How Roskomnadzor Protects Putin's Power
Russia’s main censor — Roskomnadzor — secretly monitors publications critical of Russian authorities on the internet. They generate reports that they then send to the security forces. What does it mean for Russian citizens?
Up until now, Roskomnadzor has been known primarily as Russia’s main censor. Since the beginning of Russia's invasion of Ukraine alone, Roskomnadzor has blocked more than 125,000 published materials about the war, in addition to independent media and major social networks like Facebook and Instagram.
But blocking sites the authorities find objectionable isn’t Roskomnadzor’s only responsibility. The Kremlin has assigned the agency another important function: to act as Vladimir Putin's personal digital eye. Inside Roskomnadzor there is a whole state enterprise that employs more than 1,000 people, and every day — sometimes even on weekends and holidays — they look for published online material critical of Putin. Their reports are sent to the Presidential Administration of Russia and the security forces.
This has all come to light as a result of a massive data leak from Roskomnadzor: millions of confidential documents, images and emails from Russian censors have come into the possession of journalists. IStories, together with the German newspaper Süddeutsche Zeitung and other participants in this investigation, have pored through the leak. Here's what we found out:
- Employees of the GRFC — we’ll explain who this is in a moment — look for publications critical of Vladimir Putin and the deterioration of his health. They also make predictions about what events may spur a future increase in criticism;
- To send reports “upstairs” the GRFC uses an internal messaging app which they also use to communicate with employees of Roskomnadzor, the Prosecutor General’s Office, the Ministry of Internal Affairs and the Federal Security Service (FSB);
- Roskomnadzor monitors social tension among Russians: GRFC employees compile and maintain reports on the existence of dissent in federal districts and individual regions.
Putin is a crab
In Moscow's Zamoskvorechye district on Derbenevskaya Embankment, there stands an inconspicuous two-story red brick building. It looks like an old factory floor converted into a trendy loft. There’s a sign in front of the entrance: Federal State Unitary Enterprise "General Radio Frequency Center" (GRFC).
The GRFC website states that its main function is to ensure the proper use of radio frequencies. But, as #RussianCensorFiles show (that’s what the journalists involved in this investigation call the leak), the State entrusted another important task to GRFC staff. Every day, starting at 8:30 am, they monitor the internet in search of publications that the authorities deem dangerous: for example, memes about Putin in the form of a crab, reports about his diseases, or negative comments from local residents after visits by the head of state.
In November 2022, a group of Belarusian hackers known as “Cyberpartisans'' announced that they had hacked into the internal network of the GRFC and downloaded documents, correspondence and mail from employees, as well as surveillance systems for them - in all, more than two terabytes of data. As evidence, they showed screenshots of employee correspondence in messaging apps, via e-mail, and internal documents listing tasks. The Cyberpartisans also claimed to have disrupted the GRFC’s work by encrypting their workstations. The cyber attack was confirmed by the GRFC itself. However, they noted that hackers "did not gain access to either classified information or critical infrastructure." According to the Cyberpartisans, the materials they received prove “large-scale surveillance and control over everyone who has spoken out against the Putin regime over the past 20 years.”
The hacktivists remained inside the GRFC system for many months before they were discovered. No one paid any attention to the hackers as they kept an eye on all the personnel and what they were doing. After the hack was announced, the Cyberpartisans still had access to internal communications. They said that they witnessed panic among management and administrators, as well as ordinary employees, who were afraid that their data would be sold or made public.
Everything that the Cyberpartisans handed over everything they obtained through the hack to journalists of the German newspaper Süddeutsche Zeitung, IStories and other Russian media. The leak has been called the #RussianCensorFiles.
The hackers chose Roskomnadzor for the attack, they said, because the department is “the most important element of the Russian repressive machine.”
“They monitor everyone and everything on the internet, and as soon as they see any violations, they send this information directly to the FSB, the National Guard, the Federal Protective Service (FSO), etc., so that their agents are promptly sent to a region where a potential threat to regime stability is growing. The regime successfully suppresses any alternative movements or even thoughts of disobedience,” the Cyberpartisans explained to journalists from Süddeutsche Zeitung.
