Through March 2026, police in Hubei province executed specific raids on individual homes resulting in fines for unauthorized VPN use. One Chinese citizen was fined 200 yuan (approximately $28 at then-prevailing exchange rate) for accessing TikTok and X via VPN. Another was fined 500 yuan for "illegally registering and using VPN software." Two weeks later, on April 1, 2026, Chinese authorities physically disconnected thousands of relay servers in domestic Chinese data centers, causing mass outages across proxy services using Shadowsocks, V2Ray, Trojan, and similar protocols. The term that spread on Chinese social media was "拔线潮" — translated approximately as "the Great Firewall Unplug" or "Plug Pulling Wave."
This Desk reads the March-April 2026 sequence as an inflection point in Chinese government VPN enforcement. The Hubei fines targeted individual citizens for individual VPN use — historically Chinese enforcement had focused primarily on commercial unauthorized VPN providers and specific high-profile individual cases rather than routine individual VPN use. The April 1 mass infrastructure disconnection targeted the relay infrastructure that obfuscation protocols depended on within China rather than at the cross-border boundary. The combined episodes establish elevated enforcement intensity that affects specific operational considerations for Chinese citizens, expat users in China, and business users.
What the Hubei March 2026 Episodes Specifically Established
Specific details of the enforcement actions.
200 yuan fine for TikTok and X access. Hubei police identified individual citizen accessing TikTok (banned in mainland China; specific blocked beyond simply unavailable) and X (Twitter — blocked in China since 2009). Fine of 200 yuan represented relatively modest financial penalty but specific reputational and ongoing-monitoring implications.
500 yuan fine for VPN software registration. Different Hubei case where individual fined 500 yuan for "illegally registering and using VPN software." The framing — "illegally registering" — suggests specific framework where unauthorized VPN registration constitutes specific offense beyond just use.
Police home raids. Specific operational pattern: police raids on individual citizen homes rather than primarily commercial premises. The shift represents enforcement intensification.
Specific provincial pattern. Hubei province has been more active enforcement provider in recent enforcement waves. Specific provincial variation exists in Chinese VPN enforcement.
The combined pattern suggests escalation from primarily commercial-actor enforcement toward individual-user enforcement.
What the April 1, 2026 "Great Firewall Unplug" Specifically Did
The April 1 escalation had specific operational characteristics.
Physical infrastructure disconnection. Chinese authorities physically disconnected thousands of relay servers operating within Chinese data centers. The specific framework: domestic Chinese data centers had been hosting relay servers for various proxy and obfuscation protocols (Shadowsocks, V2Ray, Trojan).
Multi-protocol impact. The disconnection affected services across Shadowsocks (Chinese-developed obfuscation protocol), V2Ray (more advanced obfuscation framework), Trojan (HTTPS-mimicking protocol), and similar tools.
Mass outage scope. Specific outages affected substantial fraction of unauthorized proxy infrastructure operating from Chinese soil. Users in China and abroad accessing through Chinese-hosted relays faced service disruption.
"拔线潮" social media response. The term spread on Chinese social media (despite censorship of related discussion) reflecting widespread user impact.
Notice framework. Specific notices to data center operators directing customers to remove signs of VPN, proxy, or other tools used to bypass restrictions.
The structural significance: targeting infrastructure rather than just users represents different enforcement framework. Even sophisticated individual users with technical capability cannot maintain access if infrastructure they depend on is disconnected.
Specific Implications for Different User Categories
Three categories of users face different operational considerations.
Chinese citizens. Substantially elevated enforcement risk. Specific fines, potential additional consequences depending on framework evolution. Specific operational discipline required: minimal VPN use, specific obfuscation framework, specific operational security around VPN connection patterns.
Expat residents in China. As of available reporting, no foreigner has been fined or arrested for VPN use in China. Crackdown overwhelmingly aimed at Chinese citizens. Specific operational risk lower for expats but not zero.
