FSB demanded from Internet services online and user correspondence

In the summer of 2019, the FSB sent letters to the largest Russian Internet services demanding to install equipment that allows special services to receive round-the-clock access to user data. Such the right of the special service gives the “Yarovaya Law”, but the FSB began to put forward the requirements for Internet services only last summer.

What's happened?

In the summer of 2019, Russian Internet services included in the register of information distribution operators (AHI) received letters from the FSB demanding to install equipment that gives the special services to the round-the-clock online access to their information systems and keys to decrypt user correspondence, three sources in Internet companies told The Bell. Services included in the ORI Register are required to provide data from the FSB users at the request of the Yarovaya Law. In case of failure to fulfill the requirements, they face locking.

On the evening of Tuesday, the “Medusa” also reported on letters entered the Internet services in the summer of 2019.

Roskomnadzor has been maintaining the Ori Register since 2015, now it has 202 participants . The register includes Internet services that allow users to exchange messages. Now it has, for example, Yandex services, Mail.ru Group, Telegram, Sberbank-Online, Avito. Google and Facebook services (including WhatsApp) in the registry. As the head of Roskomnadzor, Alexander Zharov, explained , companies fall into the register after law enforcement agencies for certain purposes request their contacts.

“Before last summer, no one has been engaged in the register, and no action on it was taken. We have been in it for a long time, but they did not demand anything from us, ”says one of The Bell's interlocutors. Having received a letter, he tried to check the neighboring identification numbers of customs from the help of a tracker on the Russian Post website and made sure that the letters from the Center for Operational and Technical Events of the FSB received dozens of companies included in the ORA register, for example, the KEH-Commerz company Managing Avito service.

In Yandex, Mail.ru Group, Ramblera and Avito have drew up from comments. The FSB did not respond to the request of The Bell.

What the FSB wants

The letter was signed by the FSB officer M.Yu. Mikhailov. According to RBC, Mikhail Mikhailov is the head of the 12th Center of the FSB, who also oversees the system of wiretapping and monitoring the correspondence of SORM. In the public space, Mikhailov seems to be the "head of the Center for the FSB of Russia." In the letter, he indicates that by the decision of the director of the FSB, the Center for Operational and Technical Events of the FSB is chosen by the body for interacting with the participants in the ORI register. It was this unit that was indicated in the order of the FSB on the disclosure of the encryption keys.

With reference to the laws and by -laws adopted for the implementation of the Yarovaya Law, Mikhailov reports to the addressees about the need:

• development and approval of the installation plan on their equipment systems necessary for solving the problems of security agencies or operational-search activities;
• organizations of round-the-clock remote access of the FSB center to the information system of the Admanate Organization;
• Urgent provision of the information necessary for decryption of users of Internet services of the addressee.

The letter indicated the name of the authorized representative of the FSB and the 24 -hour telephone number of the duty officer for interaction with the participants in the ORA register. Working meetings were proposed to be held at the FSB reception on the Kuznetsk bridge, or in the office of the Address organization. Addresses reminded of the clause of the rules for the interaction of information distribution operators with special services prohibiting the disclosure of information about this interaction.

Is this legal?

Yes. In 2014, approved by the government, the rules for the interaction of the organizers of the dissemination of information with special services oblige them to provide information from the FSB. According to the explanations of the Ministry of Communications to the “Yarovaya Law”, published in February 2018, the Ministry of Communications, participants in the ORI register are obliged to provide the FSB with the personal data of the user (login, real name and surname, passport data, registration, list of languages ​​that the user owned, his communication circle, data of accounting in other services, IP addresses), correspondence Users, files that they exchange, records of audio conversations and data on their payments.

The requirements correspond to what is spelled out in the package of Yarova, the “Law on Bloggers” 97 of the Federal Law and the requirements of the SORM-3, which are also assigned to the participants in the Ori Register, says the lawyer of the Roskomsvoboda organization Sarkis Darbinyan. But the problem is that there are no criteria in order to recognize the service of Ori as such: only the possibility of inter -speaking interaction, he notes. This means that if the site allows you to send and accept messages - even if it is a communication between the administration and users - it can be entered into the register. The FSB makes these decisions without obvious logic, only in binding to its needs: now there is a psychological dispensary and kindergartens in the registry, Darbinyan says. As far as he knows, some services from the ORA register have already connected the necessary equipment and began to comply with the FSB requirement.

Are these data transmitted now?

The source of The Bell in the company entering the register says that the interaction of Internet companies with the FSB is already going on, at least part of the Internet companies installed the necessary equipment. “The special services at our expense put the infrastructure and can already receive a significant part of the data of our services,” he says.

In November 2019, the participants in the ORA register received another letter - with an invitation to meet on Lubyanka for clarification to those who have not yet put the equipment, says The Bell's interlocutor. He also heard about how two FSB officers themselves came to the office of the online service, after which he installed the necessary equipment. “They put those who had no choice, who had all the equipment and trademarks in Russia,” he says.

The law establishes similar requirements to operators, Internet providers and date-centers owners. On their networks, the equipment of the SORM-2 system has long been installed, which allows special services to monitor the online mode of users in the online mode and read their correspondence.

In the summer of 2019, RBC reported that the FSB employees issued a more detailed requirement to provide session keys for Yandex.Pocht and Yandex.Disk, which are re -generated every time the user is included in the system. Then Yandex, according to RBC, refused to fulfill the requirement, considering it excessive. How this story ended, The Bell failed to find out.

What am I to me?

The European Court of Human Rights has already recognized Russia with a country with non -thargeted surveillance - but now the situation is only worse, Darbinese says from Roskomvoboda. “Who and how will receive information about the user from mobile operators, and now - from the participants in the Ori Register, one God knows. All this means a complete collapse of privacy if you use unencrypted services. But, even if the services are encrypted, but they fulfill the law and transfer the FSB session keys, their users find themselves in a similar situation, ”he warns.