11 December 2019

Russia Is Teaching the World to Spy

By Alina Polyakova

Huawei, the Chinese telecommunications company and the largest telecommunications equipment manufacturer in the world, has helped African governments spy on political opponents. Beijing has also sold mass video surveillance to Ecuador and is advising a growing number of autocratic regimes on “information management.” There’s good reason to be worried about the exportation of Chinese technology.

But China isn’t the only merchant offering digital surveillance tools to strongmen. It may be tempting to dismiss Russia as irrelevant in this domain, but that would be a mistake. In fact, Russia’s low-tech model of digital authoritarianism could prove to be more readily adaptable and enduring.

A lot more countries look more like Russia than China: resource strapped aspiring authoritarians without “Great Firewalls” to filter data and block content. The Chinese surveillance model rests on the principle of wholesale integration of offline and online data, linking everything from closed-circuit television footage to social media activity to medical records. This requires vast administrative resources. Few states can afford the level of investment needed to obtain them.

That may be the strength of Russia’s model.


At home, Russian surveillance technology relies less on mass filtering — or, as is the case in China, the blocking of information before it reaches citizens — and more on post-hoc monitoring, a repressive legal network and intimidation of private companies and nongovernmental organizations. That’s much easier to replicate.

While Beijing instituted government control over the internet in the 1990s, the internet in Russia (as in most countries) penetrated society relatively unencumbered. Facebook, Twitter and Google — all blocked in China — are accessible in Russia. That’s why the Russian government had to build a digital surveillance infrastructure that could sit on top of an open digital space, using fewer state resources than are used by China.

Enter the System of Operative Search Measures, or SORM, which is based on a Soviet-era surveillance system for monitoring telephone calls. In 1995, the system was resurrected and expanded to monitor email traffic and online browsing. Today, a growing list of companies, including telecommunications companies, internet service providers and social media platforms, are legally required to install SORM equipment.

SORM doesn’t block information. Instead, it allows the security services and government agencies to access all the data that flows on the internet and on telecommunications networks. SORM basically works as a government’s “backdoor” to the internet. It can be used to track personal details like Internet Protocol, or I.P., addresses, social media user names and the email addresses of, for example, protest leaders or opposition politicians.

Russian companies have been selling SORM-related technologies to Belarus, Kyrgyzstan, Kazakhstan and Ukraine — and further afield to countries in Latin America, Africa and the Middle East. MFI Soft, one of the largest SORM providers, offers a variety of packages and 24-hour customer service, and it claims a decade of experience providing equipment. One of MFI Soft’s most popular packages, SORMovich, can be purchased for approximately $20,000. In 2017, MFI Soft became part of a growing consortium of so-called “information security” companies known as the Citadel group. The move to consolidate the surveillance technology market under one umbrella holding suggests the Kremlin intends to scale up capabilities and harmonize pricing.

SORM pales in comparison with China’s “Sharp Eyes” initiative, which aims to be a fully omniscient system integrating artificial intelligence and data input from video and online surveillance. It’s also not secure. Recently, a Russian programmer found that SORM devices were leaking Russians’ personal data, including geolocation coordinates and telephone numbers. But unlike the complex Chinese vision of complete surveillance, SORM technologies are relatively easy to install and integrate with other systems.

Russia has not been the industry leader in exporting high-tech digital surveillance, and it is unclear to what extent Russian companies are directly competing with Chinese firms for the same markets. For Chinese companies, Russia’s small market share in surveillance technology is unlikely to be seen as a competitive threat. As more countries adopt other Chinese technologies, such as Huawei’s 5G systems, compatible Chinese-made surveillance equipment will become increasingly cheaper and easier to install. As the cost of Chinese-made technologies decreases, the window for Russian exports to get a foothold in the market will narrow.

But Russia is also exporting ideas. The so-called “sovereign internet” law, signed by President Vladimir Putin earlier this year, came into effect on Nov. 1. Theoretically, the law enables the government to cut off the Russian internet in whole or in parts from the global internet in order to prevent, for example, protesters from communicating, organizing or broadcasting their messages. It also requires internet service providers to automatically block banned websites and monitor (and block as required) international communications.

Even before the law came into effect, the Russian government had already experimented with targeted mobile internet shutdowns during anti-government protests in Moscow this summer. Other countries have followed Moscow’s lead: In November, amid widespread protests, Iran successfully shut down the internet across the country. Such shutdowns are part of a growing trend: Authoritarian regimes are learning from each other how to weaponize technologies.

Past Russian behavior suggests that when the West is preoccupied elsewhere, Russia seeks out new opportunities to advance its influence. As the United States grows skeptical of Chinese technology companies and tries to pressure other countries to join a crackdown, Russian surveillance technology exporters may step in to offer an alternative, and perhaps more affordable, model of digital authoritarianism.

No comments: