Medvedev approved the identification of instant messenger users by phone number. Law on messengers: What will happen to Telegram and Tor How the changes will affect users

The course to combat anonymity on the Internet continues. Today, in the first reading, the State Duma adopted a bill on the regulation of instant messengers. According to the document, users will have to be identified by phone number. Amendments will be made to the law “On Information, information technology and information protection."

In addition to identification, the bill talks about the possibility of sending electronic messages at the initiative of public authorities. This is necessary for emergency situations when the population needs to be promptly warned of danger.

And, of course, the main goal is to limit the transmission of messages with data that violates Russian legislation and to prevent terrorist acts.

Tsargrad spoke in detail with the director of the Safe Internet League, Denis Davydov, about this initiative, as well as about anonymity on the Internet.

Everything is possible in technology

- How do you assess the legislative initiative? What do you see as the pros and cons?

The initiative is timely to say the least. The Safe Internet League talked about identification in instant messengers (and not only) several years ago. It's good that the process has moved forward.

Firstly, this is important for preventing terrorist attacks. These are anti-terrorist and anti-extremist actions and activities. Everything that is aimed at ensuring public safety and increasing the level of anti-terrorism resistance.

Head of the Safe Internet League Denis Davydov: “There is no anonymity for the state.” Photo: Mikhail Pochuev/TASS

It has long been said that, unfortunately, terrorists and extremists also use these means of communication, messengers. And if law enforcement officers do not have the legislative tools for an effective fight, it will obviously be a losing battle.

Therefore, the initiative is very timely and correct. And technically feasible. Any technical initiatives are feasible - this is technology. When someone says that something is impossible in the technological sphere, this is a lie and distortion - everything is possible there. If there is technology for disseminating information, then there is technology to ensure the implementation of laws. Including methods of identification.

There was a lot of controversy on this topic. There has been a lot of talk about the fact that in some European countries authorization in Wi-Fi networks has been in effect for many years. One way or another, authorization and identification are already existing mechanisms. Therefore, we can say that the law will work. Those who say otherwise are somewhat disingenuous. The main thing is how regulators will implement this law, because the main thing is technical implementation.

As for the weaknesses... The weaknesses of any law primarily lie in the fact that technology develops faster than legislative and law enforcement practice. Of course, it is necessary to keep up with the times: to monitor how technology develops, what is used by attackers and scoundrels - so that the state can be fully armed and counter threats in time.

There is no anonymity for the state - even on Telegram

- Many people have asked on popular telegram channels whether anything will change after the adoption of the bill. After all, Telegram is also a messenger, but if you want to remain anonymous, no one will recognize the authors of popular blogs...

The correspondence between users itself can be encrypted, but users already use mobile numbers when registering. Telegram does not work without being linked to mobile number. And, frankly speaking, there are no obstacles for the intelligence services to understand who is behind this or that telegram channel.

Now they are talking about anonymity in telegram channels, which does not exist. Because there is no problem for the state to remove this anonymity. Everything else is speculation on this topic. Of course, this will not affect these channels in any way - they can be anonymous for a wide range of users, but for the state - for intelligence services, for law enforcement agencies - no anonymity exists. This is just a matter of not very much time and competence in carrying out technical activities. And our special services are great masters at this.

Uberization of crime

- You have already mentioned simplifying the fight against terrorists. Many also hope that it will be easier to identify cyber fraudsters...

Hard to tell. I wouldn't rejoice prematurely. The peculiarity of cybercrime is that the so-called Uberization of crime occurs - when entire cybergangs are formed on the Internet and, as a rule, their members do not even personally know each other in life. They commit a crime that may consist of small pieces of crime - some of the types of work cybercriminals do are not even crimes in the criminal codes of some countries, including ours.

Therefore, it is too early to say that we will defeat cybercrime. I would consider the security system of our country as a complex of measures. Because the bill on instant messengers itself should be closely connected with others - for example, an initiative to ban anonymizers and VPN channels that are not registered or unknown to government agencies or regulators.

