Search
Russian developer Ivan Kirsanov worked as a senior software engineer at MFI-Soft, analysing internet traffic. In 2025, he resigned, left Russia, and took with him an archive on SORM—the surveillance system used by the FSB. The investigative outlet “Important Stories” spoke with Kirsanov and studied the technical documentation.
According to the archive, SORM equipment receives a copy of users’ internet traffic and links it to specific subscribers. The system identifies the type of connection and the service a person is using, as well as collecting metadata. However, modern services encrypt the contents of traffic, so SORM cannot access the text of messages, voice calls or transmitted files.
What the FSB can learn about a user via SORM:
- when a person accesses the internet and how much data they transmit;
- which websites they visit and which services they use;
- when and for how long they make calls through messaging apps;
- whether they use certain VPN services.
According to Russian authorities, SORM is supposed to help law enforcement find suspects, investigate crimes, and prevent terrorist attacks. However, there is no publicly available data to evaluate the system’s effectiveness. In 2020, researchers from Perm—a major city in the Urals—noted that authorities had not reported any high-profile crimes solved with SORM. They even suggested that mandatory reporting on the system’s use and results should be introduced. And in March 2024, SORM did not help prevent the attack on Crocus City Hall near Moscow, in which 147 people were killed, wrote The Bell.
The main users of SORM are FSB officers: they also set tasks for developers to improve the system. Other security agencies do not have direct access to it. However, developers at Citadel—the largest Russian producer of SORM equipment, which includes MFI-Soft—could in fact observe people’s internet activity without special authorisation. As Kirsanov told Important Stories, while working there he himself intercepted real internet traffic of Tele2 subscribers in Nizhny Novgorod, a large city on the Volga River.
Kirsanov left Russia soon after he was detained by law enforcement. Before working at MFI-Soft, he took part in protest actions, and after a rally in support of Alexei Navalny in 2021, he was summoned for a “chat” at the Centre “E” (the Centre for Countering Extremism). After quitting, the developer returned to political activity. On the anniversary of Navalny’s death, for example, he held a solo picket.
In April 2025, two men in plain clothes forced Kirsanov into a car and took him to a police station. According to the developer, he thought he was being kidnapped and tried to get the attention of passers-by. From the station, he was sent to a psychiatric hospital, from which he was later released.
The Ministry of Internal Affairs later claimed that Kirsanov was “voluntarily” brought in for questioning as a witness in a case of threats of murder or causing grievous bodily harm (Article 119 of the Criminal Code). Kirsanov himself links what happened to his political activity.