The All-Seeing State Eye

The invasion of Ukraine started almost a year ago. Russian authorities didn’t just prepare for it by moving troops to the border; they also cleared the information space in order to cut Russians off from publications that contradict official positions. After the invasion, authorities labeled almost all independent media in Russia as “foreign agents” and blocked their websites. The list of "foreign agents" is still updated weekly with new names of independent journalists, oppositionists, activists, actors, musicians and more.

However, for a large-scale cleansing, Roskomnadzor did much more than can be seen on their public registers where they list sources of information objectionable to the authorities. IStories obtained access to the largest data leak in the history of the country's main censorship agency in a leak we call the #RussianCensorFiles. Journalists studied more than 2 million internal documents, images and letters of a Roskomnadzor subsidiary, the "General Radio Frequency Center" (GRFC), which monitors the internet, prepares sheets about "foreign agents", reports on "forbidden information," and blocks sources.

Our report describes the structures of Roskomnadzor on the eve of and during the war, as it stamped hundreds of sheets to label Russians as "foreign agents", blocked media outlets by the dozens, participated in information campaigns against people the authorities disapprove of — and for those who were favored, cleaned up unflattering publications.

From this article you’ll learn:

for whom Roskomnadzor prepared sheets for recognition as "foreign agents" and why these people have not yet been included in this register;

how Roskomnadzor tries to censor tech giants (YouTube, Google, etc.);

who the agency coordinates with to block websites;

how Roskomnadzor participates in information campaigns against people disapproved of by authorities.

WHO HACKED ROSKOMNADZOR AND WHY SHARE DATA WITH JOURNALISTS? MORE ABOUT #RUSSIANCENSORFILES

In November 2022, a group of Belarusian hackers known as “Cyberpartisans'' announced that they had hacked into the internal network of the GRFC and downloaded documents, correspondence and mail from employees, as well as surveillance systems for them - in all, more than two terabytes of data. As evidence, they showed screenshots of employee correspondence in messaging apps, via e-mail, and internal documents listing tasks. The Cyberpartisans also claimed to have disrupted the GRFC’s work by encrypting their workstations. The cyber attack was confirmed by the GRFC itself. However, they noted that hackers "did not gain access to either classified information or critical infrastructure." According to the Cyberpartisans, the materials they received prove “large-scale surveillance and control over everyone who has spoken out against the Putin regime over the past 20 years.”

The hacktivists remained inside the GRFC system for many months before they were discovered. No one paid any attention to the hackers as they kept an eye on all the personnel and what they were doing. After the hack was announced, the Cyberpartisans still had access to internal communications. They said that they witnessed panic among management and administrators, as well as ordinary employees, who were afraid that their data would be sold or made public.

Everything that the Cyberpartisans handed over everything they obtained through the hack to journalists of the German newspaper Süddeutsche Zeitung, IStories and other Russian media. The leak has been called the #RussianCensorFiles.

The hackers chose Roskomnadzor for the attack, they said, because the department is “the most important element of the Russian repressive machine.” “They monitor everyone and everything on the internet, and as soon as they see any violations, they send this information directly to the FSB, the National Guard, the Federal Protective Service (FSO), etc., so that their agents are promptly sent to a region where a potential threat to regime stability is growing. The regime successfully suppresses any alternative movements or even thoughts of disobedience,” the Cyberpartisans explained to journalists from Süddeutsche Zeitung.

The Cyberpartisans have teamed up in 2020 during large-scale protests against the regime of Alexander Lukashenko in Belarus. In an interview with the BBC Russian Service, they said that all of them have extensive experience in the IT sector, but none had been involved in political activism before. “Our friends and family are being killed, tortured and raped. No one will be able to sit on the sidelines,” the hackers published in a statement on the website of the Belarusian Chamber of Commerce and Industry, announcing the start of their team’s work. Since then, they have organized cyber attacks on the Belarusian railway system, received data from the internal security department of the country's Ministry of Internal Affairs, and audio recordings of wiretaps of security forces and officials. Following Russia's full-scale invasion of Ukraine, they declared that they were "ready to assist in the fight against the fascist campaign to invade fraternal Ukraine." “At this momentous time for our peoples, it’s important to join forces and show that together we are able to fight back against tyrants who want to drown our countries in blood,” they said in a statement the day after the invasion began. After that, the number of hacktivists in the Cyberpartisans doubled — from 30 to 60 people.

