Should anonymity be prohibited in instant messengers? Subscription agreement: how the ban on anonymity in instant messengers can affect users

On the prohibition of anonymity in instant messengers. It obliges message services to identify users by mobile phone numbers (in order to transfer data to the authorities when they ask for it) and to limit the distribution of messages at the request of an “executive authority” (which authority is not specified in the document). Services that refuse to comply with these conditions will be blocked.

Almost all popular messaging services require a number during registration - it is needed for authorization and user protection: to start using the application, you need to enter the code from the SMS that it will send. But no one bothers you to use another person’s number when registering. In addition, in Russia more than 70% of SIM cards are registered to individual entrepreneurs and other legal entities. The subscriber may be known on paper, but it is impossible to determine who actually uses the services. But changes are also expected in this area.

In fact, there are only two ways to block the messenger.

1). When blocking prohibited sites, providers use solutions based on DPI (Deep Packet Inspection) technology. The same hardware and software systems can be configured to block instant messengers.

2). Another way is to block instant messengers by IP addresses using any firewalls that providers have. The disadvantage of this option is that, along with instant messengers, other resources that use the same addresses will be blocked.

You can block any messengers you like, but it is an expensive and thankless task. If such a decision is made, it will only be in the interests of some structures or specific people who want to make money from it.

Will messengers be able to bypass the blocking?

They can. If they really want it. For example, it will be possible to regularly change the interaction protocol so that DPI solutions for identifying messengers are forced to constantly learn new signatures. It will be an endless race.

Another option is to use standard protocols. Then it will be difficult for blockers to distinguish the protocols of instant messengers from the protocols of allowed services.

In addition, messengers can rent address space from global cloud providers - so that the addresses belong not only to them, but also to other companies. But since Russia is 1–2% of the world market, hardly anyone will want to play such a game.

If messengers do not resist, will their users be able to bypass the blocking themselves?

If the messenger is truly convenient and useful, or simply really liked by users, people are likely to find a way. True, this requires a certain level computer literacy, but in Russia it is not very high.

There are paid and free VPN applications for all smartphones and other anonymizers. Another thing is that there are more such solutions for computers than for mobile devices, and they work better.

Can intelligence services already read correspondence in instant messengers?

If the service refuses to provide information, there are no legal ways to read encrypted correspondence. But you can use hacking methods.

Intelligence agencies can easily access the SMS of a person being monitored. In this case, only two-factor authentication can save the messenger from being hacked. It needs to be configured.

You can also infect your phone with malware software or, even simpler, intercept data for web access.

Cover photo: The Washington Post/Getty Images

Today, the State Duma adopted in the final third reading amendments to the Law “On Information” and the Code of Administrative Offenses, introducing sanctions for web resources for accessing prohibited sites. They will apply to all proxy and VPN services, as well as anonymous networks, such as Tor. Also in the third reading, the Duma approved the law on regulating the activities of exchange services by email(messengers) and measures aimed at combating illegal SIM cards. All these changes were adopted despite criticism from industry experts and business representatives.

Amendments by deputies Maxim Kudryavtsev (“ United Russia"), Nikolai Ryzhak (A Just Russia) and Alexander Yushchenko (Communist Party of the Russian Federation) suggest that Roskomnadzor will create a list of tools to bypass the blocking of prohibited resources, identify their hosting providers and other persons ensuring their operation. Providers who receive a notification from Roskomnadzor will be required to take action within 30 days or independently send to the agency an application for connection to the register of prohibited sites and readiness to block the resources listed in it. If service owners do not comply with the requirement, they themselves face blocking. At the same time, owners of programs, networks and services who use them for clients with whom they have an employment relationship will not be subject to sanctions.

The mechanism for restricting access to information resources based on decisions of Roskomnadzor is being implemented in order to prevent the onset of harmful consequences from the use of “means of bypassing blocking” and does not exclude the possibility of subsequent appeal of such decisions in court. At the same time, it will be not Roskomnadzor, but the FSB and the Ministry of Internal Affairs that will identify anonymizers.

Search engines are also required to apply to join the registry of blocked sites within 30 days at the request of the department. Having connected to the registry, the search engine is obliged to stop issuing links to prohibited sites and their pages on the territory of the Russian Federation at user requests. Failure to fulfill this obligation will result in a fine for citizens in the amount of 5 thousand rubles, for officials - 50 thousand rubles, for legal entities - 500–700 thousand rubles.

