FSB Tightens Control Over Runet Following the Failure of the Yarovaya Law — Investigation
The FSB’s Second Directorate, which is responsible for counterterrorism, effectively took control of the development of Russia’s internet surveillance system following the terrorist attack at Crocus City Hall. This was prompted by the fact that large-scale audits revealed an almost complete failure to implement the “Yarovaya Law,” according to The Bell.
According to the publication, even before the start of the full-scale war against Ukraine, the Operational-Investigative Measures (SORM) system—which was intended to ensure total control over internet traffic and user correspondence—had not been fully implemented by any major telecommunications operator or internet company. A former employee of the FSB’s 12th Center admitted in 2026 that the system had been implemented to about 80%, but experts called this estimate significantly overblown.
The main reason was the enormous costs involved. Even after the requirements of the “Yarovaya Law” were relaxed, operators would have had to spend tens of billions of rubles each year, while the telecommunications market was already stagnating. Many companies preferred to pay nominal fines rather than invest in expensive equipment. As a result, most of them stored only user metadata—IP addresses, connection times, device information, and websites visited—but not the full content of messages or calls, as required by law.
Following a wave of false bomb threats in 2022 and the terrorist attack at Crocus City Hall in March 2024, the FSB conducted large-scale inspections of SORM operations across the country. According to The Bell, the inspections revealed that the system was either only partially operational or completely absent, even among major telecommunications operators in certain regions. Following this, the FSB’s Second Directorate assumed de facto control over the project, while the FSB’s Scientific and Technical Directorate, which had previously been responsible for SORM, lost its leading role.
In 2022–2023, Russian authorities adopted more than ten new laws and regulations that significantly tightened requirements for the surveillance system. Not only telecommunications operators but also hosting providers and owners of autonomous networks were required to install SORM. In addition, rolling fines were introduced, along with the possibility of suspending operators’ licenses and large-scale inspections by Roskomnadzor.
The Bell also notes that even the largest Russian companies systematically failed to comply with the security services’ requirements. Since 2022, Yandex entities have faced more than 20 attempts to hold them accountable for violating SORM requirements, specifically for failing to provide the FSB with round-the-clock access to a number of services and for failing to hand over encryption keys. Similar claims were made against MTS, VimpelCom, Er-Telecom, and other operators.
According to the publication, following the terrorist attack at “Krokus,” Russian authorities used the issue of SORM’s ineffectiveness as one of the justifications for increasing pressure on Telegram. Subsequently, Russia blocked calls on Telegram and WhatsApp, and in 2026, the FSB charged the messenger’s founder, Pavel Durov, with aiding terrorist activities and announced its intention to place him on an international wanted list.
Source: The Bell investigation
As a reminder, Durov has responded for the first time to being labeled a terrorist in Russia.
Earlier, Russia added Pavel Durov to its list of terrorists and extremists.
Prior to this, Telegram founder Pavel Durov was questioned again in Paris as part of an investigation into the platform’s possible involvement in criminal activity.
