FSB demands round-the-clock access to Russian citizens’ online correspondence
Russia’s Federal Security Service (FSB) has demanded that the major internet service providers give it access to their users’ online activity, The Bell reports, citing sources in Russian internet companies.
In summer last year, Russian companies on the register of information distribution operators (IDO) started receiving a letter from the FSB headquarters on Lubyanka Square related to the requirements of the “Yarovaya Law”. In the letter, the FSB instructed the companies to install equipment to give its personnel round-the-clock access to the systems, as well as the keys to decrypt users’ traffic.
According to the Russian Communications Ministry’s explanation of the Yarovaya Law, companies on the IDO register are obligated to give the FSB their users’ personal data (login details, real name and surname, passport information, residential address, residential registration, a list of languages known, social circle, accounts on other services, IP address), users’ correspondence, files exchanged, audio call records, and transaction logs.
Before this, the law had only been applied on two occasions – against Telegram and against Yandex. Now the situation has changed, and at least some internet companies have installed the required equipment, a source reported: “At our expense, the intelligence services have set up infrastructure and are already able to obtain a significant portion of our services’ data.”
Companies which neglected to install the equipment were summoned to Lubyanka to explain themselves, another source told The Bell. The source had heard that two FSB officers had come in person to the offices of one service provider, after which the company made all the necessary installations: “The ones who had no choice, whose equipment and trademarks are all in Russia, have installed [the equipment].”
RosKomNadzor, Russia’s federal communications censorship agency, has been maintaining the IDO register since 2015, and it now lists 202 companies. The register includes online services that let users exchange messages. For example, it currently includes the services of Yandex, the Mail.Ru Group, Telegram, Sberbank Online and Avito. Google’s and Facebook’s services (including WhatsApp) are not in the register. RosKomNadzor’s director Alexander Zharov explained that companies only end up in the register after law enforcement requests their contact details for some reason or other.