If we consider the problem information security as a comprehensive one, then, of course, this will also make it possible to combat cybercrime. The de-anonymization measure itself is unlikely, but the set of measures is definitely yes.

There is no trick against Thor?..

- People are also haunted by Tor - a space where everything is possible. Where there are also anonymous messengers. There is a lot of debate about whether it can be limited or prohibited; various arguments are given. In this case, given the de-anonymization measures, can we at least somehow influence Tor?

It’s hard to say... If it becomes impossible to use Tor on the territory of the country, if all Russian operators stop providing access to Tor or its nodes, then it will be impossible to use its messengers. Such initiatives are under consideration.

Therefore, there must be a comprehensive security system. When someone says "it can't be done," think about your corporate network. For example, is it possible to use Tor in Constantinople? No you can not.

The state and its regulators can also turn things on and off. Therefore, if something can be done in a corporation, why not at the country level? There are no problems here. Yes, it will be more expensive - but the scale will be different. Yes, it will be more expensive and more players will be included, including telecom operators...

Of course, there will be those who will use the satellite communication system. Those who will try to hide. But their number in the total number of criminals will tend to zero. By and large, we are reducing the room for maneuver for various attackers. If you make it very difficult for attackers to use services, if an attacker thinks: why should he use Tor if the FSB finds him there, then they will use less or make a mistake and be caught. In any case, this will have a beneficial effect on our security. Definitely.

The government has approved rules for identifying instant messenger users with the help of telecom operators . The corresponding resolution signed by Prime Minister Dmitry MedvedevOctober 27, Tuesday was published on the legal information portal.The rules will come into force in 180 days.

According to the document, messengers will have to check information about the user’s number at his mobile operator. As follows from the resolution, for this the messenger sends a request to the operator, and he must conduct a check and respond within20 minutes. If the numbers are in the operator's database it won't turn out or the operator will not answer, the messenger will not will register the user. If a user who has already passed verification later changes his information or changes his phone number, he will need to go through the procedure again.

After registering toEach user will receive a unique identification code in the messenger. The messenger will transfer this data to the operator, and he will have to enter it into his database, indicating, in which application this client is corresponding.

Old messenger users will not have to undergo identification if the data is alreadyreceived from them by the service, andthe information available to the operator will match.

If a user who has previously completed the identification procedure terminates the contract with the operator, the latter must notify the messenger about this within 24 hours. The messenger, in turn,within 20 minutes after receiving such notificationis obliged to re-identify the user. If this fails, registration is considered unsuccessful and the user will not be able to usemessenger, follows from the document.

The head of Roskomnadzor, Alexander Zharov, explained to Izvestia that the anonymous use of messengers interferes with the investigation of crimes. In addition, during correspondence, it is important for users to know “who is really on the other end of the line,” Zharov noted. “The current government resolution is a necessary step towards creating a safe communication environment for both citizens and the state as a whole,” he is confident.

Press service MTS told the newspaper that the requirements are technically feasible, but will require modifications to the equipment.“We are ready to implement the government decree, since it was adopted in pursuance of the law that came into force [on regulating the work of instant messengers],” a Megafon representative told Vedomosti. It introduces existing actual relationships into legality, when instant messenger users are identified by phone number. Nothing will change for users, the operator’s representative assures.A VimpelCom representative declined to comment.

On amendments to the federal law “On information, information technologies and information protection”. This document, in essence, proposes to prohibit anonymity in instant messengers by introducing mandatory user identification by the telecom operator.

Ban on anonymous posts

According to the explanatory note to the document, this bill is intended to regulate the activities of organizers of the exchange of electronic messages, that is, instant messengers.

“The bill defines the concept of an organizer of instant messaging and imposes on this entity the obligation to ensure the transmission of electronic messages only to those Internet users who are identified in the manner established,” the text of the draft says.

Thus, a user who has not been identified according to all the rules will not be able to use the messenger services and exchange messages.

User identification is required to be carried out by telecom operators based on the number mobile phone under an agreement concluded with the organizer of the exchange of electronic messages.

