Programmer says Moscow's e-voting system checks for active VPNs

Programmer Pyotr Zhizhin, who previously analyzed and documented in detail the scheme used to falsify electronic voting during Russia's 2021 State Duma elections, says he has identified a hidden VPN check built into Moscow's online voting platform, elec.mos.ru.

How the check works

According to Zhizhin, before a voter logs in, their browser is made to load an image hosted on YouTube, a site blocked within Russia. If the image successfully loads, it indicates the voter has an active, working VPN connection. This result is then transmitted to the voting server. About a second later, the same voter logs into the system through mos.ru using their real identity.

Voting is not blocked

Zhizhin stresses that the outcome of the VPN check does not prevent anyone from casting a ballot. However, he explains that for every voter, the system's operator obtains an answer to whether that person is using a VPN, while simultaneously learning who that person is. Nothing needs to be hacked to make this connection, he notes, since both requests simply appear next to each other in the same server log.

Zhizhin points out that the site's underlying code does not explain what purpose this data collection serves or how long the information is retained. This leaves open questions about how such data could be used going forward, though no direct consequence for individual voters has so far been confirmed.