He helped build the surveillance system the FSB uses to spy on Russians. Then he escaped Russia with an archive of its internal documents. Here’s what he told iStories.

Journalists from iStories talked to Ivan Kirsanov, a 24-year-old programmer who worked at a company owned by the Citadel holding. The holding is the main developer of SORM, the FSB’s surveillance system. In 2025, Kirsanov left Russia and took with him an archive of technical documentation on SORM. He now lives in France on a student visa, works part-time as a shepherd on a farm, and is challenging the denial of his refugee status. Here is what Kirsanov said about himself, his work for the FSB, and the system used to spy on Russians.

What Ivan Kirsanov said about himself

Ivan Kirsanov grew up in Zelenodolsk, a small town near Kazan, in a large family: his father drove for a living, and his mother worked as a cleaner. He started teaching himself to code at 11, using YouTube videos, and it was there that he also came across videos by Alexey Navalny, which, he said, made him start “getting into the subject, taking an interest in politics.” In ninth grade, Kirsanov attended his first rally in Kazan: the “Voters’ Strike,” held after Navalny was barred from the 2018 presidential election.

Kirsanov was detained in 2021 at a rally against the politician’s arrest. He was fined, his college threatened to expel him, and prosecutors sent him written warnings. After officers from Center E spoke with him, he said he “finally understood” that if he kept doing “something like that,” it would “ruin” his life. “I understood that I would have to keep quiet, because I wanted to preserve myself,” the programmer said.

Alongside college, Kirsanov studied at School 21, the Russian franchise of France’s École 42 coding school. The program led to an internship — and soon after, a full-time job — at Sberbank, when he was 19. He finished college in 2022 and moved to Moscow, he said, to steer clear of the draft office. In 2023, he took a new job at MFI Soft, a company based in Nizhny Novgorod; at the interview, he was told the work involved the “Yarovaya package,” but Kirsanov said he “didn’t care.”

What the programmer said about working for Russia’s Federal Security Service

MFI Soft has developed technical equipment for the System for Operative Investigative Activities (SORM), the system Russia’s FSB uses to spy on Russians. The company belongs to Citadel, a holding that has acquired a series of firms supplying SORM equipment and software. Kirsanov joined MFI Soft in the summer of 2023 as a senior software engineer in the department handling internet traffic, where his job included refining code written by “FSB developers.”

Kirsanov said he initially took the FSB-linked job for the money, but later “started picking up on this general spirit: we’re doing something useful, fighting crime, writing great software, and with its help, they catch murderers and terrorists.” How useful SORM actually is for law enforcement work remains publicly unknown.

Kirsanov quit in 2024 after asking for a promotion and being told to wait. During his year working for the FSB, he said, he “barely grew as a programmer,” and management brushed aside his proposals for innovation. “If I had been promoted back then and given the chance to keep developing myself, I probably would have kept working there, climbing higher and higher up the career ladder, doing worse and worse things. I would have sincerely believed I was doing the right thing, just as I believed then,” Kirsanov reflects now.

Soon after quitting, Kirsanov decided to leave Russia. While preparing to emigrate, he said, someone tried to abduct him and take him to a police station. Kirsanov dropped to the ground outside the station, screamed for help, and threatened suicide. He was ultimately taken to a psychiatric hospital instead. After being released on a friend’s guarantee, he left the country, first for Serbia and then for France.

Kirsanov’s studies at École 42 allowed him to obtain a visa, and he lived off his savings for a while. Since the fall of 2025, he has been herding goats and picking strawberries on a farm. French authorities rejected his asylum application, saying they did not believe he faced a threat of persecution in Russia. Kirsanov plans to appeal the decision.

What we learned from the programmer’s account of SORM

Kirsanov gave iStories an archive of documents detailing exactly what happens to internet traffic as it travels from users to FSB officers.

Other journalists have previously reported on SORM’s capabilities, including Andrey Zakharov and Meduza. But as Zakharov says, “at the time we could only judge them by indirect signs.” The documents Kirsanov provided confirm those earlier conclusions — for example, how SORM “sees” Russians’ online activity.

Key takeaways:

• Most of the data on Russians’ online activity that SORM can collect is not especially useful, since a large share of the traffic is encrypted. Phone calls and text messages, however, are fully visible to the system.
• SORM can detect use of several popular messaging apps — Telegram, WhatsApp, IMO, Zoom, Viber, WeChat, and Discord — collecting metadata on calls made through them without revealing who the user is talking to or what they discussed.
• SORM cannot detect the use of Signal.
• Older, unencrypted services such as ICQ, Mail.ru Agent, and Jabber remain fully visible to SORM, and the Max messenger is likely just as transparent to the system, according to Zakharov.
• Users’ search queries on Google, and the search engine’s responses, are invisible to SORM, which can only tell that a user accessed the google.com domain. Google Meet and Google Drive both register to SORM simply as Google. The system can distinguish a Meet call from a Drive file upload only by indirect signs.
• SORM can identify some VPNs that run on the OpenVPN and PPTP protocols.
• Security officials likely cannot quickly decrypt traffic from many Russian services, including Yandex and VK, since they too rely on encryption, though the FSB can obtain data from Russian services through other channels.
• Only the FSB and developers have direct access to SORM. Kirsanov said that for one task, he captured the internet traffic of the operator Tele2 in Nizhny Novgorod. “I could analyze it, do whatever I wanted with it. Without any special clearance, I could effectively observe real people. In fact, every developer at the company could have had that same ability,” he added.

“Kirsanov confirms that a large part of the traffic recorded by SORM is junk. The equipment cannot decrypt data sent over HTTPS, which a large share of modern websites use,” Andrey Zakharov sums up.