At a briefing hosted by the Commission on Security and Cooperation in Europe (U.S. Helsinki Commission), panelists from civil-society and research organizations warned that the Russian "Max" app poses major privacy and human-rights risks by enabling device-level surveillance and by being aggressively promoted and, in some cases, required on new phones.

Anastasia Germont, who led AccessNow's Eastern Europe and Central Asia policy work, said Max "doesn't merely record user messages and metadata." She told the commission the app embeds "deep tracking analytics" that can link personal identifiers across accounts and collect precise geolocation, and that it can tie search history to identity. Germont also described reports that the app can covertly activate microphones or cameras and perform screen recording.

"Max can report your real time movements," Germont said, describing the risks for people attending protests, political gatherings or otherwise mobilizing. She said the app has been preinstalled on devices sold in Russia since Sept. 1 and has been launched in neighboring states including Belarus, Kazakhstan, Kyrgyzstan, Uzbekistan, Tajikistan, Armenia and Azerbaijan.

Laura Cunningham, president of the Open Technology Fund, framed Max not only as a single product but as part of a broader model of Internet control. She said the Kremlin's strategy combines platform substitution, throttling or blocking of alternatives and legal pressure on companies and users, a pattern she compared to a "lock net" that can erode citizens' familiarity with the global Internet.

"The Kremlin really hopes to force their people to choose between convenience and ease of a super app over freedom," Cunningham said, arguing that U.S. policy should focus on preserving access to the global Internet rather than trying to replicate or compete with state-built platforms.

Justin Sherman, founder and CEO of Global Cyber Strategies, placed Max within a longstanding Russian surveillance ecosystem that includes device monitoring, biometrics and censorship. Sherman said Max's combination of consumer-facing features plus legal and commercial pressure to install it could let the project avoid the technical and political failures that impeded earlier efforts.

All three participants urged policy responses. Panelists recommended renewed congressional funding and U.S. support for a diversity of circumvention and privacy tools, public'private collaboration to preserve VPN and other access technologies, and stronger oversight of U.S. executive-branch efforts aimed at supporting Internet freedom.

During audience questions, panelists discussed whether major technology companies have done enough to resist censorship demands and restore access to VPNs and other circumvention tools. Cunningham noted that some U.S.-funded VPNs have been removed from app stores, complicating aid to users in authoritarian contexts. Sherman and Germont urged clearer corporate policies that weigh security updates and user safety against local takedown demands.

Panelists also addressed enforcement: they said they had not identified publicly confirmed arrests or prosecutions solely attributable to Max data, but warned inspections and targeted enforcement in occupied territories create a high risk that the app's data could be used to penalize journalists, opposition figures or other targets. Germont said it may be a matter of time before targeted actions follow once adoption reaches critical levels.

The panelists emphasized regional risks. Germont said Max has been introduced in Moldova and other neighboring markets where users need to stay connected to relatives in occupied territories, increasing the app's export potential and the likelihood other governments may adopt similar models.

The hearing concluded with panelists asking Congress to sustain funding for circumvention tools, to pursue international partnerships that preserve the open Internet and to conduct oversight of relevant executive-branch programs. The commission's director closed the briefing and announced another briefing next week on European and Ukrainian defense supply-chain procurement and innovation.

Note on sources and limits: the panelists based their statements on civil-society reporting and independent assessments; where audience questions referenced arrests or fines, panelists said no confirmed public cases were available in the briefing transcript. Quantitative claims such as "millions of Russians" affected or the precise technical mechanics of the app were described in testimony but not independently documented in the transcript and therefore are reported here as described by speakers.