Unsafe Connections: the Classified Files Archive and the Philosophy Shared by an FSB Surveillance Project Ex-Developer

“Two years earlier, I’d been attending protests, getting beaten up, and being interrogated — and now there I was, working for a company that develops software for the very same system that had subjected me to violence and repression. It’s a bit of a disconnect, but at the time I just didn’t think about it.”

This is how Ivan Kirsanov, a 24-year-old programmer, describes starting his former job at one of the companies within the Citadel holding group, the main manufacturer of the surveillance system for the FSB, Russia's Federal Security Service. Kirsanov has since quit and now works as a shepherd on a farm in France earning four euros an hour.

Ivan left Russia in 2025, taking with him a technical documentation archive related to SORM, a system of interception interfaces used for surveillance in Russia, produced by Citadel. IStories spoke with Ivan and examined the archive.

The traitor

Ivan grew up in the small town of Zelenodolsk, not far from Kazan, Russia. He is the youngest of three children. The Kirsanovs lived modestly: the father worked as a driver, and the mother as a cleaner at a factory.

“I wouldn’t even ask them to buy me anything because I knew it was impossible. For example, I wanted a new computer because I played games and did some programming. Finally it was my sister who bought it for me, not my parents.”

Ivan began learning the fundamentals of programming at the age of 11. He would watch YouTube tutorials on how to write cheat codes for Minecraft, and YouTube was where he came across Alexei Navalny’s videos. Kirsanov began to “delve into the subject and take interest in politics.” In one of Navalny’s livestreams, the late politician had mentioned that Russian schoolchildren weren’t given textbooks at schools, and this, according to Ivan, “hit the nail on the head.” His school had the exact same problem.

Kirsanov then wrote a complaint to the Ministry of Education, which was forwarded to the school. The administration did not appreciate the initiative. “They started telling me that I’d let the whole school down, that I was a traitor, and that the school would face major problems and trouble because of me. My parents were asked to meet with the principal, even though I was doing well in school as I valued my reputation,” Ivan recalls. His relationship with the teachers deteriorated, but they did provide him with textbooks after all.

Kirsanov realized that taking action worked, so he kept doing what he saw as working. A complaint to the housing and utilities department helped restore hot water in his friend’s home, and a complaint about the summer obligatory work program at school helped escape the obligation to shovel out basements. In ninth grade, Kirsanov and a friend attended their first protest in Kazan — the “Voters’ Strike” against Navalny being banned from the 2018 presidential election. Kirsanov’s parents did not support their son’s political activism: they threatened to take away his pocket money and cut off his internet access.

After ninth grade, Ivan was told that his family couldn’t afford his university education. Following his parents’ advice, he enrolled in a college in his hometown to study shipbuilding, a discipline that didn’t interest him at all. In his third year in 2021, Kirsanov attended another Navalny support rally when the politician was arrested upon his return to Russia .

This time, Ivan was detained and fined. The administration of his college threatened to expel him. “You screwed me and the principal over, do you understand? I don’t need students causing problems! We just need to get rid of you,” the academic dean would scold him.

Kirsanov was not expelled from college, but the consequences of the protest did not end with that. The then student began receiving the prosecutor’s warnings on the “unacceptability of participating in unauthorized protests,” and in the fall of 2021, the Center for Combating Extremism officials visited the college. Ivan was called in for a “chat” and asked about his views on Navalny. By that point, Navalny's Anti-Corruption Foundation (FBK) had already been added to the Russian extremist and terrorist organizations list, and some protesters had received actual prison sentences.

“After that interrogation, I finally realized that if I kept doing something like that, they would simply ruin my life… I was very scared. I knew I would have to keep quiet because I wanted to protect myself.”

The way out of poverty

Acting on a friend’s advice, Ivan enrolled in School 21, a Russian franchise of École 42, a French programming school. The curriculum at School 21 differed from typical Russian education. The students are taught for free, and there are no lectures or teachers — they learn the material on their own, submit their projects and grade each other’s work.

“The school changed me. In college, I was surrounded by very strange people who, basically, didn’t really need anything in life. I felt very lonely; there was no one to have interesting discussions with. But at School 21, there were enthusiastic people of different professions and ages. It was as if I had stepped into some different world.”

Ivan devoted all his free time to programming, and six months later he landed an internship at Sber, Russia’s biggest bank. “It was just amazing for me,” the developer recalls. “At 19, I was working as a programmer at one of Russia’s top companies. At the time, I was making about 50,000 rubles ($650 approx. as of 2021) a month. That was more than both my parents would earn combined.” At first, he didn’t even spend his salary: he just saved it and “felt better.”

