Kremlin Leaks: How Putin’s Regime is Building AI Surveillance Operations

Dangerous “kind of magic”

A woman approaches two cyclists in the park:

– Is your name Kit? – she asks one of them in Russian.
– Yes.
– You are 26 years old and living in Moscow?
– Yeah.
– How do you think I know all that?
– Some kind of magic?

In fact, it has little to do with magic and a lot to do with advanced data science.

The video of this conversation, published seven years ago, is still available on YouTube. The woman was testing a new Russian mobile app for “finding out [about] random people you see on the street,” presented as a revolution in dating.

The app, called FindFace, did indeed turn out to be a revolutionary tool – but its purpose is not to help people find romance on the street

“It would be interesting to create an algorithm that could work efficiently with CCTV cameras. (…) This would make our cities significantly safer” – Artem Kukharenko said in that same video. Kukharenko is a data analyst, co-founder, and, at that time, CEO of NtechLab, the company behind FindFace, a facial recognition technology.

In autumn 2021, the company was already presenting itself as the “leading AI software developer,” providing face and body recognition as well as vehicle detection. At the time, the tool operated in “more than 30 countries” across the globe (including South Asia, Middle East, and Latin America).

Speaking at the G20 Innovation League event in Sorrento in October 2021, Andrei Telenkov, a mathematician and NtechLab’s former CEO, listed the company’s successes, including the patent registered in the US. “We have a proprietary search algorithm which can search 1.5 billion people photos in less than 0.3 seconds” – he added.

Andrei Telenkov at the G20 Innovation League event in Sorrento in October 2021. Source: YouTube screenshot

While Telenkov listed potential uses like “preventing crimes,” “helping the elderly,” and “finding missing children,” he somewhat missed mentioning other “successes” notched by the company’s technology. For example, he neglected to share that the Kremlin-controlled Russian security services used it to arrest people attending demonstrations in support of Alexey Navalny across Russia in 2021.

Millions of euros for AI-powered surveillance

In the “Kremlin Leaks” – the secret documents detailing the Kremlin’s administration budgets and projects, which VSquare and partners have analyzed – we found evidence that the Kremlin has paid millions of euros for these advanced surveillance technologies.

In 2024, the Kremlin has set aside approximately 4.86 billion rubles for this project. For 2024-2026 it is at least 11.2 billion rubles – over €111 million.

This money is intended for the “creation of a platform for aggregation of data received from the service for intelligent processing of video streams, recognition of objects of interest and analytical support of the service.”

A line in one of the leaked budget documents describes the purpose of this project in a more detailed way: “Within the framework of the tasks of the internal policy: to ensure the timely identification of threats, objects that are risk carriers in the field of internal policy, their accounting, study, and analysis, including in the context of recognizing video streams and high-quality photos, as well as checking matrices and individuals for destructive and/or disloyal behavior.” 

Budget documents also indicate that the presidential administration will buy special facial recognition software from NtechLab. The special software license is to be purchased for more than 80 million rubles per year. 

NtechLab’s FindFace technology was used on a large scale during the 2018 Fifa World Cup in Russia – and NtechLab still advertises this as a success story. During the championships, the system was connected to cameras in the stadiums, the fan zone, and cities surrounding the events, monitoring 1.8 million visitors. According to NtechLab’s own information, biometric data was recorded and compared with databases of criminals and other persons of interest. The company claimed that their system can identify an individual in two seconds.

The surveillance system was connected to the cameras in the stadiums. Moscow, June 2018. Photo: Wikimedia Commons / soccer.ru

Following Russia’s full-scale invasion of Ukraine in February 2022, FIFA announced that it was suspending Russia’s participation in the World Cup. But while the Russian team was not present at the World Cup in Qatar in November 2022, the Russian surveillance system was — on an even larger scale and with more cameras.

“FIFA is not responsible for the potential use of specific technologies by public security authorities,” said FIFA security chief Helmut Spahn in a statement sent to us, adding that security issues at the World Cup are the responsibility of the host country’s national authorities.

Traces to Cyprus

Rostec, a Russian state defense group under international sanctions, presents the NtechLab surveillance system as their own. In a company memo they mention that “in 2022, the company implemented projects in 36 countries; the Rostec system was used at the FIFA World Cup in Qatar.” At the same time, the brief also complained that “there is not enough support at the government level to promote the program in friendly countries.”

In April 2019, Rostec already announced that NtechLab’s face recognition would be used for “the needs of the armed forces and special forces.”

