Russia Wants to Wiretap Its Own Wiretappers via New SORM Rules

Under a newly drafted regulatory framework slated to take effect in March 2027, the Russian Ministry of Digital Development plans to enforce granular surveillance over technicians managing the state wiretapping architecture known as SORM.

Telecom operators and data providers will be legally required to log every shell command, configuration adjustment, external connection, and software launch performed by system administrators. The days of casually maintaining interception servers without an automated warden scrutinizing every keystroke appear to be ending, as running unapproved external utilities will be strictly prohibited by default.

All collected security events and admin activity logs must be preserved for at least 12 months and dispatched to authorized surveillance consoles over secured HTTPS channels. The draft clarifies that while the FSB won't get a live video feed of the administrator's terminal in real-time, any non-routine intervention will leave a permanent digital trail.

Physical security mandates are equally rigid: wiretap hardware cannot be announced on the public internet, server racks must be physically locked in isolated cabinets, and plugging in peripheral hardware outside approved vendor manifests is banned outright.

Virtual environments face matching constraints, requiring isolated data streams, access control lists for virtual machines, and mandatory automated backups under the updated federal communications law. Public discussion of the draft continues until September 19, 2026, leaving network operators to figure out how to finance the surveillance of their own surveillance teams.

The digital panopticon has achieved peak ouroboros, turning inwards to cannibalize its own trusted workforce in a fever dream of institutional distrust. A security apparatus that feels compelled to audit the shell history of every night-shift server technician is an apparatus quietly terrified of its own shadows.