Few thought Russia could build a surveillance state. Here’s how it did it

In the summer of 2016, Russia's security services gained unprecedented access to citizens' private calls, messages, and photos.

The so-called Yarovaya laws demanded that telecoms companies store user data and hand it over to Russia's security services on request — even without a court order.

For activists, the danger of such laws was obvious. The illegal annexation of Ukrainian Crimea had taken place two years prior; politician Boris Nemtsov had been gunned down in view of the Kremlin in 2015, and criminal cases had already been opened against key opposition figures.

"It was already clear that what was happening was another link in the chain leading towards the establishment of a dictatorship in Russia," says Russian journalist Arseniy Vesnin.

For many Russians at that time, however, the newly introduced restrictive measures were not a point of concern.

Ten years on, the Yarovaya laws now stand as a watershed moment for Russia's digital freedoms. They are an example of the Russian state's ability to achieve its goals through sheer force, grinding down technological barriers and mobilizing private firms to build the country's repressive and controlled digital sphere.

They also show how the Russian government played the long game, gradually turning up the heat of repression with little opposition from the public.

'I have nothing to hide'

Named after United Russia lawmaker Irina Yarovaya, the Yarovaya laws demanded telecom firms keep copies of all communications sent via their networks — including text messages, calls, data, and images — for six months. Metadata, such as the time and location a message was sent, had to be held for three years.

Not only did all of this data need to be stored in Russia itself, but companies also had to provide officials with the tools to decode information if it had been encrypted.

Even as the legislation was rubber-stamped by Russia's parliament, the Yarovaya laws showed the Kremlin had little fear of pushing repressive laws. Despite small-scale protests happening in multiple Russian cities, public discontent was quickly brushed aside, cementing an already familiar pattern of opposition action that failed to reach the masses.

Moscow authorities reluctantly approved a rally in the capital after demanding the gathering move away from the city center to Sokolniki Park in the city's northeast.

Some 2,000 protestors gathered to hear speeches by Anton Nosik, the blogger described as the Godfather of the Russian internet, and opposition leader Alexey Navalny.

Vesnin attended an anti-Yarovaya protest in St Petersburg with several hundred people. Most were familiar faces from the city's political scene, the same people who protested against the annexation of Crimea or campaigns to protect the city's historic buildings.

"Most people were not interested. The idea that someone would store people's communications data was simply not enough to bring large numbers of Russians onto the streets," Vesnin says.

"Unfortunately, it did not concern most people then, and it still does not concern them now. Many would say: 'I have nothing to hide,' or 'If they want to find something out about me, they will do it anyway.'"

'This can't be'

Ten years on, more striking is how the Kremlin was able to wave aside experts who said that the law would simply be all but impossible to implement. Instead, it recruited businesses to cover the costs of a growing surveillance state.

The Yarovaya laws required huge amounts of data storage and demanded staggering investments from the country's telecoms giants.

These companies pushed back against the laws. In 2016, Russian business news outlet Vedomosti published an article on the Yarovaya laws simply titled, "This can't be." It reported that telecoms firms had estimated the cost of complying with the three-year data storage requirement at 5.2 trillion rubles ($66.49 billion). The amount, Vedomosti noted, was equivalent to a third of the country's budget.

The apparent disconnect between the Kremlin and economic reality shaped early discourse.

"The legislation in a way was ahead of what they were able to law in terms of infrastructure control," says Dr Mariëlle Wijermars, associate professor in internet governance at Maastricht University.

"That also meant that a lot of the discussions were also sometimes ridiculing the Russian state, ridiculing (Russia's internet watchdog) Roskomnadzor, showing how they were not really able to do it."

Such dismissiveness did not last. Improving technology made data storage easier, but telecom companies were allowed to slowly make the investments needed to bring their operations in line with the new laws.

The Yarovaya laws outlined that Russian operators should boost their internet traffic storage capacity by 15% annually. Those requirements were deferred after the Covid-19 pandemic struck, while Russia's full-scale invasion of Ukraine and the sanctions that followed also slowed the pace of change.

"Businesses spent years negotiating with the state, extracting delays and deferrals on the final implementation of the surveillance system and on storing the full volume of user data — including messages and heavy video content," says Sarkis Darbinyan, co-founder of digital rights groups Roskomsvoboda and RKS Global.

"It would be wrong to say the system is fully built even today. Compliance is a perpetually expanding obligation," Darbinyan says.

A cycle of dependence

Even these slower, more piecemeal changes added up to create a highly capable surveillance system.

Other legislation would follow a similar pattern: Russia's Sovereign Internet Law in 2019 demanded that companies foot the bill for equipment such as deep packet inspectors, tools capable of filtering content, and identifying the source of online traffic.

"The Yarovaya laws normalized the idea that an information intermediary is not a neutral service provider, but effectively a component of the state's apparatus of control," says Darbinyan.

Similar models are now seen in other spheres of Russian life, he adds. Online platforms and operators are legally obligated to remove content, identify users, and throttle or block specific tools and websites on the government's behalf.

Ultimately, Russian companies caved to government demands because they wished to keep operating inside the Russian market. Now, these companies' potential to continue working and turn a profit is expressly tied to their ability to carry out the government's wishes.

Russia's descent into authoritarianism has made that relationship increasingly stark.

When the initial versions of Russia's SORM state wiretapping system were being rolled out in the 1990s and 2000s, the market was competitive, and fines were low, which meant many operators could afford simply to ignore such requirements, Darbinyan says.

Today, companies that have not implemented the more advanced SORM-3 are barred from the state-approved whitelists that continue to operate during Russia's ever more prevalent internet shutdowns.

They are also denied other state privileges, including deferments for their employees to avoid military service.

As Moscow's war on Ukraine continues and issues such as inflation continue to bite, Russian companies may face more challenges in carrying out the Kremlin's demands. Sanctions also continue to cause problems in sourcing equipment.

But the ten-year legacy of the Yarovaya laws suggests that dismissing or downplaying Russia's ability to implement more repressive reforms would be a mistake, experts say.

"Today, Russia has built one of the most comprehensive surveillance and traffic interception systems in the world — one that every Russian business is legally obligated to comply with," Darbinyan says.