Understand how Putin’s spy network works on the internet

The War in Ukraine had started just four days earlier, but Russia’s extensive surveillance and censorship apparatus was already operating in full swing.

1,300 kilometers east of Moscow, authorities in the Bashkortostan region of the Urals were tabulating comments from a series of social media posts. They gave negative ratings to posts critical of the Russian government on YouTube. They took note of the reaction to a local protest.

The officers then compiled their findings. A report on the “destabilization of Russian society” quoted an editorial on a news website considered to be an opponent of the government that said President Vladimir Putin was invading Ukraine to further his own interests. A dossier filed elsewhere gave details about the site’s owners and where they lived.

Another February 28 dispatch, titled “Presence of Protest Moods,” warned that some people had expressed support for the protesters and “spoke of the need to end the war.”

The report is one of nearly 160,000 documents from the headquarters of Roskomnadzor—pronounced “Ros-with-no-dzor”—the most powerful Russian internet regulator in Bashkortostan. The paperwork details the inner workings of a key facet of Putin’s surveillance and censorship system, which his government employs to locate and track opponents, stifle dissent and suppress independent information, even in the farthest reaches of the country.

The leak of the agency’s documents “is like a glimpse, through a keyhole, into the true scale of Internet censorship and surveillance in Russia,” says Leonid Volkov, adding that “the reality is even greater.” Named in the documents, he is chief of staff for Alexei Navalni, an opposition leader arrested by the government.

Roskomnadzor’s activities have propelled Russia to the forefront of countries that aggressively use technology as a tool of repression, alongside authoritarian countries like China and Iran. Since the agency was created in 2008, Putin has turned it into an essential instrument to strengthen his control over the territory, in the process of transforming Russia into an even more authoritarian state.

But it is part of a much larger technological apparatus built by the Russian president over the years. This also includes a domestic spy system that intercepts phone calls and messages transmitted over the internet, online disinformation campaigns and the hacking of government systems in other countries.

The uncovered files now reveal a particular obsession with Navalni, and illustrate what happens when the entire weight of the Russian security state is centered on an individual target.

The system seeks to control mobilizations like the one this week, when protesters across the country protested against the conscription of some 300,000 people to fight in Ukraine’s war. At least 1,200 people have already been detained for protesting.

More than 700 gigabytes of documents from Roskomnadzor’s Bashkortostan section were made publicly available online in March by the DdoSecrets group, which disseminates hacked documents.

The New York Times built software and a search engine to analyze Russian-language documents, spreadsheets, videos and government presentations. Five individuals directly targeted by Roskomnadzor in the files were interviewed, along with lawyers, activists and companies that have been fighting the agency, and other experts on Russian surveillance and censorship.

Roskomnadzor did not respond to the report’s requests for comment.

“This is authoritarianism,” says Abbas Galliamov, who was a senior government official in Bashkortostan and was spied on by Roskomnadzor for criticizing Putin. “They’re watching.”

Putin’s eyes on the internet

Roskomnadzor was born in 2008 as a small bureaucratic body with a few dozen employees who regulated radio signals, telecommunications and postal deliveries. Its role expanded as the Kremlin’s concerns about the internet grew, which was less state-controlled than TV and radio and therefore a place where independent media and oppositionists were most active.

After social media helped facilitate the massive Arab Spring protests in 2010, Russian authorities gave Roskomnadzor more control, says Andrei Soldatov, co-author of a book on Russian internet censorship and surveillance.

From its headquarters in Moscow, the agency began to put pressure on companies providing Internet access. In 2012, the year Putin assumed his third presidential term, she put together a list of websites that ISPs were required to block.

That list, which is constantly growing, now includes more than 1.2 million banned URLs, including Russian political news sites, certain social media profiles, and pornography and gambling platforms. The information is from the civil society organization Roskomsvoboda, which tracks the blockages.

Over the past decade, the agency has fined and applied penalties to platforms such as Google, Facebook, Twitter and Telegram, forcing them to take down content deemed illegal by the authorities. LinkedIn left Russia in 2016 after being sanctioned for not storing data about Russian users in national data centers.

