Former SORM Developer Exposes Surveillance Capabilities
According to documents, SORM does not see Signal: the system treats traffic from this messenger as an ordinary encrypted connection, without specifically identifying Signal within it.
Consensus
- Ivan Kirsanov, a 24-year-old former programmer for the company 'MFI-Soft' (part of the 'Citadel' group), worked on SORM systems for the FSB.
- Kirsanov provided journalists with an archive and source code of the SORM system.
- The SORM system captures full copies of internet traffic from users within Russian telecom networks.
- SORM can detect when a user is online, which websites they visit, and the duration and volume of their connections.
- SORM cannot decrypt modern encrypted traffic due to HTTPS and similar protocols.
- SORM cannot access the content of messages, search queries, or the full content of web pages.
- SORM can identify use of certain messaging apps like Telegram, WhatsApp, Zoom, Viber, WeChat, and Discord, but not who users are communicating with or what they discuss.
- SORM does not detect Signal traffic as a specific service; it appears as regular encrypted traffic.
- Outdated unencrypted services like ICQ, Mail.ru Agent, and Jabber are fully visible to SORM.
- SORM can detect some older VPN protocols like OpenVPN and PPTP, but not modern ones.
- SORM sees services like Google Meet and Google Drive only as general Google traffic.
- SORM does not have evidence of being able to decrypt or analyze Russian services like Yandex or VK better than foreign ones.
Points of divergence
- Kirsanov confirmed that a large portion of the traffic processed by SORM is 'garbage'. — tvrain
- Journalists emphasize that it is unknown whether security forces actually perform traffic analysis, based on the documents. — tvrain
- Kirsanov stated that content of many modern connections is inaccessible to SORM due to HTTPS protection. — tg_moscowtimes_ru
Coverage (2 sources)
- What the FSB sees in Russian traffic: investigation — Дождь
- Developer of surveillance systems for the FSB revealed that law enforcement sees all Russian internet activity without VPN — The Moscow Times