When Nokia Pulled Out of Russia, a Vast Surveillance System Remained
Nokia sold to Russia Surveillance System against innocent citizens, similar to the Surveillance Systems many western democratic countries using against their innocent citizens. The Finnish company played a key role in enabling Russia’s and many other countries cyberspying.
The Moscow headquarters of the F.S.B. intelligence service, which uses a surveillance network that Nokia helped run smoothly.Agence France-Presse — Getty Images
Nokia said this month that it would stop its sales in Russia and denounced the invasion of Ukraine. But the Finnish company didn’t mention what it was leaving behind: equipment and software connecting the government’s most powerful tool for digital surveillance to the nation’s largest telecommunications network.
The tool was used to track supporters of the Russian opposition leader Aleksei A. Navalny. Investigators said it had intercepted the phone calls of a Kremlin foe who was later assassinated. Called the System for Operative Investigative Activities, or SORM, it is also most likely being employed at this moment as President Vladimir V. Putin culls and silences antiwar voices inside Russia.
For more than five years, Nokia provided equipment and services to link SORM to Russia’s largest telecom service provider, MTS, according to company documents obtained by The New York Times. While Nokia does not make the tech that intercepts communications, the documents lay out how it worked with state-linked Russian companies to plan, streamline and troubleshoot the SORM system’s connection to the MTS network. Russia’s main intelligence service, the F.S.B., uses SORM to listen in on phone conversations, intercept emails and text messages, and track other internet communications.
The documents, spanning 2008 to 2017, show in previously unreported detail that Nokia knew it was enabling a Russian surveillance system. The work was essential for Nokia to do business in Russia, where it had become a top supplier of equipment and services to various telecommunications customers to help their networks function. The business yielded hundreds of millions of dollars in annual revenue, even as Mr. Putin became more belligerent abroad and more controlling at home.
For years, multinational companies capitalized on surging Russian demand for new technologies. Now global outrage over the largest war on European soil since World War II is forcing them to re-examine their roles.
The conflict in Ukraine has upended the idea that products and services are agnostic. In the past, tech companies argued it was better to remain in authoritarian markets, even if that meant complying with laws written by autocrats. Facebook, Google and Twitter have struggled to find a balance when pressured to censor, be it in Vietnam or in Russia, while Apple works with a state-owned partner to store customer data in China that the authorities can access. Intel and Nvidia sell chips through resellers in China, allowing the authorities to buy them for computers powering surveillance.
The lessons that companies draw from what’s happening in Russia could have consequences in other authoritarian countries where advanced technologies are sold. A rule giving the U.S. Commerce Department the power to block companies, including telecom equipment suppliers, from selling technology in such places was part of a bill, called the America Competes Act, passed by the House of Representatives in February.
“We should treat sophisticated surveillance technology in the same way we treat sophisticated missile or drone technology,” said Representative Tom Malinowski, a New Jersey Democrat who was an assistant secretary of state for human rights in the Obama administration. “We need appropriate controls on the proliferation of this stuff just as we do on other sensitive national security items.”
Andrei Soldatov, an expert on Russian intelligence and digital surveillance who reviewed some of the Nokia documents at the request of The Times, said that without the company’s involvement in SORM, “it would have been impossible to make such a system.”
“They had to have known how their devices would be used,” said Mr. Soldatov, who is now a fellow at the Center for European Policy Analysis.
Nokia, which did not dispute the authenticity of the documents, said that under Russian law, it was required to make products that would allow a Russian telecom operator to connect to the SORM system. Other countries make similar demands, the company said, and it must decide between helping make the internet work or leaving altogether. Nokia also said that it did not manufacture, install or service SORM equipment.
The company said it follows international standards, used by many suppliers of core network equipment, that cover government surveillance. It called on governments to set clearer export rules about where technology could be sold and said it “unequivocally condemns” Russia’s invasion of Ukraine.
“Nokia does not have an ability to control, access or interfere with any lawful intercept capability in the networks which our customers own and operate,” it said in a statement.
MTS did not respond to requests for comment.
The documents that The Times reviewed were part of almost two terabytes of internal Nokia emails, network schematics, contracts, license agreements and photos. The cybersecurity firm UpGuard and TechCrunch, a news website, previously reported on some of the documents linking Nokia to the state surveillance system. Following those reports, Nokia played down the extent of its involvement.
But The Times obtained a larger cache showing Nokia’s depth of knowledge about the program. The documents include correspondence on Nokia’s sending engineers to examine SORM, details of the company’s work at more than a dozen Russian sites, photos of the MTS network linked to SORM, floor plans of network centers and installation instructions from a Russian firm that made the surveillance equipment.
