WikiLeaks’ Spy Files Russia Mapped Peter-Service and SORM Before the Kremlin Put Surveillance Inside the Max Messenger
On September 19, 2017, WikiLeaks posted a document set it called Spy Files Russia. The timing was the point as much as the pages. For months, politicians and a large share of the American press had treated WikiLeaks as a mailbox for the Kremlin, because the organization had published Democratic National Committee emails during the 2016 election and had spent years publishing United States secrets. A dump about Moscow’s own machinery for watching Russians was an awkward fit for that story. It did not disprove the hacking findings. It did show a publisher willing to put a Russian surveillance contractor on the same table as the National Security Agency.
The trove is not a thriller. It is about 209 documents, 34 base files in multiple versions, dated from 2007 to 2015, many of them in Russian, and they orbit a St. Petersburg company called Peter-Service. The firm was founded in 1992 to bill mobile subscribers. Billing is a polite word for a database of who called whom, from which handset, through which tower, at which address on the network. WikiLeaks’ summary said Peter-Service could see phone and message records, device identifiers such as IMEI and MAC addresses, IP addresses, and cell-tower data for a large share of Russian mobile subscribers, and that access for state agencies had been built into the architecture rather than bolted on later. The base software, described as SVC_BASE, bundled data retention, long-term storage tied to SORM, a Traffic Data Mart that logged IP traffic for mobile devices, and adapters so agencies could query the pile. A 2013 presentation introduced DPI*GRID, a deep-packet-inspection box the company claimed could inspect traffic at 10 gigabytes a second per unit. The presentation landed months after Edward Snowden’s NSA files. The rhyme was obvious, and Snowden said so at the time.
The documents say “state agencies” more often than they say FSB. That omission is not a comfort. SORM, the System for Operative Investigative Activities, is the legal and technical system through which Russia’s security service and Interior Ministry take communications. Providers install the equipment at their own expense and give the services a port. The 2016 Yarovaya package, sold as an anti-terror law, then forced operators to store the content of calls and messages for up to six months and metadata for years, and it pressed major Russian platforms to hand over encryption keys. A 2019 “sovereign internet” law gave the regulator Roskomnadzor authority to put its own filtering gear, known as TSPU, inside provider networks, so the state could black-hole a service without asking the provider to be creative. IntelliNews, citing The Bell, later reported that from 2016 to 2024 Russian courts granted surveillance permissions nearly seven million times, and that in 2023 more than 500,000 requests were approved and 272 were rejected. A lawyer who handles state-security cases told The Bell the rejections looked like paperwork errors. A St. Petersburg interior-ministry university paper noted the limit that embarrasses the whole design: once a site is on HTTPS, SORM-3 often cannot read it. The vacuum cleaner is enormous. The bag has a hole.
From a Billing Database to an App That Refuses to Send
SORM was already public in outline when WikiLeaks posted. Investigative journalist Andrei Soldatov said the value was technical detail inside a system built to be opaque. The years after the invasion of Ukraine showed what opaque looks like when it stops pretending to be a lawful intercept. Facebook and Instagram were branded extremist and blocked. YouTube was throttled and then effectively shoved off the open Russian internet. Signal was blocked in August 2024. WhatsApp was cut in February 2026. Telegram has faced mass blocking since March 2026. In the space those apps left, the state promoted Max, a messenger built by VK.
Max has been mandatory on smartphones, tablets, computers, and smart TVs sold in Russia since September 1, 2025. It is increasingly the door to government services, including in occupied Ukraine, down to enrolling a child in school. InterSecLab’s technical report, based on Android build 26.12.0 examined between March and May 2026, is the closest thing the Max era has to a Spy Files memo, except the researchers wrote it instead of leaking it. The app has no end-to-end encryption. VK can read message contents. “Secret chats” expire. They are not encrypted against the company. Voice messages can be decrypted on VK’s servers. What the app does to a given account is set on those servers, without an update and without a switch in the interface: network probing, VPN detection, voice transcription, elevated logging, and which outside services receive a user’s identity. When probing is on, opening the app or sending it to the background can report the public IP address, the carrier, whether a VPN is running, and whether a list of services, including the state portal, can be reached. The destination the researchers identified, trace-flow.ru, sat on VK’s network. Try to reply while a device-level VPN is on, and the app can fill the screen with an instruction to turn the VPN off. A VPN on the router can slip past that check. New accounts are handed a list of recommended channels before the user searches for anything. Meduza’s write-up of the same report noted a dormant feature that would inventory the other apps on the phone. The European Union listed the Max operator, under a former company name, in July 2026. VK’s own user counts, which are not independent audits, went from about a million in June 2025 to claims of 100 million by March 2026.
The clampdown did not stop at the big foreign messengers. After Russia’s State Duma elections, TechRadar reported on September 30, 2026, that at least ten VPN services saw sharp new blocking, including providers that had to replace servers in a matter of days and others whose foreign addresses were cut entirely. Meduza was among the outlets describing the wave. Roughly 57 million people in Russia are estimated to rely on circumvention tools. A person inside the country put the practical result in one sentence on September 29: through a VPN, only VK and Max were working. That is the Spy Files business model moved from the telephone company into the icon on the home screen. Peter-Service sold the state a view of the metadata. Max sells the state a place where the metadata and the message are the same product, and where the workaround is treated as a malfunction.
The argument about WikiLeaks itself has to stay in two pieces. U.S. intelligence agencies, special counsel Robert Mueller’s investigation, and the Senate Intelligence Committee concluded that Russian state-linked hackers broke into the DNC and that the stolen material reached WikiLeaks. The theory that murdered staffer Seth Rich was the source was not established. Fox News retracted the story it had aired, and the network later settled a lawsuit by Rich’s family. Publishing Spy Files Russia did not erase that record. It did make the “Kremlin asset and nothing else” line harder to say with a straight face, because the documents describe a Russian system for watching Russians. Julian Assange pleaded guilty in Saipan in June 2024 to a single U.S. charge, left Belmarsh, and went home to Australia. On September 17, 2026, he posted “I’m back” on the account that had been silent since the week of his release. His wife, Stella Assange, said the account was real. The Spy Files page on WikiLeaks is still up, which is more than can be said for a lot of Russian internet that existed in 2017.
Peter-Service’s old slide decks and Max’s new permission screen are the same idea at two prices. One was a contractor’s pitch to wire lawful intercept into the billing system. The other is an app the state can require on a new phone, with the intercept written into the settings the user never sees. The AEGIS Alliance keeps the surrounding record on the hacker news desk and in international news, including the later fight over Pavel Durov, Telegram, and the governments that want a back door of their own.
