Ivan Kirsanov, a 24-year-old programmer, worked at MFI Soft, a company within the Tsitadel holding, the main producer of SORM surveillance systems for the Federal Security Service (FSB). He now lives in France, where he moved in 2025, taking with him an archive of technical documentation on SORM, which he passed on to journalists at the outlet Important Stories (Vazhnye Istorii).
Kirsanov grew up in Zelenodolsk, a town near Kazan. In his youth he was interested in opposition politics, attended protest rallies, and in January 2021 was detained at a rally in support of Alexei Navalny. After a conversation with officers from Center E, the Russian police unit that handles extremism cases, he said he decided to "fall silent" to preserve himself. At 19, he joined Sberbank, and in the summer of 2023 he moved to the Nizhny Novgorod-based company MFI Soft, where he was told the firm's work was tied to the "Yarovaya package" of surveillance laws. The project is overseen by Sergei Korolev, the son of the FSB's first deputy head.
At the company, Kirsanov held the position of senior software engineer in a department that works with internet traffic. He had to refine code written by former FSB officers. According to the programmer, he initially worked for the money, but later "began to pick up on the general spirit: we are doing a useful thing, fighting crime." He quit in 2024 after being denied a promotion.
The archive Kirsanov handed to Important Stories contains company documents from 2021–2024: technical descriptions of the process of delivering internet traffic from a subscriber to FSB officers, training presentations, and the names of developers. Experts asked by the outlet to review the archive confirmed the documents' authenticity.
The documentation shows that SORM receives a copy of users' internet traffic and analyzes it. The system can record the time of going online, the websites visited, connection durations, and data volumes. The content of most modern connections, however, is inaccessible to SORM because of the use of the secure HTTPS protocol. Phone calls and SMS, meanwhile, are fully transparent to the system.
SORM can determine when the messengers Telegram, WhatsApp, IMO, Zoom, Viber, WeChat and Discord are being used and collect call metadata. The content of correspondence in these apps cannot be obtained — the system sees them as encrypted connections. Security services can read messages only on outdated, unencrypted services — ICQ, Mail.ru Agent and Jabber. Signal traffic appears to the system as an ordinary encrypted connection, making it the most "inaccessible" to surveillance. Russian intelligence services can also track visitors to a specific website if those visitors do not have a VPN enabled.