Three months later, Kirsanov was offered a full-time position. His salary nearly doubled, but it was getting harder and harder to keep up: there were a lot of uncompleted college tasks, and his professors were threatening to not let him take his exams and to expel him.

“My life was falling apart. If I’d been expelled from college, I would have been drafted into the army. If I’d been drafted, I would have lost my spot at ‘School 21’ and my job at Sber, which was my only way out of poverty.”

Ivan felt alone: his parents weren’t supportive of him, and his relationship with his girlfriend fell apart. He was diagnosed with an adjustment disorder and prescribed antidepressants. In June 2022, he finally managed to graduate. His problems with the college were over, but so was his student military service deferment. To hide from the military enlistment office, Ivan moved to Moscow.

A life the way it should be lived

Kirsanov began building a “richer life” in Moscow. He rented an apartment, took up horse riding lessons, bought a motorcycle and rode it across Russia; for the first time in his life, he flew to Sochi on vacation.

“I saw the sea and realized that besides the life I’d been living — constant work, constant studying, a pretty low-income life — there’s another kind of life out there. And that’s the norm; that’s the way it should be lived by everyone.”

His friends from School 21 would find better jobs and start getting bigger paychecks. Ivan had got promoted several times, but he wouldn’t catch up with his friends. In the summer of 2023, he quit a position where he was earning three times his starting salary — which, just a year earlier, had seemed “something out of a fantasy” to him.

Kirsanov found a higher-paying position within three weeks. MFI-Soft, a company based in the Russian city of Nizhny Novgorod, promised shared workspaces equipped with kitchens and breakfasts provided, a company laptop, and the net salary of 200 thousand rubles ($2.200 approx. as of 2023). Neither the job responsibilities nor the company’s line of business were of decisive importance to Ivan at the time. During the interview, he was told that the job was related to the Yarovaya Law Package compliance, the infamous regulation of continuous data storage for the purposes of Russian state security and law enforcement agencies. ‎

“At that moment, I just nodded and said, ‘Wow, that sounds great.’ But I didn’t actually care. I’d never even heard of that company.”

The FSB’s poor quality code

The company unknown to Ivan had been developing technical tools for the SORM surveillance system practically since Kirsanov’s birth. The enterprise had been called MERA back then. In 2003, a division dedicated to developing the SORM solutions was created within the company. That division later became a separate company, MFI-Soft.

In 2016, the Russian telecom industry was taken aback by the Yarovaya Law Package which required Russian internet providers and mobile network operators to store (and share with the FSB) massive amounts of their customers’ traffic: their correspondence, phone calls recordings, and the photo, video, and audio files they share. From the telecom companies it required spendings several times greater than their annual revenue.

Six months earlier, major changes had begun in the SORM systems development market, as those were private companies responsible for the software. Anton Cherepennikov, an entrepreneur, the Virtus.pro esports club owner, and billionaire Alisher Usmanov’s business partner (Usmanov himself is a close associate of Putin) founded the Citadel group and began acquiring firms supplying equipment and software for the SORM system. The 2017 acquisition of Nizhny Novgorod-based MFI-Soft made Citadel the largest player in the SORM market . A year later, the group owned five of the seven companies whose services the Russian Ministry of Communications had recommended to the internet providers and mobile operators to be able to comply with the Yarovaya Law, accounting for up to 80% of the market.

“We certainly stood out from our competitors in the SORM market—at that time, they were mainly former state scientific research institute employees or state security services officers,” Cherepennikov said in 2019.

Ivan Kirsanov had to work on improving a product of one of such companies, Nika-X, which became part of Citadel. In correspondence with his colleagues, he discussed the poor quality code written by “the developers from the FSB”. “They’re well-trained, but they lack real-world experience because they can’t work at normal commercial companies,” a senior colleague explained to Ivan. When the war had begun, the “FSB developers” had resigned. As Ivan assumed, they were “needed by the state in a related field.”

In July 2023, when Ivan was already working at MFI-Soft, all the holding company’s SORM-related subsidiaries were consolidated under the Citadel brand.

From the user to the FSB

In the summer of 2023, Kirsanov joined the MFI-Soft department that handled internet traffic as a senior software engineer. The documents archive he shared with us shows in detail what happens to the internet traffic data on its way from the user to FSB employees.

