Key facts
- Russia has compelled tens of millions of citizens to install the Max app, a messaging and payments platform.
- Max is a 'super-app' developed by VKontakte, a Russian social media company with state ties.
- Researchers found Max can screenshot devices and access information within its mini-apps without user knowledge.
- The app can impersonate users and inject code into mini-apps, potentially enabling cyberattacks.
- Many Russians in state institutions, including students and teachers, have faced pressure to use Max.
- Max's rapid imposition represents a significant advancement in digital authoritarianism, achieved in a decade compared to China's decades-long development of similar controls.
Tens of millions of Russians have been compelled over the past 18 months to install Max, a messaging and payments 'super-app' developed by VKontakte, a Russian social media company with deep ties to the state. Authorities have promoted it as a patriotic alternative to platforms like Telegram and WhatsApp, and it has become the country's most-used messaging app this summer. Vladimir Putin, the Russian president, reportedly holds an indirect stake in Max.
Forensic research has revealed that Max possesses extensive surveillance capabilities, described by experts as a 'backdoor' into its mini-app ecosystem on users' devices. Roya Ensafi, an associate professor of computer science at the University of Michigan, stated that Max represents a 'cleverest and also the scariest tactic' by authoritarian governments to surveil citizens, offering a 'blueprint any government can follow' towards digital authoritarianism. Her team found that Max can screenshot devices and their mini-app contents without user knowledge, access messages and payments, impersonate users, and inject code into mini-apps, which could enable cyberattacks.
While Max cannot break into apps like Telegram and WhatsApp, Russia has banned both. Many individuals working in or around state institutions, including public-sector employees, university students, teachers, and schoolchildren, have faced pressure to use Max for communications. One schoolteacher reported being ordered to use Max for all school-related communication, stating there was 'isn’t really an option to say no.' University students have also been told they would be denied access to campus facilities without a QR code generated through the app.
However, among Russia's elite, the use of Max is often described as performative, with Telegram and Signal still preferred for daily communication. Some individuals have reportedly bought second phones solely to install Max for compliance purposes. Max has also yet to replace Telegram as a primary news source for many Russians, as its public channels are less developed. Users like Nikolai, a consultant in Moscow, expressed widespread concerns about privacy, stating, 'Using Max feels like you never quite know who else might be watching.' Ensafi highlighted that Russia has imposed these restrictions in a decade, contrasting with China's decades-long development of digital controls, calling it a 'wake-up call' for the world.