Over the past 18 months, tens of millions of Russians have been made to install a new app on their phones: a violet-blue button for messaging and payments called Max. Authorities have promoted it as a patriotic alternative to Telegram and WhatsApp, and Russian celebrities have pushed it in rap videos and comedy sketches. This summer, it became the country’s most-used messaging app.
It is made by VKontakte, the Russian social media company that is closely tied to the Russian state. President Vladimir Putin is reported to own an indirect stake in Max.
Max is Russia’s version of a “super-app,” combining a range of services into one platform. It hosts many “mini-apps” that now support everyday life in Russia—banking apps, a messaging service meant to replace Telegram, and apps for essential government services. The best-known super-app in the world is WeChat, China’s all-in-one platform that helps the state enforce social controls. But while WeChat was developed over decades alongside China’s other internet controls, Max has been forced on a population that once had mostly free internet access.
Now, forensic research has revealed more about Max’s powerful surveillance capabilities. These amount to a “backdoor” into its entire mini-app ecosystem on every user’s device, said Roya Ensafi, an associate professor of computer science at the University of Michigan.
“We have studied Russia’s escalation of internet control for the past decade,” Ensafi said. “What Max provides is the cleverest and also the scariest tactic by authoritarian governments” to surveil their citizens.
Max is “a blueprint any government can follow” toward digital authoritarianism, Ensafi said. It represents the cutting edge of what governments such as Iran, Kazakhstan and India may soon try to achieve.
Ensafi’s team was able to download the version of the app used in Russia. They found that Max can screenshot users’ devices—and the contents of its mini-apps—without their knowledge. It can access all the information stored in these mini-apps, including their messages and payments. It can impersonate its users without them knowing. It can even inject code into mini-apps—which would mean, Ensafi said, that the Russian government could use Max to launch cyberattacks.
Their research adds new clarity to an ongoing debate about Max’s surveillance capabilities. Crucially, Ensafi said, it cannot break into apps like Telegram and WhatsApp if users have them installed. However, Russia has banned both.
Many Russians working in or around state institutions have effectively been forced to use Max. Officials and public-sector employees, university students, teachers and even schoolchildren have all faced pressure to move their communications onto the platform.
One schoolteacher in Moscow said staff at their school were ordered to switch to Max after instructions from the city authorities. “The school director called us in last March and told us directly: from now on, everything is on Max. That included chats with parents, sending out homework and other school communication,” the teacher said. “There isn’t really an option to say no, so in the end you just use the app,” they added.
Daniil, a university student in St Petersburg, said he reluctantly downloaded Max shortly before the start of the academic year after being told students would be denied access to university buildings or dormitories without a QR code generated through the app. He said he had concerns about the app’s security andAmong Russia’s elite, using Max often seems mostly for show. Telegram and Signal are still widely used for everyday communication, according to several well-connected figures and prominent businesspeople. One person in the Kremlin’s inner circle said he and several friends had bought second phones just to install Max, while continuing to use their main devices and preferred messaging apps as before. “It’s all for show. No one in politics really uses it,” the person said, speaking on condition of anonymity.
Max has yet to replace Telegram as a major news source for Russians. Public channels—used by media outlets, bloggers and officials to broadcast news and commentary to large audiences—remain far less developed on Max, where only a small number have built audiences comparable to the biggest channels on Telegram.
Several Max users contacted by the Guardian said the app closely resembles Telegram, long Russia’s most popular messaging platform, in its design and functionality, but concerns about privacy and surveillance were widespread. “Using Max feels like you never quite know who else might be watching,” said Nikolai, a 34-year-old consultant in Moscow. While the app looked modern and slick, Nikolai said there was always something slightly sinister about using it. “You end up using it more and more because the alternatives are becoming harder to access. But it still doesn’t feel right.”
Russia’s success in rapidly pushing out Max should be a “wake-up call”, said Ensafi. China reached its current state of digital authoritarianism over the course of 35 years. But Russia has imposed these sweeping restrictions—shepherding people on to a state-controlled internet—in just a decade. “The world is changing, the infrastructure of private communication is changing—and the assault by authoritarian governments is very aggressive,” she said.
Max and VKontakte were approached for comment.
Get in touch
Contact Aisha Down about this story
If you have something to share about this story, you can contact Aisha using one of the following methods:
Secure Messaging in the Guardian app
The Guardian app has a tool to send tips about stories. Messages are end to end encrypted and concealed within the routine activity that every Guardian mobile app performs. This prevents an observer from knowing that you are communicating with us at all, let alone what is being said. If you don’t already have the Guardian app, download it (iOS/Android) and go to the menu. Select ‘Secure Messaging’.
Email
If you don’t need a high level of security or confidentiality you can email aisha.down@theguardian.com.
SecureDrop
If you can safely use the tor network without being observed or monitored you can send messages and documents to the Guardian via our SecureDrop platform.
For other options, see our guide at theguardian.com/tips.
Frequently Asked Questions
FAQs How Russia Uses the Mobile SuperApp Max to Spy on Its Citizens
What is Max
Max is a Russian mobile superapp a single platform that combines messaging payments government services banking and social features similar to WeChat in China
Who made Max
It was developed by VK a major Russian tech company with close ties to the Kremlin
Why do people call it a spying tool
Because the app can collect huge amounts of user data messages location contacts financial activity and share it with Russian state security services
How is Max different from WhatsApp or Telegram
Unlike those apps Max is built and controlled inside Russia which means the government can legally force its operator to hand over user data and even grant direct access to accounts
Is using Max mandatory in Russia
Not officially for everyone but the government has pushed it hard requiring it on some official devices and pressuring citizens to use it for state services
What data can Max collect about me
Potentially your messages call logs location history contact list photos payment records and even biometric data if you use its ID features
Can the government read my messages on Max
Yes Under Russian law security services can demand access to communications on platforms operated by Russian companies and Max is no exception
Does Max track my location
Yes if you grant location permissions the app can log where you are and that data can be requested by authorities
What is the superapp model and why is it risky for privacy
A superapp bundles many services into one place so it gathers far more data about you than a simple chat app creating a detailed profile of your life
How does Max connect to government services
It links to Russias state portal letting you handle documents benefits and IDs which ties your real identity directly to the app
Can I use Max without giving up my privacy
Not fully You can limit permissions and avoid sensitive features but as long as you use it some data collection is unavoidable
What are the practical alternatives to Max
Encrypted apps like Signal and to a lesser extent Telegram and WhatsApp offer stronger privacy though Telegrams security has its own tradeoffs
