Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

In August 2013 Irina decided to get a spectator pass, so she went on the official Olympic website. Because the procedure required taking a photo, Irina clicked the function to do this. Her computer then warned her that the site “is requesting access to your camera and microphone. If you click ‘Allow,’ you may be recorded.” This seemed a bit odd, so we asked Citizen Lab’s researcher Byron Sonne to look at the site more closely. “This image, where the Flash entity on the site is asking for access to your camera and microphone, does indeed appear pretty intrusive and downright creepy,” he responded. We wondered whether this procedure was intended to collect legitimate information or to send a message that everybody was being watched.

We analyzed dozens of open-source technical documents published on the government procurement agency website as well as public records of government oversight agencies and presentations of companies contracted by the government. We confirmed that SORM had been greatly strengthened in Sochi for the Olympics.

In November 2012 it was announced that there would be free WiFi access at all the competition venues “for the first time in Olympic history” as well as in the media centers and media hotels. But all users were required to login and provide their spectator pass details—the FSB wanted to make sure nobody went unrecognized.

Conventional security measures would be high at Sochi, with more than forty thousand police on duty and more than five thousand surveillance cameras installed across the city. To gather data from cameras, in 2009–2011 Sochi had a federal program called “Safe Sochi,” and a centralized command and control center was built in the city. The cost of the program was more than 1.5 billion rubles (over $48 million), and 1.2 billion of that was provided by MegaFon, one of three national mobile operators. We also discovered that Sochi was to be the first Olympics that would use surveillance drones, with both the FSB and the Interior Ministry acquiring drones. The FSB also purchased sonar systems to detect submarines so as to prevent a sea-launched terror attack.

We wanted our investigation to come out before the Olympics, as we hoped that the international and national media attention to Sochi could help prompt the conversation about out-of-control surveillance throughout Russia. But where could we publish the story? When dealing with sensitive stories, Russian media preferred not to be the initial source. In our investigation project “Russia’s Surveillance State,” most of our stories were first published in Wired and only then translated and picked up by Russian media.

The Guardian seemed to us the obvious choice. The British newspaper put a great deal of effort into covering surveillance issues. In these months the Guardian had been running Snowden’s revelations almost on a weekly basis, and the Guardian ’s Luke Harding had been our friend since his days as a Moscow correspondent.

We wrote to Luke in early September, describing what we had. “Sochi is a terrific story,” he answered. He forwarded our e-mail to the Guardian ’s foreign editor and put us in touch with their new Moscow correspondent, Shaun Walker, whom we met at a Moscow café to discuss the story and possible repercussions. It was a very sensitive story, and we didn’t know how the Kremlin might react to such an account in a Western newspaper; the Games were Putin’s personal project, guarded by the FSB. The decision was not easy for Shaun either; though he had been living for years in Moscow, it was his very first week as the Guardian Moscow’s correspondent, and the FSB had expelled his predecessor, Luke Harding, from Russia two years before.

We spent three weeks editing and repackaging our investigation. Meanwhile Shaun worked on getting comments. But it was slow and painful. Finally Shaun said that the Guardian had decided to run the story on October 1. Then it was delayed. And then, a surprising development: on the morning of October 2 the authorities announced that there was to be a press conference about security measures at the Olympics, that day at 2:00 p.m. Shaun rushed to the RIA Novosti building, where the press conference was to take place. FSB official Alexey Lavrishchev was listed among the participants and stated, “No, the city of Sochi will not be like a concentration camp.” He then recalled the London Olympics: “Video surveillance cameras were mounted everywhere, even, excuse me, in the toilets. None of this will happen in Sochi!” He stressed that security in Sochi will be “invisible and unnoticeable.” [9] Fred Weir, “Russia’s Sochi Games: Why You May Want to Leave Your Laptop at Home,” Christian Science Monitor , October 7, 2013, www.csmonitor.com/World/Europe/2013/1007/Russia-s-Sochi-Games-Why-you-may-want-to-leave-your-laptop-at-home . Shaun sent us a quick message, “Amazing press conference! He read off a sheet of paper for 15 minutes, then they had questions, but only Russian outlets.” He added, “He scuttled off like a crab at the end.”

