Rules requiring firms to store data of Russian citizens on Russian soil seen as a way for Putin to tighten control over internet

A new law has been implemented in Russia that in theory demands companies store data about Russian citizens on Russian territory, throwing thousands of firms with online operations into a legal grey area.

The law, which came into operation on Tuesday, is part of an attempt to wrest control of the internet, which president Vladimir Putin has called a “CIA project”. The Russian authorities are keen to ensure greater access for domestic security services to online data, and lessen the potential for foreign states, especially the US, to have the same access.

The law has created disquiet among internet giants such as Facebook, Twitter and Google, which would have to move data on Russian users to servers inside Russia and notify the Russian internet watchdog, Roskomnadzor, about their location.

As is often the case with Russian legislation, the exact scope of the law is unclear. It could be left largely unimplemented, but always available as a tool to use when required.

“There are a lot of nuances and indirect contradictions in the law,” said Irina Levova, strategic project director at the Internet Research Institute in Moscow. “For a start, it’s unclear what exactly ‘personal data’ means. Theoretically it means something that can identify an individual, so a Facebook account may not be enough; it doesn’t have to be your real name there.”

It is difficult, said Levova, to “get inside the head of our internet regulator” and understand what exactly the purpose of the law is.

Already, Roskomnadzor has made an exception for air travel data, which under international conventions must be stored internationally. Levova said the main target for now is the Russian-language segment of the market; companies that buy and sell products or services in Russia to Russians, but may store consumer data in servers offshore.

“Transnational internet giants are not the main object of attention for this law. It’s more about the banking sphere, air travel, hotels, mobile operators, e-commerce. This is what is important,” Roskomnadzor’s spokesman, Vadim Ampelonsky, told Kommersant-FM radio. However, while insisting there were no plans to bring Facebook and other major companies to book in the short-term, he implicitly left open the possibility it could happen later.

“We are not saying that if they don’t move their data to Russia, we’ll close them down, and in 2015 we definitely won’t say that. The plan for checks for 2015 has already been drawn up, and Facebook, Twitter and Google are not part of it,” he said.



“The law is not meant to be taken literally,” said Andrei Soldatov, an investigative journalist and co-author of The Red Web, an upcoming book about the internet in Russia. “The idea is to have a pretext to force these big global companies to talk to the Kremlin. It could also force them to open offices here, which would make them more amenable to pressure from authorities.”



Of the major internet giants, only Google has an office in Moscow. Facebook representatives have held meetings recently with Roskomnadzor officials to exchange views.

Soldatov said a major part of the law is Russia’s battle against the https protocol, used by Gmail and Facebook. The Russian security services’ system for monitoring the internet cannot handle https, due to the encryption used.



“When you reach Facebook it’s an unencrypted connection, but when you do anything on Facebook or send a message there, it goes through two or three servers, and that makes everything completely inaccessible. They need access before the encryption,” said Soldatov.

Some also saw a recent spat with Wikipedia as linked to the unease Russian authorities have over https. Wikipedia also uses the protocol, which means that in order to ban one specific page, the whole site must be banned. Russian authorities demanded that Wikipedia take down a page about a particular drug, and when Wikipedia refused, the whole site was briefly put on the list of banned sites.

In addition to making more data about Russian internet users potentially available to the Russian authorities, the law could also remove that access from the west. In the wake of the Edward Snowden disclosures, there has been discomfort in Russia and many other countries about the level of access US agencies have to data about internet users. In Russia, this also feeds into paranoia about political interference and regime change.

Russian parliamentarian Irina Yarovaya said last year that the internet “breaks down borders and undermines the idea of sovereignty”, saying the web was able to “encroach on internal sovereign interests and destroy national security”.

Last month, Russia’s security council chief, Nikolai Patrushev, said government officials should not use services such as WhatsApp and Google, as they were vulnerable to having their communications intercepted. Last year, President Putin claimed the entire internet was a “CIA project”. As such, there has been much discussion on how to create a Russian internet that would be free from foreign peeking, of which the new law is undoubtedly one element.

“It’s great they [the US] invented the iPhone but when you open your iPhone and see the camera you have to guess whether it’s photographing you at that moment or not,” said Russian oligarch Konstantin Malofeyev at an internet forum in Moscow earlier this year. “Russia went into space first and Antarctic first but we don’t control those things. They are controlled by international charters. Why should the US control the internet?”