Questions regarding pre-installed government spyware

polymer_wildcat

Hello everyone!
I'm very new to all the security / privacy information, so please don't be too hard on me - any help is very appreciated.

Problem

I'm looking into buying Pixel 9 and installing GrapheneOS, because...well my country is Russia, which is anarcho-tyranny, that clearly wants to turn itself into even harder China-style model of total surveillance.

But i'm seeing some potential complications with recent laws, that as far as i understand, may have just introduced some forced spyware, hence few questions i try to find answers for, before any attempts to buy device.

Starting from September 1, 2025, pre-installation of government apps will be mandatory for all smartphones, tablets, computers, smart-TVs sold in Russia:

RuStore (The Russian app store)

MAX messenger (what they plan to make as a "super-app" forced on everyone, Chinese WeeChat style)

Госуслуги (public services, again government service to do "everything")

Domestic search engines

Russian Social networks

«Мир» payment system

Needless to say that all of this is obviously government spyware.

It's very hard to say how exactly those laws will function and who exactly will be responsible to install all that crap in anarcho-tyranny state, they promise some penalties to smartphone manufacturers and sellers for not following their law, so i assume that's their plan, which in reality could turn very loosely "forced".

However, seeing trajectory of their moves - let's assume worst case (for sake of questions):
All smartphones that are available outside of black market are forced to be handled by FSB agents.

What we know for a fact:
Most of those apps require government trusted CA and silently install that CA root certificate in order to work. As far as i understand, any poisoned CA can basically snoop and MiTM all internet traffic.

Also, there are some scary articles about plans to have a government IMEI-registry tied to government ID of all devices in the future.

Question 1

Before GrapheneOS installation, how will government trusted CA look inside Google Android, will it be recognized as System or User certificate?
How to remove it?

Question 2

I would like to not give those government snoops a chance in leaking any information about device before / during GrapheneOS installation, as far as reading installation instructions, my assumptions are:

Physically not connect to the internet and not insert SIM, set Airplane mode.
Remove all government spyware apps that i can find.
Remove all known Government root CAs, so that when i am forced to connect to the internet to enabled OEM unlocking hopefully no data / metadata will be leaked or traffic won't be tampered with.
Reboot.
Connect to Torrified Wi-Fi network, enable OEM unlocking.
Proceed to install GrapheneOS.

Will this be enough for the task?
Have i missed anything?

Question 3

Is there any chance that government agents can pre-install some persistent zero-click spyware somewhere deeper than OS?
Perhaps like Bootloader or some Firmware?

How to check and protect from such cases, if that's possible at all?

Question 4

Regarding potential future for all devices IMEI-registry, as far as i understand, basically the only way not to become a tagged cattle would be to buy devices only through distant relatives / friends / drops and pray to never get caught by cops?

Kuklovod

polymer_wildcat You ask sensible questions. I'm also interested. I'm really already using the Pixel unfortunately, but not yet with the GOS firmware. It is especially interesting on the second question. Do I need to delete everything first, now it works? Isn't it easier to reset to factory firmware? Wouldn't just installing GOS delete everything that was previously installed? Where did you get all this mechanics from?

Kuklovod

polymer_wildcat It is a pity that there is no response to your appeal. Maybe it is worth printing it in English

23Sha-ger

Your device is fully wiped (formatted) when you install GOS.
So all these concerns are irrelevant, nothing stays on the system partition.

GrouchyGrape

23Sha-ger true. OP's biggest challenge will be getting an OEM-unlocked Pixel in Russia. No idea how difficult that is to do.

ourslfs

GrouchyGrape not that difficult, as long as you don't get a US version

ourslfs

And to begin with, pixels aren't officially available im russia, most of them are being sold by individual resellers on second hand and other digital platforms that probably wouldn't do a thing.

ourslfs

But if we're talking about other brands, then majority that do business officially will probably comply with rules and ship those apps themselves as regional thing. And for the ones that do not, retail employees will install them themselves(which is something that they have been doing for a while now).

7697latrena

Google doesn't officially sell Pixel phones in Russia. Instead, there are resellers - like online shops and physical stores - and it's their job to handle the software installation. But honestly, many of them don't bother. To cover themselves legally, they often claim the product is malfunctioning (товар ненадлежащего качества), even though everyone knows the devices work just fine. Savvy customers realize they don't need any of the bloatware.

If you somehow buy a device with the preinstalled software, you can just factory reset it. From there, update to the latest version of Android and install GrapheneOS. During the setup, all the userspace apps and certificates will be wiped out, so you don't have to worry about backdoors.