We examined these documents with the help of Leonid Yuldashev, a cybersecurity expert and project coordinator at eQualitie. What can FSB officers learn about Russians’ online activities using SORM, according to the documents, and how does the system identify services and messaging apps?

The SORM equipment is installed within the operator’s network to intercept the complete copy of all the users’ traffic. This is a massive volume of data. To extract useful information from the raw data, the traffic must be parsed. SORM has a special component for this, called the extractor. This is what Ivan was working with.

The traffic is parsed layer by layer. One of the first stages is accounting, during which SORM links the traffic to a specific subscriber. In a mobile network, this is done via the phone number and the user’s IMSI; for the wired access, it is done via the login used for authentication with the provider. Therefore, all online activity via home Wi-Fi is linked to the person who signed the contract via the subscriber identification.

Next, the extractor monitors the traffic flow and attempts to identify the nature of the connection — whether it was a message app call, a file transfer, an email, or a website access. In the documentation, this process is called “tasting.” The type of connection can be recognized by:

•  signatures, patterns or distinctive features distinguishing one type of traffic from another;
•  server name identification (SNI);
•  indirect statistical characteristics.

Finally, the content of the traffic is analyzed. Here, the system’s capabilities are severely limited. Modern services encrypt traffic, and, according to Kirsanov, the developers at MFI-Soft and Citadel were not tasked with decrypting it. The message text, the conversation audio, and the transferred files remain inaccessible for decryption.

But even encrypted traffic leaves some metadata traces. The metadata can reveal when a person logged on, which websites they visited, how much data they transmitted, how long their messenger call lasted, and when it began and ended. By analyzing metadata, one can discover one's interests, and by comparing the call start and end times of different users, one can determine who is communicating with whom. It is unclear from the documents whether the FSB engages in such traffic analysis.

The FSB officers access SORM through control consoles. This is how they filter out the information they need from all the traffic. A SORM operator can set various parameters for intercepting the traffic: the IP address, the phone number, the email address, or the server domain name. E.g., it is possible to collect all traffic identified by the system as “Telegram,” or to monitor everyone who visits the FBK website, or the “Freedom of Russia” Legion website. ‎

Technically, it is possible to filter traffic by a specific word mentioned. In the training presentation example, the word “blow up” appears among the filtering criteria. However, according to a former SORM developer, full-text search was rarely used — neither in the test environment nor with the real data — as it consumed a lot of resources and slowed down the performance. Moreover, there is very little unencrypted traffic data for the full-text search to process.

The analyzed traffic which did not reach the control panels based on the selection criteria is not lost. Statistics on all connections and the available content of messages are sent to the Yanvar data storage system, where they are stored for six months to three years, depending on the type of data according to the Yarovaya Law. During this entire period, the government security and intelligence agencies can access the stored traffic, but it is unknown whether they do so or to what extent.

Telegram, Signal or Google: How well can SORM see encrypted services data?

To extract the valuable information from traffic more effectively, the developers use decoders: software modules designed for a specific service or app. These decoders do not decrypt the traffic, but they allow the developers to identify the services and collect more detailed metadata.

Such decoders exist for many messaging apps — for example, Telegram or WhatsApp — as well as for traffic anonymization services (Tor or various VPN services) and for certain cryptocurrencies. If no decoder has been written for a particular service, information will still be collected. But in that case, some data may be lost, and the traffic will be marked as unrecognized, Kirsanov explains.

Upon reviewing the decoder documentation, we figured out how well SORM can “see” the data in some popular messaging apps.

• There are decoders for Telegram, WhatsApp, IMO, Zoom, Viber, WeChat, and Discord. SORM detects the mere fact that these services are being used and collects call metadata, but it does not know what you are discussing.

• There is no decoder for Signal. Based on the available documents, it is the most inaccessible service to SORM out of the entire list: it's even questionable if the system can reliably detect its use. Apparently, the system views its traffic as a standard encrypted connection without specifically identifying it as Signal.

• Outdated, unencrypted services such as ICQ, Mail.ru Agent, or Jabber are the most transparent to SORM. The system can even access the message content. According to cybersecurity expert Leonid Yuldashev, activists occasionally come up with the idea to revive such services and use them for secure communication. The documentation we reviewed shows the opposite.

• Search queries and results on Google are invisible to SORM. However, the system knows that a user accessed the google.com domain.