The Cyberpartisans have teamed up in 2020 during large-scale protests against the regime of Alexander Lukashenko in Belarus. In an interview with the BBC Russian Service, they said that all of them have extensive experience in the IT sector, but none had been involved in political activism before. “Our friends and family are being killed, tortured and raped. No one will be able to sit on the sidelines,” the hackers published in a statement on the website of the Belarusian Chamber of Commerce and Industry, announcing the start of their team’s work. Since then, they have organized cyber attacks on the Belarusian railway system, received data from the internal security department of the country's Ministry of Internal Affairs, and audio recordings of wiretaps of security forces and officials. Following Russia's full-scale invasion of Ukraine, they declared that they were "ready to assist in the fight against the fascist campaign to invade fraternal Ukraine."
“At this momentous time for our peoples, it’s important to join forces and show that together we are able to fight back against tyrants who want to drown our countries in blood,” they said in a statement the day after the invasion began. After that, the number of hacktivists in the Cyberpartisans doubled — from 30 to 60 people.
“The unscheduled stop by the presidential motorcade in Kaliningrad, and the dialogue between the President of the Russian Federation and local residents caused a negative reaction from the Russian internet community. The authors noted with skepticism that ‘Vladimir Putin, surrounded by security guards, talked for 10 seconds with local residents in Kaliningrad and drove on,’ and called the stop a ‘cheap performance.’ It was suggested that the conversation between the Head of State and the citizens could have been a ‘planned action,’ where the roles of most of the passers-by were played by members of the security services. [...] Other authors sneered at the phrase voiced by V. Putin that ‘industriousness is generally a separate talent, it’s not just, excuse me, a rubber butt.’ It was emphasized that such statements, like the rest of the Head of State’s speeches, ‘haven’t evoked any emotions for a long time, except for second-hand embarrassment.’”
This is a fragment from one of the reports that GRFC staff regularly compile following the results of events involving Putin’s participation.
In addition to quotes from bloggers and local residents, the authors of these analyses, as a rule, cite the number of negative publications during the monitoring period, the top news stories, and the so-called “points of informational tension” in the regions — events that can cause public outcry.
An excerpt from the methodological recommendations for preparing these analyses reads: “It’s only necessary to put the most significant, high-profile agendas into the report [...] It is worth noting that for the report, individual points of informational tension that have formed in a particular region are also important. As a rule, this is a kind of topic unique to the region that caused negative feedback regarding the monitoring topic (for example, forest fires, the influx of refugees into a region, the appointment of a new governor, etc.).”
An example of one of these regional “points of informational tension” can be found in one of last year’s reports on negative attitudes toward Putin: “The authors called the Head of State the ‘executioner of Beslan,’ explaining their position via the fact that, in this tragedy, the authorities put the ‘interests of the state’ above ‘people's lives’ and had ‘sacrificed their own citizens.’ At the same time, it was stated that V. Putin ‘has been ignoring the worst event of his reign for 14 years and doesn’t take part in mourning events dedicated to the victims of the terrorist attack. Attention was focused on the fact that the President of the Russian Federation allegedly never uttered ‘words of ordinary human sympathy’ for the victims of the terrorist attack in the city of Beslan and for the relatives of the dead crew members of the Kursk submarine, ‘who never received help’ from the State.
In addition to looking for negative published material about Putin, GRFC employees forecasted what events might cause an increase in criticism in the future. In August 2022, for instance, they suggested that Putin's participation in the Eastern Economic Forum in Vladivostok or the results of the Single Voting Day in September would lead to increased criticism of him.
