He helped build the surveillance system the FSB uses to spy on Russians. Then he escaped Russia with an archive of its internal documents. Here’s what he told iStories.
Journalists from iStories talked to Ivan Kirsanov, a 24-year-old programmer who worked at a company owned by the Citadel holding. The holding is the main developer of SORM, the FSB’s surveillance system. In 2025, Kirsanov left Russia and took with him an archive of technical documentation on SORM. He now lives in France on a student visa, works part-time as a shepherd on a farm, and is…
Ivan Kirsanov, a 24-year-old programmer from Zelenodolsk, grew up in a large family. He began teaching himself coding at age 11 using YouTube videos and became interested in politics after watching Alexey Navalny's videos. At 9th grade, Kirsanov attended his first rally in Kazan for the "Voters' Strike," protesting Navalny's disqualification from the 2018 presidential election.
He was detained, fined, and threatened with expulsion from college after he protested Navalny's arrest. Afterward, Kirsanov decided to keep quiet to preserve his life.
Kirsanov completed college and moved to Moscow in 2022 to escape the draft office. Later that year, he joined MFI Soft, a company that develops technical equipment for SORM, the FSB's surveillance system. At first, Kirsanov took the job for the money but later became aware of the system's purpose. He worked as a senior software engineer refining code written by FSB developers. Kirsanov left MFI Soft in 2024 after asking for a promotion and being denied.
During his time at MFI Soft, Kirsanov gained insider knowledge of SORM, which he shared with iStories. The surveillance system enables the FSB to spy on Russian citizens' online activity. Most of the data collected is not very useful due to encryption, but phone calls and text messages are fully visible. SORM can detect several popular messaging apps, including Telegram, WhatsApp, IMO, Zoom, Viber, WeChat, and Discord, collecting metadata on calls without revealing the users' identities.
Signal is not detected by SORM. Older, unencrypted services like ICQ, Mail.ru Agent, and Jabber are also visible to the system. Google search queries and responses are invisible to SORM, but Google Meet and Google Drive are registered as "Google." The system can distinguish a Meet call from a Drive file upload using indirect signs.
SORM can identify some VPNs but not many Russian services that rely on encryption. Only the FSB and developers have direct access to the data.
Written by urgent.news from Meduza (English)'s reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
