Moscow's Department of Information Technology (DIT) has been installing a software module on interactive classroom panels in the city's schools that, on command from a server, switches on the built-in microphone and records what happens in class without any notification. The finding comes from a technical analysis published on GitHub by an employee of a Moscow school. The independent outlet Mediazona says it downloaded the package while it was still available online, examined its contents and confirmed the findings.
Since 2022, computers and interactive panels in Moscow schools have run the Moscow Electronic School operating system, known as MOS. It is a Linux distribution built on ROSA Linux and maintained by DIT specialists.
On the classroom panels, the researcher found a package named mesh-agent-lesson-log, along with a log of network commands showing that it had been pushed to the boards through DIT's remote administration system. The package does not appear in the public MOS software repository. According to the researcher, it was distributed instead as a standalone installation file, including from mostech-cloud.mos.ru, a cloud service the researcher says belongs to DIT.
Two versions of the software exist. The earlier one, built in July 2026 and apparently never installed widely, was titled "Lesson audio-recording agent". The current version, built in October, carries the far more neutral title "Agent supporting lesson delivery" and no longer mentions recording. The researcher found that the earlier build was signed with the official MOS key, which every MOS installation trusts by default, while the newer one carries no signature.
According to the analysis, the current version installs a background process that checks in with a server every 10 minutes, turns on the microphone by itself, records classroom audio, uploads the file to DIT infrastructure and then deletes the local copy. The researcher says the new version also temporarily unmutes the microphone, so recording proceeds even if it has been muted, and drops a desktop alert that the earlier version displayed when recording began.
The earlier version contacted a server at an address belonging to the hosting provider Selectel. The newer one connects securely to school.mos.ru, at an address containing the phrase "speech-analytics", and has an access key embedded in it.
Installation records on three boards in different schools show the package being installed and updated between August and October 2026, with the same sequence of versions and dates on each machine. The researcher says this points to a centralised rollout. During an in-person check of one board, the researcher found folders for recording tasks, the oldest created on October 16; the most recent held an audio file. Because every panel is registered to a specific school, building and room, and the software identifies itself to the server, the researcher concludes that each recording source can be located down to the classroom. Only three boards have been examined, so the full scale of the deployment is unknown.
According to the researcher, neither staff nor pupils were officially told about the recording, although some teachers may have heard rumours. The researcher believes school administrations were informally warned and cites a teacher's message saying a principal had told staff that all the boards were set up to record sound. The researcher also says no regulations require schools to install remote-management or audio-recording software, and has published instructions for removing the packages.
An unnamed source in Moscow's education system told Mediazona that laptops from the Mostech ecosystem can also record audio, and that the system automatically logs who is recorded and when. The source said the recordings were meant to be analysed by artificial intelligence, but that results have been poor and the system will be retrained with human involvement. These claims have not been independently verified. According to Mediazona's reporting, the official purpose of the feature is to check that what is taught in class matches the lesson schedule.
DIT did not respond to Mediazona's request for comment. The download link for the current version stopped working on the evening of November 3. The researcher says the file was removed after media reports, and has published a saved copy with checksums so others can verify it.