In addition, messengers must provide the user with the technical ability to refuse to receive messages from another user, and also be ready to provide mass mailing at the initiative of government authorities. The bill also separately stipulates the obligation to ensure the confidentiality of transmitted electronic messages.

The organizer of the exchange of electronic messages is obliged to limit the sending and transmission of messages containing information, the dissemination of which is contrary to the laws of the country. As told "Interfax" one of the authors of the project, such information includes, for example, a call to participate in unauthorized street protests.

If the messenger refuses to comply with the requirements of the authorized federal executive body, it may face blocking on the territory of the Russian Federation. In addition, in parallel, bill on administrative fines for failure to fulfill duties: 3-5 thousand rubles. - For individuals, 30-50 thousand rubles. — for officials and from 800 thousand to 1 million rubles. - for legal entities.

Both laws must come into force on January 1, 2018, by which time organizers of the exchange of electronic messages are required to bring their activities into compliance with the requirements set out in the legal document.

The press service of the Media Communication Union (MKS) told Gazeta.Ru that

The need for a bill on the regulation of instant messengers is caused by the presence of legal relations that are outside the framework of Russian legislation, which includes communication in instant messengers.

There are no tools for users of such services to protect their rights, for example, in the event of receiving threats in instant messengers or mailings to which the user did not subscribe. With the introduction of instant messengers into the legal field, users can finally count on their rights being respected.

The introduced bill is generally based on the expert developments that were proposed by the ISS, and was finalized by deputies taking into account the additions and recommendations of industry regulators.

“De facto, most instant messengers already use the subscriber number to identify the subscriber, and he will not be required to take any additional actions when the law comes into force,” the ISS explained.

The PR director also confirmed to Gazeta.Ru that

Most messengers already ask for a phone number during registration, so the State Duma is essentially “formalizing what already exists.”

“The bottom line is that the country has certain legislation in the field of communications. But the world is changing, new forms of communication are emerging that need to be brought under existing laws,” explained Lidov.

The law will only affect ARI

The law, if adopted, will apply only to those messengers that are in the register of information dissemination organizers (ORI), formed by Roskomnadzor. At the time of publication of the note, there are 81 resources on the ORI list, including services, VKontakte and some others.

The bulk of the list consists exclusively of Russian websites, but in the spring of 2017, the Swiss messenger Threema appeared on it, which supposedly has increased security of personal data thanks to end-to-end encryption.

In early May, Roskomnadzor blocked the famous Chinese messenger WeChat in Russia, adding it to the register of prohibited resources. A few days later, the owners of the messenger provided the data requested by the supervisory authority, and access to it was restored.

The popular messengers Viber, WhatsApp, Telegram and Facebook Messenger in Russia are not yet included in this register of information dissemination organizers. The representative previously refused to say whether the agency had contacted these companies with a request to provide data for inclusion in the ARI list.

Back in October last year, Dmitry Medvedev signed a decree according to which new rules for identifying subscribers in all popular instant messengers came into effect in Russia as of May 5, 2019. We propose to understand in more detail what the innovation is connected with and what will change for users of Viber, Skype, WhatsApp, Telegram and other widely used applications.

Signed on 10/27/18 and published on 11/06/18, the resolution “on the identification of messenger users by personal number telephone” is one of the stages of the program to combat fraudsters who use cellular communications for illegal purposes. According to the text of the document, the new norms come into force 180 days from the date of publication, which means 05/05/19. During this period mobile operators, operating outside the territory of Russia, must be technically prepared to implement the new authentication rules.

Let us remind you that in order to protect citizens of the Russian Federation from telephone swindlers and fraudsters, as well as to simplify the work of the Ministry of Internal Affairs during the investigation of various types of crimes, since 2018, each SIM card of a mobile operator that assigns a specific phone number to the subscriber must be officially registered on specific person. To complete the registration procedure, the owner must provide passport data, which the operator enters into a single database, to which law enforcement agencies have access.