• There are no decoders for Google Meet and Google Drive. All of these services appear as Google traffic, which SORM identified by domain names in secure connections. The conversations, files, and search queries themselves remain inaccessible. The system can likely distinguish a Meet video call from a file upload to Drive, but only based on indirect characteristics: the domain and the type of data flow (a long two-way exchange looks different from a one-way file upload).

• SORM can detect some VPNs being used. There are decoders for the classic OpenVPN protocol — which most such services use — and the outdated PPTP protocol. However, modern protocols like WireGuard or VLESS are not mentioned in the documentation. The services designed to bypass Russian restrictions are currently switching to these very protocols. VLESS disguises itself as regular HTTPS, so to the system it most likely appears as some ordinary encrypted web traffic. It is unclear from the documents how WireGuard is perceived by the system.

The data on Russians’ online activities that SORM is capable of collecting is of little interest, since a significant portion of the traffic is encrypted, Yuldashev concludes. But with messaging apps blocked, users rely on VPNs, and if a VPN doesn’t work and there’s no access to messaging apps, people switch to phone calls and text messages, which are already transparent to SORM, the expert points out.

Many Russian services, including Yandex and VK, also use encryption. The documents reviewed contain no information suggesting that SORM can decrypt or analyze Russian encrypted services in greater detail than foreign ones. This is also confirmed by Kirsanov as a former developer of the system. But this does not mean that communicating via such messaging apps is safe: SORM is far from being the only weapon in the security forces’ arsenal.

The tasks from FSB

The main SORM users are the FSB officers. From them, developers get tasks to make improvements and fix bugs in the system, yet their own security requirements prevent these bugs from being fixed promptly.

Without the full access to detailed error logs, the developers cannot immediately understand the cause of the problem and spend significantly more time resolving it, Kirsanov explained.

The security service was not very quick to adopt the improvements from the developers. “The FSB still has not tested them or put them into operation. They don’t have time,” one of Ivan’s colleagues described the status of the settings that had been submitted for approval a year before.

Not only did the FSB give the developers tasks, but expressions of gratitude as well. In the first half of 2024, Citadel completed the system implementation in the newly-annexed regions of Kherson, Zaporizhzhia, Donetsk, and Luhansk. Those responsible for the project received a letter of appreciation from the FSB, and all Citadel employees were notified of this via corporate email, Kirsanov explained.

Other government agencies do not have direct access to the system. The Ministry of Internal Affairs officers must submit reasoned requests if they want to place someone under wiretap, Andrei Zakharov shares in his book, Russian Cyberpunk.

However, regular Citadel employees do have access to the data. Ivan recalls intercepting the internet traffic of the Tele-2 operator in Nizhny Novgorod to complete one of his tasks. “I could analyze it, or do whatever I wanted with it. Without any special authorization, I could effectively monitor real people. In reality, every developer at the company has been able to do so,” says the former SORM developer.

“We make the world a better place.” What SORM developers think about their work

The authorities state that SORM’s purpose is to help solve crimes, track down criminals, and prevent terrorist attacks. Some developers see this as the end goal of their work as well.

“What do you like about your work?”

“The creative approach. We make the world a better place by using cutting-edge development and testing tools.”

“Have you ever considered that SORM could be used for political persecution, not just to fight crime?”

“There are people who manufacture weapons; they provide the technical means to physically eliminate both enemy forces and civilians. I can’t be held responsible for who pulls the trigger of the gun I made. I make guns. I like it.”

This is how Alexei (the name has been changed) — a current Citadel employee who spoke with IStories on condition of anonymity — describes his work. Another employee’s position might be understood from his messages in public Telegram chats.

“The FSB always acts strictly in accordance with the law. <…> It is technically impossible to incorporate selection criteria into the operational and investigative system without a valid court order number. Therefore, when it comes to organizing illegal surveillance, the FSB’s technical capabilities (and the FSB itself) are absolutely no help at all.😉”

However, in the video depicting the control panel in action, there is no field for a court order number to be seen. Kirsanov has also confirmed that he had never heard of such a requirement.

He, too, quickly came to embrace the same idea of his work’s mission. “At first, I went there for the money, but then I started to capture the overall spirit: we do something useful, we fight crime by writing great software which is used to catch murderers and terrorists,” the developer recalls.

Six months after starting the job, Kirsanov even suggested creating a regular motivational newsletter with the information about crimes solved using SORM to an HR department colleague. She told him that this was classified information and the company didn’t have access to it.

