Russia has spent more than a decade building a system of total digital surveillance: from the SORM interception infrastructure to the state-promoted MAX messenger. Investigative journalist Andrey Zakharov, author of “The Russian Cyberpunk. How the Kremlin Builds a Digital GULAG”, explained Veridica how data turns into criminal cases, why the system runs above all on fear, and why its weakness is built into its very design.
Putin can block anything by a classified decree
VERIDICA: When you talk about a “digital gulag” in your book, do you see it as something deliberately built, or something that emerged from overlapping interests: security services, business, the state?
ANDREY ZAKHAROV: I think that what is called the “digital gulag” was, of course, built deliberately: by the Kremlin and the security services. These are parts of a single system. The construction began as a reaction to the protests of 2011. That was when the law on website blacklists was drafted and adopted in 2012: first drugs and child pornography, then the list kept expanding. Today Putin can block anything by a classified decree, with no explanation given. And after Crimea and the Snowden revelations, they decided to build a sovereign digital system: a closed Russian internet with restricted exits abroad and its own services. The state interest here always comes bundled with money for “their own people”: people make money on SORM, the interception system. I did an investigation about this: the company Citadel is part of IKS Holding, and the family of the FSB's first deputy director holds a stake in it.
VERIDICA: Is this level of control something the Kremlin actually planned for, or more a byproduct of trying to stay in power?
ANDREY ZAKHAROV: Partly yes: it is planned in order to stay in power. But there is also an element of how, in the minds of “the old men,” the state is supposed to be organized: maximum control, including over dissent. It is their idea of the norm: a kind of revival of the KGB's ideological Fifth Directorate. If an anonymous letter of criticism arrived at the newspaper Izvestia, you were obliged to find the author and establish who had written such anti-Soviet things. Today it is roughly the same practice.
A mirror of all internet traffic
VERIDICA: In practical terms, how does data turn into control in Russia? What happens between collecting information and actually using it against someone?
ANDREY ZAKHAROV: In terms of digitalization there is no difference between Russia and other countries: systems that collect data appeared everywhere. The difference is elsewhere. In Russia, SORM is a mirror of all internet traffic and phone calls, fed to a control console even without the provider's knowledge. In other countries the security services tell a service that they need such-and-such data, and it can refuse: Apple has refused. In Russia it is unthinkable that anyone would refuse the siloviki, and part of the information the FSB simply mirrors: SORM is set up so that formally they must obtain a court order for something they already have access to anyway.
That said, a large part of the mirrored traffic is “garbage”: it is encrypted, and they cannot decrypt it. A person goes to Google, and in SORM you can see only that, not what he did there. To find out, you need a request to Google, which will refuse. Yandex will not refuse.
VERIDICA: Is the system more about preventing dissent before it happens, or punishing people afterwards?
ANDREY ZAKHAROV: The main point of the system is prevention. Where there are the most criminal cases (fines and prison terms for posts, reposts and likes), people write far more of what counts as extremist than there are punishments: punishment means bureaucracy, plus the “palki,” the quotas. Your notional Center “E” officer in Vladimir needs five fines a month, and he is not going to do twenty. But since you can be punished, self-censorship kicks in: people know it and do not post, although they might not have been punished anyway. The fines for searching for extremist materials are the same story: what a person searched for is visible neither in SORM nor to the provider. Most likely, a person was grabbed, hit over the head, the police looked through his phone and presented that as what he had searched for.
VERIDICA: How dependent is the state on private infrastructure and oligarch-linked companies for this system to function?
ANDREY ZAKHAROV: These things are connected. Here is how SORM was installed. The provider calls its FSB curator (that is literally the word), and the curator says: install equipment from such-and-such a company. And that is a licensed IT company owned by former FSB officers: Norsi-Trans, or the same Citadel, where the family of the FSB's first deputy director Korolev, Bortnikov's successor, officially holds a stake. I investigated this. The main money is, of course, in the hardware, and Citadel is the symbol and the leader here: the connection to the state is direct.
People do not want to be read and listened to
VERIDICA: At what point do people start changing their behavior simply because they assume they're being watched?
ANDREY ZAKHAROV: The more people read about this, the more wary and distrustful they become. The discontent with MAX turned out to run deeper than the authorities expected: people do not want to be read and listened to. There was a joke on KVN on Channel One: “Why do you write ‘hi everyone in this chat' when you are writing only to me?” “Because we are on MAX.” The understanding that you can be fined for what you write simply reinforces the self-censorship. It started after 2011, and the list of grounds only kept growing.
VERIDICA: Do you think this system produces real conformity, or mostly surface-level caution?
ANDREY ZAKHAROV: It is like any censorship, and it works: people are genuinely afraid. I had a case: friends of mine who are in Russia were messaging each other on Telegram (“is he a foreign agent? is he wanted?”), and then they deleted the exchange, even though they had discussed nothing inapprpriate. People are scared, and I do not judge them at all.
VERIDICA: There's a growing perception that authoritarian states are becoming all-seeing. In Russia's case, how much of that is real, and how much is projection or myth?
