The findings come from a nine-week study in which InterSecLab researchers monitored Max on real accounts, analyzed the app's code and intercepted its network traffic before encryption. According to the report, the set of active features can differ from account to account, and VK can change it at any moment without any visible change to the interface.

"Max does not have a single set of functions. VK decides what exactly the app will do in your case, separately for each account," InterSecLab director Marla Rivera said.

The report's central conclusion is that the messenger has no end-to-end encryption, meaning the contents of correspondence are technically accessible to VK. So-called secret chats also do not use end-to-end encryption: messages in them are simply deleted on a timer but remain on the company's servers. The researchers believe the name misleads users, since in Telegram the term denotes a mode with end-to-end encryption.

According to InterSecLab, for individual accounts VK can enable decryption of voice messages on its servers, block message sending when a VPN is detected, expand the collection of data on user activity, and transfer information about a user's identity to third-party services. Separately, the researchers found code for a function that allows obtaining information about all programs installed on a device; at the time of testing it was not active.

Each time Max is launched, according to the study, it transmits data about the user's network environment to VK: the public IP address, information about the mobile operator, whether a VPN is running, and the availability of other internet services. The IP address allows an approximate determination of location. The address book is uploaded to VK's servers in unencrypted form: names are matched with phone numbers, and changes are synchronized. In this way VK obtains the numbers of people who have never registered with Max.

The researchers also found a way to obtain account information by phone number. In response to a request, the service returns the account identifier, the display name, the time the account was created, and then, within 15 minutes, information about when the user was last online. The user receives no notification. No limits on the number of such requests were found during the study.

InterSecLab separately examined the messenger's interaction with VPNs. Max is able to detect that a VPN is running directly on the device and to block message sending until it is turned off. A VPN configured on a router is not detected in this way.

New Max users are offered 25 recommended channels even before their first search query. According to the laboratory, these include RIA Novosti, NTV, Izvestia, Vladimir Solovyov and Deputy Chairman of Russia's Security Council Dmitry Medvedev.

The report's authors stress that the discovery of a technical capability does not mean it is being used against all or any specific users: because the functions can be switched on remotely, the set of them can differ from account to account.

Max was developed by VK and is positioned by the Russian authorities as a national messenger. Amid its rollout, the authorities are restricting foreign messaging services and moving a number of state and educational communications to Max.