Russia is not a fan of online rights. This has been abundantly clear for some time.

From trying to ban anonymous messaging apps such as Telegram, demanding VPNs comply with their onerous internet censorship laws, to blocking VPNs altogether, it has been clear that the Putin regime is determined to control the flow of information online and monitor what its people are saying online.

But until now, no-one was absolutely sure how effective their surveillance systems were. International sanctions resulting from Russia’s occupation of the Ukrainian region of Crimea have crippled the country’s economy and internet surveillance technology does not come cheap.

But now, the world has been given a startling insight into how Russia monitors the phone calls, messages, and data of customers of the country’s largest mobile phone network, Mobile Telesystems. And it has come as a result of a blunder by a staffer at Finnish telecoms firm Nokia.

How Russia’s spy network has been revealed 

It appears that the data was revealed after a Nokia employee connected a USB flash drive containing work documents to his home computer.

His PC was set up in such a way that all the files on his device, including those on the USB drive, were accessible from the internet without having to pass through any security and ID checks.

The files were spotted by Chris Vickery, director of cyber risk research at security firm UpGuard. He notified Nokia and four days later they were secured.

In total, almost 2 terabytes of data was accessible, the majority of which was internal Nokia files and documentation. But the section which provoked the most interest related to Nokia’s role in providing “lawful intercept” technologies to the Russian government.

How SORM spies on you

The technology in question is known as SORM. It is an acronym for “system for operative investigative activities,” a technology first developed back in 1995 to help Russia’s Federal Security Services (FSB, but formerly known as the KGB) access Russian telecoms data.

Since that technology was created Russian law has been expanded to take in internet service providers (ISPs) and websites. Many Russian based companies are now thought to have been forced to introduced SORM technology onto their networks. Those that refuse face large fines and the prospect of having their service blocked across Russia.

So, what exactly is SORM? It essentially looks like a large box, perhaps about the size of a washing machine. When this box is connected to a telecoms or ISP network, it can intercept all of the data that is passing through their systems.

In the case of Mobile Telesystems, which is covered by these documents, this means that the Russian government is able to access data about all calls, text messages, and internet data which is being sent on their network.

The documents show that Nokia is working to modernise and improve this system with specific references to phone exchanges in the cities of Belgorod, Kursk and Voronezh. This is needed to be compliant with the latest Russian surveillance laws.

Why SORM should worry people outside Russia too

This data is thought to be made accessible to several government agencies as well as the Russian police and other law enforcement bodies.

In Russia, the use of SORM technology is particularly troubling given the Putin regimes appalling record on human rights and its treatment of opposition politicians and journalists.

But if you are reading this article outside Russia, you shouldn’t be sitting back comfortably either. Western governments including the UK and the USA routinely monitor data using technology which works in much the same was as SORM.

Indeed, Nokia has confirmed that the Russian company Malvin, which supplies SORM to the Russian government is a customer, but far from the only one.

Equally, there is a reasonable chance that your data passes through Russia at some point and is therefore subjected to state surveillance there in much the same way as domestic data.

There is one sure-fire way to stop the Russian government, and indeed your own, from spying on your online data.

By using a VPN, you are ensuring that all of your online data is encrypted. This means that if and when it is intercepted, there is no way that the Russian authorities can read it.

Russia is doing its best to stop its own people from using VPNs and the moment but at the time of writing most are still functional and many can still offer Russian servers too, although we would recommend using servers in other countries where possible.

If you are not sure which VPN to use, a good place to start is our article on the Best VPN for Russia.