This means that after the introduction of mandatory authentication for messenger users, a clear connection will be established between a person’s account in a particular application and his passport data.

The innovation has several goals:

1. Increasing the security of subscribers, because in the absence of anonymity the number of people who want to break the law will significantly decrease.
2. Simplifying the work of employees of the Ministry of Internal Affairs and ensuring maximum quick access to customer information cellular network and applications used.
3. Creation of a single database, which, in addition to many other functions, will allow collecting statistics on the use of certain instant messengers by users mobile communications.

Practical implementation

The messenger subscriber authentication process will become mandatory for those who want to create new account, and for those who already use Viber, Skype, WhatsApp or Telegram applications.

The procedure will take no more than 20 minutes. This is exactly how much it will take to check user data in the operator’s database cellular communications. The whole process will occur according to the following algorithm:

1. The user installs the application and provides his data when registering.
2. The messenger system sends a request to the mobile operator to confirm the data.
3. After receiving confirmation that the data matches, the subscriber is given access to the messenger, and the mobile operator enters information into the database that the client is using a specific application.

Naturally, if the response from the mobile operator is negative, using the application on a smartphone, tablet or computer will be impossible.

What will change for subscribers

To everyone who, according to last year’s innovations, successfully completed the registration procedure telephone number Having provided your mobile operator with your passport data, there is absolutely nothing to be afraid of.

Population surveys show that the biggest fear in Russia is that after new, stricter rules for identification by phone number for users in instant messengers came into effect on May 5, 2019, people will lose their previously guaranteed confidentiality.

Answering questions from journalists back in November last year, Alexander Zharov (head of Roskomnadzor) explained that “anonymity” in mobile applications– this is a beautiful myth for users. It’s simple - at the time of installing the messenger, you yourself provide the program with full access to the device (without this, the installation will not be completed), which means that the mobile operator’s employees can easily identify the user. This can be confirmed by official data on the use of instant messengers by smartphone owners for 2018, collected by mobile operators.

What will change with the introduction of new rules?

• Employees of the Ministry of Internal Affairs will be able to obtain the necessary information much faster.
• The number of offenses will decrease, because people will know that their actions will be punished.

Who may have problems

Problems with using instant messengers may arise for those who, after the introduction of mandatory SIM card authentication using a passport, continue to use phone numbers registered to third parties. Unfortunately, the process of re-registering a number for a new user requires the presence of two people - the one who previously owned the SIM card and the new owner. If it is not possible to find the person for whom the number is recorded, an insoluble problem arises.

It is easier for everyone who finds themselves in a similar situation to change their number by registering a new SIM card for their passport. Although for many people changing their number is associated with some inconveniences, neither the authors of the innovations nor the mobile operators of the Russian Federation can offer any other solution.

© Photo from K. Kazaryan’s Facebook page

Let us remember that the law obliging instant messengers to identify users by mobile phone number was adopted last fall. It came into force on January 1, 2018. According to the document, if the resource administration was unable to confirm the user’s identity by subscriber number with a cellular operator, he should be blocked. Otherwise, the company faces a fine - from 800 thousand to 1 million rubles. Almost a year has passed since the law was adopted, but it still has not taken effect. Does he have a chance with the adoption of new identification rules, and what this procedure will look like in practice, a leading analyst of the Russian Association of Electronic Communications (RAEC) told Rosbalt Karen Kazaryan.

— The law on the identification of instant messenger users was adopted last fall, but still does not work. Will the new rules adopted by the Cabinet change this?

- No. In addition to the rules, it is necessary to adopt a number of by-laws, which still do not exist.

— Will all users have to undergo identification or only new ones?

— This law has no retroactive effect. This means that those who already use instant messengers will not be affected by identification. It will only affect new users who will register after the law comes into force.

— According to the new rules, after registering in the messenger, the user will have to “perform an action using the subscriber number that allows you to reliably establish that the subscriber number reported when registering in the instant messaging service is used by the user.” What is it about?