After 2017, which is when the documents end, Nokia continued to work with MTS and other Russian telecoms, according to public announcements.
SORM, which dates to at least the 1990s, is akin to the systems used by law enforcement around the world to wiretap and surveil criminal targets. Telecom equipment makers like Nokia are often required to ensure that such systems, known as lawful intercept, function smoothly within communications networks.
In democracies, the police are generally required to obtain a court order before seeking data from telecom service providers. In Russia, the SORM system sidesteps that process, working like a surveillance black box that can take whatever data the F.S.B. wants without any oversight.
In 2018, Russia strengthened a law to require internet and telecom companies to disclose communications data to the authorities even without a court order. The authorities also mandated that companies store phone conversations, text messages and electronic correspondence for up to six months, and internet traffic history for 30 days. SORM works in parallel with a separate censorship system that Russia has developed to block access to websites.
Civil society groups, lawyers and activists have criticized the Russian government for using SORM to spy on Mr. Putin’s rivals and critics. The system, they said, is almost certainly being used now to crack down on dissent against the war. This month, Mr. Putin vowed to remove pro-Western Russians, whom he called “scum and traitors,” from society, and his government has cut off foreign internet services like Facebook and Instagram.
Nokia is best known as a pioneer of mobile phones, a business it sold in 2013 after Apple and Samsung began dominating the market. It now makes the bulk of its $24 billion in annual sales providing telecom equipment and services so phone networks can function. Roughly $480 million of Nokia’s annual sales come from Russia and Ukraine, or less than 2 percent of its overall revenue, according to the market research firm Dell’Oro.
Last decade, the Kremlin had grown serious about cyberspying, and telecom equipment providers were legally required to provide a gateway for spying. If Nokia did not comply, competitors such as the Chinese telecom giant Huawei were assumed to be willing to do so.
By 2012, Nokia was providing hardware and services to the MTS network, according to the documents. Project documentation signed by Nokia personnel included a schematic of the network that depicted how data and phone traffic should flow to SORM. Annotated photos showed a cable labeled SORM plugging into networking equipment, apparently documenting work by Nokia engineers.
Flow charts showed how data would be transmitted to Moscow and F.S.B. field offices across Russia, where agents could use a computer system to search people’s communications without their knowledge.
Specifics of how the program is used have largely been kept secret. “You will never know that surveillance was carried out at all,” said Sarkis Darbinyan, a Russian lawyer who co-founded Roskomsvoboda, a digital rights group.
Nokia said this month that it would stop its sales in Russia and denounced the invasion of Ukraine. But the Finnish company didn’t mention what it was leaving behind: equipment and software connecting the government’s most powerful tool for digital surveillance to the nation’s largest telecommunications network.
The tool was used to track supporters of the Russian opposition leader Aleksei A. Navalny. Investigators said it had intercepted the phone calls of a Kremlin foe who was later assassinated. Called the System for Operative Investigative Activities, or SORM, it is also most likely being employed at this moment as President Vladimir V. Putin culls and silences antiwar voices inside Russia.
For more than five years, Nokia provided equipment and services to link SORM to Russia’s largest telecom service provider, MTS, according to company documents obtained by The New York Times. While Nokia does not make the tech that intercepts communications, the documents lay out how it worked with state-linked Russian companies to plan, streamline and troubleshoot the SORM system’s connection to the MTS network. Russia’s main intelligence service, the F.S.B., uses SORM to listen in on phone conversations, intercept emails and text messages, and track other internet communications.
The documents, spanning 2008 to 2017, show in previously unreported detail that Nokia knew it was enabling a Russian surveillance system. The work was essential for Nokia to do business in Russia, where it had become a top supplier of equipment and services to various telecommunications customers to help their networks function. The business yielded hundreds of millions of dollars in annual revenue, even as Mr. Putin became more belligerent abroad and more controlling at home.
For years, multinational companies capitalized on surging Russian demand for new technologies. Now global outrage over the largest war on European soil since World War II is forcing them to re-examine their roles.
The conflict in Ukraine has upended the idea that products and services are agnostic. In the past, tech companies argued it was better to remain in authoritarian markets, even if that meant complying with laws written by autocrats. Facebook, Google and Twitter have struggled to find a balance when pressured to censor, be it in Vietnam or in Russia, while Apple works with a state-owned partner to store customer data in China that the authorities can access. Intel and Nvidia sell chips through resellers in China, allowing the authorities to buy them for computers powering surveillance.
