By Decree of the Government of the Russian Federation, organizers of the dissemination of information (ORI) registered with Roskomnadzor are now required to store information about users' messages and about themselves for a year, providing it to the special services.
The government has changed the rules for the storage by organizers of the dissemination of information (Internet resources and services entered in the special register of Roskomnadzor at the direction of the FSB) of information about the facts of receiving, transmitting, delivering and processing user electronic messages and data about them, thereby regulating some paragraphs of the federal law related to ARI No. 374-FZ ("Yarovaya package"). According to the document published on the "Official Internet Portal of Legal Information", the following changes are made to the above rules:
PIOs will be required to store information about the transmission, delivery and (or) processing of voice information, written text, images, sounds, videos or other electronic messages of Internet users during the year;
Provide the above information to the subdivision of the federal security service body authorized to interact with the organizer of the dissemination of information on the Internet using the technical means and software necessary to perform the tasks assigned to it, including in the interests of other authorized bodies, by organizing a round-the-clock remote access to the information system operated by the organizer of information dissemination on the Internet.
This Decree of the Government of the Russian Federation came into force on December 26, 2017.
Federal Law No. 374-FZ, also called the “Yarovaya package”, is gradually becoming a storehouse of large and small legal curiosities, which is not surprising, since some concepts in the law are described indistinctly, plus it contains many references to a large number of already existing federal laws and other legal normative acts, which inevitably leads to and is already causing confusion in the enforcement and interpretation of some of its provisions.
In the case of the Decree of the Government of the Russian Federation of December 16, 2017 No. 1576 “On Amendments to the Decree of the Government of the Russian Federation of July 31, 2014 No. 759”, which appeared yesterday, a number of interesting circumstances are being clarified.
According to one of the requirements of the Yarovaya package, the organizers of the dissemination of information (messengers, Internet forums, mobile applications, etc.) are obliged from the moment it comes into force, i.e. already from July 20, 2016, store the above information about actions and interactions, as well as other information about their users for a year and transfer it to the FSB - this is required by the amendments introduced by the aforementioned federal law 374-FZ to article 10.1 (clause 3.1) of federal law No. 149-FZ "On Information, Information Technologies and Information Protection". But, according to the chief analyst of the Association of Electronic Communications (RAEC) Karen Ghazaryan, no one fulfilled this requirement - neither, in fact, the organizers of the dissemination of information themselves, nor the security forces. The legal conflict here is that until yesterday everyone was waiting for by-laws from the Government, since it is it that is obliged to determine the procedure for the implementation of the Yarovaya package, and this should have been done as soon as possible after the entry into force of 374-FZ time. However, as we see, the corresponding Decree appeared only on December 16 of the current year and only entered into force. In fact, all entities subject to the “Yarovaya package” until yesterday were implementing Decree of the Government of the Russian Federation of July 31, 2014 N 759, which currently contradicts the requirements of the “Yarovaya package”, which means that both the FSB and the ORI have been in the position of "offenders".
It will be necessary for the information dissemination organizers and telecom operators entered in the relevant register to store the user messages themselves for six months from July 1, 2018 - this is a well-known fact, but it must be clarified that the above-mentioned Decree of December 16 does not apply to operators, since the regulation of their activities in accordance with the requirements of the "Yarovaya package" - this is a separate song. In fact, at the moment, only the work of the ARI regarding the storage of user metadata is regulated. As you remember, the Government has not yet developed clear instructions regarding the storage of all traffic either for operators or for RIOs, and one of the latest proposals of the Ministry of Telecom and Mass Communications is the gradual introduction of the requirements of 374-FZ: first, operators and RIOs will be offered to store "information garbage" of their users within a month, then this period will gradually increase.
Another legal conflict of the “Yarovaya package” is the lack of specifics in determining the person responsible for developing the regulations for fulfilling the requirements of the “Yarovaya package”. On the one hand, it is not a secret for anyone that the Government is almost always involved in this, and the text of federal law 374-FZ says this, however, if you carefully read each paragraph, then it is in paragraph 3.1 of Article 10.1 of the law “On Information, information technology and information protection” does not indicate who develops and determines the procedure for fulfilling the requirements. And in paragraph 3.2 there is such an indication - the Government of Russia has been appointed responsible. And in paragraph 6 of the same law, which refers to the “composition of information to be stored”, it is specified that “the place and rules for its storage, the procedure for its provision to authorized state bodies engaged in operational-search activities or ensuring the security of the Russian Federation, as well as the procedure for exercising control over the activities of the organizers of the dissemination of information on the Internet associated with the storage of such information, and the federal executive body authorized to exercise this control, are determined by the Government of the Russian Federation. Based on this, it is not entirely clear - does the Government (and in general any other state body) have the authority to regulate issues related to the storage by the organizers of the dissemination of information about the actions and interactions of their users (metadata) and their transfer to the FSB? But on the fact of the release of the resolution in question, it turns out that it has (which does not exclude a legal conflict and the possibility of challenging such documents in courts).
