Moscow has introduced a digital tracking system to enforce a coronavirus lockdown — but critics say the technology represents an unprecedented threat to privacy.

The capital is the epicenter of Russia’s coronavirus outbreak, recording 11,513 of the country’s official toll of 18,328 cases of Covid-19. “If previously we had around 500 hospitalizations daily, now we have 1,300,” said Mayor Sergey Sobyanin on Friday. Sobyanin has declared the digital tracking system is a response to Moscow’s rapid spike.

The permit concept is simple in theory. Muscovites and residents of the Moscow region — anybody 14 years old or above — must download a QR code if they want to move around their city. By registering on a government website or downloading an app on their smartphones, citizens can declare a route and purpose in advance; they then receive a QR code that can be checked by the authorities.

The measure will initially only apply to people using public transport, but authorities say restrictions will gradually scale up to passes for short trips around neighborhoods.

Police will scan these codes and fine people without a permit or if they intentionally provided false information. Those who still go to work can get a special unlimited pass, but for personal matters — such as driving to a store or a dacha (a country house) — residents can only get two passes a week, each valid for one day.

Officially, the pass system becomes mandatory on Wednesday, but authorities are already cracking down on unauthorized movement in the city. On Monday, police cordoned off entry points to determine if drivers had a valid reason to be in Moscow, according to state media and witnesses.

The government has already used the coronavirus pandemic as a testing ground for a range of new technologies, particularly the use of artificial intelligence and facial-recognition tools. And using permits to enforce lockdowns is not unique to Russia. While European cities such as Paris have introduced paper-based forms, Moscow’s effort is more similar to China’s use of QR codes for extensive population monitoring.

But opposition activists warn the new system will lead to unprecedented government intrusion.

For example, the permit website prompts all users to register at or link their existing page to a government e-portal, which stores user data on traffic fines, utility bills, foreign passports and so on. Users also need to disclose their points of origin and destination, their employer tax identifier, car plate number and upload their IDs.

Daria Besedina and Maxim Katz, local opposition lawmakers who voted against the system, dubbed it a “cyber Gulag” and “digital concentration camp,” criticizing the authorities for mixed messaging about the coronavirus.

“If on one side you tell people all day long that the situation is under control and only the elderly die, and on the other side you do not provide any economic support, people will not stay home,” Katz wrote on Twitter. “No matter how many passes you introduce.”

City officials initially backed off on implementing the permit plan, saying they were happy with the self-isolation rates. But the system was put back on the table when it became evidence that coronavirus infection rates continued to rise. One reason? Moscow doctors began diagnosing Covid-19 in pneumonia patients based on lung scans, saying that the coronovirus tests were only accurate 70-80% of the time.

Sobyanin also wasn’t pleased to see Muscovites pouring out into the streets and parks during warm spring weather last week, when the lockdown was voluntary. In response, city authorities tightened the rules, instructing residents only to venture outside to go to a nearby store and to walk a dog within 100 meters of their homes — or risk a fine.

It’s clear that local authorities are already crunching data. On April 10, the day that Sobyanin announced the tracking system would go live, the city’s coronavirus response headquarters reported 3.5 million people in the city of more than 12.5 million went outside of their homes for more than six hours. Yandex, Russia’s tech giant, created a map calculating “self-isolation index,” which showed that Moscow residents were more relaxed about breaching the self-isolation rules in the past days than a week before.

“On average, a Moscow family consists of 2-3 people, which means that 3.5 million citizens who do not abide by self-isolation rules pose a potential threat of infection to 6-9 million of their neighbors, friends, relatives and friends,” the Moscow coronavirus center said in a statement.

Sobyanin has said obtaining a pass should not be harder than placing an order online. But in practice, the system has had a rocky start. The registration website went offline several times, text-codes came with hours of delay and call center lines were busy, according to CNN research. The mayor’s office blamed the glitches on multiple DDoS-attacks “orchestrated from abroad.”

Some technical experts have doubted the authorities’ ability to process potentially millions of requests from Muscovites. But once perfected, privacy advocates worry the QR code system could lay the ground for an invasive practice that won’t disappear with the pandemic.

Roskomsovoda, a group that monitors internet freedom in Russia, called the new tool part of “a surveillance race” and rolled out a map of “digital civil rights abuses” to monitor restrictions that may stay in place past the coronavirus era.

The Moscow mayor’s office says it will delete all data after the self-isolation period ends, but experts worry the accumulated database with people’s full profiles and extensive records of their every move could end up in the wrong hands.

“There is a high probability that once the epidemic ends this data will start leaking to the [black] market, which happens to many other data bases,” said Sarkis Darbinyan, Roskomsvoboda’s lawyer. “This is very risky.”