Don’t exaggerate the level of control required. For all that things are bad and getting worse, Russia has not reached the North Korea percolation point where every facet of government control is tied to every other one. (Neither has Russia reached a NK-style total war economy, partly through bureaucratic dysfunction and partly by design; but I digress.) The things that it does are still pretty modular and don’t require $YOURCOUNTRY becoming Russia in its entirety. Hell, London had more outdoor surveillance than Moscow until after Covid. As far as Internet censorship, here’s what the playbook was:
1. Have a dysfunctional court system. (Not a powerless one, mind you; it’s enough that it basically never rule against the government. It would probably even be enough if it never ruled against any of the following.)
2. Mandate page-level blocks of “information harmful to the health and development of children” (I wish I were joking) for consumer ISPs, by court order; of course, that means IP or at least hostname/SNI blocks for TLS-protected websites, we can’t help that now can we. The year is 2012.
3. Gradually expand the scope throughout the following steps. (After couple of particularly obnoxious opposition websites and against an unavoidable background of prostitution and illegal gambling, the next victim, in 2015, was piracy including pirate libraries. Which is why I find the notion of LibGen or Sci-Hub being Russian soft power so risible, and the outrage against Cloudflare not being in the moderation business so naïve.)
4. Make sure the court orders are for specific pieces of content not websites (as they must be if you don’t want the system to be circumventable by trivial hostname hopping), meaning the enforcement agency can find a particularly vague order and gradually start using it for whatever. Doesn’t hurt that the newly-blocked website’s owner will be faced with a concluded case in which they don’t even have standing.
5. Ramp up enforcement against ISPs.
6. Use preexisting lawful intercept infra at ISPs to ramp up enforcement even further. Have them run through the agency-provided daily blacklist, fine the offenders. Any other probe you can get connected to the ISP will work too.
7. Offer ISPs a choice (wink, wink) of routing their traffic through agency-controlled, friendly-contractor-made DPI boxes they will need to buy, promising to release them from some liability. (First draft published 2016, signed into law 2019.)
8. Mandate the boxes.
9. It is now 2021 or so and you’ve won, legally and organizationally speaking, the rest is a simple matter of programming to filter out VPN protocols, WhatsApp calls and such. Pass additional laws mandating blocks of “promotion” of block evasion if you wish, but the whole legal basis thing is a pretence at this point. For instance, you can de facto block YouTube absent any legal order by simply having the DPI boxes make it very slow, a capability not mentioned in any law whatsoever, then cheerfully announce that in the national press.
See how very easy it is? How each legal or technical capability logically follows from very real deficiencies of the preceding ones so even a reasonable court would be disinclined to rule against them? Understand now why I’m furious when reasonable people on this forum defend the desires of their—mostly good and decent!—governments to control the Internet?
(See also how most of this happened before “Russia bad” became the prevailing sentiment, and how most of it went largely unnoticed in the EU and US, aside from a couple of reputable-but-fringe orgs like RSF to whom very few listen because they cry wolf so much? The ECtHR didn’t even get to the cases, IIRC, before the trap snapped shut and Russia was drummed out of the Council of Europe to widespread cheering, making the matter de facto moot.)
You know that road. You know exactly where it ends.