It should also be noted that, according to the Decree of the Cabinet of Ministers in December, information about their clients will be required to be provided by PIOs not only to the FSB, but also to "other authorized bodies." Which one is still unclear. Questions are also raised by the point regarding “organization of round-the-clock remote access to the information system operated by the organizer of the dissemination of information on the Internet” - no one knows what kind of access it is and what kind of information system we have from the information from the ORI.
As we expected, the Yarovaya package is creating more and more legal, financial and technological chaos.
The Ministry of Telecom and Mass Communications of the Russian Federation believes that the presence of functions on a particular site that allow users to leave comments is sufficient grounds for including the resource in the register of information dissemination organizers (ORI). This is stated in the response of the department to the request of the editors of the site. Roem.ru, which was added to the roster in 2014 and is now seeking to be removed from the roster.
According to the definition of the law, the organizer of the dissemination of information "is a person carrying out activities to ensure the functioning of information systems and (or) programs for electronic computers that are intended and (or) used for receiving, transmitting, delivering and (or) processing users' electronic messages ". From the point of view of the Ministry of Telecom and Mass Communications, comments are electronic messages, while the editors of the site take the opposite point of view.
To date, the ARI registry maintained by Roskomnadzor has only 98 entries, although the number of sites on which users can leave comments is in the tens, if not hundreds of thousands. As noted by Roem.ru, from this point of view, it can be considered that Roskomnadzor and the Ministry of Telecom and Mass Communications perform their duties poorly.
By law, the organizers of the dissemination of information are required to store in Russia data on the facts of receiving, transmitting and processing voice information, written text, images, sounds, video or other electronic messages of users for six months from the date of completion of such actions, and after entry into On July 1, 2018, this period will be extended to one year, and companies will also have to store the contents of conversations, messages and other user content for up to six months. These data companies must provide upon request to authorized bodies, such as the FSB.
Last year, Telegram messenger entered the registry. Entering information about the service, founded by Pavel Durov, was preceded by a conflict with Roskomnadzor, and Durov himself stated that the company does not assume any obligations and will not comply with the unconstitutional and technically unrealizable "Yarovaya Law", as well as other laws incompatible with the protection privacy and Telegram privacy policy.
Shortly after the messenger was included in the register of the ORI, the FSB demanded that the company provide encryption keys, but the Telegram administration did not comply with the requirement, and the service cost 800 thousand rubles. Currently, representatives of Telegram are challenging the order of the FSB in the Supreme Court, on the basis of which the special service received encryption keys.
After a tense public dialogue last week between the head of Roskomnadzor Alexander Zharov and the actual owner of the Telegram messenger, the service was included in the register of information dissemination organizers. How can events develop now, how long has this registry been in existence, are there any records other than Telegram, and will there be more messengers there? Rossiiskaya Gazeta learned about this from Oleg Ivanov, deputy head of Roskomnadzor.
Roskomnadzor has been keeping a register of information dissemination organizers since 2014. How is it filled? Why is there tension around this register right now?
Oleg Ivanov: This register was indeed created in 2014 as a result of the adoption of an "anti-terrorist" package of amendments to the current legislation. This package introduced two new concepts into the legal field - "blogger" and "information dissemination organizer". The latter definition includes any Internet site or online service that allows users to exchange messages or files. These are social networks, various forums and blog platforms, instant messengers, file hosting, video hosting.
The main legislative requirement for the organizer of the dissemination of information is that he is obliged to ensure the storage of information about the actions of users for six months. And provide this information at the request of law enforcement agencies in the course of their operational-search activities. First of all, when preventing or investigating terrorist attacks.
In order for government agencies to understand who they are dealing with and know where to send their requests, the organizers of the dissemination of information are required to notify Roskomnadzor of the start of their activities. That is, provide a specific set of contact information. There are five identifiers in total: country of registration, legal address, domain name, postal and email addresses of the company and hosting provider, as well as a general description of the service's functions. These data are entered into the relevant register.
