SORM

Architecture and deployment

Russia uses deep packet inspection (DPI) on a nationwide scale, with part of the DPI infrastructure used for SORM. Some mobile networks use DPI to additionally filter traffic.

The SORM device recommended by the FSB is named Omega. Equipment by Cellebrite appears to be in use. SORM also enables the use of mobile control points, a laptop that can be plugged directly into communication hubs and immediately intercept and record the operator's traffic.

Roskomnadzor, a federal executive body responsible for media control, reported that several local ISPs were fined by the government after they failed to install FSB-recommended SORM devices.

Access by government agencies

On 5 January 2000, during his first week in office, President Vladimir Putin amended the law to allow seven other federal security agencies (next to the FSB) access to data gathered via SORM. The newly endowed agencies included:

• Russia's tax police
• Russian Police
• Federal Protective Service
• Border patrol and customs
• Ministry of Internal Affairs
• Kremlin Regiment
• Presidential Security Service
• Parliamentary security services

Warrant and notification regulations

The acquisition of communications by entitled security services in general requires a court warrant, but at the same time they are allowed to start wiretapping before obtaining such warrant. The warrant is also only required for communications content, but not metadata (communicating parties, time, location etc.), which may be obtained without the warrant.

In cases where an FSB operative is required to get an eavesdropping warrant, he is under no obligation to show it to anyone. Telecom providers have no right to demand that the FSB provide a warrant, and are denied access to the surveillance boxes. The security service calls on the special controller at the FSB headquarters that is connected by a protected cable directly to the SORM device installed on the ISP network.

Since 2010, intelligence officers can wiretap someone's phones or monitor their Internet activity based on received reports that an individual is preparing to commit a crime. They do not have to back up those allegations with formal criminal charges against the suspect. According to a 2011 ruling, intelligence officers have the right to conduct surveillance of anyone who they claim is preparing to call for "extremist activity".

Zakharov v. Russia

In December 2015, The European Court of Human Rights ruled on a case on the legality of Russian SORM legislation. In a unanimous Grand Chamber decision, the Court ruled that Russian legal provisions "do not provide for adequate and effective guarantees against arbitrariness and the risk of abuse which is inherent in any system of secret surveillance". It noted that this risk "is particularly high in a system where the secret services and the police have direct access, by technical means, to all mobile telephone communications". It ruled that therefore, the legislation violated Article 8 of the European Convention on Human Rights. In response, the Duma passed a law that allowed the Constitutional Court of Russia to overrule any international court orders that it found to contradict the Russian Constitution. Russia was suspended from the Council of Europe on 16 March 2022 due to its invasion of Ukraine, and consequently ceased to be a party to the Convention on 16 September 2022.

Yarovaya law

In July 2016, President Vladimir Putin signed into law two sets of legislative amendments commonly referred to as the Yarovaya law, after their key author, Irina Yarovaya, a leading member of the ruling party United Russia. The new regulations took effect on 1 July 2018.

According to the amendments, Internet and telecom companies are required to disclose communications and metadata, as well as "all other information necessary", to authorities, on request and without a court order.