NATO issues and then withdraws Russian taxi app travel advice for defense industry conference

NATO on Thursday issued and then withdrew guidance suggesting attendees of its flagship defense industry conference in Turkey use a Russian-owned taxi app, after concerns were raised that doing so could expose their movements and locations to Russian intelligence.

In an email sent to NATO Edge 26 attendees, the alliance said that parking would be limited at its venue in Izmir, on Turkey’s west coast. It listed Yandex Go as a taxi option for attendees to use instead, despite longstanding concerns about the Kremlin’s access to the app’s data. 

The conference is expected to draw more than 2,000 participants from NATO itself, allied governments, and the defense industry and academia.

“Recommending Yandex to people attending NATO’s biggest industry conference is a serious mistake,” said Erik Kursetgjerde, an attendee and doctoral research fellow studying critical digital infrastructure at the University of Inland Norway.

“Yandex is Russian-owned, and Russian law already gives the FSB round-the-clock access to its taxi data,” said Kursetgjerde, who highlighted the risk with the conference organizers.

A NATO official told Recorded Future News: “In an oversight, the event team responsible for NATO Edge 26 sent an email to conference participants that recommended the use of Yandex Go for local transport. This was corrected within the hour.”

Emails seen by Recorded Future News show the correction being sent just over two hours later.

Separately a NATO official told Kursetgjerde: “Following questions raised on data handling and technology dependencies, we have issued a corrigendum removing [Yandex Go] from the suggested transport options.”

Kursetgjerde credited the organizers for acting quickly. “But it should never have been sent,” he said. “Where NATO staff and defense suppliers stay and how they move is exactly what an adversary wants to know.”

Russian ownership and infrastructure

Yandex Go is operated in Turkey by Yandex Türkiye, a subsidiary of the Russian technology company Yandex — often called Russia’s Google as it runs the country’s largest search engine.

Yandex Türkiye did not immediately respond to questions about where Turkish users’ ride data is stored.

Last month, Ukrainian drones struck three Yandex data centers in Russia disrupting a range of the country’s digital services and also Yandex Go in Turkey. Taxi drivers using the app could not collect their earnings for several days after the strikes, as reported by Euronews.

Concerns that both the domestic and international versions of the app could expose users to Russian government surveillance grew after the full-scale invasion of Ukraine in February 2022.

In December of that year, Russia adopted a law giving the FSB constant access to databases used by taxi-ordering services. The law took effect in September 2023.

Citing company insiders and internal emails, the independent Russian outlet Meduza reported in 2023 that Yandex was storing ride data from its foreign services inside Russia without separating it from domestic trips, potentially exposing that data to FSB surveillance.

Yandex denied the report, stating only law enforcement agencies in the country where a ride took place could obtain users’ records.

European countries, including Estonia and Latvia, have revoked Yandex’s taxi license, warning the company posed national security risks.

In May, Dutch regulators fined MLU, the Netherlands-based company behind Yandex Go, €100 million ($110 million) for sending Norwegian and Finnish users’ data to Russia without adequate safeguards. The company said it would appeal the decision.

“We are approaching five years of full-scale war in Europe, started by the same country whose security service can access this kind of data,” Kursetgjerde said. “At this point, slip-ups like this are simply not good enough, and they can have serious consequences.”