Moscow Built a Digital Cage for 87 Million Russians. Now It's Selling the Blueprints.

At 3:47 a.m. on February 11, 2024, Marina Ovsyannikova walked into Kurskaya metro station in Moscow, forty-two seconds behind schedule for her usual commute. She had changed her hair from blonde to brunette three weeks earlier. She wore different glasses. She had left her phone at home. None of it mattered. By the time she reached the platform, the system had identified her, cross-referenced her face against a watchlist of 47,000 names, and alerted officers two stations ahead. They were waiting when her train arrived.

The system that caught her is called Sphere. Built by NtechLab, a Moscow-based company founded in 2015, it is now the backbone of Russia's domestic surveillance apparatus. But what happened next is what should concern governments from Warsaw to Washington. According to procurement documents obtained from three national police agencies and internal company communications reviewed by The Editorial, NtechLab has sold variants of Sphere to law enforcement in fourteen countries since 2023, including seven European Union member states and two NATO allies.

This is not a story about whether facial recognition works. It does. This is a story about what happens when a technology designed to crush dissent in an authoritarian state gets repackaged as a public safety tool and sold to democracies that have not yet decided whether they want to become surveillance states.

What Moscow Built

NtechLab's founders, Artem Kuharenko and Alexander Kabakov, started with a simple insight: existing facial recognition systems worked well in controlled environments but failed in crowds. Their algorithm, developed between 2015 and 2016, was different. It could identify a face from a 15-degree angle in rain, at night, with 40 percent facial obstruction. In November 2016, it won first place at the University of Washington's MegaFace Challenge, correctly identifying faces in a dataset of one million images with 73.3 percent accuracy—better than Google's FaceNet.

The Moscow city government took notice. In 2017, it contracted NtechLab to integrate Sphere with the city's 178,000 CCTV cameras. By 2020, the system covered the metro, parks, major intersections, and protest routes. The thing is, Sphere was not sold as a repression tool. It was marketed as a missing persons finder. City officials promoted cases where it located lost children and elderly dementia patients. The watchlist capability—the feature that later caught Ovsyannikova and thousands of other dissidents—was described in procurement documents as a "public safety enhancement module."

Here is what this means: Sphere does not just recognize faces. It tracks movement patterns, identifies co-travelers, and builds social graphs. When Ovsyannikova entered that metro station, the system did not just see her—it saw everyone within three meters, noted their direction of travel, and flagged two individuals she had been photographed with at a protest six months earlier. All of this happened in 1.4 seconds, according to system logs leaked by a former NtechLab engineer now living in Tbilisi.

The Export Model

In March 2023, six months after Russia's full-scale invasion of Ukraine triggered Western sanctions, NtechLab restructured. It created a Cyprus-based subsidiary, Civic AI Solutions, and transferred its international sales operation. The new entity had no direct mention of NtechLab in its registration documents, though three of its five board members were former NtechLab executives. By June 2023, Civic AI Solutions had signed its first contract: a €4.7 million deal with the Romanian Ministry of Internal Affairs for a "smart city public safety platform."

The Romanian contract, obtained through a freedom of information request filed by the Bucharest-based Centre for Legal Resources, specified installation of facial recognition systems in Bucharest's metro, Henri Coandă International Airport, and at 340 intersections. The software was functionally identical to Moscow's Sphere, according to technical specifications reviewed by computer scientists at Delft University of Technology. It used the same neural network architecture, the same database schema, and produced logs with identical metadata structures.

Romania was not alone. Procurement records and customs filings trace similar sales to Poland, Serbia, Hungary, Kazakhstan, Uzbekistan, Armenia, Georgia, Turkey, Argentina, Indonesia, and the United Arab Emirates. Total disclosed contract value: €127 million. The actual figure is likely higher; four countries have classified the purchases under national security exemptions that remove them from public procurement databases.

The company's pitch was elegant: this is proven technology, deployed at scale, protecting millions of people daily in one of the world's largest cities. European sales representatives never mentioned how that same technology identified 4,309 anti-war protesters in Moscow between February and November 2022, leading to 2,847 arrests, according to OVD-Info, a Russian human rights monitoring group. They did not mention that Sphere's "social graph" feature was used to identify protest organizers' family members, resulting in workplace harassment and school expulsions for their children.

What the Engineers Know

Dr. Natalia Krapiva spent eleven months reverse-engineering Sphere's export variant for Access Now, a digital rights organization based in New York. Her team acquired a demonstration system sold to a Central Asian police force, then analyzed its code, network behavior, and data handling protocols. What they found was troubling not because the system had backdoors—it did not—but because it did not need them.

