Panel at U.S. Helsinki Commission: Russia's "Max" super app enables broad surveillance and risks export of a new censorship model

At a briefing hosted by the U.S. Helsinki Commission, panelists warned that Max, a Russian "super app" developed by VK, is being deployed as a tool of state surveillance that could reshape how citizens access information and be exported beyond Russia.

Alana, director with the U.S. Helsinki Commission, opened the session by describing visits to occupied Ukrainian territories where civil-society groups reported repeated device inspections, propaganda campaigns and severe information controls. Anastasia Gimont of AccessNow said Max is "not merely [to] record user messages and metadata" but instead aggregates personal identifiers, usage data and precise location information and "can report your real time movements" if location permissions are granted. She added that Max reportedly can perform more invasive operations, including remotely enabling microphones, cameras or screen recording.

Laura Cunningham, president of the Open Technology Fund, framed Max as part of a broader "lock net" approach to information control. She said the state's strategy pairs a content-rich, convenience-focused platform with legal and technical barriers to alternatives, a combination that can erode users' familiarity with the global internet. "The Kremlin really hopes to force their people to choose between convenience and ease of a super app over freedom," Cunningham said.

Justin Sherman, founder of Global Cyber Strategies, added that VK's Max is now required to be installed on new phones sold in Russia and that the Kremlin is using a mix of regulatory pressure and throttling of alternatives to push adoption. "It is required to be installed on every new phone sold in Russia," he said, describing how local regulation and market pressure combine to nudge users onto the platform.

Panelists said the app is being promoted through multiple levers: whitelisting during internet shutdowns so only a narrow set of state-approved services remain accessible, school and employer pressure to install the app, and the removal or throttling of circumvention tools. Anastasia noted that starting Sept. 1 Max began shipping preinstalled on devices in Russia and that more than 100 VPNs were reported unavailable in the Apple App Store in Russia, limiting users' options.

When asked whether officials had seen confirmed arrests or fines tied directly to Max-based surveillance, panelists said they had not verified mass arrests linked to the app but warned the technical and legal infrastructure exists to target journalists, opposition figures and other individuals selectively. "We didn't receive any reports yet, but I think this is only the matter of time," Anastasia said, describing a sequence in which authorities first build the surveillance infrastructure and later use it selectively against chosen targets.

Panelists also discussed risk of export. Anastasia said Max has launched in neighboring states and named Moldova as an example; the panelists stressed that even if the app itself does not spread, the tactics and legislative frameworks underpinning it could be copied elsewhere. Justin and Laura urged sustained U.S. investment in circumvention tools, privacy-forward encrypted messaging, international collaboration with partners and continued congressional oversight.

Panelists urged private-sector changes as well: clearer, human-rights-informed take-down and app-store policies, more robust corporate rules around responding to government requests for app removals or data access, and technical efforts to make circumvention more affordable for end users. Laura emphasized that OTF-funded circumvention tools have been removed from certain app stores, which can undermine U.S.-funded human-rights work.

The briefing concluded with panelists framing the issue as both a human-rights concern and a strategic U.S. interest: a model that consolidates information control at the device and platform level can weaken civil oversight and create persistent national-security and cybersecurity risks. The Commission announced a follow-up briefing on European and Ukrainian defense supply-chain procurement.