Where did the Phonenenumber.to website come from, which contains data from millions of Russians

Roskomnadzor is going to block the database

On October 12, Roskomnadzor said that he intends to block the Phoneenumber.to website, which allegedly stores the personal data of 80 million inhabitants of Russia. This base was known at least since the summer of 2016, but on social networks and on imageboards it began to be discussed only now - some users find data about themselves and relatives, others note that the information in the archive is outdated. "Medusa" says what is known about Phonenumber.to, and how information security experts relate to this database.

Where did the Phonenumber.to website come from?

The first of the Russian media about the telephone base containing the data of millions of residents of the Russian Federation was written on October 11 by TJournal. Later, Kommersant said that Roskomnadzor filed a lawsuit against the hosting service provider; The department is going to block the base, because he "provided an unlimited circle of people with access to personal data of citizens without their consent." Roskomnadzor conducted a check on the basis of two complaints.

How many records are in the database is unknown, but the search for a random symbol gives out more than 78 million results. Many users confirm that their relevant data is in the archive; Separates note that they managed to find the "grandmother’s number, who could not leave him anywhere." The site has not only information about mobile phones, but also about the place of registration of citizens and previous places of work.

Judging by other messages, some information in the database is outdated , taken from fake pages on social networks or simply inaccurate . It was not possible to find any connection between the relevance of information in the archive, the mobile operator or the work life of the Medusa SIM card.

The first entries on the site blog are dated to the beginning of 2015, while, according to Similarweb.com , there were no visitors on the site until June 2016 (about 140 thousand unique visitors in September). Earlier, the site, obviously, was located in the domain zone .OBL-on the network there are references to June 3, 2016, as well as complaints about it dated January. The Facebook page at the site appeared in May 2015.

The “On Site” section reports that the base was created from “Nostalgia for telephone books that were before” - as an alternative to fraudulent services, where to receive information from the telephone base you have to send SMS to a paid number. “In addition, the site is made to support and increase the popularity of bitcoins,” the same section says. However, the site conducts commercial activities: it accepts cryptocurrency as payment for exception from the base.

It was not possible to find data on the creators of the Medusa site.

Where does the site take personal data and how legally it is?

The authors of the site report that they receive personal data in different ways: from public sources, using API other sites (software interfaces to the database of third-party services), from data suppliers (“specialize in the collection of personal data for the purpose of further resale”); Some subscribers are added by users themselves.

“Using public sources, it is really possible to collect a large database. Take the same FindFace ( Search for Users from the photograph, Read about it, read here - approx. Medusa ) - they received not only text information, but also images, avatars of all users of VKontakte, on the basis of which they are building their own, ”the leading researcher of the information security department of the Digital Security Audit Department noted in a conversation with Medusa Security Sergey Belov. He compared the search in such a database by the degree of legality with the indexation of public data “Google” or “Yandex”.

Information Security Specialist, Cisco Systems employee Alexey Lukatsky agreed that it is not difficult to assemble “uncovered data”. “Many users on social networks indicate their data, including the phone number, and with the help of a conventional scanner and disassembler web page you can pull out this information and then automate the collection,” said Lukatsky Medusa.

However, according to him, despite the general accessibility of the data, users who have found their phone in the database may be justified. “On the one hand, according to the law, a person who posted data in a public source, for example, on a social network - if the profile is not closed, thereby gave permission to access them to an unlimited circle of people. On the other hand, the law on personal data says that even for publicly available data it is necessary to clarify the goal of collecting and processing. The fact that the social network collects information for his goals does not mean that someone else can use them for purposes that the user did not provide for, publishing his phone number, ”says Lukatsky.

In his opinion, data collection using third -party sites also raises questions: “Where does those sites have users from those sites? If this, for example, is a person’s profile in an online store, such information is not public. Those who somehow received it violate the law on personal data, which requires consent to its processing. ”

There are many such data archives?

Bases with different data of residents of Russia periodically find themselves in the public domain on the Internet. In April 2009, the site radarix.com was closed , which had previously sold information about millions of citizens of the Russian Federation during the year; After liquidation on its main page, there was a link leading to the FSB website. In May 2016, the base of car owners appeared ( blocked by Roskomnadzor three months later); In September, the database of the disbanded FSKN, containing information about hundreds of thousands of people with HIV, drug addiction, a tendency to suicides (there is no information about the reaction of Roskomnadzor), in October - the base of debtors of banks, classified law enforcement officials and senior officials (Roskomnadzor did not react).

Information security specialist Alexei Lukatsky notes that the methods of collecting bases remain the same: “As a rule, this is the drain of some operator with further addition to information from the Internet or the use of bases of several departments-cadastrals, the traffic police-with the subsequent attempt to unite by keywords or general fields. But there is always a matter of relevance. I used some databases on the Internet, tried to check myself - they are far from all relevant. ”

Sergei Belov from Digital Security is sure that there will be more and more archives similar to Phonenumber.to: “The more popular Data Mining becomes (deep analysis of raw data in them to find previously unknown, useful and affordable knowledge - approx. Medusa) , the more such bases will be. There are already plenty of initial data for the collection, it just became a little more convenient to look for them by open sources. If it is cold to look at this news [about Phoneenumber.to's website, nothing happened. ”

Evgeny Berg

Moscow