The Guardian ran our investigation on Sunday, October 6, placing it on the front page and headlined, “Russia to Monitor ‘All Communications’ at Winter Olympics in Sochi.” It added, “Exclusive: Investigation Uncovers FSB Surveillance System—Branded ‘PRISM on Steroids’—to Listen to all Athletes and Visitors.” The term “PRISM on Steroids” was coined by Ron Deibert, with PRISM referring to the especially intrusive NSA program designed to intercept communications without the knowledge of communications services providers, exposed by Snowden.

Three days after the Guardian piece was published, the major English-language Russian government propaganda outlet, the Voice of Russia , ran an interview with a pro-Kremlin expert about the story, full of personal attacks against us and Shaun Walker. [10] “Let’s Just Put Some Random Words: FSB, Sochi, Spying,” Voice of Russia , October 9, 2013, http://sputniknews.com/voiceofrussia/2013_10_09/Let-s-just-put-some-random-words-FSB-Sochi-spying-4373 . We had expected as much. But the next day the position was changed: the same Voice of Russia published a story that seemed to come clean about what we were reporting. We were stunned at the admissions, particularly the headline that admitted that the authorities were tapping the phones. “Don’t Be Scared of Phone Tapping During Sochi-2014, It’s for Your Own Safety—Experts.” [11] Nikita Sorokin, “Don’t Be Scared of Phone Tapping During Sochi-2014, It’s for Your Own Safety—Experts,” Voice of Russia , October 10, 2013, http://sputniknews.com/voiceofrussia/2013_10_10/Dontt-be-scared-of-phone-tapping-during-Sochi-2014-its-for-your-own-safety-experts-5489 . We were further surprised when these experts talked openly about the equipment installed. They admitted that “technological equipment of special services provides for eavesdropping on telephone conversations, as well as for analyzing social network and e-mail correspondence” and said that “this kind of control is the best way to spot terrorist activity and nip the problem in the bud.” [12] Ibid.

We began to wonder: Why was this being acknowledged so openly? Were all these sophisticated technologies going to be actually used at Sochi, or was it something else? Was it just the threat of surveillance being used to intimidate and deter? What really puzzled us was that the story was not met with the usual denials and silence; instead, the authorities were talking about it.

Even as the acknowledgment of the surveillance plans surprised us, we did a double-take on November 8, 2013, when Prime Minister Dmitry Medvedev signed an instruction listing all the parties who would be subject to FSB surveillance, including the organizers of the Games, all the athletes from around the world, judges for the competitions, and the thousands of journalists who would converge on Sochi. [13] The decree No. 1003 “Ob osobennostyakh okazania uslug svyazi i o poryadke vzaimodeistvia operatorov svyazi s upolnomochennimi gosudarstvennimi organami, osushestvlyaushimi operativno-razysknuyu deyatelnost, na territorii g. Sochi v period provedenia XXII Olimpiyskikh zimnikh igr i XI Paralimpiyskikh zimnikh igr 2014 goda v g. Sochi” [Details of the Provision of Telecommunications Services, and on the Interaction of Operators with the State Authorities Conducting Operational Search Activities on the Territory of Sochi During the XXII Olympic Winter Games and XI Paralympic Winter Games of 2014 in Sochi], Rossiyskaya Gazeta , November 8, 2013, www.rg.ru/2013/11/13/opera-site-dok.html . The decree provided for the creation of a database for the users of all types of communication, including Internet services at public WiFi locations “in a volume equal to the volume of information contained in the Olympic and Paralympic identity and accreditation cards”; that is, the database contained not only each subscriber’s full name but also detailed information guaranteed to establish his or her identity. The database contained “data on payments for communications services rendered, including connections, traffic, and subscriber payment,” meaning it contained all information on who called whom or sent messages during the Games as well as the location of each call. In the language of intelligence agencies this is called “gathering metadata,” the same kind of data-harvesting that the US NSA carried out and Snowden exposed.