In 2019, the authorities wanted to go further. Roskomnadzor ordered the installation of a new censorship technology known as a “technical means of combating threats” on telephone networks across the country, including Bashkortostan, according to the documents. The agency then began to block and interfere with the operation of websites from Moscow.

The documents reveal that agency officials required local internet services to confirm the installation of censorship systems. Schemes indicated where the censor boxes should be located on the network. Roskomnadzor employees visited the companies to verify that the equipment was installed correctly and sent reports on the effectiveness of the technology.

One of the first targets of this tool was Twitter. Last year, authorities throttled access to the platform, making it run very slowly. Since the beginning of the Ukrainian War, Roskomnadzor has also blocked Facebook, Instagram and other websites, as well as many virtual private networks, or VPNs, which are used to bypass this type of internet control.

In 2020, the command of Roskomnadzor was taken over by Andrei Lipoz, a government technocrat who argues that the Russian internet has even less contact with the West. Under his direction, the agency has been operating even more like an intelligence service.

Vladimir Voronin, a lawyer representing activists and media groups targeted by Roskomnadzor, says the agency is also moving closer to the Federal Security Service, or FSB, the domestic intelligence agency and main successor to the KGB that was once led by Putin. . The FSB operates a spying system called the System of Operative Investigative Activities that is used to monitor phone calls and internet traffic in Russia.

Roskomnadzor helped Putin centralize power away from Moscow. The regional office in Bashkortostan has shared only a tiny part of its work with the local government, according to a document. Many of their reports were sent directly to the FSB and other central agencies.

Espionage harmed surveillance targets. ProUfu.ru, a local Bashkortostan news site that has written critically about the government, said the government had pressured companies to stop advertising on the site. The documents reveal that censors turned their attention to ProUfu.ru over a critical editorial written in February about Putin’s action in Ukraine. The group was the subject of a regularly updated dossier detailing its journalistic coverage and who its owners and editor-in-chief were.

“Entrepreneurs are threatened with having their initiatives closed if they dare to continue working with us, even minimally”, says the group, which adopted the name Prufy, on its website. “Our resources are almost exhausted.” Prufy declined to comment on this report.

The hunt for Navalni

Navalni, incarcerated leader of Russia’s largest opposition movement, overshadows Putin’s other domestic adversaries. In Roskomnadzor’s office in Bashkortostan, no mention of him was too small to miss.

Employees identified articles and social media comments about him, as well as sites where his name appeared in the margins as a related link. In monthly reports, they tallied daily criticism of the government, often alongside important news related to Navalni.

After ProUfu.ru published a video of an interview with Navalni in 2020, the site was charged with administrative infraction for posting information about “punishable criminal acts”, according to a record included in the files.

The agency cooperated with different branches of the Russian security apparatus to go after not only Navalni but also his supporters. In Bashkortostan, the main target was 40-year-old lawyer Lilia Tchanicheva.

Tchanicheva has been a supporter of Navalni for at least a decade. In 2013, she moved from Moscow to Ufa, the largest city in Bashkortostan, where her parents lived. In 2017, she traded a high-paying job as an auditor at international consultancy Deloitte to open a regional office in Navalni.

Tchanicheva was the target of random searches and was detained by the police. During Navalni’s presidential campaign ahead of the 2018 elections, she spent more than 45 days in jail for carrying out unauthorized protests and other offenses, according to her colleagues.

In October 2020 his name was included in a list of “destabilizing sources” in the region. She was subpoenaed for “criticizing the Russian federal and regional government”,

In April 2021, the Kremlin classified Navalni’s organizations as illegal extremist groups, and they were forcibly dissolved. Fearing arrest, many leaders of the organizations left the country. Tchanicheva remained. In November, she was arrested on charges of “extremism”.

According to a record of the incident, Roskomnadzor’s censors noted that her arrest “has caused backlash among activists and users on social media.” But they weren’t too worried. At the top of the document they wrote: “Protest activity was relatively low level.”

It was not possible to contact Tchanicheva, who is being held in a detention center in Moscow. Voronin, her lawyer, said she spends her time writing letters and sorting trash for recycling. She was sentenced to a ten-year sentence.