“It’s not possible to establish the logic of entering ["foreign agents"] into the register”

The first five “foreign agents” were added to the official register on December 28, 2020. The list included three journalists, a human rights activist and an activist-artist. Prior to this, only non-profit organizations and some media outlets were labeled as "foreign agents". In deciding who exactly will become a “foreign agent”, the Ministry of Justice has the final word. That’s where information from Roskomnadzor on possible “traitors to the motherland” is sent, as well as data on financial transactions involving money received from abroad — even gifts from relatives.

Although the Russian authorities have repeatedly stated that a “foreign agent” or agency doesn’t bear any restrictions, being marked as such influences significant negative consequences. Experts refuse to communicate with journalists and advertisers flee. In addition, individuals and organizations labeled as "foreign agents" must report in detail on their spending, and mark each of their public messages with a phrase stating that it was created by a “foreign agent”. Any violation of the law leads to a fine, and subsequently to criminal liability. In the first quarter of 2021 alone, “foreign agent” media outlets were fined 79 million rubles, according to Roskomnadzor’s accounting.

The Ministry of Justice slowed down after the first five additions to the register — until July 7, 2021, at which time the recognition of Russians as "foreign agents" essentially turned into a conveyor belt. New "foreign agents" were being added to the list every Friday, and today there are already more than two hundred people listed. However, as IStories has uncovered, this represents just a small portion of those who have been tracked by Roskomnadzor, and had sheets drawn-up for them to be recognized as "foreign agents".

In the GRFC data leak, IStories journalists found lists of people and organizations about which employees of the department compiled such sheets. Some of them have already been used by the Ministry of Justice to label Russians as "foreign agents", while others are still waiting.

Support independent journalism Your donation will help us to continue telling the truth — we do not obey censorshipDonate

Why haven’t these sheets, which were prepared in 2021, been used for their intended purpose? Even employees of Roskomnadzor don’t know for sure. One of the reports on prepared sheets for recognizing people, media and other legal entities as "foreign agents" stated that for the year from October 2020 to October 2021, employees prepared 704 sheets, including media outlets, legal and natural persons, and unregistered associations and movements. The report’s author notes that “the logic of entering ["foreign agents"] into the registers remains not entirely clear, since, for example, of the total number of requests for the preparation of sheets regarding members of the “Golos” movement, or the opposition publications Project.Media and IStories, are not all included in the register yet.” The employees could not establish the logic, but suggested that “the determining factor is opposition activity, the conflict between the publication and the official, etc.”

Also found in the leak were official requests from the Ministry of Justice, to prepare sheets for certain people “as soon as possible,” on which the ministry itself decided to conduct an audit.

The database of the leak "Russian Censorship Files" has been updated, we have added new names to the table.

In total, IStories managed to find 940 names of people that the GRFC collected information on from 2020 to 2022 — with the purpose of labeling them as "foreign agents". 149 people from this list have already been entered into the official register. However, the number of potential "foreign agents" may be much larger, since not all documents of the GRFC and Roskomnadzor were leaked.

In addition to preparing sheets, GRFC employees also shadow opinion leaders. The lists of opinion leaders include 472 people, with descriptions of their activity, and links to all available social media accounts.

To date, surveillance of individuals and media for the purpose of labeling them as "foreign agents" and blocking them, is carried out mostly manually. According to this internal report from the GRFC, with current efforts — since the beginning of Russia’s full-scale invasion of Ukraine — Roskomnadzor “suppressed the distribution of more than 136,000 illegal materials aimed at destabilizing Russian society, against the backdrop of the special military operation [Russian state euphemism using by the authorities instead of ‘war'] on the territory of Ukraine, including those containing unreliable publicly significant information, and also calls for riots.” In addition, “access was limited to 68 websites of Russian opposition resources [...] and to more than 540 Ukrainian websites.”

In the future, Roskomnadzor plans to automatically track the social media accounts of recognized and potential "foreign agents", as well as opinion leaders. It also plans to determine the topics of all articles that fall within the field of vision of the developed automated systems for Internet monitoring in order to block "dangerous" resources in the future. To train the automatic monitoring program to search for such resources, Roskomnadzor employees use the sites of media outlets already labeled as "foreign agents".

