Revealed: how Russia uses mobile ‘super-app’ Max to spy on its citizens

Over the past 18 months, tens of millions of Russians have been forced to install a new app on their phones – a violet-blue button designed for messaging and payments, called Max.Authorities have touted it as a patriotic alternative to Telegram and WhatsApp; Russian glitterati have promoted it in rap videos and comic routines. This summer, it became the country’s most-used messaging app.It is a product of VKontakte, the Russian social media company, which is deeply entangled with the Russian state. The Russian president, Vladimir Putin, reportedly owns an indirect stake in Max.Max is Russia’s version of a “super-app,” combining an ecosystem of services into a single platform. It is a container for a number of “mini-apps” that now facilitate everyday life in Russia – banking apps, a messaging service that aims to replace Telegram, and apps for essential government services. The best-known super-app in the world is WeChat, China’s everything platform which facilitates the state’s social controls.But while WeChat was developed over decades, in step with China’s other internet controls, Max has been imposed on a population that once had mostly-free internet access.Max is described as ‘a blueprint any government can follow’ towards digital authoritarianism. Photograph: Contributor/Getty ImagesNow, forensic research has revealed a fuller picture of Max’s powerful surveillance capabilities. These amount to a “backdoor” into its entire mini-app ecosystem on every user’s device, said Roya Ensafi, an associate professor of computer science at the University of Michigan.“We have studied Russia’s escalation of internet control for the past decade,” said Ensafi. “What Max provides is the cleverest and also the scariest tactic by authoritarian governments” to surveil their citizens.Max is “a blueprint any government can follow” towards digital authoritarianism, said Ensafi.It represents the cutting edge of what governments such as Iran, Kazakhstan and India may soon try to achieve.Ensafi’s team were able to download the version of the app used in Russia. They found that Max can screenshot users’ devices – and the contents of its mini-apps – without their knowledge. It can access all the information stored in these mini-apps, their messages and payments. It can impersonate its users without them knowing.It can even inject code into mini-apps – which would mean, said Ensafi, that the Russian government could use Max to launch cyberattacks.Their research adds new clarity into an ongoing debate on Max’s surveillance capabilities. Crucially, said Ensafi, it cannot break into apps like Telegram and WhatsApp, if users have these installed. However, Russia has banned both.Many Russians working in or around state institutions have in effect been forced to use Max. Officials and public-sector employees, university students, teachers and even schoolchildren have all faced pressure to move their communications on to the platform.One schoolteacher in Moscow said staff at their school were ordered to switch to Max after instructions from the city authorities.“The school director called us in last March and told us directly: from now on, everything is on Max. That included chats with parents, sending out homework and other school communication,” the teacher said.“There isn’t really an option to say no, so in the end you just use the app,” they added.The Russian State Duma deputy, Sergey Boyarsky, demonstrating an age verification system using the Max app at a supermarket in February. Photograph: Contributor/Getty ImagesDaniil, a university student in St Petersburg, said he reluctantly downloaded Max shortly before the start of the academic year after being told students would be denied access to university buildings or dormitories without a QR code generated through the app.He said he had concerns about the app’s security and privacy, but felt he had little choice if he wanted to continue accessing campus.Among Russia’s elite, use of Max often appears to be largely performative, with Telegram and Signal still widely used for day-to-day communication, according to several well-connected figures and prominent businesspeople.One person in the Kremlin’s inner circle said he and several friends had bought second phones solely to install Max, while continuing to use their main devices and preferred messaging apps as before.“It’s all for show. No one in politics really uses it,” the person said, speaking on condition of anonymity.Max has yet to replace Telegram as a major source of news for Russians. Public channels – used by media outlets, bloggers and officials to broadcast news and commentary to large audiences – remain far less developed on Max, where only a small number have built audiences comparable to the biggest channels on Telegram.Several Max users contacted by the Guardian said the app closely resembles Telegram, long Russia’s most popular messaging platform, in its design and functionality, but concerns about privacy and surveillance were widespread.“Using Max feels like you never quite know who else might be watching,” said Nikolai, a 34-year-old consultant in Moscow.While the app looked modern and slick, Nikolai said there was always something slightly sinister about using it.“You end up using it more and more because the alternatives are becoming harder to access. But it still doesn’t feel right.”Russia’s success in rapidly pushing out Max should be a “wake-up call”, said Ensafi. China reached its current state of digital authoritarianism over the course of 35 years. But Russia has imposed these sweeping restrictions – shepherding people on to a state-controlled internet – in just a decade.“The world is changing, the infrastructure of private communication is changing – and the assault by authoritarian governments is very aggressive,” she said.Max and VKontakte were approached for comment.