ANDREY ZAKHAROV: Russia is not the only such country, though in facial recognition Moscow is probably among the leaders after China. But some things do not work the way they are imagined to: SORM is believed to see everything, when in fact it does not. And it does not matter whether these things are real or mythological: the very fact of the threat, and the incomplete understanding of how it all works, is what matters most to the state. How is MAX set up: end-to-end interception of all conversations at once, you say something harsh about Putin and they come for you straight away? Or will they pull up the recordings only if someone takes an interest in you? Who knows. It is a myth that they can do everything, but the myth has an effect.
Cyberpunk rather than Orwell
VERIDICA: Is the state actually capable of processing and using all the data it collects, or is there a gap between ambition and capacity?
ANDREY ZAKHAROV: Yes, there is a gap. “The old men” have the notion that everything can be seen: maximum control. But in Russia far from everything works: a lot runs on the off-chance, a lot has been built and does not work, functions duplicate one another. There is the traditional Russian cudgel: powerful, but not always effective and not as frightening as it looks. A great deal of data is collected, which is why I write my books. At the same time this data leaks onto the market: the more it collects, the more leaks out. An interesting paradox.
VERIDICA: How does corruption fit into this: does it undermine the system, or is it part of how it functions?
ANDREY ZAKHAROV: The leaks and the “probiv” trade are the flip side of all this. A great deal of data is collected, so police officers' access to it is as broad as possible. And the police are poor: there will always be an officer who sells data onto the market. The state wants to control a great deal, and then this hits the state itself in the form of investigations: thanks to the leaks, you learn the secrets of that very state, or rather of its people.
VERIDICA: People often reach for Orwell when talking about Russia. Do you think that comparison is useful, or does it miss what's specific about the Russian model?
ANDREY ZAKHAROV: I think the cyberpunk model is more accurate here. There is a strong state, but there are also partisans: investigative journalists who resist using the state's own tools, that same data. Plus the data sellers. And there are corporations: the biggest social networks (the MAX messenger, VK Video) are owned by the non-state company VK, and it belongs to people close to Putin, like the banker Kovalchuk. There is also a stake held by a nephew of his, Shelomov. I investigated this: he is a nominee for Putin, and de facto it all belongs to Putin. But if the tsar is gone, these networks will still not be state-owned: they will be Kovalchuk-owned. Quite a corporation in the style of Blade Runner.
VERIDICA: Would you say the system is trying to control everything, or just certain moments and certain people very tightly?
ANDREY ZAKHAROV: Yes, of course it is trying. Another matter is that not everything works out. And the more control, the more leaks, as with the data market.
Dependence instead of sovereignty: why the system will degrade
VERIDICA: What actually works today if someone wants to resist or avoid this kind of control?
ANDREY ZAKHAROV: VPN works, of course, although that is exactly what the authorities are fighting. In Russia it is very hard to keep the state from recording your data, but against SORM you can protect yourself quite effectively: you use a VPN or other anonymizers, and tracing what you do becomes practically impossible. Then there is the second phone, where all the Russian services live as potential surveillance tools, while everything most valuable is elsewhere. But none of it protects you from being hit over the head at six in the morning: many cybersecurity tips are canceled out by a blow to the head.
VERIDICA: Do you see this becoming more centralized and structured over time, or staying messy?
ANDREY ZAKHAROV: It is trying to structure things, but the flip side of this structuring is the growth of those same leaks. And none of it is about efficiency. They made MAX, and immediately the talk started: let's make Gosuslugi a social network too. The catch is that one of MAX's selling points was that MAX itself would essentially be Gosuslugi: a WeChat-style messenger where you can get a loan and an ID. So the duplication begins: why, what for? Same as with the laws: there were a dozen grounds to block Western social networks (they do not store data in Russia, they do not take down content), but they were not blocked, because the decision was political.
VERIDICA: What could realistically weaken or break it?
ANDREY ZAKHAROV: Unfortunately, the digital gulag will keep intensifying. Another matter is that the notions of sovereignty are shattering against Russia's technological weakness. Putin said there are only three countries with genuine digital sovereignty: Russia, China and the US. They have Facebook, the others have WeChat, we have, roughly, MAX and VK. But MAX and the other Russian apps have been removed from the App Store and Play Market. Digital sovereignty in which a quarter of the phones (the iPhones) cannot install MAX is not strength, it is weakness and dependence. And all the hardware this gulag is built on is Western or Chinese.
China is a huge market and can live with a fully closed system. Here the market is a hundred million adults, a hundred and forty with children: very small. IT of that level needs to go abroad, and you cannot: abroad nobody wants you, you are with the FSB. So they have latched onto the budget: MAX is “national,” which means budget money, a crutch. Tomorrow there will be less money, and then what? For years the system was built on open exchange with the West, like in Iran: there was a huge shutdown there, and it turned out that a heap of systems had not been updated and everything was infected. You will be dependent, and that is why you block. And that is the main weakness, which means degradation.