Companies are included in the register of information dissemination organizers either at the request of law enforcement agencies, or at the initiative of the service itself. As of yesterday, the register contains information about 85 organizers of the dissemination of information - primarily those who have notified themselves on their own initiative.
There are ten foreign companies in it. Among them are companies that manage popular file sharing services (Depositfiles, Letitbit, etc.), browsers (OperaSoftware), video hosting services (Vimeo), instant messengers (WeChat, Threema, Telegram).
The adoption in 2016 of amendments to the Law "On Combating Terrorism" served as an impetus for strengthening the work of ministries and departments to implement this law.
There is an opinion that after registering in this register, Russian special services get the opportunity to read the correspondence of users. To what extent is it true?
Oleg Ivanov: This is not true - the law on the organizers of the dissemination of information does not require the content of correspondence to be stored or transmitted. From what network address the person involved in the investigation accessed the Internet, what sites he visited, with whom he corresponded, whom he called in the messenger, at what time, and so on. The law on organizers of the dissemination of information does not require the content of users' correspondence to be stored or transmitted.
The obligations of the organizer of the dissemination of information arise by virtue of the law, and not by the fact of being entered in the register. If your service falls under the definition of a disseminator, you are already required to do what the law requires.
Inclusion of the information dissemination organizer in the register means the company's readiness to work in the Russian legal field, follow the requirements of national legislation, and ensure the storage of information for anti-terrorist purposes.
And to whom else did you send requests for registration in the registry? Will it include, for example, such popular services in Russia as WhatsApp or Viber?
Oleg Ivanov: We are in direct dialogue with most of the largest international IT companies and services - Apple, Twitter, Facebook and WhatsApp, Google, Microsoft, Viber, etc. We have personal meetings and consultations with their representatives. We respect the companies' right to confidentiality of negotiations, therefore we do not make public the results of their intermediate stages. These companies are currently in the process of making a decision to be included in our register. You need to understand that these are global corporations with a complex system of management and coordination of legally significant actions. But for us, the desire of the company to cooperate is important. If it is explicitly indicated, we have procedural options to give the service the extra time it needs to agree on the final decision.
On the contrary, if a company avoids dialogue, ignores our requirements, or broadcasts through the media a clear unwillingness to comply with them, we are obliged to apply the sanctions provided for by law. In the case of the organizers of the dissemination of information, this is an administrative fine of up to 300 thousand rubles or blocking in Russia. As you understand, only companies registered in Russian jurisdiction can be fined. For foreign companies, blocking their services in Russia is a non-alternative measure of influence.
The register includes 85 information dissemination organizers. There are more of those who notified themselves
At the moment, there are several foreign companies that have refused to register their services in the register of information dissemination organizers. Four foreign resources are blocked - Zello, Line, BlackBerryMessenger, PaulKeever.
Blocking the organizer of the dissemination of information is not an eternal measure. What do companies need to do to lift the block? How long does the unlock procedure take?
Oleg Ivanov: You are right, the blocking lasts exactly until the moment the legal requirements are met. An example is the Chinese messenger WeChat. The blocking of this resource in May this year lasted a week. After TencentHoldings provided the necessary information, we checked its accuracy, and access to the messenger was immediately restored. I associate this incident with the difficulties of international communication. The administrators of the Chinese resource simply did not pay attention to the demand from Russia in time - they confirmed this to us later. To resolve this situation, we had to use diplomatic channels.
Does Roskomnadzor's work with them end with the inclusion in the register of information dissemination organizers?
Oleg Ivanov: Yes, then the direct communication of the service with the Russian special services begins. I repeat - this does not mean at all that all correspondence is read. But law enforcement agencies should be able to make sure that Mr. N is really involved in terrorist or extremist activities, stop his public work on the Web, and also reveal his criminal connections. This is the normal work of intelligence agencies around the world.
Oleg Ivanov: The law on organizers of the dissemination of information does not require the content of users' correspondence to be stored or transmitted. Photo: RIA Novosti
After a tense public dialogue with the head of Roskomnadzor Alexander Zharov, the founder and actual owner of the Telegram messenger, Pavel Durov, agreed last week to enter Telegram into the register of the department. However, he continues to broadcast on his social networks the position that the messenger will not transfer a bit of information about users to the special services of the world. How do you feel about this behavior of Durov?