The ownership structure behind NtechLab, founded in 2015, is complicated – the company is owned by an entity in Cyprus N-Tech.Lab Ltd, whose ownership is complex. According to registry documents from Cyprus, there are eight shareholders in N-Tech.Lab, including:

• Investco, a Russian company owned by a private person named Alexander Nikolayevich Nazarov. Nazarov, in turn, was the general director of RT Business Development, which is Rostec’s official investment arm, up until December 2022.
• Aton Investment Fund, which is associated with Aton Capital Markets (ACM), an investment company based in the Arab United Emirates. The identities of the true beneficiaries of this fund are unclear.
• ND Blue, a Cyprus entity that is ultimately owned by a fund connected to Russian-Armenian oligarch Ruben Vardanyan. Vardanyan has been previously identified as an investor in NtechLab by numerous media outlets. Following the Russian invasion of Ukraine, Vardanyan was placed on the Ukrainian government’s list of sanctioned people for his role as a board member of Russian air cargo company Volga Dnepr, which plays a major role in the Russian military’s air transport. Currently, however, he is not under Western sanctions.
• Thirty Seventh Investment Company, which is ultimately owned by the Government of the Emirate of Abu Dhabi. The investment arm belonging to the same Abu Dhabi fund, Mubadala, has also invested in NSO Group, the Israeli company behind Pegasus, the infamous spyware used by numerous governments, including authoritarian regimes. Additional investment has been made to NtechLab by a Russian fund, Promising Industrial and Infrastructure Technologies, owned by the Russian state and sanctioned in the US. In 2020, NtechLab announced that the Mubadala fund and a Russian state fund had contributed $15 million to NtechLab as an investment. 
• Ayar International Investments Company, a fund based in Saudi Arabia, also active in numerous other Russian investment projects.
• Perun Overseas Ltd, an offshore company registered in the British Virgin Islands, whose detailed ownership structure is unclear. It owns a minor share in another Russian company together with Rostec.

Certified by the FSB, sanctioned by the West

In September 2022, seven months into Russia’s full-scale invasion of Ukraine, Andrey Nikanorov, project portfolio manager at NtechLab, presented the company at the Digital Aviation & Travel Forum conference in Moscow. While discussing improvements to airport infrastructure and tourism in Russia, he highlighted that the “FindFace software has passed the mandatory certification of the Federal Security Service of Russia in accordance with the Decree № 969 of the Government of the Russian Federation and can be used for operation at transportation facilities.”

The importance of this system to Vladimir Putin’s regime is also clear from a presentation that Rostec Director General Sergey Chemezov made to Vladimir Putin last August. NtechLab was one of the topics of the meeting, according to one of the leaked documents.

Sergey Chemezov (C) with president Vladimir Putin (R) durin MAKS Airshow in July 2021. Photo: Wikimedia Commons / Kremlin.ru, CC BY 4.0

“Today, our system is used in our cities to ensure security. That is, it is quite easy to find either a criminal or a missing person because every camera has this NtechLab facial recognition system,” said Sergey Chemezov, according to the Kremlin’s minutes of the meeting. (Chemezov then continued onto the next point, explaining how they managed to double the production of military helicopters.) 

In March 2023, Reuters published a special report on how facial recognition is helping Putin’s regime curb dissent with the aid of U.S. technology. The report mentions that NtechLab’s technology was used against anti-war protesters. For its investigation, Reuters reviewed more than 2,000 court cases, showing that cameras played an important role in the arrests of hundreds of protesters.

A few months later, in July 2023, the European Union imposed sanctions on NtechLab for “providing technical or material support for serious human rights violations in Russia, including arbitrary arrests or detentions, and violations or abuses of freedom of peaceful assembly and of association.” According to the EU sanctions list, NtechLab has cooperated with the Moscow law enforcement in the development of the facial recognition system in the city. 

“The Main Directorate of Internal Affairs of the City of Moscow employed the facial recognition system in Moscow as a tool of repression. It used it to monitor and arbitrarily detain independent journalists and opposition activists who participated in peaceful protests in support of Alexei Navalny, against corruption of the government of Russia, and in opposition to Russia’s invasion of Ukraine. The facial recognition system was also used by the Main Directorate of Internal Affairs of the City of Moscow to track down and detain draftees seeking to evade mobilization for Russia’s war of aggression against Ukraine,” states the European Council’s document.

Along with the NtechLab, the EU also sanctioned Oleg Baranov, Head of the Main Directorate of Internal Affairs of the City of Moscow, who was – according to the EU – affiliated with NtechLab. Under his command, Russian law enforcement detained opposition supporters and activists using the facial recognition system. 

Due to international sanctions imposed on NtechLab, it remains unclear whether the company can continue its operations within the EU. To date, however, it’s served a range of purposes in Europe. For instance, in June 2022, Delfi Latvia reported that NtechLab’s software was still in use at a popular tourist destination: Livu Akvaparks, an aquapark in Jurmala, Latvia. The facial recognition software was put to use there to quickly provide guests with photos of themselves having fun at the waterpark.  Livu Akvaparks did not respond to our request for comment.

