Adversary Intelligence — 2026-05-28

Russia Expands Telecom Surveillance Requirements for FSB Data Access Through Updated SORM System

BLUFMoscow's order converts SORM into an FSB-queryable identity dragnet and squeezes small operators out of the market, though whether the compliance inspection moratorium falls by late May 2027 remains genuinely uncertain.

Russia's Digital Development Ministry published an order on May 22 expanding what telecom operators must collect and make searchable through SORM for security service queries, according to Kommersant, which first flagged the document on the official legal portal 12. The expanded categories add passport data, addresses, taxpayer IDs, banking details, IP addresses, domains, usernames, and geolocation coordinates, with the order also specifying GraphQL, WebSocket, and HTTP as required data-exchange interfaces 1234. Igor Bederov, investigations director at T.Hunter, told Kommersant the prior requirements were "far more general in scope" 12. RUVDS CEO Nikita Tsaplin put minimum SORM implementation costs at five million rubles and said small operators cannot absorb them 14; Meduza, citing RBC, reported the Ministry is also discussing lifting the compliance inspection moratorium 23.

Analysis
The order transforms SORM into a full identity-resolution platform, compelling operators to make financial records, geolocation, and biometric identifiers directly searchable by the FSB. Small operators face a structural choice between five-million-ruble compliance costs and market exit, a pressure the Ministry compounds by pursuing an end to the inspection moratorium, which may serve a consolidation agenda as much as surveillance, accelerating regional operator exit to benefit incumbents like Rostelecom. Whether Russia lifts that moratorium by late May 2027 is genuinely uncertain. That forecast carries moderate confidence: the order is verifiable, but the moratorium decision rests on internal deliberations current reporting does not illuminate. Sourcing traces to a single Kommersant cluster, constraining the picture to narrow corroboration. Compliance officers at small and mid-tier telecoms must treat moratorium status as the pivot: a lift demands immediate advancement of upgrade timelines; continued suspension permits deferral.

4 sources