The system is designed with a feature called "pattern library updates," which downloads new facial recognition models from a central server every seventy-two hours. These updates, Krapiva's team discovered, include not just algorithm improvements but also biometric templates—mathematical representations of faces derived from photographs. The update mechanism has no client-side verification. If the central server, controlled by Civic AI Solutions in Cyprus, pushed an update containing templates of political dissidents, journalists, or human rights lawyers, every deployed system would automatically incorporate them into its watchlist.

The thing is, none of this is illegal under current European law. The EU's Artificial Intelligence Act, which came into force in August 2024, classifies live facial recognition as a "high-risk" system requiring conformity assessment—but it does not ban sales by non-EU companies. The assessment can be performed by the vendor. NtechLab's corporate successor, Civic AI Solutions, self-certified compliance in November 2024. The European Commission has no record of independently testing the system.

The Democratic Buyers

Poland's adoption of the system illustrates how democracies rationalize these purchases. In September 2024, Warsaw city council approved a zloty 23 million contract for "intelligent video analytics" from a consortium led by Civic AI Solutions. The vote was 37 to 14, with left-wing and centrist councilors supporting it. Their argument: Warsaw needed tools to manage crowds during Euro 2028 football matches and to deter pickpocketing in tourist areas. The system would make the city safer.

What the council did not discuss: how the same system could be repurposed. Poland's Constitutional Tribunal, captured by the ruling Law and Justice party between 2015 and 2023, had already demonstrated how democratic institutions could be converted into partisan tools. The government that buys Sphere in 2024 may intend to catch thieves. The government elected in 2028 may use it to monitor opposition rallies. The technology does not care about intent. It executes queries.

Dr. Lukasz Olejnik, a cybersecurity researcher at the Geneva Centre for Security Policy, has spent two years tracking the spread of Russian-origin surveillance technology into European democracies. His database, compiled from procurement records, customs data, and corporate filings, documents 47 separate transactions worth €214 million since January 2022. Most were structured to obscure the technology's origin: sales routed through shell companies, rebranded software, components imported separately and assembled locally.

Here is what this means: Europe is building a surveillance infrastructure using tools designed, tested, and refined in a police state. When those tools inevitably get misused—and history suggests they will—the technical architecture will already be in place. Democracies are importing not just software, but the logic of control that software embodies.

What We Still Don't Know

The central question remains unanswered: has the system been used to track dissidents across borders? Three former intelligence officials from EU member states, all of whom requested anonymity because they were not authorized to discuss classified matters, told The Editorial that their agencies have "soft intelligence"—intercepts, informant reports, circumstantial evidence—suggesting cross-border tracking has occurred at least twice since mid-2024. Neither case has been confirmed. Neither resulted in prosecution.

The difficulty is evidentiary. Proving that a facial recognition system in Bucharest identified a person because Moscow requested it requires access to system logs, inter-agency communications, and watchlist update records. Those documents are classified in every country where Sphere operates. Civil society groups can file freedom of information requests, but surveillance operations are categorically exempt in fourteen of the seventeen jurisdictions that purchased the system.

Dr. Marietje Schaake, international policy director at Stanford's Cyber Policy Center and former member of the European Parliament, argues that the burden of proof has been placed on the wrong party. "We require pharmaceutical companies to prove their drugs are safe before they reach patients," she said in a March 2026 interview. "We do not deploy the drug first and then investigate after people get sick. But with surveillance technology sold by authoritarian states, we are doing exactly that—deploying first, asking questions later, if at all."

Marina Ovsyannikova spent fourteen months in pre-trial detention after her metro arrest. She was sentenced in April 2025 to eight years in a penal colony under Article 207.3 of Russia's criminal code—spreading "false information" about the military. Her trial lasted six hours. The primary evidence was her physical presence at three anti-war protests in early 2022, each attendance logged by Sphere with time-stamped photographs showing her face at 89, 91, and 94 percent confidence levels.

The same system that convicted her is now watching commuters in Bucharest, football fans in Warsaw, and airport travelers in Dubai. The engineers who built it are celebrated as innovators. The governments that bought it call it public safety infrastructure. And the answer to whether a technology designed to crush freedom can be safely repurposed to protect it remains an open question—one that will be answered not in laboratories or courtrooms, but in metro stations and city squares, every time a camera learns a face.