The extent to which SORM is actually useful in criminal investigations is not publicly known. As far back as 2020, researchers from a department of criminology in Perm noted that in all the years SORM had been in operation, there had not been a single official statement regarding its use in solving prominent crimes. Back then, the researchers recommended introducing a formal report system on the efficiency of SORM by law.

After the March 2024 terrorist attack at Crocus City Hall, when terrorists killed 147 people, it became completely clear that SORM was not performing the way it was supposed to, The Bell reported. After the attack — which SORM failed to prevent in any way —the control over the internet surveillance systems shifted from the FSB’s Scientific and Technical Service to its Second Service, which is known for persecuting the opposition and Alexei Navalny's attempted poisoning.

IStories reported more on the way the FSB is attempting to achieve total surveillance over the citizens with the help of newly-introduced big fines.

From Paris to Mariupol

At Citadel, Kirsanov would perform routine and not-so-exciting tasks related to product improvements, working remotely and seeing his colleagues only during conference calls, so he was unable to find friends among them. He decided to seek new experiences outside of his work and the country.

In the first year of the war, the French École 42 ended its partnership with Sber. Students could either transfer to the French branch or remain at the Russian School 21. Ivan chose the French school, was granted a French student visa, and went to Europe by bus in the fall of 2023, a month after starting work on SORM. The upcoming autumn military draft was a significant factor in his decision to leave.

Ivan would switch his IP addresses to Moscow-based ones and develop software for the Russian intelligence right from his apartment nearby Notre Dame, and at night he would walk over to the Eiffel Tower. His first emigrant experience turned out to be far from easy. “I was under constant stress because I was working illegally from abroad; I knew it could be discovered, and I would be fired. I had to take antidepressants and couldn’t sleep properly,” the developer recalls. Neither his family nor his colleagues knew he had left. A month later, he had to return as he was invited to a work conference.

A few months after returning from Paris, Kirsanov set out on a new journey. This time, he headed to Mariupol, a Ukrainian city which had been heavily destroyed and then occupied by Russian troops in 2022. “I wanted to see the war. I could monitor it online, but I wanted to see it with my own eyes, to experience what it’s like to live in a state of war,” he explains, describing his choice of destination.

Kirsanov got scared by the sight of the ruined city and the completely destroyed Azovstal plant , along with the local residents’ accounts of how they collected rainwater for their children to drink and sheltered from the bombing in their homes. He left the occupied territories that very same day, but even after the trip, he would still avoid thinking about the war. “I understood that something terrible was happening, but I didn’t support either side. I tried not to think about it and to keep all those thoughts locked away in some separate box so I wouldn’t have to face them.”‎ ‎ ‎ 

Resignation

In March 2024, Ivan received a letter from the European Court of Human Rights. The ECHR ruled Russia violated the European Convention on Human Rights when Ivan was detained at a January 2021 rally along with the other protesters, and he was granted a EUR 4.000 compensation. However, neither Ivan nor the other applicants received the money because by March 2024 Russia had been outside the jurisdiction of the ECHR for two years.

Nine years earlier, in December 2015, the ECHR had ruled that the SORM usage legislation in Russia was violating the European Convention on Human Rights and the right to respect for private life covered by it. Russian regulations did not provide “adequate and effective guarantees against arbitrariness and the risk of abuse which is inherent in any system of secret surveillance,” the court’s ruling stated.

Ivan didn’t know about the ECHR ruling on SORM; he was 13 at the time. But the ruling regarding his own detention made the developer think. “I remember I wanted to tell my friends about it, but I didn’t know how to approach it. On the one hand, I basically work within this system; on the other, a ruling like this emerges. I never told anyone,” he recalls. ‎

Kirsanov resigned a few months later, but the reason was the same as the one that had originally brought him to the company: he asked for a promotion and was told to wait.

“They want loyal employees. They were counting on people who would work quietly for eight years and never ask for anything, never seek promotions, and just be a cog in the machine,” Kirsanov describes. An example he gives is his former colleague who had been with the company for about 10 years, earning below market the entire time. Leaked data shows that in 2025, this employee was earning just over 130 000 rubles a month ($1.500 approx as of 2025), which is a third less than the salary Kirsanov started with.

Money wasn’t the only reason for his resignation. Kirsanov described he “didn’t grow much as a programmer” during his year at the company. He recalls suggesting implementing new solutions, from AI to optimizing error handling. But the management was not enthusiastic about these ideas. “It was a company with good working conditions and up-to-date processes, but there was no innovation as such,” Ivan describes Citadel.

