What the FSB knows about us: from SORM to facial recognition cameras
Russian security services have access to more data sources than in most European countries. This is not “omniscience,” but it is a set of tools that is useful to understand without alarmism: SORM, telecom operator billing, city cameras with facial recognition, biometrics in the EBS, and requirements for messengers.
Understanding what is technically available helps assess real risks instead of believing in extremes — neither “they listen to every conversation” nor “an ordinary person has nothing to fear.” The truth is between these two poles and is described in open sources.
Below is a factual breakdown: what sources exist, what they provide in practice, and what is not included in this profile.
In brief
- SORM provides access to call metadata and internet traffic metadata from all telecom operators.
- Telecom operator billing provides cell-tower geolocation — without a separate court request.
- City cameras with facial recognition operate in Moscow and large cities; they are integrated with Ministry of Internal Affairs databases.
- Biometrics in the EBS are voluntary; you can opt out through Gosuslugi (Госуслуги).
- End-to-end encryption in Signal / WhatsApp / Telegram secret chats still protects the content of messages.
What is included in the digital profile
SORM — the system for operational-search measures
All Russian telecom operators and hosting providers are required to install SORM equipment, through which the FSB can gain access to phone calls, SMS, and internet traffic. By default, operators store metadata (who, with whom, when, how much) and part of the content under the “Yarovaya Law.” More details are in our article “SORM in simple terms”.
Billing and geolocation
A mobile operator knows which cell tower your phone was connected to at any moment — this is a basic network function. Cell-tower data can be used to reconstruct a route with accuracy from 100 meters (city) to several kilometers (rural area). This channel is the most “mass-scale” source of geolocation in cases.
Cameras with facial recognition
In Moscow, the city camera network covers most streets, the metro, and a significant share of public spaces. The system is integrated with Ministry of Internal Affairs wanted-person databases. Similar systems have been deployed in large cities (Saint Petersburg, Kazan, Nizhny Novgorod). More details are in a separate analysis.
EBS — Unified Biometric System
A state platform for storing biometric templates (face + voice). It is used in banks for remote account opening and in Gosuslugi. Providing biometrics is voluntary; you can opt out through Gosuslugi at any time. According to reports, after the opt-out option became available in 2024, a significant share of users did so.
Gosuslugi and state databases
Gosuslugi is an integrated access point for data from the Federal Tax Service, the Pension Fund, the Ministry of Internal Affairs, medical databases, and education databases. Most of this data is formally not “with the security services,” but obtaining a certificate or record on request is a standard procedure. See our analysis “State databases of Russia”.
Messages in messengers
Russian law requires “organizers of information dissemination” to store messages and provide decryption keys. Telegram refused to comply with this requirement; WhatsApp and Signal use end-to-end encryption, where the service physically does not have the keys. Telegram cloud chats, regular SMS, and messages in most Russian services formally fall under the requirements.
What is included in the profile and what is not
| Source | What is available | What is NOT available |
|---|---|---|
| Telecom operator SORM | Call metadata, IP sessions, unencrypted traffic | Content of HTTPS sessions, end-to-end messages |
| Mobile operator billing | Cell-tower geolocation, movement history | Exact GPS coordinates (without a separate request) |
| City cameras | Facial recognition, route around the city | Content of conversations and messages |
| EBS (biometrics) | Face and voice templates (if submitted) | Biometrics do not work on those who opted out |
| Telegram (cloud chats) | Metadata, attempts to obtain messages — Telegram refused | Secret chats (end-to-end) are unavailable |
| WhatsApp / Signal | Metadata (Signal — minimal, WhatsApp — more) | Message content (end-to-end) |
| Gosuslugi | All integrated state databases on request | Data from services not connected to the integration |
How to check right now
Wanted Radar is a search through the Ministry of Internal Affairs wanted-person register (source: open data from Mediazona (Медиазона)). This is not a “check for the existence of an FSB case” — closed cases do not appear in open registers. But Wanted Radar can help you understand whether you are in a publicly known wanted-person list.
Also check: in your Gosuslugi account there are “Login history” and “Request history” sections. This shows which agencies requested your data through the integration (not all requests are visible, but some are).
Check a full name in the Ministry of Internal Affairs wanted-person register
What this means in practice
For most people, the actual use of these tools is not “constant surveillance,” but targeted deployment against a specific person involved in a case. Mass collection of metadata is ongoing, but no one will manually “sort through” it without a trigger (a complaint, operational-search measures, contact with a person already under investigation) — the data simply sits there.
This changes the rational set of protective measures: the focus is not on “hiding from SORM” (which is impossible), but on minimizing your digital footprint in case you come to attention for other reasons — a publication, a transfer, a contact.
End-to-end encryption (Signal, WhatsApp, Telegram secret chats) works as of 2026: the content of such messages is technically unavailable, which is confirmed by reports from Freedom House and International Partnership for Human Rights.
What to do next
- Use end-to-end messengers for important messages (Signal has minimal metadata).
- Do not publish your geolocation in real time; disable photo geotags.
- Opt out of biometrics in the EBS if you do not use remote banking services (through Gosuslugi).
- Do not use one password for all services — a password manager solves this.
- Remember: a VPN hides internet traffic from your provider, but not from the service where you are logged in.
- Do not publish photos of documents, tickets, or passes in open access.
- More on individual tools is in our analyses of SORM and facial recognition.
Disclaimer: this material is informational and is not a guide to “bypassing” state technical systems. The goal is a factual analysis of open data about what sources exist. For specific legal situations, contact a lawyer.
Conclusion
The digital profile of a Russian user from the state’s side is made up of sources available on request: SORM, billing, city cameras, the EBS, and state databases. This is a lot, but it is not “omniscience.” End-to-end encryption works, biometrics are voluntary, and mass metadata collection without a trigger does not turn into action. This picture is described in detail in reports by Freedom House Freedom on the Net 2025 (resource blocked in the Russian Federation) and International Partnership for Human Rights.