Malicious violators of Russian law and order

“Russia is bombing residential buildings,” “Russian conscripts in Ukraine,” “Russian military atrocities in Bucha.” The results generated by search queries like these in Yandex and Google are very different. IStories wrote last summer about how differently the search engines answer Russians’ questions about the war. Thanks to the leak, you can understand why this is happening. One of Roskomnadzor’s reports says that Yandex and Mail.ru fully comply with the requirements to remove "illegal" content from results, and Google "search results filtering is at the level of 70-80%."

Another headache for Roskomnadzor is YouTube. ‎“‎Currently, YouTube video hosting almost completely ignores numerous demands to remove illegal content, [...] while restricting access not only to the official accounts of Russian state media, but also to the accounts of official authorities of the Russian Federation,” employees of the GRFC wrote in their report. YouTube, like many sites, uses the https protocol, which means that Roskomnadzor cannot block a separate “undesirable” video — they would have to block the entire YouTube domain, which could cause a public outcry. Here’s what representatives of Kaspersky Secure Connection, the only VPN that meets the requirements of Roskomnadzor, wrote about this: “‎If a video on YouTube is blocked on your part, the entire domain will be blocked. We will get a lot of support calls from users.”‎

Roskomnadzor maintains a list of "significant resources," access to which is not blocked, even if they violate the law. The pre-war list included popular Russian and foreign social networks like VKontakte, Odnoklassniki, Facebook, Instagram, Twitter, YouTube, Wikipedia, the BBC website and the Daily Mail newspaper, as well as AliExpress and many others. Three popular pornography sites and Radio Free Europe/Radio Liberty (RFE/RL) are included as "Other significant resources."

After the outbreak of the war, the list of “untouchables” changed, and a new column appeared in the reports: “Significant resources, access to which is blocked.” Now it includes Facebook, Instagram, Twitter and RFE/RL. The given reason for blocking social networks is “statements by representatives of the Meta company about permission to publish calls for violence against Russian military personnel, Russian citizens.”

In August, GRFC staff prepared a sheet listing all unblocked sites. It noted 82 resources and more than 47,000 URLs to which access should be restricted. Most of the references (37,500) come from the 398-FZ register – that is, information about the Russian Armed Forces deemed extremist or false. The rest come from the Unified Automated Information System (UAIS) "Unified Register" — content about suicide, drugs, pornographic and other prohibited materials. References to this register are decided by state institutions, including the Prosecutor General's Office, courts, the Ministry of Internal Affairs, the FSB and Roskomnadzor.

Most of the "forbidden" links were published on Telegram, YouTube and VKontakte. At the same time, VKontakte was home to the most links flagged by the UAIS registry, while Telegram and YouTube contain more materials considered extremist. Due to the “significance of the resources,” Roskomnadzor can’t block them and requires employees to “seek the removal of prohibited information.”

The blocking of some materials is agreed by the GRFC employees “at the top,” when fearing a major public outcry. To do this, in the sheet about the site that ends up in the "Unified Register" of resources containing prohibited information, a mandatory section is filled out, titled "additional actions before access restriction."‎ This may be blocking of sites in coordination with the Prosecutor General's Office, the Presidential Administration, the Deputy Head of Roskomnadzor and with the notification to Roskomnadzor’s press service. If any of these actions is required, a GRFC employee must note it.

So, for example, GRFC employee Maxim Miglanov proposed to coordinate the blocking of the news on the website of the Center for the Protection of Media Rights‎ regarding a lawsuit filed by the director of the Caucasian Nature Reserve against a journalist from the “The Insider” outlet with the deputy head of Roskomnadzor.

Regarding the restriction of access to a poem published on a subdomain of the website of Lithuania’s parliament, beginning with the words, “Do the Russians want war? Don't ask the silence, don't ask those soldiers lied in the memorials...,” Miglanov offered to coordinate not only with the deputy head of Roskomnadzor, but also with the Presidential Administration.

Special tasks: "Colleagues ... you can complain"

In addition to blocking resources or having "forbidden" information removed, another unofficial occupation has fallen to the employees of Roskomnadzor: periodically, they received requests from the management with special tasks.

In the fall of 2020, a special order came from the head of the department for control and supervision of electronic communications of Roskomnadzor, Evgeny Zaitsev. He sent a link to the broadcast of “Vesti. Duty Department” on the “Rossiya” channel, during which nude photos of the daughter of the historian, researcher of Stalinist repressions, and head of the Karelian branch of “Memorial” Yuri Dmitriev, were shown. In 2016, during a search on Dmitriev’s computer, security forces found photographs of his adopted daughter without clothes. Dmitriev took them to document the state of his child’s health for guardianship authorities, Novaya Gazeta reported. The historian was sentenced to three and a half years in a strict regime penal colony, having been found guilty of sexual assault against his daughter. In 2020, the deadline for appeals was tightened to 13 years. Three days before this decision was made, a photo of Dmitriev’s daughter appeared on social networks, and after that it was shown on the air on the Rossiya channel along with the words that “the internet is boiling with indignation,” and users “call the three and a half year sentence for a pedophile who destroyed the life of a child an ‘outrage.’”

