The FSB demanded keys to Yandex services. Together with them she will receive logins and passwords

The FSB demanded that Yandex hand over the encryption keys to user correspondence, but the Internet company still refuses to do this, RBC learned . The fact that for the special services, most likely, is just a matter of convenience, "Yandex" is threatened with image and financial losses, and in extreme cases, blocking like Telegram.

What happened

A few months ago, the FSB demanded from Yandex the keys to decrypt the data of users of the Yandex.Mail and Yandex.Disk services, RBC writes. "Yandex" has not yet provided them, although the law allocates 10 days for this, the source of the publication says.

The FSB has the right to demand keys: both services are included in the register of information dissemination organizers (ORI) of Roskomnadzor. According to the "Yarovaya Law", the IRIs are required to provide "information necessary for decoding the received, transmitted, delivered and (or) processed electronic messages of Internet users."

Key to everything

Yandex believes that the FSB interprets the norm of the law too broadly and requires keys not from services, but from user sessions.

Such a key gives the FSB access not only to the user's mail and files, but also to all his traffic with Yandex services, including logins and passwords. “Giving the session key of a user to the special services can allow them to take over the login and password from the mailbox of this user,” confirms the former developer of the ecosystem of the anonymous Tor browser Leonid Evdokimov.
The FSB demand will deprive Yandex services of a competitive advantage over Google, lead to an outflow of users, loss of market share and significant financial losses, the company fears. “Foreign companies, such as Google, the FSB does not force such cooperation, so Yandex sees a threat to its competitive position here,” says a RBC source close to Yandex.
Upd. Yandex stated that the requirement to transfer session keys does not follow from the "Yarovaya law": "enforcement of the law is possible without violating the privacy of user data."

What threatens refusal

If Yandex does not provide the keys to the FSB, to begin with, it faces a fine of 1 million rubles, after which Roskomnadzor may issue an order to eliminate the violation. Then Roskomnadzor can go to court with a demand to block services on the territory of Russia, the encryption keys for which the special service did not receive.

This is how the situation developed with Telegram's refusal to provide the FSB encryption keys. They have been trying to block Pavel Durov's messenger in Russia for a year now, but only recently there has been progress on this issue related to the use of DPI systems .
Most likely, blocking will not come: Yandex and the FSB will come to some kind of compromise, RBC experts believe. In the most extreme case, services are threatened with access restriction for a day or two “for deterrence purposes”, but even this will lead to big losses.

A matter of convenience

According to the RBC expert, the FSB is simply faster to gain access to users' correspondence through the Yarovaya Law and encryption keys than to use the standard mechanism and wait for a court order.

The FSB can always go to court with a petition to limit the constitutional rights of citizens to the secrecy of correspondence and gain access to it from an Internet company by a court decision. According to the Judicial Department of the Supreme Court, Russian courts granted 828,500 such requests in 2018.

Yandex does not disclose the number of users of Mail and Disk, but according to SimilarWeb, Yandex.Mail was visited 432 million times in April 2019, and Yandex.Disk was visited 27.32 million times.

Why is it important. Unlike Telegram, Yandex won't be able to hide in a foreign cloud, so don't expect Russian intelligence services to gain access to its users' correspondence in one form or another. The fact that the security services put their own convenience above the interests of even large Russian business should no longer be surprising.