The amended law was adopted despite criticism from representatives of the Internet industry and business, who considered such regulation excessive and pointed to a violation of the rights of citizens enshrined in the Constitution. “Given the rapid development of the Internet and services associated with it, it is impossible to understand what exactly falls under the definitions of the bill,” Rambler & Co emphasized. “Even if a link to any resource is located in search results, this does not mean that the user, by clicking on the link, will be able to access the resource if the resource was blocked by a telecom operator or otherwise,” Yandex indicated. The law comes into force on November 1, 2017.

Also today, deputies in the third reading adopted a law banning the anonymous use of instant messengers - it will come into force on January 1, 2018. Its authors Marina Mukabenova (United Russia), Oleg Nikolaev (A Just Russia) and Alexandra Yushchenko (Communist Party of the Russian Federation) proposed that messenger owners enter into agreements with telecom operators - this will allow the user’s identity to be determined by phone number. In addition, messengers will have to limit the sending of messages at the request of government authorities. The government must determine the procedure for such a restriction.

These amendments have also been criticized: in May, the Russian Association of Electronic Communications indicated that the proposed changes were redundant and could be implemented within the framework of current legislation. The association also noted that the definition of “messenger” used in the bill may include any sites with the ability to correspond.

Another innovation was the adoption by deputies of amendments tightening the fight against illegal SIM cards. Now individuals will not be able to pay bills for mobile communications provided by SIM cards issued to legal entities without providing their own personal data. In turn, operators cellular communication got the opportunity to check information about subscribers using unified system identification and authentication, a single portal of government services and other systems of government agencies.

Georgy Mosalov, Anastasia Rumyantseva, Polina Poletaeva

Russian Prime Minister Dmitry Medvedev approved a government decree on the rules for registration in instant messengers. Now services will be required to check user data with the databases of cellular operators. Thus, only the person for whom it is registered will be able to use the application. telephone number. Experts are confident that such measures will allow the authorities to prevent the commission of illegal actions using anonymous accounts in instant messengers. At the same time, this resolution will not affect the activities of the services themselves and the convenience of their clients, experts are convinced.

Russian Prime Minister Dmitry Medvedev signed a decree on the rules for registering users in instant messengers by phone number. The document was published on the legal information portal. It will come into force in 180 days - May 5, 2019.

According to the text of the legal act, the messenger is obliged to confirm data about the user’s number by sending a request to the relevant mobile operator, which must confirm or deny the presence of the user in its databases within 20 minutes after the request.

If the presence of the user in the subscriber databases is confirmed, cellular company is obliged to enter into its database information about the messenger and the unique identification code that was assigned to the user by the application. In this case, already registered users will also need to undergo authorization.

“If information is not received from the operator within the prescribed period... or information is received about the absence of information about the subscriber in the databases, identification is considered failed,” the legislative act emphasizes.

When terminating a contract with a subscriber, the operator is obliged to notify within 24 hours those instant messengers in which the user was registered. After this, the application will have to start the re-identification process.

• RIA Novosti

Previously, to register in the messenger, it was enough to simply download the application and enter the code sent in an SMS message, reminded the head of Roskomnadzor Alexander Zharov. He emphasized that in this case it was possible to register for any number, including someone else’s.

“The possibility of anonymous communication in instant messengers makes it difficult for law enforcement agencies to investigate crimes. The current government resolution is a necessary step towards creating a safe communication environment for both citizens and the state as a whole,” Izvestia quotes Zharov.

The head of Roskomnadzor clarified that the owners of instant messengers are subject to administrative liability for violating the new resolution, but did not explain what it would be.

“The state must have leverage”

The state seeks to regulate the use of instant messengers, since with their help “coordination of illegal actions” is often carried out, Alexander Yushchenko, deputy chairman of the State Duma Committee on Information Policy, Information Technologies and Communications, noted in a conversation with RT.

“It’s either trade or dissemination of prohibited information. Phenomena such as, for example, extremism, which is also spread in instant messengers, have an extremely negative impact on fragile young minds. The state should have some leverage to influence or prevent this,” he said.

