A look at the cottage industry of Russian tech contractors, many owned by oligarch-linked Citadel Group, building digital surveillance tools for use by the FSB
Russia is incubating a cottage industry of new digital surveillance tools to suppress domestic opposition to the war in Ukraine. Mastodon: @Mer__edith@mastodon.world . Twitter: @matthew_d_green , @satariano , @jsrailton , @matthew_d_green , @jsrailton , @smith_jeffreyt , @profwoodward , @danharris , @lukolejnik , @paulmozur , @paulmozur , @rondeibert , and @mer__edith Mastodon: Meredith Whittaker / @Mer__edith@mastodon.world : Important reporting. Note that Signal's encryption remains robust, even as ISP-level data can, as reported, reveal limited information. — https://www.nytimes.com/... Twitter: Matthew Green / @matthew_d_green : Too much timing data is available even from encrypted messaging apps, when a passive adversary surveills the network links for a whole country. It might be smart to add some kind of delayed delivery feature. https://www.nytimes.com/... Adam Satariano / @satariano : NEW: The global supply chain for digital surveillance tech is growing thanks to Russian companies building tools to track people online and on phones. One tool logs metadata for calls on encrypted apps like Signal & WhatsApp. w/@Aaron_Krolik & @paulmozur https://www.nytimes.com/... John Scott-Railton / @jsrailton : @matthew_d_green Thanks for doing an accessible thread. Russia having these capabilities makes the stakes super clear. (But is far from the only country leveraging low-latency messaging vs. privacy trade-offs) Hopefully this makes it easier to motivate the conversations that must happen Matthew Green / @matthew_d_green : This paper looked at Signal's Sealed Sender back in '21 and showed that you could recover sender/recipient information after seeing a few (encrypted) messages, because of things like delivery receipts. No idea if there's a fix for this. https://www.ndss-symposium.org/ ... [image] John Scott-Railton / @jsrailton : NEW leak reveals the Russian surveillance tools used to monitor @telegram @signalapp & @WhatsApp activity Can't read messages, but can track relationships etc. Ft my @citizenlab colleague @edok_lotosov 1/ By @Aaron_Krolik @paulmozur @satariano https://www.nytimes.com/... [image] Jeffrey Smith / @smith_jeffreyt : “[These surveillance technologies] add up to the beginnings of an off-the-shelf tool kit for autocrats who wish to gain control of what is said and done online ... and they complement other Russian efforts to shape public opinion and stifle dissent.” https://www.nytimes.com/... Alan Woodward / @profwoodward : The Russians have had sophisticated surveillance via SORM then SORM and now even that is evolving into a frighteningly capable tool kit https://www.nytimes.com/... Dan Harris / @danharris : “China is the pinnacle of digital authoritarianism,” but Russia is fighting with Iran for second place. https://www.nytimes.com/... Lukasz Olejnik / @lukolejnik : Russia increases technical surveillance capabilities. One tool can identify when people make voice calls or send files via Telegram, Signal and WhatsApp. Another may determine if someone is using several phones. https://www.nytimes.com/... [image] Paul Mozur / @paulmozur : As the FSB demands new tools to crush dissent, Russian companies are getting better at digital surveillance. One startling new tool can track metadata for voice calls and file transfers on encrypted apps like Signal. It is already being marketed overseas. https://www.nytimes.com/... Paul Mozur / @paulmozur : Based on our findings, people in authoritarian countries should rethink how they use encrypted chat apps. In Russia the tool can track metadata only when someone makes a voice call or sends a file on apps like Signal and Telegram. Messages remain too difficult to follow for now. https://twitter.com/... @rondeibert : “Sectors connected to the military and communications are getting a lot of funding right now as they adapt to new demands,” said @edok_lotosov , a senior researcher who studies Russian surveillance companies with @citizenlab https://www.nytimes.com/... Meredith Whittaker / @mer__edith : Important reporting. Note that Signal's encryption remains robust, even as ISP-level data can, as reported, reveal limited information. https://twitter.com/...
Context & Ripple Effects
This reporting adds a supplier-layer view to Russia’s surveillance apparatus: the state is not only operating censorship and monitoring systems, as detailed in the Roskomnadzor-document investigation, but drawing on a network of contractors concentrated around Citadel Group.
It also shifts attention from the established trade in leaked personal records—the “probiv” data market—to tools that can generate communications metadata and social graphs through network-level collection.
First-order effects
- Citadel-linked contractors and the FSB gain a more organized domestic supply chain for tools that correlate device use and log activity metadata across Signal, WhatsApp, and Telegram.
- Users of encrypted messaging services retain protection for message content, but their calling, file-transfer, and relationship metadata can become more visible to network operators and security services.
Second-order effects
- Opposition groups, journalists, and other at-risk users face greater pressure to reduce identifiable network patterns, not merely to choose an encrypted messenger.
- Overseas marketing of these tools could extend the contractors’ customer base and make Russian-developed surveillance capabilities available beyond the domestic security market.
Third-order effects
- If contractor-led development continues, surveillance capacity can become less dependent on a single state agency and more embedded in a commercial ecosystem whose vendors can iterate, specialize, and export.
- The pattern underscores a durable limit of encryption as a privacy safeguard: protecting content does not by itself prevent metadata-based monitoring and association mapping.
The trend: This is one instance of surveillance states building commercialized, metadata-centric monitoring stacks alongside content-encryption-resistant collection methods.