A Russian game about the KGB leaking personal data to the FSB?

The developers of the scandalous game Atomic Heart may be transferring user data to the FSB. And not everyone is being warned about it.

Image: Mundfish/Focus Entertainment

Hybrid War Weapon

In February 2023, Atomic Heart, a game created with funding from Russian sub-sanctioned organizations, will be released. According to many game lovers, it is parasitic on the nostalgia for the Soviet Union and popularized the Russian war of aggression against Ukraine. 

The game will be released on February 21. The game’s developer is the studio Mundfish, formally registered in Cyprus. But only a few years ago, it was considered Russian and had an office in Moscow.

Atomic Heart has already been called the propaganda of the Soviet communist system. The action of the post-apocalyptic shooter takes place in the USSR of the future. As conceived by the authors, this country has yet to disintegrate and has mastered many modern technologies. The main character, KGB spy Sergei Nechaev, will fight against rebellious robots.

The soundtrack to the game was recorded by Russian singer Nikolay Baskov, who has distinguished himself for his active support of Russian aggression against Ukraine.

Many gamers have already criticized the idea and implementation of the game. In addition to Ukrainians, anger was expressed by Polish game lovers, who pointed out the inappropriate popularization of the USSR.

Polygon media also notes that culturally Atomic Heart is a profoundly Russian game. Its enthusiastic use of Soviet stylistics and echoes of Russian imperialism is perceived differently in 2023.

There are increasing calls in the gaming community to boycott the game even before its release. But the game’s problems continue after the issue of narratives and Russian-Soviet propaganda.

Image: Mundfish/Focus Entertainment

The studio’s ties to the Russian government

Despite numerous calls from those who sympathize with Ukraine and those who support Russian aggression, the Mundfish team has not commented on the Russian attack for the past 11 months. Eventually, its Twitter post did appear with vague content that did not condemn Russia’s actions at all:

«Guys, we have noted the questions surrounding where we, at Mundfish, stand. We want to assure you that Mundfish is a developer and studio with a global team focused on an innovative game and is undeniably a pro-peace organization against violence against people.»

It is known that the studio plans to release Atomic Heart on the VK Play platform, whose president is Vladimir Kirienko, son of Sergei Kirienko. He is the first deputy head of the Presidential Administration of the Russian Federation and a member of the State Council of the Russian Federation. Kirienko openly supports the war against Ukraine and believes that NATO has attacked Russia.

In addition, Kirienko, who is under US sanctions, is considered the curator of relations between the Russian Federation and the self-proclaimed DPR and LPR republics under Russian control.

According to the AIN portal, the investors of Atomic Heart are Gaijin Entertainment and GEM Capital. According to The Gamer, the former also sponsors Krupnokalibernyi Perepolokh, an anti-Ukrainian channel on YouTube promoting the Russian army.

According to Twitter users, GEM Capital is owned by a former employee of Russian Gazprom, Anatoly Paliy. This company has also been linked to sub-sanctioned banks and organizations.

For example, before GEM Capital, Paliy had First Oil business with Mark Garber, a board member of Rusal (owned by the sub-sanctioned Russian oligarch Oleg Deripaska). In the beginning, First Oil was a “key financial partner in the project” (existed in 2015); afterward, this business went into GEM Capital. In 2019, GEM Capital sold First Oil, and the deal was financed, according to Russian publications, by VTB Bank. This bank, majority-owned by the Russian government, came under EU blocking sanctions in 2022 and was cut off from SWIFT. Paliy confirmed that VTB’s money was raised in GEM Capital.

A new scandal

The popularization of the USSR, the dark origins of project financing, and the studio’s unclear position on the war are not all problems.

In addition to being politicized, Atomic Heart has another disadvantage: customers risk their safety using the product. The shop.mudfish project’s privacy policy mentions that the site collects data that can be transferred to state bodies of the Russian Federation following the latter’s legislation.

Such data is kept: surname, first name, patronymic, registration/sending address, e-mail, phone number, location, and IP address.

The site also lists institutions that can get information about Atomic Heart fans. In addition to the seemingly innocuous Pension Fund and the Tax Service, information about fans of the Russian shooter can be obtained from “other state agencies of the Russian Federation.”

According to the laws of the Russian Federation, they include the FSB, the Interior Ministry, the Ministry of Defense, and other security agencies. Previously, these features of the local legislation have already caused the condemnation of large companies: Facebook, Instagram, and Telegram.

Also, users should pay attention to the list of legislative acts under which the project’s privacy policy is built. Among the quite logical there Civil Code of the Russian Federation, the law “On personal data” also appears in the rules “On military duty and military service” and “On mobilization training and mobilization in the Russian Federation.”

By leaving your data on the game site, each user risks becoming a victim of data collection by the Russian state authorities.

But only some learn about it.

The listed conditions are mentioned only on the Russian-language page of shop.mundfish. There is no other store version yet; it is still under development. But in the English version of mundfish.com the developers promise to use data only for the following purposes and under European law:

  • to provide services to the user;
  • to improve the quality of their website and services and to offer new features to customers;
  • to understand, improve, and research products, features, and services;
  • to comply with the legal requirements established by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of individuals with regard to the processing of personal data and the free movement of such data. And repeals Directive 95/46/EC (General Data Protection Regulation).

Not a word about the laws of the Russian Federation here. Meanwhile, Mundfish is registered in Cyprus, and many users need to learn about its Russian origin.

By keeping silent about a long list of Russian laws, the company jeopardizes the safety of its English-speaking users.

So what’s the problem here?

The situation with the Mundfish game again shows the duplicity of Russian actors who want to please the Russian authorities, which are not ready to condemn war crimes and yet want to continue making money and cooperating with Europe.

They openly promote pro-Russian and pro-Soviet narratives, reinforcing Russian state propaganda, but are afraid of any condemnation. For example, after the media published information about the studio’s privacy policy, the relevant pages disappeared from the Mundfish website.

screenshot: shop.mundfish.com

Paradoxically, Russian developers do not understand (or pretend not to) why they are being criticized. It reminds us of the situation with the Russian “opposition” TV channel Rain, whose team traveled from Russia to the Baltic states and raised funds for the Russian military.

We cannot imagine a game in modern Germany where a Gestapo or Stasi officer would be the protagonist as a positive image. 

Unfortunately, Russian culture, including its digital products, is a weapon in hybrid warfare. Unfortunately, not all Europeans understand this.