Thus, according to the FSB, in 2017, 25 terrorist attacks were prevented in Russia, while terrorists managed to carry out four attacks. Moreover, all terrorist attacks, according to the department’s statements, were coordinated, including from the territory of Syria.

The new law solves the problem of matching a messenger user with a real person, says Otkritie Broker analyst Timur Nigmatullin.

“If a crime occurs using social networks, for example, someone published illegal information on the VKontakte network, you can formally link the account to a specific person... This cannot yet be done in instant messengers,” he noted in a conversation with RT.

At the same time, the resolution will not significantly affect the activities of messengers, security expert Alexander Vlasov is convinced.

“This will not affect the work of messengers yet, because the same WhatsApp and Viber must first notify themselves that the user must log in only using the number with which he is registered,” Vlasov said in a conversation with RT.

“Nothing will change for users”

Law-abiding users will also not notice changes when using applications, digital economy expert Arseny Shcheltsin is convinced.

“As for users, I don’t think this will affect them in any way. I mean ordinary users who do not go beyond the law, do not distribute illegal content and do not engage in illegal activities by creating extremist pages, groups and dialogues... The main task of the resolution is to preventively analyze the page and determine its connection to a person,” he emphasized in a conversation with RT.

RT and the Megafon press service also said that there will be no changes for users. The company also noted that they are ready to comply with the resolution.

“We are ready to implement the government decree, since it was adopted in pursuance of the law that has entered into force. In fact, it introduces legal relations into existing actual relationships, when messenger users are identified by phone number. Nothing will change for users,” added the Megafon press service.

However, this resolution may create some problems for users. RT told about this ex-partner Pavel Durov by social network"VKontakte" Anton Rosenberg.

“No one wants to wait 20 minutes to register. Not all users are, in principle, ready to indicate first and last names, not to mention indicating full names, and judging by the text, if they indicate, for example, Vanya instead of Ivan, registration should be denied,” he said.

Rosenberg also pointed out that law-abiding citizens will be able to circumvent the new rule by registering an account in the messenger with a SIM card from another country.

Let us remind you that the activities of instant messengers are now regulated by amendments to the law “On Information, information technology and on the protection of information”, which came into force on January 1, 2018. The rule of registration using a code in an SMS message, for example, is provided for by this particular legal act.

Messengers are also required to provide users with the opportunity to refuse to receive messages from other subscribers, limit the spread of unlawful information and allow government agencies to carry out mass mailing messages.

The bill prohibits messengers from working with unidentified “in accordance with the established procedure” users. A messenger that does not follow the law will be blocked. For clarification, we turned to Oleg Nikolaev, a State Duma deputy who participated in the preparation of the document (A Just Russia faction, member of the State Duma Committee on Economic Policy, Industry, Innovative Development and Entrepreneurship).

About the purposes of the law

The first is to separate instant messengers into a separate segment and regulate it. Now the area is not regulated, which is why prohibited content circulates in it and at the same time a huge flow of information.

The second is to establish interaction between market participants in the segment and government agencies. So that the service organizer can register and identify himself.

The third is to make sure that behind the users of instant messengers there are real people who can be identified, and not bots.

The fourth is the opportunity to convey official information to people from government agencies, and in case of an emergency - to contact a person, warn or find him.

Messengers are increasingly used in terrorist attacks. Partially because in the unregulated segment there is an uncontrolled dissemination of information. And in order not to deprive people of the opportunity to use useful resources, but also to prevent use for illegal purposes and block dubious sources, legislative regulation is needed.

"Identification in accordance with the established procedure"

This means that the [messenger] service and the user are identified. The service is registered with Roskomnadzor (the bill, if adopted, will affect messengers registered with Roskomnadzor - ed.). The user is identified as a subscriber who purchased and issued a SIM card according to the rules.

How will the blocking happen?

Exactly the same way websites are blocked. And it will be temporary - as soon as the conditions are met, the blocking will be lifted.

How the changes will affect users

No way. Conscientious messenger operators have nothing to fear, and conscientious users have nothing to fear either. No one will notice changes in work, just as we do not notice the same regulation of SMS or calls.

Regulation will make it possible for the telecom operator to block dubious content and prevent uncontrolled distribution of information.