Oleg Ivanov: The anonymity of the messenger and the absolute confidentiality of communications within it (including through the use of end-to-end encryption in "secret" chats) is the "trick" around which Telegram has built its entire marketing campaign. This is the basis for the reputational identification of the service and Pavel Durov personally. I believe that Pavel Valeryevich will continue to broadcast this position in the public field. However, it is difficult to predict what he will do when the intelligence services, with facts in hand, prove to him that a terrorist act is being prepared with the help of Telegram. What will he choose - the abstract value of online anonymity or the lives of specific people?
In addition, in my opinion, there are two types of anonymity. The anonymity that protects users' privacy is a blessing. Such anonymity is in fact protected not only by the IT industry, but also by states. For example, the right to privacy of correspondence is guaranteed by the Constitution of the Russian Federation, and the law on the organizers of the dissemination of information, as I have already said, does not encroach on this constitutional right of citizens. However, there is another anonymity that allows terrorists to hide their criminal intentions. And this is unacceptable in the civilized world. It is necessary to separate these concepts.
There are domestic messengers in Russia. They are also about to launch state messengers, about which the Internet Development Institute claims. Do they need to be included in the register?
Oleg Ivanov: On the part of the Russian organizers of the dissemination of information, we see a complete understanding of all law enforcement processes. None of them claims any privileges in the execution of the law. All of them are in the Russian legal field, declare full compliance with all legislative requirements and, in fact, comply with them.
How promising are instant messengers and can they be distinguished from other communication services?
Oleg Ivanov: The classic messenger is a closed system. All communication between users takes place inside it, and the ability to send any information to an external resource depends not only on the capabilities of the messenger itself, but also on the capabilities of the operating system of your computer or mobile gadget. I believe that if in the near future someone implements an integrated interface that allows you to use all the instant messengers installed on your device at the same time, then this will probably be a business success. And the future, in my opinion, is still behind the technology that will combine the capabilities of the browser, social network, instant messenger, mail, online shopping, and so on. I don't think it will take too long. The process of mutual penetration of these services is already going quite intensively.
The government approved the Yarovaya package. According to the amendments to the Federal Law of July 6, 2016 No. 374-FZ “On Information, Information Technologies and Information Protection”, the rules of the “Yarovaya package” come into force on July 1.
The information is addressed to students of professional retraining and advanced training courses in the following areas:
As determined by the Government Decree of June 26, 2018 No. 728 "On approval of the Rules for the storage by the organizer of the dissemination of information in the Internet information and telecommunications network of text messages of users of the Internet information and telecommunications network, voice information, images, sounds, video, other electronic messages of users of the information and telecommunication network "Internet" everyone who is the organizer of the dissemination of information on the Internet must store any electronic messages of users.
Who refers to the organizers of the dissemination of information?
Federal Law of July 27, 2006 N 149-FZ "On Information, Information Technologies and Information Protection" in the first part of Article 10.1 clearly defines that the organizer of the dissemination of information are persons who ensure the operation of information systems and software used for receiving, transmitting and delivery of messages to the global Internet. In other words, these persons must be licensed by telecom operators. These persons must send a notification to Roskomnadzor about their inclusion in Register of information dissemination organizers (ORI). Refusal to enter into this register entails administrative liability from 75 thousand rubles to 300 thousand rubles (according to the Code of Administrative Offenses of the Russian Federation Article 13.31. Failure to fulfill obligations by the organizer of the dissemination of information on the Internet). From July 1, 2018, Roskomnadzor will issue fines, and not the prosecution authorities.
"A fine in the amount of 300 thousand rubles - for the lack of notification of Roskomnadzor about the start of work of the organizer of the dissemination of information"
At the same time, the existing practice of Roskomnadzor and official letters from the departments of the Ministry of Communications indicate that not only telecom operators can be classified as organizers.
At the beginning of this year, a scandal erupted around one of the sites. The site decided that in order to get out of the ARI registry, it was enough to remove such a function as "sending private messages to the site." Roskomnadzor did not agree with this, referring to the fact that users can still leave their messages under the news. Therefore, the site cannot be excluded from the registry. The Ministry of Communications of the Russian Federation also agreed with the position of the supervisory authority.
Your website, your company and your personal page may fall under the Yarovaya package
As the Ministry of Communications of Russia points out, any sites where it is possible to exchange messages fall under the rules for storing information. This includes comments posted by users of the site. In other words, almost all Runet sites, including online stores, blogs, and reviewers, should be included in the ARI registry.
“Any person can be recognized as the organizer of the dissemination of information: a legal entity or an individual”
The list of conditions under which you fall under the "Yarovaya law":
- Your site has the ability to leave comments under publications. It doesn't matter if visitors leave these comments or not.
- Online stores with product reviews.
