Starting September 1, all smartphones and tablets sold in Russia will have the national messenger Max preinstalled. Against that backdrop, digital security experts are warning about the risks posed by the new app and explaining what employees can do if their employer demands that it be installed on a personal device.
Cyber lawyer Sarkis Darbinyan says the first step is to try to refuse. In his view, the phone belongs to the employee, as do the rights to privacy and freedom of choice. He notes that labor law does not require a person to perform job duties exclusively through Max.
If someone is fired because they did not receive an assignment through Max, that decision can be challenged in court and would likely be overturned, Darbinyan says.
Lawyer Evgeny Smirnov of the human rights project Pervy Otdel adds that much depends on the employment contract and the employer’s internal rules. If the obligation to use a corporate chat in Max is written into those documents and the employee agreed to it, the employer gains leverage. At the same time, no one can require a person to use the messenger in private life beyond work communication.
Smirnov also argues that the state is trying to make Max universal: the app will be mandatory for preinstallation, and government bodies are expected to respond to appeals only through it. In that situation, he says the safest option is to use two phones: one for personal communication and another for public services and banking.
If refusal is impossible and a confrontation with management is undesirable, experts advise against installing Max on a primary smartphone. Darbinyan recommends getting a separate inexpensive device with no personal data on it, ideally without a SIM card and connected only through Wi‑Fi. If a second device is not affordable, the app can be isolated in a separate container and denied access to the camera, microphone, contacts, and geolocation through the Permissions settings on Android and iOS.
They also recommend disabling automatic updates and, where possible, limiting some of the app’s network activity through tools such as NetGuard or AdGuard. If an employee only needs to show that the app is installed, Darbinyan suggests using an app clone such as Dual Apps or Parallel Space. His main point is that Max should be kept as separate as possible from private life: the less data the service can access, the lower the risks of network-behavior analysis, real-world tracking, and possible administrative or criminal prosecution by the state.