If the market is organized, users will be able to receive centralized newsletters. This is an emergency notification system or weather warnings, like those sent by SMS from the Ministry of Emergency Situations. Or, for example, recently there were problems with Megafon, and some messengers worked - it would be possible to send out a newsletter.

About anonymity

The government definitely doesn't want access to the correspondence. It wants to limit the spread of unverified, dangerous and extremist information. Messengers will be subject to the same laws on the protection of personal information and correspondence. This is also spelled out in the bill.

On the readiness of the law

The law requires improvement. The content will be supplemented taking into account the opinions of market players. There will be a round table, maybe two, on this topic. The law will undergo several readings. We will try to carry out the review and adoption during the spring session, that is, until the end of July.

Evgeniy Chereshnev, CEO Biolink.Tech

The law banning anonymity in instant messengers is, firstly, the height of technological incompetence: the people who proposed it have no idea how Internet identification and authorization technologies work - a telephone number has long been a rudiment and is absent as a class in many instant messengers – none of the commercial players in their right mind would change their business model in order to program a “crutch” into their product to please the government of one particular country, thereby significantly increasing their burden on product development and support.

Secondly, the true motive of this law is unclear - the reference by the Chairman of the State Duma for Information Policy Leonid Levin to the benefit of the draft law in limiting the actions of criminals is rather a screen to disguise actions aimed at justifying the expansion of state control over the freedom of private life.

Banning convenient methods of authorization and identification will lead to nothing in terms of finding criminals. There are open source technologies - anyone, including a criminal, can put together their own messenger in a matter of hours on their knees and communicate with anyone in encrypted form and without reference to a phone number. In fact, that's what they do.

In addition, I cannot help but draw attention to one fact that does not fit with the above motive: deputies propose to oblige messengers to provide selective blocking of messages and, vice versa, a “green light” for messages sent at the initiative of government authorities.

We are being asked to go back in time and in Russia again start managing the settings of advanced services manually. That is, what the deputies propose and what Mr. Levin considers positive, contradicts what Vladimir Putin is talking about, demanding that Russia move towards a digital economy. I find this extremely strange and ill-conceived.

Let's first learn how to build good roads throughout the country, and then we will regulate the Internet. During this time, specialists of the required level will grow up.

So far, unfortunately, legislators lack even basic technological expertise and we are getting such strange initiatives. The new law, in essence, says that every Internet user is required to have a phone registered with a Russian passport. And this is a worrying sign.

It turns out that if a precedent is created - if one application is forced to let people in only with a passport (in fact, this is so - this is the law) - then they can then force everyone else. The Internet using passports is the first path to digital slavery. All reasonable residents of Russia, I am sure, are disgusted by this approach. Personally, I am against this law for this reason.

What will happen to Telegram? Nothing bad will happen. Telegram already uses a phone number to authorize a user in its service. You can link any number, including buying any IP telephony number on the Internet and communicate easily.

The fact is that in Telegram, encryption works separately from identification - roughly speaking, the state, at best, can see that two people are communicating, but cannot see what they are talking about - since all correspondence is encrypted by algorithms with public key– no one can read it, not even the creators of Telegram. The technology of this type of encryption is not Durov’s monopoly - although I have great respect for him. This is how many popular instant messengers work.

And the law here should not rebel against the universe, but, on the contrary, help - make encryption of private correspondence a freedom protected by the Constitution of the Russian Federation.

Petr Lidov, PR Director of Megafon

The State Duma's motivation [in considering the bill] is clear. Such regulation of instant messengers should have happened sooner or later, since they replaced other types of communications, but are excluded from regulatory measures. It is quite logical to regulate instant messengers for security reasons. Limiting spam mailings, for example, extremist messages, is a normal measure.

There is a second point: if your SMS correspondence falls into someone else’s hands, there will be persons who can be legally held accountable for leaking information. And with information leakage from instant messengers, you won’t attract anyone. This is a matter of consumer control.

Financial benefits for operators mobile communications they won’t make money on this - such an idea (making money on instant messengers) would have been appropriate at the dawn of the technology. Our revenue is based on traffic mobile internet. And no one plans to bring all users back into calls and SMS. Here, rather, we will adapt. But the costs of messenger operators will most likely increase in application production. As for the anonymity of correspondence, the same legislation applies here as in the case of SMS and calls.