The war and Putin’s health
Since February 2022, the war in Ukraine has become the primary topic of GRFC’s reports on negative publications about Putin. “In most cases, the authors wrote that the President of the Russian Federation ‘unleashed a war,’ ‘illegally invading’ the territory of a neighboring country, sent the Russian military to death, provoked the consolidation of Western states against the Russian Federation, and that he is fully responsible for the consequences - economic, political and isolating — because of the decision he made to start the special operation,” GRFC employees reported of the media discourse during the first month of the war.
Russian censors paid attention to publications in a variety of sources — from the websites of large foreign media outlets like CNN, Fox News and the Financial Times, to anonymous Telegram channels such as General SVR [originally: Генерал СВР].
Judging by the GRFC’s internal documents, Putin was criticized most of all last fall in connection with the mobilization, his 70th birthday and the explosion on the Crimean bridge. During that time, GRFC staff found more than 1,000 critical messages about the president per week.
Along with the war, employees of the GRFC monitored reports daily of Putin's "critical state of health."
“Monitoring informational events about the deterioration of the president’s health status” was entrusted as a test task to candidates for positions in the monitoring department of the GRFC.
Russian censors were looking for reports of Putin's illness in the context of "fakes," "along with the ‘special military operation’ [Russian state euphemism using by the authorities instead of ‘war']" — as well as publications about the killing of civilians in Ukraine and losses experienced by the Russian army. The censors quoted messages from Telegram chats such as: "Putin suffers from cancer, dementia and mental illness." “Your Putin already has bipolar and schizophrenia [...] Will a normal Russian support a president with mental illnesses?” “Putin has 100% dementia! The old man has lost his mind,” “Putin has cancer [...], but he will live.” GRFC employees titled their report with examples of negative publications about Putin’s health, “The results of work to counter attempts to destabilize Russian society in the context of the ‘special military operation’ on the territory of Ukraine.”
“Popularity is of great importance to the leader [of a country], that’s also right for Putin. Any regime can be sustainable only if it relies on the support of a significant group of voters,” said political scientist Abbas Gallyamov about why the GRFC monitors negative publications about Putin every day. “You cannot build a stable regime based only on bayonets. If you are hated by your people, then at some point the security forces will simply get rid of you — you will become unnecessary to them. Popularity is not just a way to prevent an uprising, a revolution, it is also a way to avoid falling into dependence on this security forces apparatus. The only thing that makes a politician truly independent of the security forces is when he does not need their services much in order to rule.”
According to Gallyamov, Russian authorities use the reports about the negative publications to make decisions on how to “quell unrest.”
“You see an information threat, and you make a decision how to stop it, how to deal with it. Either by creating an alternative agenda, or by making power moves.”
How Roskomnadzor looks for negativity about Putin
The GRFC monitors publications critical of the President both using the Brand Analytics media and social media monitoring system, as well as manually. Materials about Putin are searched for, as an example, using the following keywords: “bald dwarf,” “puilo” [a pun on Putin’s name and a euphemism for penis], “PutinVor” [translation: PutinIsThief], “Little Zaches,” “chief corrupt official,” “Putler,” “Pynya,” The word "palace" in publications about Putin is also among offensive ones, according to Russian censors.
In addition to negative statements, GRFC employees are also required to look for offensive images. For example, “comparison of the president with negative characters” (Hitler, a terrorist, a thief in law, a vampire, a pedophile or a maniac). In addition, Russian censors have searched for images of Putin depicted as a woman, a “homosexual,” a crab [Vladimir Putin’s nickname which we’ll explain below] or a moth [according to media reports, in Putin had a moth-related nickname when he was young], as well as on his knees in a derogatory position, among human waste products, in a trash can, next to excrement or in pornographic scenes.
On 14 February 2008 Vladimir Putin stated: “I am not ashamed of the citizens who voted for me twice when I was elected president of the Russian Federation. All these eight years I worked as a slave on a galley, and I have done it to the best of my ability.”
The phrase "All these eight years I worked as a slave on a galley." («Все эти восемь лет я пахал как раб на галере») in Russian can be misheard as «как краб на галере». And this is translated as “like a crab on a galley”.
