Russian authorities have compelled tens of millions of citizens to install Max, a 'super-app' developed by VKontakte, which researchers say possesses extensive surveillance capabilities. The app can screenshot devices, access messages and payments, impersonate users, and inject code, potentially enabling cyberattacks. This development marks a rapid advancement in digital authoritarianism, with implications for other governments.
The widespread adoption of Max, facilitated by state coercion, demonstrates a new, aggressive model for digital authoritarianism that could be replicated globally, potentially eroding private communication infrastructure and enabling state surveillance on an unprecedented scale.
Tens of millions of Russians have been compelled over the past 18 months to install Max, a messaging and payments 'super-app' developed by VKontakte, a Russian social media company with deep ties to the state. Authorities have promoted it as a patriotic alternative to platforms like Telegram and WhatsApp, and it has become the country's most-used messaging app this summer. Vladimir Putin, the Russian president, reportedly holds an indirect stake in Max.
Forensic research has revealed that Max possesses extensive surveillance capabilities, described by experts as a 'backdoor' into its mini-app ecosystem on users' devices. Roya Ensafi, an associate professor of computer science at the University of Michigan, stated that Max represents a 'cleverest and also the scariest tactic' by authoritarian governments to surveil citizens, offering a 'blueprint any government can follow' towards digital authoritarianism. Her team found that Max can screenshot devices and their mini-app contents without user knowledge, access messages and payments, impersonate users, and inject code into mini-apps, which could enable cyberattacks.
While Max cannot break into apps like Telegram and WhatsApp, Russia has banned both. Many individuals working in or around state institutions, including public-sector employees, university students, teachers, and schoolchildren, have faced pressure to use Max for communications. One schoolteacher reported being ordered to use Max for all school-related communication, stating there was 'isn’t really an option to say no.' University students have also been told they would be denied access to campus facilities without a QR code generated through the app.
However, among Russia's elite, the use of Max is often described as performative, with Telegram and Signal still preferred for daily communication. Some individuals have reportedly bought second phones solely to install Max for compliance purposes. Max has also yet to replace Telegram as a primary news source for many Russians, as its public channels are less developed. Users like Nikolai, a consultant in Moscow, expressed widespread concerns about privacy, stating, 'Using Max feels like you never quite know who else might be watching.' Ensafi highlighted that Russia has imposed these restrictions in a decade, contrasting with China's decades-long development of digital controls, calling it a 'wake-up call' for the world.