Dmitry Ogorodnikov, director of the information security competence center at Technoserv

The fact that it is necessary to establish the user’s identity by mobile number and by agreement of the telecom operator is questionable. Experts believe that this bill is useless. If necessary, it is possible to identify the user by IP address and subscription agreement. The contract contains passport data and copies of documents. This project does not even reflect the possibilities for timing and registration of user data. It is absolutely clear that the law has not been worked out. If we take, for example, the jurisdiction of other countries, then the share of Russian users on WhatsApp is about 2% of the billion-strong audience. No one will try to put the data in order. This means that, apart from a new bureaucratic problem, no solutions are planned to simplify the use of messengers at all.

On amendments to the federal law “On information, information technologies and information protection”. This document, in essence, proposes to prohibit anonymity in instant messengers by introducing mandatory user identification by the telecom operator.

Ban on anonymous posts

According to the explanatory note to the document, this bill is intended to regulate the activities of organizers of the exchange of electronic messages, that is, instant messengers.

“The bill defines the concept of an organizer of instant messaging and imposes on this entity the obligation to ensure the transmission of electronic messages only to those Internet users who are identified in the manner established,” the text of the draft says.

Thus, a user who has not been identified according to all the rules will not be able to use the messenger services and exchange messages.

User identification is required to be carried out by telecom operators based on the number mobile phone under an agreement concluded with the organizer of the exchange of electronic messages.

In addition, messengers must provide the user with the technical ability to refuse to receive messages from another user, and also be ready to provide mass mailings at the initiative of government authorities. The bill also separately stipulates the obligation to ensure the confidentiality of transmitted electronic messages.

The organizer of the exchange of electronic messages is obliged to limit the sending and transmission of messages containing information, the dissemination of which is contrary to the laws of the country. As told "Interfax" one of the authors of the project, such information includes, for example, a call to participate in unauthorized street protests.

If the messenger refuses to comply with the requirements of the authorized federal executive body, it may face blocking on the territory Russian Federation. In addition, in parallel, bill on administrative fines for failure to fulfill duties: 3-5 thousand rubles. — for individuals, 30-50 thousand rubles. — for officials and from 800 thousand to 1 million rubles. - for legal entities.

Both laws must come into force on January 1, 2018, by which time organizers of the exchange of electronic messages are required to bring their activities into compliance with the requirements set out in the legal document.

The press service of the Media Communication Union (MKS) told Gazeta.Ru that

The need for a bill on the regulation of instant messengers is caused by the presence of legal relations that are outside the framework of Russian legislation, which includes communication in instant messengers.

There are no tools for users of such services to protect their rights, for example, in the event of receiving threats in instant messengers or mailings to which the user did not subscribe. With the introduction of instant messengers into the legal field, users can finally count on their rights being respected.

The introduced bill is generally based on the expert developments that were proposed by the ISS, and was finalized by deputies taking into account the additions and recommendations of industry regulators.

“De facto, most instant messengers already use the subscriber number to identify the subscriber, and he will not be required to take any additional actions when the law comes into force,” the ISS explained.

The PR director also confirmed to Gazeta.Ru that

Most messengers already ask for a phone number during registration, so the State Duma is essentially “formalizing what already exists.”

“The bottom line is that the country has certain legislation in the field of communications. But the world is changing, new forms of communication are emerging that need to be brought under existing laws,” explained Lidov.

The law will only affect ARI

The law, if adopted, will apply only to those messengers that are in the register of information dissemination organizers (ORI), formed by Roskomnadzor. At the time of publication of the note, there are 81 resources on the ORI list, including services, VKontakte and some others.

The bulk of the list consists exclusively of Russian websites, but in the spring of 2017, the Swiss messenger Threema appeared on it, which supposedly has increased security of personal data thanks to end-to-end encryption.

In early May, Roskomnadzor blocked the famous Chinese messenger WeChat in Russia, adding it to the register of prohibited resources. A few days later, the owners of the messenger provided the data requested by the supervisory authority, and access to it was restored.

The popular messengers Viber, WhatsApp, Telegram and Facebook Messenger in Russia are not yet included in this register of information dissemination organizers. The representative previously refused to say whether the agency had contacted these companies with a request to provide data for inclusion in the ARI list.