— Well, each messenger has its own confirmation procedure: some ask you to enter a code from an SMS, others ask you to make a call to a specific number. It is not very clear what this will look like in the future, so the wording in the law is rather vague.

— Do I understand correctly that after this procedure, the administration of the messenger sends a request to the mobile operator?

- As it will be? So I register in the messenger, indicate my phone number, and confirm it. Next, the resource administration sends a request to the telecom operator to find out if they have me in their database. What exactly should the operator answer? Is such a number even registered on the network? Who exactly is it registered to? Does this mean that when registering in the messenger, I will have to indicate my real first and last name, and maybe my passport information, so that later the resource administration can check all this with the mobile operator’s database?

“There is not a word about this either in the law itself or in the identification rules. There are no explanations about what kind of information the messengers ask from mobile operators.

— I don’t know if it makes sense to ask this question now, but I’ll ask anyway: according to the new rules, the mobile operator has 20 minutes to respond to the messenger administration. If he answers that there is no data about such a subscriber in the database or does not answer at all, then the identification is considered failed. By law, the messenger must block the user in this case. Including simply because the cellular operator did not respond.

“This is another problem why the identification law will not work. It is not stated anywhere that the mobile operator is obliged to cooperate with instant messengers and provide them with any information. And there is no punishment for simply not answering. In addition, it is still unclear who will pay for identification, as the Ministry of Economic Development pointed out in its response to the bill. After all, messengers and mobile operators will have to carry out certain work. And the SMS itself is also worth something.

— Which messengers are covered by the law? After all, VKontakte and Facebook also have the ability to exchange instant messages.

— Roskomnadzor maintains the so-called register of “Information Dissemination Organizers (IDOs)”, which are subject to the law. Currently, the only known resources in Russia include Telegram and VKontakte, as well as Snapchat, WeChat, Line Chat. Neither WhatsApp, nor Viber, nor Facebook Messenger, nor even Tam Tam are on this list.

- How did this happen?

— There are two ways for companies to enter the Roskomnadzor register: either they submit an application themselves, or they are forced to be included in this list - by decision of the national security authorities. Since they haven’t done this for WatsApp or Viber, it means there’s no need for it yet.

As for voluntariness, formally all companies that provide users with the ability to exchange instant messages actually had to submit applications to Roskomnadzor themselves to be included in the register. But there are no sanctions for failing to do this.

— Do I understand correctly that this entire identification law is tied to the Roskomnadzor register, and the demand is only from those who are listed in it?

“It’s probably wrong to say that.” Formally, the law has a specific legal definition of the concept of “organizer of information dissemination.” Another thing is that law enforcement is really tied to the inclusion of such companies in the register.

It is not possible to view the entire list of companies included in the list of information dissemination organizers on the Roskomnadzor website. You can only check by the name of a particular company whether it is there or not.

As of August 10, 2017, there were 89 companies on the register. As RBC wrote, among them at that time were email clients Mail.Ru Group and Yandex, cloud service“Yandex.Disk”, social networks “My World”, “My Circle”, “VKontakte”, dating services Mamba, Badoo, messengers “[email protected]”. “Due to reluctance to provide data for inclusion in the registry, the online radio Zello, BlackBerry and Imo messenger sites were blocked in Russia. A Zello representative called the department’s demands “absurd and impracticable,” the publication noted.

Later, Roskomnadzor announced that it was negotiating with the largest international IT companies such as Facebook, WhatsApp, Viber, Apple, Twitter, which are in the process of making a decision on entering the ARI register. “We respect the right of companies to confidentiality of negotiations, therefore we do not make the results of their intermediate stages public. You need to understand that these are global corporations with complex system management and coordination of legally significant actions. But what is important to us is the company’s desire for cooperation. If it is clearly indicated, we have procedural capabilities to provide the service with the additional time necessary to agree on the final decision,” Deputy Head of Roskomnadzor Oleg Ivanov told Rossiyskaya Gazeta back in April 2018. Since then, there has been no public information about the inclusion of WhatsApp, Viber or Facebook in the register.

Interviewed by Anna Semenets