Russia expands surveillance data requirements for telecom operators

Russia's Digital Development Ministry has drafted new requirements expanding the user data that telecom operators must store and share with security services via the SORM surveillance system. The order was published on Russia's official legal information portal and reported by business daily Kommersant. The move signals a further tightening of state surveillance infrastructure in Russia.

Russia's Digital Development Ministry has published updated requirements that broaden the scope of user data telecom operators are obligated to collect and hand over to security services. The new rules were posted on Russia's official legal information portal and brought to wider attention by the Russian business newspaper Kommersant.

The expanded requirements operate through SORM — the System for Operative Investigative Activities — a legal framework that compels Russian telecommunications companies to install equipment giving the Federal Security Service (FSB) and other agencies direct access to communications data. SORM has been in place since the 1990s but has been periodically updated to keep pace with new technologies and communication platforms.

Under the newly drafted ministerial order, the range of user data that operators must store and make available to security services has been widened. While the specific categories of newly added data were not fully detailed in the initial publication, such expansions typically include metadata, device identifiers, and location information associated with subscribers.

The development comes as Russian authorities have been steadily tightening their grip on digital communications infrastructure, particularly since the full-scale invasion of Ukraine in 2022. Independent journalists, activists, and opposition figures inside Russia have increasingly faced surveillance-related prosecutions, and expanded SORM obligations give authorities broader tools to monitor online and telephone activity.

For Estonia and other Baltic states, which closely monitor Russian digital policy developments given their proximity and the presence of Russian-speaking communities, such moves are viewed as part of a broader pattern of information control and repression that Moscow has been intensifying in recent years.