“Experience of cooperation with the Latvian water park Līvu Akvaparks showed that the technology can be used to recognize faces in particularly difficult conditions: splashing water, sun glare, movement, as well as to recognize children’s faces with high accuracy,” NtechLab explained in a statement in 2019. In April 2023, Delfi Latvia reported that a similar technology was still in use.

Facial recognition of Navalny’s mourners

The system has reportedly now also been used to identify people attending Alexei Navalny’s funeral. Russian human rights organization OVD-Info, which records politically motivated arrests, says it has already found 19 cases in which people who attended Alexei Navalny’s funeral were arrested after facial recognition technology was used on them.

Thousands of people came to say goodbye to Alexei Navalny at his funeral ceremony in Moscow, March 1, 2024. Photo: Andrei Bok / Zuma Press / Forum

“A person does not know what information is stored about them in the relevant information databases associated with facial recognition systems, on what basis they may have been included in these databases, and for how long these data are stored, whether they are in principle subject to deletion. This is a fairly serious invasion of a person’s privacy, and information systems can collect quite sensitive data. Some technologies are designed to recognize a person’s emotions, and a person can get on a wanted list just because of their political views. For example, in 2022, at least 141 people were detained in the Moscow metro who were recognized by cameras. These people had not done anything illegal that day, but had previously participated in protest activity,” said Maria Nemova, a lawyer at OVD-info. 

According to the Russian human rights organization, very often law enforcement officials may refer to the secrecy of investigative activities. This means that there may not be any trace at all in the case file to suggest that the person was identified and tracked by facial recognition system. According to Russian law, however, such practices are illegal.

A parallel investigation into NtechLab, conducted by The Bureau of Investigative Journalism (TBIJ) and Follow The Money, and also published today, exposes how NtechLab used an EU-based company to hire gig workers to help train their AI system. As part of their investigation, TBIJ and Paper Trail Media were able to speak to Vladimir Zalishchak, formerly a local politician in Moscow, who has experienced the surveillance system first-hand. In January 2021, a few days after Alexei Navalny returned to Russia after being treated in Germany for his poisoning with Novichok, Zalishchak showed up at a large demonstration — as he claims, in an observer role in his deputy function.

“The entire center of Moscow was filled with protesters. They demanded the release of Navalny and the resignation of Putin,” he recalled. He also described how the demonstration was monitored by minivans equipped with cameras. However, during the demonstration, the police did not intervene,” Zalishchak recalled.

Intervention came a week later on the metro. 

“The cameras identified me. This information went to some center, was processed, and the parameters were set so that a week later, a facial recognition camera in the metro was triggered,” he said.

Zalishchak was arrested by police on the train and taken to a small detention room in the metro station. “I asked why they were holding me. They said,’You are wanted by these cameras, the facial recognition system.’”

He was sentenced to 15 days in prison for taking part in an illegal gathering. The court documents refer precisely to the CCTV footage. After his release from prison, he started wearing a hat and a mask and tried to hide from the cameras. Zalishchak has since escaped Russia and lives in Germany. 

Extract from a Russian court case obtained by OVD-Info showing the use of facial recognition, in this case a camera at the gate of an apartment building.

The system, however, is tightening and getting harder to escape. For example, NtechLab now offers surveillance on the go: a mobile unit with 24 cameras that, according to the company, “can operate for up to 8 hours without being connected to the power supply or data networks. (…) Equipped with wireless access points of extended range, the mobile biometric complex allows you to use monitoring cameras at a distance of up to 1000 meters.”

While there is as yet no evidence to suggest that Russia has been using the same system in the occupied territories in Ukraine, the significant increase in the installment of video cameras in public spaces has been reported to us by Donetsk residents.  

However, as we revealed in earlier installments of the Kremlin Leaks investigation, Russia is making sure to monitor the situation in the occupied territories, including by surveilling social media profiles and channels. The Putin administration also plans to develop an “artificial-intelligence-based system that will detect prohibited content in images with the capacity to analyze at least 200,000 images per day.”

Early founders of NtechLab now distance themselves from the Kremlin. After the Reuters investigation, they gave a statement saying they signed an anti-war petition: “It became clear that the country is moving towards a disaster, although no one could have imagined that the country would start a war,” company founder Artem Kukharenko told Reuters.

Kukharenko, approached by us for comment, provided more details in a LinkedIn message: “We broke all the connections with the company and stopped being shareholders as well. After our anti-war statement, the company forbade its employees from sharing any information or even communicating with us, so we don’t have any details about what is going on.”