The FSB requested an online access to Internet services. What is this threatened?

Online services began to plunge into the new reality of the Yarovaya Law, in which communication operators and Internet providers have been living for a long time. In the summer of 2019, the FSB was sent to Russian services included in the register of information distribution operators (Ori), letters demanding to give special services to special services to their information systems and keys to decrypt user correspondence, The Bell found out . We explain what this threatens both.

Who is under the blow

Letters signed by the head of the Center for Operational and Technical Events of the FSB Mikhail Mikhailov were received by participants in the register of information distribution operators (Ori), which Roskomnadzor has been conducting since 2015. Now in the register of 202 participants , from the largest Internet companies like Yandex, Mail.ru Group and Avito, to anyone unknown regional sites-for example, one of the latter in the register included the website of the municipal administration of the 10,000th city of Shagonar in Tuva. There is no single logic in the formation of the registry - resources get there after law enforcement agencies for certain purposes request their contacts.

“Before last summer, no one has been engaged in the register, and no action on it was taken. We have been in it for a long time, but they did not demand anything from us, ”says one of The Bell's interlocutors. Having received a letter, he tried to check the neighboring identification numbers of customs from the help of a tracker on the Russian Post website and made sure that the letters from the Center for Operational and Technical Events of the FSB received dozens of companies included in the ORA register, for example, the KEH-Commerz company Managing Avito service. "Medusa" in the same way installed 10 more addressees of letters.

There are no largest Internet channels among the Medusa found, but in June 2019, RBC reported that the FSB demanded from Yandex sessional keys for the “Post” and “disk” services. Yandex refused to provide the keys, but a few days later the managing director of the company Tigran Khudaverdyan said that Yandex managed to find an acceptable solution. What - Khudardyan did not say, and no one still knows this.

What does it give to the FSB

Two main requirements of the FSB for online services-give the special service access to these sites and issue traffic encryption keys.

The first means connecting the service to the “remote control” installed in the FSB, which is already connected, for example, the equipment of SORM, installed by operators of communication. The remote control itself is a computer in a separate closed office in the FSB, where only an employee with a certain level of access and internal regulations can get. Which one - no one knows, in the public domain and in the laws there are no references to him, Kulin explains.

Using the FSB remote control, it receives all the data that is obliged to issue by the law : textual, audio and video messages of users and all information about them that they are obliged to store six months after publication,- login, name, passport data, address, list of languages, its user, his communication circle, data of accounts in other services, IP addresses. An FSB officer with access to the remote control will be able to unload them at any time.

The second requirement of the FSB is to issue encryption keys, both ordinary and session, which are responsible for the encryption of each user’s connection with the company’s server and allow access to the entire correspondence of the service users. Kulin notes that due to the wide interpretation of laws in Russia, special services may not include messages deciphered with the help of keys to protected constitutional secret correspondence: keys are the so-called non-formatted data and are not spelled out in the laws in any way.

RISKS for Ori

The requirements of the FSB are impressed by the safety of the services themselves from the ORI registry, experts say.

• If earlier the services kept all the information at home and only employees of the same company, which issued it, which issued it only upon request, now it now has access to it, in fact, an indefinite circle of persons.
• The FSB requirements are added to the “Empire Svic” services: that is, the number of points that the attacker can use will now increase, explains Alexander Romanov, deputy director of the Digital Security Audit Department: “Previously, services could not store this data. Now they are obliged to store them and transmit them. And where exactly to transmit - it doesn’t matter at all, even if it is the FSB. ”
• The risk is obvious that the FSB officers who have gained access can use them for illegal selfish purposes. There are many such examples: the ex-head of the banking department of the Kirill Cherkalin management department extorted bribes for the roofing of banks, and the deputy head of the information security center (QIB) of the FSB Sergey Mikhailov received 22 years for espionage.

How much is it all costs

It is not yet clear which equipment of the FSB asks to install services from the registry, but one thing is already obvious: they will have to do it at their own expense. The owner of the service, who had already connected the special service to the company's servers, told The Bell that this cost the amount noticeable for business, but did not clarify its order.

Another participant in the Ori list said that, according to their estimates, the “iron” for connecting to the FSB remote control, depending on the volume of traffic, can cost several million rubles - and given that there are very small companies in the registry, it can be a very sensitive waste for them.

Philip Kulin says that, not knowing what equipment companies put, it is difficult to evaluate its price - but you can figure out how much they will have to spend on the software “docking” of their systems with the FSB infrastructure: this development will cost even a small service 1-2 million rubles.

How to protect yourself to the user

The question is how to protect myself in the user in this situation: in the context, it sounds like “how can I protect my data from the FSB?” Romanov says.

But there are general rules:

• Do not use messengers and social networks;
• go to news resources and blogs only through VPN;
• Use browsers who do not give metadata that could be compared with you.

But the golden rule here is the same, says Romanov: “If you do not want any information about you to surfacing you on the Internet, then do not post it on the Internet.”