Mass surveillance is the pervasive surveillance of an entire or a substantial fraction of a population. Mass surveillance in Russia includes surveillance, open-source intelligence and data mining, lawful interception as well as telecommunications data retention.
Key systems include the SORM lawful interception network, which gives the Federal Security Service (FSB) direct access to communications, and deep packet inspection equipment installed on every internet provider. Cities operate camera networks with facial recognition, and the state maintains centralised registries of biometric, travel and conscription data. Retention laws oblige telecom operators and internet platforms to store users' communications and disclose them to the authorities. Following the invasion of Ukraine in 2022, these systems were increasingly turned against anti-war protesters, draft evaders and other critics of the government, and were extended to occupied Ukrainian territories.
Interception of communications
SORM
Russia's System of Operational-Investigatory Measures (SORM) requires telecommunications operators to install hardware provided by the Federal Security Service (FSB) which allows the agency to monitor users' communications metadata and content, including phone calls, email traffic, and web browsing activity. The SORM-1 system captures telephone and mobile phone communications, SORM-2 intercepts Internet traffic, and SORM-3 collects information from all forms of communication, providing long-term storage of all information and data on subscribers, including actual recordings and locations. In 2012, SORM-2 was expanded to include social media platforms, and in 2014 the Ministry of Communications ordered companies to install new equipment with deep packet inspection (DPI) capability. In 2016, SORM-3 added additional classified regulations that apply to all Internet service providers in Russia. Since 2019, a separate state-supplied DPI network known as TSPU ("technical means for countering threats"), installed on providers' networks under the Sovereign Internet Law and controlled by Roskomnadzor, has given the state an additional traffic inspection layer that researchers found to operate independently of the ISPs hosting it.
The FSB is required to obtain a post-collection court warrant to access these records. Surveillance can begin before the warrant is granted or requested, the warrant need not be shown to the telecom operator, and it is only required for the retrieval of collected communications content, not for the metadata. According to figures from the judicial department of Russia's Supreme Court, courts received 4,659,325 requests for the interception of phone calls and correspondence between 2007 and 2015 and granted 4,517,515 of them, about 97 percent, with the number of requests growing every year. The European Court for Human Rights deemed Russia's SORM legislation in breach of the European Convention on Human Rights in 2015 (Zakharov v. Russia), pointing to defects in the law that allowed communications to be intercepted without prior judicial authorisation.
Intercepted communications have repeatedly leaked to pro-government media. In December 2011 the LifeNews portal published dozens of recorded phone calls of the opposition politician Boris Nemtsov, and in 2012 Komsomolskaya Pravda published a recording in which a voice resembling that of the protest leader Sergei Udaltsov discusses paying participants for opposition rallies.
Equipment suppliers SORM's technical framework goes back to systems developed by the Soviet KGB in the late 1980s, and the equipment has been exported: implementations produced by Russian firms such as MFI Soft have been deployed across post-Soviet Central Asia. A 2022 investigation by The New York Times, based on internal company documents, found that Nokia had for more than five years supplied equipment and services connecting SORM to MTS, Russia's largest telecom operator. Much of the SORM equipment market has been consolidated by the Citadel Group, once partially controlled by the businessman Alisher Usmanov, which according to the US State Department controls about 60 to 80 percent of the market for telecommunications monitoring technology; the United States sanctioned Citadel and its owner in February 2023. Software made by its subsidiary MFI Soft presents subscriber data to FSB officers and can map the locations of phones to detect meetings, spot a person carrying several phones, and identify file transfers through deep packet inspection.
Encryption Under the 2016 Yarovaya Law amendments, services registered as "organizers of information dissemination" must give the security services the information needed to decode users' electronic messages, and in 2019 the FSB required registered internet services to install equipment giving it around-the-clock access to their systems and decryption keys, without judicial oversight. When Telegram refused a 2017 FSB demand for the keys to its users' correspondence, it was fined and ordered blocked; the blocking attempt in 2018 rendered almost 16 million IP addresses inaccessible while leaving Telegram broadly reachable, and was abandoned in 2020. The underlying FSB order, which sought to decrypt the end-to-end encrypted "secret chats" of six users, reached the European Court of Human Rights: in Podchasov v. Russia (February 2024) the court ruled unanimously that Russia's data retention regime and its decryption requirement violate Article 8 of the European Convention, holding that legislation obliging a provider to weaken encryption for all users impairs the very essence of the right to private life.