“Memorial” considers Dmitriev's case to be unequivocally political, and Nobel laureates, foreign scientists and Russian cultural figures have spoken out in support of the historian.

Zaitsev sent Roskomnadzor staff a link to the Rossiya program with the words that this is an “extremely hot topic” and “in case there are complaints / letters regarding this topic, send them to me immediately and do nothing WITHOUT APPROVAL!” “If they believe that it’s pornographic production, as they say, then this is dissemination, and the TV channel has committed a crime – the same thing that Yury Dmitriev’s is now accused of,” Dmitriev’s lawyer Viktor Anufriev said at the time. However, Roskomnadzor did not find violations of the rights of Dmitriev's adopted daughter in the broadcast of her photographs.

In 2019, Yevgeny Zaitsev supervised the implementation of another “special task,” which consisted of “limiting access to materials with a negative focus on [businessman] Ruben Tatulyan. Negative information about Tatulyan is divided into four topics: U.S. sanctions, family, Czech Republic and the criminal world…” As part of this task, employees had to write and send “reports on Tatulyan” to management on a daily basis. Despite the fact that the “negative” information about the reputable businessman Tatulyan was cleaned from the web for at least two years (2019–2020), you can still find information on the internet about his connections with the criminal world and sponsorship of United Russia [largest political party in Russia which fully supports Putin’s regime]. In one of the letters, the employees refer to a ruling by the Tagansky District Court, which allows them to block materials about Tatulyan. However, on the court’s website there only exists a decision to recognize several parts from one article about Tatulyan as untrue, noting that it discredits his honor and dignity.

Another instruction to delete information came from the deputy head of Roskomnadzor, Vadim Subbotin, in 2019. It concerned news of the death of Roman Lotvin, deputy commander of the Presidential Regiment, which had been published by many pro-government publications, including RIA Novosti and Vechernyaya Moskva. Employees of Roskomnadzor compiled a list of all publications and wrote a "memo on the results of the search for the primary source of the news story." “Mash” media outlet turned out to be the primary source, and only there does the news about the possible suicide of Lotvin still remain. It wasn’t possible to determine from the leak why all the other media publications removed the materials, and why Subbotin gave such an order.

Most likely, in 2020, Vadim Subbotin turned to the staff of the GRFC with another very important task to ensure the “stability of the state” (according to the mission of Roskomnadzor, described in the internal documents of the department, this is what they are doing). “We received an order from the V.A. to massively fill up video sites with complaints. [...] Connect regional specialists, please,” the correspondence from the heads of the GRFC says. The request to “fill up with complaints” began to be circulated to other departments. The managers asked “to organize at least one complaint from each of your employees” and be sure to report how many people complained and how many complaints went away. “Colleagues… you can complain,” one of the participants summed up in the correspondence.

Roskomnadzor employees started spamming with complaints on every platform: YouTube, VKontakte, Odnoklassniki, Yandex.Efir. And the reason for such a commotion was an interview with the singer Nargiz on the program, “Day with a Star,” by Denis Kovalsky. During the interview, the singer, apparently sarcastically chose Hitler when asked to decide between a photo of music producer Maxim Fadeev and Adolf Hitler. Nargiz stopped working with Fadeev and accused his production center of bullying. For that skit with the photo of Hitler, Nargiz brought down the wrath of Vadim Manukyan — an expert for the media commission of the Public Chamber of Russia, and music producer Iosif Prigozhin. Roskomnadzor employees, at the request of their leadership, in turn massively reported the video due to it being "fascist propaganda."

Roskomnadzor, GRFC and Brand Analytics didn’t respond to a request from IStories and Süddeutsche Zeitung for comment on the leaked materials.

You can find out more about this leak in other Important Stories:

How Roskomnadzor monitors negative publications about the Russian president and other topics dangerous to the authorities in order to send reports to the security forces.

How Roskomnadzor plans to conduct total surveillance of the entire Russian-speaking Internet using artificial intelligence.