Is Russia's Surveillance State Being Modelled on the West?
New Russian anti-encryption and data retention laws look sadly familiar.
St. Petersburg, Russia—Did legislation in the United Kingdom and the United States inspire Russian authorities to adopt their country's new domestic spying laws? Maybe.
On July 7, Russian President Vladimir Putin signed the "Yarovaya Law," which came into effect earlier this week. The Yarovaya Law—named after Irina Yarovaya, the ultraconservative legislator who pushed for it—is styled as an "anti-terrorism" measure. Among other things, it mandates that telecommunications and internet service providers store all telephone conversations, text messages, videos, and picture messages for six months. In addition, telecom companies must retain for three years customer metadata—that is, data showing with whom, when, for how long, and from where they communicated. The law requires "the organizers of information distribution on the Internet" to do the same thing, except they need only retain the metadata for only one year.
Under the Yarovaya Law, providers of telecommunication services, such as a messenger app, a social network, an email client, or a website that encrypts its data, are required to help Russia's Federal Security Service decipher any message sent by its users. In other words, the new law essentially requires internet service providers to install back doors in their services. The fine for refusing to cooperate can be as high as a million rubles (more than $15,000).
In order to comply, telecommunications firms operating in Russia claim that they will have to build vast new data storage infrastructure costing many times more than they now make in profits. They also point out that most of the data storage technologies being required are manufactured outside of Russia. And they plausibly argue that the new rules will bring information technology investment and innovation in Russia to a halt.
From the authorities' point of view, the fact that most Russian telecoms will not be able to comply with the Yarovaya Law is a feature, not a bug. As the U.S.-based Electronic Frontier Foundation notes, those companies are now "de facto criminals," giving the Russian government "the leverage to extract from them any other concession it desires."
Russia Direct tellingly observes that "in Russia, the legislation is compared to the USA Patriot Act." But there is one big difference: "While the Patriot Act prescribed covert surveillance of citizens, the new so-called 'Yarovaya Law' mandates open surveillance." Russia is implementing what some lawmakers in the United States and the United Kingdom have long advocated in their own countries.
For example, Britain's Investigatory Powers Bill, nicknamed the "Snooper's Charter," was just passed by an overwhelming majority in the House of Commons and is now under consideration of the House of Lords. It sets up a review process that will likely end up authorizing the bulk collection and retention of telecommunications and internet metadata. (Earlier this week, the Court of Justice of European Union ruled that Britain's data retention mandates violate the right privacy of its citizens. But Brexit will make such rulings moot.) And like its Russian legal counterpart, the Investigatory Powers Bill gives the British government the authority to ban end-to-end encryption in telecommunications and web services and to force companies to provide "back doors" so that government spies can listen to and read citizens' communications. The House of Commons adopted this legislation in June, before the Russian Duma passed its new domestic spying law.
How about the United States? No doubt the extensive capabilities exercised in secret by the National Security Agency disclosed in 2013 must have elicited considerable professional envy among Russian spy agencies. Still, those revelations did provoke alarm among civil libertarians at home, prompting Congress to pass the USA Freedom Act last year, ending the National Security Agency's clandestine bulk collection of Americans' telecommunications data. Some analysts argue that despite this, when it comes to the NSA's domestic spying not much has actually changed.
Meanwhile supporters of domestic spying have been indefatigable in proposing legislation to undermine the privacy of U.S. citizens. For example, during the run-up to the passage of the USA Freedom Act, Senate Majority Leader Mitch McConnell (R-Ky.) proposed an amendment that would have required telephone companies to alert the government six months in advance before they change their data retention practices to keep phone records for less than 18 months. This was evidently so that spy agency officials would have an opportunity to intervene and try to force companies to continue to retain customer records. More recently, Sens. Dianne Feinstein (D-Calif.) and Richard Burr (R-N.C.) introduced in April the Compliance with Court Orders Act of 2016, which would force telecommunications and internet companies to obey court orders demanding access into their devices or services. Sounds reasonable, but the upshot is that the legislation would compel web service providers to create back doors enabling government snoops to read their customers' encrypted communications.
So was Russia's new Yarovaya Law actually inspired by British and American legislation, or is this case of independent invention? We can't say for sure. But the West's laws certainly didn't help.