In 2021, reports on “negative, defamatory information in relation to the President of the Russian Federation” were prepared daily. In mid-August, employees of the monitoring department noted that it was impossible to continue work in the same mode due to the blocking of independent media and social networks. Since then, reports of negative publications about Putin have been prepared weekly.
To whom are reports on Putin sent
Employees of the GRFC send weekly and monthly reports about the negative attitude toward Putin to Roskomnadzor and other recipients whom we could not identify. One of them, for example, named his email address after the fictional character Francis Dolarhyde, a maniac who killed entire families: he shot them in their own beds, strangled them or cut their throats.
The GRFC prepares monthly reports for the presidential administration, too. In them, the censors report on how many links they have blocked containing information they deem should be prohibited. In addition, the GRFC reports to the presidential administration on all messages that mention mass events. These reports include publications not just about anti-war actions, but also regional protests. In one of the notes for the presidential administration, for example, GRFC employees described a rally against the “optimization” of hospitals in Shadrinsk, Kurgan Oblast, a picket against the liquidation of the Murmansk Oceanarium, and an action against the construction of chemical plants in Nakhodka.
To send reports “upstairs” at the GRFC, they use an internal messaging app — the “Operational Interaction Room” (OIR), which was launched at the end of 2019. Employees of Roskomnadzor, GRFC, the Prosecutor General's Office, the Ministry of Internal Affairs and the FSB communicate via this messenger.
By August 2021, more than 1,000 people, primarily law enforcement officers, had registered on OIR. Also connected to the system are members of the governments of different regions, employees of the Federal Security Service (FSO) and one representative of the FSB, whose name is classified.
Russian censors sent some reports directly to the security services in private messages. In one of the messages, an employee of the GRFC sent links to "inaccurate" information about the actions of the Russian army in Ukraine to senior prosecutor Timur Abregov.
What else is Roskomnadzor monitoring
Before the start of the full-scale war, the workload on the employees of the GRFC’s monitoring department increased. In one message, they complained that in 2019 they had to generate just eight reports; in 2021, twice as many were required.
In addition to negative publications about Putin, Russian censors began to closely monitor reports of mobilization, losses experienced by the Russian army, and developments in the occupied territories of Ukraine.
- War: mobilization and losses of the Russian army
Employees of the GRFC follow publications about the war in Ukraine every day. Due to the increased workload "regarding the ‘special military operation’," they even temporarily stopped compiling reports on the topic of terrorism. Roskomnadzor instructed the employees of the GRFC to collect reports regarding the "discrediting of the Armed Forces of the Russian Federation" even on weekends and holidays. Management called the search for "materials critical of the ‘special military operation’, creating the prerequisites for panic and disruption of public order" a priority for employees.
Russian censors considered all messages about the murder of the civilian population of Ukraine, the destruction of social infrastructure, the losses of the Russian army, and the refusal of Russian soldiers to participate in the war as such.
The GRFC also monitors anti-war messages from Russians: the day after the start of the full-scale war, censors launched an automated monitoring of publications with "calls for illegal rallies on the situation in Ukraine," according to the leak.
- Agenda in the occupied territories
A separate area of monitoring was the agenda in the territories of Ukraine occupied by Russia. For example, reports say that after the annexation of the Kherson and Zaporizhzhia regions, and the blocking of more than 260 Ukrainian media sites, there are practically no independent media outlets in the occupied territories that write about the war.
The newspaper “Naddnepryanskaya Pravda” in Kherson publishes “materials on the topic of social support” from Russia, the newspaper “Novaya Kakhovka” writes about “integration with the Russian Federation,” the newspaper “Vesti Genicheska” “contains pro-Russian articles expressing the desire to unite with Russia,” “Zaporozhye Vestnik” “informs readers about the benefits of joining the Russian Federation” and warns against “inaccurate information from Ukraine and the USA,” one of the reports said.
