The tech stack behind Meduza’s efforts to bypass Russian censorship

As an exiled media outlet addressing Russian audiences, Meduza quickly fell under the Kremlin’s radar. It became one of the first media outlets the Russian authorities added to its “foreign agent” list in April 2021. Back then, this label required rigorous labelling and financial obligations and tended to scare off advertisers, which used to be their main source of income (today advertising for foreign agents is already completely banned). The publication survived thanks to a successful crowdfunding campaign. 

The foreign agent label wasn’t the only blow to the Latvia-based media outlet. When Russia openly invaded Ukraine in February 2022, Meduza kept reporting about the war, for which the Russian authorities blocked access to their website only a couple of days later. Moreover, in January 2023, Russian authorities designated Meduza as an “undesirable organisation”, essentially outlawing the publisher in Russia and creating legal risks for sharing its materials or giving them a donation. 

Despite all the obstacles, the majority of their followers – about 70%, or 7 million – live in Russia. Katerina Abramova, Meduza’s Head of Communications, says they succeeded in keeping their audience for two reasons. First is broadcasting from all available platforms possible – not only the website, but also Telegram, Instagram, YouTube, and newsletters. The second is the technical solutions IT specialists employed by Meduza developed to bypass Russian censorship.

BACKGROUND: 

Publication	Meduza
Type	News, investigations, podcasts, newsletters, books; before Russia’s invasion of Ukraine famous for its gamified content
Country (population)	based in Latvia but serving Russian audiences (144,2 million)
Readership	about 10 million (7 million in Russia, 3 million abroad); inaccurate data because people use VPNs rough estimation
History and presence	Meduza was founded by Galina Timchenko in 2014 in Riga, Latvia, after being fired from her job as chief editor at the Russian news website Lenta.ru. Nowadays, it is known as one of the leading exiled media outlets serving Russian audiences. It also features an English version, tailored to international audiences.

Developers and designers, the backbone of the editorial team

Integrating developers and designers into the editorial team was one of Meduza’s distinct features from its very start. They are to be thanked for Meduza’s distinct visuals and formats such as gamified content (the latter has been put on halt since the start of the invasion, both due to ethical reasons and resource management, but once one of Meduza’s main selling points). With Russia’s severe censorship, cyberattacks and threats of internet shutdowns, however, this part of the team has proved to be the backbone of Meduza we know today. 

Currently, Meduza’s technical team consists of about 10 people. They have worked on the following tools Meduza uses to circumvent censorship and reach its audiences – without VPNs (virtual private networks):

The app

Being “mobile-first” was one of Meduza’s earliest strategies; no wonder the publication launched its own app almost at the very start. At that point, it developed two apps: one for iOS and one for Android users. In 2020, to save resources, Meduza’s developers wrote a new app from scratch in Flutter, an open-source framework written and maintained by Google, which could serve users of both ecosystems simultaneously. It is in this second, unified app that they started to develop ways to circumvent Russia’s censorship.

Meduza started preparing for the worst-case scenario – getting blocked in Russia – in the fall of 2021, that is, after they and a series of other media outlets have been proclaimed “foreign agents” by the Russian authorities, Abramova says. “Then, we had a serious conversation about what are we going to do when we are blocked, what survival strategies do we have, what kind of disaster scenarios can there be,” she adds. “It became clear that we need to start using available technologies and adapt them to our needs, to the Russian market, and the specifics of Russian blocking [of websites and other internet resources].” It was then that Meduza started researching options for integration censorship bypassing within applications more seriously.

By the time they were blocked in Russia in early March of 2022, their application already had built-in methods to bypass blocking; they have been upgrading them since then, and right now, the app integrates four ways to bypass censorship. “If one of them does not work, it automatically switches to another one. As a reader in Russia, you shouldn’t notice that something is wrong,” Abramova explains. But to keep the experience for Russian residents as smooth as possible, Meduza constantly urges its followers to update the app as frequently as possible. It also keeps asking them to download the app even if they follow them on platforms that still work in Russia, like Telegram. Those concerned that someone might catch them consuming content from an “undesirable organisation”, can opt to change the icon on the phone’s home screen.

The app remains at the core of Meduza’s mission to bypass censorship; however, the developers of the media outlet have also developed several other backup options, such as:

Mirrors

The Russian authorities keep improving their blocking technologies. That means that Meduza’s team always has to constantly try to be a step ahead. They do so by borrowing already existing technologies used in places such as Latin America, Iran, and Hong Kong, developed by activists and companies, and applying them to a Russian context. “It’s like building a car,” Abramova suggests. “You take an engine from here, a fender from there, and you somehow assemble it.”

The most widespread option Meduza uses is mirrors – duplicate versions of websites that are hosted on different servers or domains. These mirror sites are used to circumvent censorship by providing alternative access points to the same content that might be blocked or restricted in certain regions; they’re also popular with other exiled Russian media outlets. The usual downside of mirror sites is that they can be easily detected and blocked by censors, which can lead to an ongoing cat-and-mouse game between censors and those creating mirrors. However, Meduza says it’s prepared for such a scenario, and it urges its audiences to memorise a bit.ly shortcut to their main mirror. 

Magic links

Meduza also uses “magic links” – links to specific content which can be accessible without a VPN. Every user with access to Meduza’s website or app can generate them for a specific article. Meduza itself also uses this technology when adding links to its publications on social media and newsletters. This option, however, doesn’t work for non-text content, such as live translations or podcasts.

The SOS-newsletter

Meduza designed the “SOS newsletter” technology for the case of an internet shutdown. It is a newsletter sent from a domain and a server not directly linked to Meduza, built in a way that bypasses potential newsletter blocking. Readers, however, should at some point understand it is coming from Meduza, Abramova explains. Its technology relies on the premise that it’d be very hard to completely shut down the internet – it is much more likely that it would be slowed down. “Emails should most likely arrive to you. Moreover, they will remain in the mailbox. That is, if you have already downloaded it, it should stay there,” says Abramova.

At the time of writing this article, they haven’t used it yet. They, however, keep asking their followers to subscribe to it. 

Security

Bypassing censorship is only one of the pillars Meduza’s technical team is responsible for. The second, no less important, is the security and stability of the publisher’s infrastructure, its employees and freelancers, which has been under increasing threat. “They [Russian authorities] are constantly trying to hack us, there’s a huge number of DDoS attacks [a cybercrime in which the attacker floods a server with internet traffic to prevent users from accessing connected online services and sites]. There are attacks even on crowdfunding, carding attacks [a cybercrime in which attackers try to enter stolen credit card credentials into a payment system],” Abramova says. Russian authorities will not be favourable towards those who support Meduza, nor to those who donate money to Ukrainian civilians and political prisoners. Leaks from payment systems therefore shouldn’t happen. 
As with ways to circumvent censorship, prevention is key to security. Apart from investing more financial resources to fend off these attacks, Meduza therefore devotes more time to training its staff about potential security risks, such as phishing attempts and other hacking threats.

---