- Any forum where users exchange messages.
- Corporate or personal blog with commenting.
- All messengers (Twitter, WhatsApp and others),
- Social media
It is obvious that sooner or later the owners of websites and Internet resources will either have to enter the ARI registry or fulfill certain requirements in order not to get there. The very fact of not being included in the ARI category does not exempt from the implementation of the law and the rules for storing information. The register is needed for government agencies for ease of accounting. If you have not yet been included in this register, this does not mean that you (your website) must not comply with the requirements of Government Decree No. 728 of June 26, 2018 (download PDF document ).
What information are the organizers required to keep?
According to this Decree, all organizers must store electronic messages (including voice messages, as well as images, sounds, video images) of users in software and hardware that are used by the organizers of the dissemination of information in the information systems they operate, in full for 6 months from the moment of completion of acceptance, transmission, delivery and (or) processing of electronic messages.
The storage of electronic messages is necessary so that the bodies carrying out operational-search activities can gain access to them. Such access must be provided by the organizers.
What information should the organizers provide to the security authorities?
At the request of government authorities, it is necessary to provide information about users who
- registered using network addresses;
- authorized using network addresses;
- indicated when registering or using the Internet service an identity document issued by a Russian state authority;
- used to access the Internet devices or programs that transmit to the Internet service geographic data (metadata) indicating their location (temporary location) on the territory of the country;
- indicated when registering or using the functions of the Internet service as contact information the telephone numbers allocated by Russian telecom operators when concluding an agreement with the subscriber for the provision of communication services.
To which authorities should this information be provided?
This is stated in Article 13 of the Federal Law of August 12, 1995 No. 144-FZ (as amended on July 6, 2016) “On operational-search activity”.
It includes the following departments:
- Internal Affairs Bodies of the Russian Federation (MVD).
- Bodies of the Federal Security Service (FSB).
- Federal executive body in the field of state protection.
- Customs authorities of the Russian Federation.
- Foreign intelligence services of the Russian Federation.
- Federal Penitentiary Service (FSIN)
Journalists have found out which resources will soon have to be used with increased caution.
Starting July 1, 2018, Internet companies included in the register of organizers of the dissemination of information (ARI) will be required to store the correspondence of Russian users for six months and transfer this information to special services upon request. The Meduza journalists found out which of the services popular among Russians agreed to such cooperation, and which is better to use with caution in the future.
So, almost all Russian services got into the register of ARI and did not intkbbee the western ones, however, it seems that Roskomnadzor is of little concern.
Experts recommend using the VKontakte messaging function and other social network services with caution, perhaps with the exception of audio and video calls, where, according to the developers, end-to-end encryption is used.
Odnoklassniki never mentioned end-to-end encryption, and, apparently, any data and correspondence of users are stored in clear text and can be transferred to special services, the newspaper writes.
From Yandex, e-mail and cloud storage got into the ARI registry. Despite the fact that the company supports data encryption, it still has access to users' emails and files.
At Mail.ru, mail, cloud storage, the My World social network and the Mail.Ru Agent messenger, with which you can communicate on ICQ, VKontakte, Odnoklassniki and even Facebook, got into the registry.
The American Google did not say anything about preparing for the "Yarovaya package", but unofficial sources reported back in 2015 that the company was transferring Russian users' data to servers in the Russian Federation.
Telegram is in open opposition to the transfer of data to intelligence agencies. At the same time, end-to-end encryption is used only in the secret chats of the service, and the usual correspondence of users is stored on the company's servers.
Viber last March announced that it was not going to transfer the keys to encrypt user messages to the special services, and all correspondence in the messenger is end-to-end protected. The "Yarovaya Law" is contrary to Viber's policy, and Roskomnadzor did not list it as an ARI.
At WatsApp, Roskomnadzor has not yet seen the need to be included in the ARI, and messenger chats use end-to-end encryption.
Facebook has not yet been included in the ARI list, but Roskomnadzor has threatened to block the service if the company does not meet the halfway, reminds the publication. Chats on the social network are not protected by end-to-end encryption, but you can enable it yourself in the settings.
According to Roskomnadzor, Twitter in 2017 agreed to store the personal data of Russians in the Russian Federation, although official representatives of the service did not comment on this information. The social network provides a private messaging service that is not protected by end-to-end encryption.
The popular Instagram photo service is not yet in the ARI registry. Other information about this social network is not yet given.
We add that many large companies, including Mamba, Rambler, My Circle, Habrhabr and others, have entered the ARI register. The full list is on the website.