Business users with corporate VPN. State-approved VPNs primarily for business use exist. Closely monitored and compliant with censorship laws. Specific business VPN access doesn't provide privacy benefits — provides access to non-blocked international resources for legitimate business purposes within censorship framework.
Travelers to China. Traveler VPN use historically tolerated. Specific April 2026 framework changes may evolve.
The combined picture: most severe enforcement risk for Chinese citizens; lower but increasing risk for expats; specific framework for legitimate business use.
What VPN Providers Are Doing in Response
Major VPN providers face specific operational decisions.
Continued obfuscation framework operation. Providers like NordVPN, ExpressVPN, Surfshark, Mullvad, others continue offering obfuscated protocols designed to operate in restrictive environments.
Specific China-focused frameworks. Some providers maintain specific China-focused servers and configurations. The April 2026 escalation tests these frameworks.
App store availability. Major VPN provider apps removed from Chinese app stores. Distribution through alternative channels (specific direct downloads, side-loading) remains operational.
Specific Russian framework parallel. Russia removed 100+ commercial VPN apps from Russian app stores in 2025. Combined frameworks across China and Russia produce specific cross-jurisdictional considerations.
The combined provider response represents continued operational commitment to circumvention market despite intensified enforcement environment.
Comparison Across Authoritarian VPN Frameworks
| Country | Framework | Recent enforcement | Provider impact |
|---|---|---|---|
| China | Comprehensive Great Firewall + April 2026 escalation | Hubei March 2026 fines, infrastructure disconnection | Substantial obfuscation requirements |
| Russia | FSB-licensed only, 100+ apps removed 2025 | Continued enforcement | Substantial provider exit pressure |
| Iran | Variable framework | Specific enforcement | Substantial operational difficulty |
| North Korea | Comprehensive blocking | Severe enforcement | Limited operational possibility |
| Other authoritarian | Variable | Variable | Variable |
The pattern shows multiple authoritarian frameworks operating with progressively intensifying enforcement. The combined frameworks affect global VPN provider operations.
What This Means for Threat-Modeling Users
Three operational considerations.
First, China-resident users face genuine legal risk. Specific enforcement intensification means Chinese citizens face material consequences for VPN use. Operational decisions should account for this.
Second, infrastructure dependence creates new attack surface. April 2026 infrastructure disconnection demonstrated that infrastructure dependence is itself attack surface. Sophisticated users may need to maintain framework redundancy across infrastructure types.
Third, specific operational security matters. VPN connection patterns, payment frameworks, authentication choices, specific operational discipline all matter for users in restrictive environments.
What 2026 Specifically Tests
Three datapoints worth tracking.
Continued enforcement escalation. Whether Chinese enforcement continues escalating beyond April 2026 baseline tests framework trajectory.
Russian framework operations. Continued Russian VPN restriction enforcement provides cross-reference framework.
Provider operational responses. Major VPN provider responses to authoritarian enforcement frameworks shape user operational possibilities.
What This Desk Tracks Through 2026
Three datapoints across the rest of 2026.
Continued Chinese enforcement intensity through Q2-Q3 2026.
Russian framework operations and any specific changes.
Cross-jurisdictional framework convergence or divergence.
Honest Limits
This Desk reads China VPN enforcement framework from publicly available reports including Vision Times, China Digital Times, contemporary reporting in Cybernews, BleepingComputer, broader China-focused sources. Specific enforcement details may be incomplete given Chinese information environment. The 2026 references reflect data through early May 2026. None of this constitutes legal advice for users in restrictive jurisdictions.
Sources
- How to Use a VPN in China & Russia Amid VPN Ban 2026 — Wizcase
- China Telecom Crackdown May Block All Overseas Internet — Vision Times April 11, 2026
- April 2026: China's Mass VPN Crackdown Explained — RelyVPN
- Documents Raise Fear of Further Crackdown — China Digital Times
- VPN in China 2026: What's Blocked — Michele Ponte
- How To Use a VPN in China and Russia 2026 — Enstine Muki
- VPN Bans in 2026 — LimeVPN