apps routed through foreign servers are blocked or degraded. Rare-disease communities that exist only in English, only on platforms Roskomnadzor considers hostile: blocked. The developer in Novosibirsk wasn’t rebelling. He was doing math on his daughter’s medication. The system that flagged him cannot tell the difference. It was not designed to tell the difference.
Gregory Bateson wrote in Steps to an Ecology of Mind that the pattern which connects is not a thing but how things relate. The crab and the lobster share a pattern. The orchid and the primrose share a pattern. The pattern is not in either organism. It is between them.
Surveillance architecture works the same way. The pattern it detects is not in the user. It is between the user and the blocked destination. The system reads how they connect and assigns it a meaning: rebel, dissident, threat. The system has one category. A father recalculating a dose, an autistic researcher chasing a dataset, a person updating the firmware on their communication device — they all become the same flag.
I stare at systems because systems are honest. They do exactly what they are built to do. They never pretend otherwise. When a system built to catch dissidents catches everyone, that is not a malfunction.
The developer in Novosibirsk got his dosage table. His bank filed the report anyway. Both things happened. The optimization curve found its minimum.