Russia has dramatically widened the scope of personal data that telecom and internet operators must make available to the security services on demand, moving beyond the bulk collection of call metadata to the granular identification of individual citizens. A decree from the Ministry of Digital Development, published on 22 May, updates the technical requirements for the System for Operational-Investigative Measures (SORM), the mandatory surveillance infrastructure embedded in all Russian networks since the 2016 “Yarovaya law” anti-terrorism amendments. Henceforth, law enforcement and the FSB will be able to pluck from operator databases not only IP addresses and domain logs but also passport details, home addresses, taxpayer identification numbers, bank account information and real-time geocoordinates. The order, first reported by the Russian business daily Kommersant, represents the most significant expansion of SORM’s remit in years.

Viewed from Moscow, the ministry frames the changes as a necessary technical modernisation. The internet has become more encrypted and complex, officials argue, rendering the old interception toolkit obsolete. To keep pace, the updated SORM interfaces will support modern query and streaming protocols—GraphQL, WebSocket and HTTP—allowing security agencies to run precise, persistent searches across provider data lakes. Yet within Russia’s telecom industry, the decree is read as a heavy-handed regulatory burden. Small and regional operators, many of which have long skirted full compliance, will now need to retrofit servers and software at a minimum cost of five million roubles per installation. The architecture of legacy SORM nodes was never designed to give the owner of the system access to the transferred content; building that capability threatens to squeeze marginal players out of the market entirely.

The privacy implications are stark, particularly for those who had assumed that Russia’s mass surveillance regime was limited to traffic patterns rather than life profiles. The Moscow-based outlet The Insider noted that previously only metadata and the content of messages and calls were subject to handover. Now, a single query can tie a username or IP session to an individual’s identity document, financial footprint and precise movements. This collapses the distance between online anonymity and state identification, a shift that legal analysts in Russia describe as a qualitative leap from bulk surveillance to targeted dossier-building. The state’s appetite extends to data on organisations as well as individuals, effectively making the network a real-time informant on both personal and corporate behaviour.

Analysts in London observe that the decree consolidates a broader trend across authoritarian states: closing off the remaining pockets of anonymous digital life while centralising control through a cowed and consolidated provider landscape. The likely disappearance of smaller, less compliant internet service providers will leave the field to national champions that are more easily pressured. As Russia’s war in Ukraine grinds on and domestic repression deepens, the ability of security services to harvest bank details and location breadcrumbs at will will further curtail any space for dissident communication. The international implications are also coming into focus, as Western firms with residual data flows through Russia must now assume that an expanded set of their users’ attributes is systematically exposed to state scrutiny. What Moscow presents as a routine technical refresh is, in effect, another brick in a surveillance state that has been methodically assembled since 2016.