The lessons that companies draw from what’s happening in Russia could have consequences in other authoritarian countries where advanced technologies are sold. A rule giving the U.S. Commerce Department the power to block companies, including telecom equipment suppliers, from selling technology in such places was part of a bill, called the America Competes Act, passed by the House of Representatives in February.
“We should treat sophisticated surveillance technology in the same way we treat sophisticated missile or drone technology,” said Representative Tom Malinowski, a New Jersey Democrat who was an assistant secretary of state for human rights in the Obama administration. “We need appropriate controls on the proliferation of this stuff just as we do on other sensitive national security items.”
Andrei Soldatov, an expert on Russian intelligence and digital surveillance who reviewed some of the Nokia documents at the request of The Times, said that without the company’s involvement in SORM, “it would have been impossible to make such a system.”
“They had to have known how their devices would be used,” said Mr. Soldatov, who is now a fellow at the Center for European Policy Analysis.
Nokia, which did not dispute the authenticity of the documents, said that under Russian law, it was required to make products that would allow a Russian telecom operator to connect to the SORM system. Other countries make similar demands, the company said, and it must decide between helping make the internet work or leaving altogether. Nokia also said that it did not manufacture, install or service SORM equipment.
The company said it follows international standards, used by many suppliers of core network equipment, that cover government surveillance. It called on governments to set clearer export rules about where technology could be sold and said it “unequivocally condemns” Russia’s invasion of Ukraine.
“Nokia does not have an ability to control, access or interfere with any lawful intercept capability in the networks which our customers own and operate,” it said in a statement.
MTS did not respond to requests for comment.
The documents that The Times reviewed were part of almost two terabytes of internal Nokia emails, network schematics, contracts, license agreements and photos. The cybersecurity firm UpGuard and TechCrunch, a news website, previously reported on some of the documents linking Nokia to the state surveillance system. Following those reports, Nokia played down the extent of its involvement.
But The Times obtained a larger cache showing Nokia’s depth of knowledge about the program. The documents include correspondence on Nokia’s sending engineers to examine SORM, details of the company’s work at more than a dozen Russian sites, photos of the MTS network linked to SORM, floor plans of network centers and installation instructions from a Russian firm that made the surveillance equipment.
After 2017, which is when the documents end, Nokia continued to work with MTS and other Russian telecoms, according to public announcements.
SORM, which dates to at least the 1990s, is akin to the systems used by law enforcement around the world to wiretap and surveil criminal targets. Telecom equipment makers like Nokia are often required to ensure that such systems, known as lawful intercept, function smoothly within communications networks.
In democracies, the police are generally required to obtain a court order before seeking data from telecom service providers. In Russia, the SORM system sidesteps that process, working like a surveillance black box that can take whatever data the F.S.B. wants without any oversight.
In 2018, Russia strengthened a law to require internet and telecom companies to disclose communications data to the authorities even without a court order. The authorities also mandated that companies store phone conversations, text messages and electronic correspondence for up to six months, and internet traffic history for 30 days. SORM works in parallel with a separate censorship system that Russia has developed to block access to websites.
Civil society groups, lawyers and activists have criticized the Russian government for using SORM to spy on Mr. Putin’s rivals and critics. The system, they said, is almost certainly being used now to crack down on dissent against the war. This month, Mr. Putin vowed to remove pro-Western Russians, whom he called “scum and traitors,” from society, and his government has cut off foreign internet services like Facebook and Instagram.
Nokia is best known as a pioneer of mobile phones, a business it sold in 2013 after Apple and Samsung began dominating the market. It now makes the bulk of its $24 billion in annual sales providing telecom equipment and services so phone networks can function. Roughly $480 million of Nokia’s annual sales come from Russia and Ukraine, or less than 2 percent of its overall revenue, according to the market research firm Dell’Oro.
Last decade, the Kremlin had grown serious about cyberspying, and telecom equipment providers were legally required to provide a gateway for spying. If Nokia did not comply, competitors such as the Chinese telecom giant Huawei were assumed to be willing to do so.
By 2012, Nokia was providing hardware and services to the MTS network, according to the documents. Project documentation signed by Nokia personnel included a schematic of the network that depicted how data and phone traffic should flow to SORM. Annotated photos showed a cable labeled SORM plugging into networking equipment, apparently documenting work by Nokia engineers.
Flow charts showed how data would be transmitted to Moscow and F.S.B. field offices across Russia, where agents could use a computer system to search people’s communications without their knowledge.
Specifics of how the program is used have largely been kept secret. “You will never know that surveillance was carried out at all,” said Sarkis Darbinyan, a Russian lawyer who co-founded Roskomsvoboda, a digital rights group.