By November 2022, 74% of the media in the Zaporizhzhia region and 63% of the media in the Kherson region were labeled as “pro-Russian” by the staff of the GRFC. All other media outlets were either already blocked or were expecting to be blocked. In addition to traditional media, Russian censors monitored messages in city-specific social network groups, and even the social networks of local residents.
- Protests and destabilization of Russian society
The GRFC also monitors "social tension" in the Russian regions. The censors compiled reports on protest sentiments in all federal districts, and in individual regions, for example, in the annexed Crimea and Sevastopol. These reports include not only news events that caused anti-government protest sentiments (for example, one of them talked about how residents of Chelyabinsk complained in comments on social networks about smog in the air and blamed the city authorities for it), but also information about upcoming protests and "measures taken" to quell them.
Employees of the monitoring service have been compiling daily reports “on the destabilization of Russian society” since at least 2020. The OIR system even has a separate “Destabilization Urgent” chat, where employees of the GRFC send monitoring results for the day with links to “the most resonant and / or radical materials.”
Which sections included reports on monitoring the destabilization of Russian society in 2022:
- “Violation of territorial integrity, regionalization”;
- “Criticism of the current Russian government, comparison of living standards [in Russia with the Western countries]”;
- “Coverage of the activities of the non-systemic opposition”;
- “Sanction pressure”;
- “Antimilitarism”;
- “Religious and national conflicts”;
- “Sexual and other ‘freedoms’. Imposing tolerance”;
- “Legalization of soft narcotics”;
- “Foreign policy aggression, interference in the internal affairs of foreign states”;
- “Distortion of the history of the Second World War, pro-Western interpretation of the results and course of the war”;
- “Cross-border influence of neighboring states [on Russia]”;
- “Activities of foreign NGOs”.
- Negativity about officials
Employees of the GRFC follow negative publications about not only Putin but other officials, too. In 2020, they compiled a 42-page memo about online criticism of Alexander Khinshtein, the head of the State Duma Committee on Information Policy. The report’s authors noted that “mental disorders and non-traditional sexual orientation of the parliamentarian became one of the main news items.” Also included in the note were publications about Khinshtein's failed work as an adviser to the head of the National Guard, scandalous legislature he authored, drunken brawls, connections with criminals, and bribing of voters.
Apparently, even the authors of Khinshtein's memo weren’t too enthusiastic about him. “Repeatedly acting as the author of statements that are dubious from the point of view of logic on socio-political topics, A. Khinshtein himself became a participant and one of the initiators of scandals. [...] Periodically, he tries to act as an expert even on issues on which he is most likely absolutely incompetent,” they note. At the beginning of 2020, a similar memo was written up in the department about criticism of the head of the Ministry of Health, Mikhail Murashko, who was recently appointed to the position.
Roskomnadzor blocks information they don’t like regarding officials. Usually this happens at the request of the court or the Prosecutor General's Office. In October 2022, the department was instructed to block websites with the image of a “man outwardly similar to [ex-head of Roscosmos] Dmitry Rogozin,” giving a Nazi salute and holding a poster that read “Whites of all countries, unite.” In addition, the GRFC monitored publications about corruption violations and the plagiarized dissertation of Senator Artem Sheikin — they were required to be removed or the pages were blocked.
It’s clear from the leak that the GRFC monitoring department will continue to track public reaction to the most painful topics for Vladimir Putin moving forward. Back in 2021, they began to prepare for the upcoming 2024 presidential elections in Russia. According to the leak, GRFC will monitor the agenda during the presidential election, and they are going to hire even more people to continue to monitor what Russians think and write.
Roskomnadzor, GRFC and Brand Analytics didn’t respond to a request from IStories and Süddeutsche Zeitung for comment on the leaked materials.
You can find out more about this leak in other Important Stories:
- Who and why is in Roskomnadzor's sights: potential "foreign agents" and opinion leaders, the media, IT giants, messenger apps and people close to power.
- How Roskomnadzor plans to conduct total surveillance of the entire Russian-speaking Internet using artificial intelligence.