After being denied a promotion, he began looking for a new job and having online interviews right from the company’s office. Management noticed this fairly quickly. He was given a choice either to quit or to stay agreeing to never seek employment elsewhere and to exclusively work at Citadel. Ivan decided to quit.

“If they had promoted me back then, if they had given me the opportunity to grow professionally, most likely I would keep working there, climbing up the career ladder and doing increasingly worse things. I would sincerely believe I do the right things, just as I believed back then.”

Abduction

After he quit, Ivan recalls, he quickly found a new job and began gradually reconnecting with old acquaintances, following independent media, watching the oppositioners' and military analysts' blogs on YouTube and donating to human rights activists — “getting back to himself after many years,” in his words.

On the first anniversary of the murder of Navalny, Kirsanov went out to a one-person protest. He knew that being detained could lead to problems with the military registration office, as he still didn’t have a military ID {a document proving a Russian citizen’s status regarding the obligatory military service}, but he felt it was important to him not to remain silent, he says.

“By early 2025, the big picture had become absolutely clear, and I realized that something horrible was happening in Russia — a war going on, the growing isolation. I began to understand that I could no longer stay there.”

While preparing to leave, Ivan listed his car up for sale. A meeting with a potential buyer was scheduled for April 24, 2025. Instead of the prospective buyers, two men in plain clothes approached him, showed their police IDs and forced Ivan into their car. Kirsanov figured he was being abducted. He opened the car door and unsuccessfully tried to get people’s attention, then decided to tear up his passport, recalling Belarusian opposition activist Maria Kolesnikova doing the same . But that didn’t stop his captors taking him to the police station in Khoroshevo-Mnevniki .

Ivan recalls throwing himself to the ground outside the police station, screaming for help, and threatening to kill himself. The police officers clearly weren’t expecting such a reaction. They began to mock him, then tried to persuade him to enter the station and call his parents or a lawyer, but called an ambulance after the suicide threat.

The doctors took Kirsanov to a mental hospital, where, after being questioned, he was released due to his friend agreeing to take responsibility for him. Ivan didn’t know why he had been abducted, but he suspected it might be related to his involvement in political activities over the past few months. Two days after the abduction, he flew out of Russia.

The departure and a new life

Kirsanov flew to Serbia and moved to France six months later, as his studies at École 42 enabled him to obtain a French residence permit. This time, he wasn’t facing the threat of getting fired; his savings allowed him to not work, and the threat of persecution vanished. “From the very first days, I began to feel the freedom that everyone should have,” recalls the former surveillance software developer.

Ivan enjoyed long walks, went on short trips within France and became a volunteer with the Get Lost human rights organization. He worked on the hotline, giving instructions on how to obtain a military ID and avoid conscription, providing emotional support and referring people to counselors in the more complex cases.

The life of an unemployed emigrant and his attempts to legalize his status quickly ate up all his savings. Since the fall of 2025, Ivan has been living “a minimalist lifestyle”: he stays in a trailer on a farm and herds goats and picks strawberries there. In his free time — of which he now has plenty — he plays video games, reads books and rides his bike.

Kirsanov plans to enroll in college and enjoy a “peaceful student life” without having to combine it with working. He wants to learn the language and integrate into French society. However, first he needs to resolve his documentation issues. His student residence permit is about to expire, and the French authorities rejected his asylum application: they did not believe he faced a risk of persecution in Russia. Currently, Kirsanov is getting ready to file an appeal.

Meanwhile, the Russian Ministry of Internal Affairs has issued a statement explaining that in 2025 Ivan was “voluntarily” taken to the police station to be interrogated as a witness in a criminal case in accordance with Article 119 of Russia's Criminal Code, Threat of Murder or Infliction of Grave Injury Health. The case is being handled by the St. Petersburg Center for the Security of Persons Subject to State Protection.

Kirsanov suspects that the case may be linked to his messages to a former Federal Penitentiary Service (FSIN) employee, Igor Potapenko, who later became St. Petersburg’s vice governor for security. Ivan had learned that Potapenko had been involved in torturing Ukrainian prisoners of war, so he sent him private messages on VK requesting a comment on the allegations — according to him, he wanted to “generate public pressure.”

“I don’t see any scenarios in which I would definitely return to Russia. Some people have told me I shouldn’t tell my story without hiding my identity. But I’m not the only one; the others remain silent and don’t speak out. Yes, I had no control over how these systems would be used. I created them with good intentions. Nevertheless, I became somewhat complicit in it all. I was also scared and afraid, but I think people need to know the truth.”