Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

Many years earlier the first generation of SORM had begun when the Soviet KGB had tapped telephones. Then it was known as SORM-1. When it moved to the Internet in the 1990s—capable of intercepting e-mail, Internet traffic, mobile calls and voice-over Internet such as Skype, that was SORM-2. In the end the security services developed a third generation—SORM-3—which encompassed all telecommunications. All Russian operators and ISPs were required to install the black boxes, about the size of an old video tape recorder, which would fit on a rack of equipment, and permit connection to the regional departments of the FSB. The result: the FSB could intercept whenever anyone on Russian soil made a phone call or checked an e-mail.

The surveillance system enhanced the power of the security services, which lacked any kind of oversight. They didn’t hesitate to interfere with politics by using the tools of surveillance and interception. Levenchuk grasped this danger almost immediately and realized that the FSB intercepts of phone lines—and then the Internet—would further feed kompromat. It could include all kinds of misdeeds, from a target’s supposed connections with criminals to nasty details about bribery or prostitutes. At times kompromat was aimed at business rivals, prominent journalists, and politicians. But now the FSB was harvesting the raw material—intercepts from phone calls and e-mail messages—to manufacture kompromat.

For more than a decade, as investigative reporters for newspapers, we covered the Russian secret services. Andrei wrote his first article about SORM in July 1998. Then in 2000 we set up a website Agentura.ru, which we intended to be a watchdog of the Russian secret services. We’ve had a section on SORM issues ever since.

We were curious about many aspects of the story that had never been fully explained. First, we wondered why the communications industry, in the years of relative freedom in the 1990s, had been so willing to comply fully with the security services and put the black boxes on their lines? We knew there were open debates in the United States and elsewhere about electronic surveillance, such as the 1994 Communications Assistance for Law Enforcement Act, which required telecommunications providers to make their lines available for law enforcement purposes. Why was it different in Russia? Did SORM signal a return to the Soviet totalitarian practice of surveillance, or was it a legitimate method of law enforcement wiretapping in the digital age?

Second, how did SORM really begin? Was it an outgrowth of the old KGB or something new?

To answer the questions, we first looked at the document leaked to Egorova and posted by Levenchuk. We noticed that it included the identity of a special research institute in charge of the technical aspects of SORM, the Central Research Institute of the Communications Ministry. We found it had a whole section dealing with SORM, and the chief of the section was listed as Vyacheslav Gusev.

When Andrei called him, Gusev was less than helpful. He told Andrei that all work on SORM started in 1994 because that was when Russian communications switched over from analog lines to digital cables. Then he said, “I’ve been doing SORM for thirty years. I looked at your articles, our views are different, and I do not want to help you write your book.” Later the same day he sent an angry e-mail. “There are plenty of problems in this area, and your publication will not solve anything and only cause various squabbles. People who are engaged in SORM do not deserve” this critical attention. [6] Gusev, communications with authors, August 8, 2014.

That avenue was obviously a dead end. But he exposed a serious contradiction: Gusev said that all work started in 1994 and that he had been working on it for thirty years. If SORM started in 1994, then it was a relatively recent invention, created after the Soviet collapse. But if he had been working on it for thirty years, then perhaps it originated in the KGB.

We searched through documents of the Ministry of Communications under Yeltsin and found that the first time SORM was mentioned was in a decree of November 11, 1994. The decree was about phone eavesdropping and said the SORM system would be established on Russia’s communications lines. [7] Decree No. 252, Ministry of Communications, the Russian Federation, signed by Vladimir Bulgak, minister of communications. But the document also contained another clue: not only was the research institute in Moscow working on SORM, but there was mention of a branch in St. Petersburg as well. We knew of a scientist who was one of the most prominent Russian technical experts on SORM, Boris Goldstein, who had provided us with comments and explanations for our investigations in the past, and it turned out he had worked at the St. Petersburg branch for decades. Irina went to see him at the University of Telecommunications on the outskirts of St. Petersburg, where he teaches. When Goldstein opened the door to his study on the fifth floor of the university, she saw a tall, slim, and well-mannered professor, sixty-three years old. And he had a very good memory.

Goldstein recalled Soviet times, when KGB officers eavesdropped on the telephone system. They connected wires from the phone exchanges to hidden rooms where the monitoring took place. “Big, old-fashioned tape recorders turned on at the beginning of a conversation and started recording,” he recalled. “All of this was done in secret.” [8] Boris Goldstein, interview with Borogan, September 2014.

Goldstein described a critical difference between the Western and Russian approaches to intercepting communications. In the West, he said, the phone company or ISP gets an order to begin the interception, receives the identity of the target, and provides access. But in the Russian system the phone company or service provider has no idea who is being tapped. As Goldstein explained it, the Russian security agencies simply do not trust the operators.

Then Goldstein clarified why SORM was carried out in such secrecy. The black box installed at the provider is just one part of the system. The cable connects it to a second part at the office of the FSB, and these second devices are the work of the FSB’s own secret research institutes and are manned by the FSB. Goldstein made one thing very clear: it was not all that difficult for the authorities to shift from monitoring telephones, in SORM-1, to monitoring the Internet, in SORM-2. “Technically there was nothing new” in SORM-2, he said. To scoop up the data, “you didn’t need anything very special, just to mirror the traffic.” In some respects, Goldstein said, monitoring data was even easier than voices. After talking to Goldstein we realized that SORM probably had roots in the long-standing Soviet practice of tapping telephones. When the technology changed, the black boxes simply adjusted.

Still, not all of the pieces of the puzzle were fitting together. To get a better picture of how SORM began, we continued to scrutinize the Ministry of Communications documents from the 1990s, searching for clues in names, organizations, and facilities. Soon we discovered the name Sergei Mishenkov, then chief of the scientific department in the Ministry of Communications. In some documents he was identified as the official in charge of supervising SORM research “at the request and with the financial support” of the Russian security services. It seemed he might know a lot about SORM.

Andrei found him one day on the fourth floor of the Ministry of Communications in Moscow. Cheerful, paunchy, and with unruly hair, Mishenkov was a radio enthusiast from his youth—his e-mail address is his radio call sign—who filled his inner office with old radio sets made in Soviet times. He was an engineer who devoted his career to Moscow’s radio network and was recruited by his old pal Vladimir Bulgak into the government in the 1990s to bring more discipline to the ministry’s research institutes. They were accustomed to years of government subsidies, but now Mishenkov had to press them for real results. They also needed money. Mishenkov needed to find funds, and that is how he got involved with SORM: the FSB paid for the research on the black boxes.