The authorities have also sought to restrict encryption technologies that prevent monitoring equipment from identifying which websites users visit. In September 2020 the Ministry of Digital Development published a draft law to ban protocols that conceal the name of a requested website, naming TLS 1.3 with ESNI, DNS over HTTPS and DNS over TLS, on the grounds that they reduce the effectiveness of the state's filtering systems; in November 2024, TSPU equipment began blocking connections that use the Encrypted Client Hello extension, making thousands of websites served through Cloudflare inaccessible. The Tor network and website were blocked from December 2021, when Russia had more than 300,000 daily Tor users, encrypted email and messaging services including ProtonMail, Tutanota, Signal, Discord and Viber were blocked between 2020 and 2024, and in July 2024 Apple removed about 25 VPN applications from its Russian App Store at Roskomnadzor's demand.
2014 Winter Olympics Citing threats from Islamist insurgents and the host city's proximity to Georgia, the Russian government applied comprehensive screening measures during the 2014 Sochi Winter Olympics. It was reported to have served as a testing ground for comprehensive and invasive surveillance, reportedly making Sochi the most policed environment in history. The FSB arranged classified upgrades to SORM equipment in Sochi before the event, and all communication and Internet traffic of Sochi residents was captured and filtered through deep packet inspection systems at all mobile networks, an arrangement one analyst described as a "giant vacuum cleaner which scoops all electronic transmissions from all users all the time". Roskomnadzor reported that several local ISPs were fined after failing to install FSB-recommended SORM devices. Aside from security perimeters staffed by the police, the government installed 5,500 CCTV cameras to monitor the surrounding countryside.
Open-source monitoring The FSB and Interior Ministry monitor open sources and the Internet, including the blogosphere and social networks, with an analytical system called "Semantic Archive", made by the Russian firm Analytic Business Solutions and also used elsewhere in the Commonwealth of Independent States; the system aggregates material from media, blogs, forums, social networks and internal databases, extracts persons, events and relationships, and assembles dossiers with visualised connection charts.
In February 2023, Roskomnadzor was reported to have launched "Oculus", an automated image-scanning system operated by its subsidiary, the General Radio Frequency Center, capable of scanning up to 200,000 images a day for prohibited content, including images of protesters, "positive depictions" of LGBT culture and memes criticising President Vladimir Putin. Leaked documents from the same agency, analysed by Mediazona, describe a commissioned system called "Vepr" intended to monitor and predict "information tension points" online.
Monitoring of social networks has resulted in large numbers of prosecutions. A Novaya Gazeta Europe study of court data from 2010 through October 2024 counted more than 30,000 criminal and administrative cases over social media posts, shares and likes, including around 1,200 criminal cases; 896 administrative cases were brought over private direct messages, and the VKontakte platform accounted for almost 80 percent of administrative cases.
Legislation has also extended monitoring to users' search queries. A law adopted in July 2025 imposed fines on citizens for "intentionally" searching online for content designated "extremist", including through VPNs, together with fines for advertising VPN services; it took effect that September. The first known case followed in November 2025, when a 20-year-old from Sverdlovsk Oblast was reported to the FSB by his own internet provider after allegedly viewing information about Ukrainian military units.
Movement tracking A passport has been required to buy a train ticket since 2001, a plane ticket since 2004, and an interregional bus ticket since 2012. Since 2000 the Interior Ministry has checked passenger records against a database called Rozysk-Magistral, which covers people wanted by Interpol, foreigners suspected of crimes in Russia, Russians suspected of offences such as murder, terrorism and trafficking in ammunition or antiques, and leaders of criminal groups. In 2005 the database gained a section known as Storozhevoi Kontrol ("sentry control") listing "potential extremists"; estimates of its size range from 3,800 to 6,500 names. Police used the system in 2007 and 2008 to take the human rights activist Sergei Shimovolos off trains and search him, suspecting that he was travelling to opposition events. Ruling on his complaint in 2011, the European Court of Human Rights found that the operation of Storozhevoi Kontrol, which offered no minimal safeguards against abuse, fell short of the standards of legality, and that Shimovolos's registration in it violated Article 8 of the European Convention on Human Rights.
Road traffic is tracked by CAMERTON, a vehicle-tracking system that identifies probable routes and the places where a given vehicle most often appears, drawing on a distributed network of road-surveillance cameras and radar complexes with photo and video capture. It was developed by the St. Petersburg company Advanced Scientific Research Projects and is used by the Interior Ministry and other state agencies.
Under a taxi law adopted in December 2022 and in force since 1 September 2023, ride-hailing services must give the FSB permanent remote access to the databases in which they process passenger orders, store travel data for six months, and keep their cooperation with the agency secret.
Video surveillance and facial recognition Covert filming has been used against opposition politicians. In February 2012 a hidden-camera video of the private life of Vladimir Ryzhkov was circulated online, and in March 2016 the NTV channel broadcast similar footage of Mikhail Kasyanov.