May 5, 2021
Russia’s Broken Web of Internet Laws
A Deep Dive into Five Laws
In March 2021 Russia used the latest in a series of newly passed Internet laws for the first time. The ‘sovereign’ 2019 law was used to throttle Twitter’s speed by 50% on desktops and by 100% on mobile phones. This move was triggered by Twitter’s non-action in deleting content considered illegal by the Roskomnadzor (RKN), Russia’s federal authority overseeing online and media content. This illegal content included the Twitter accounts of several government critics, such as Mihkail Khodorkovsky. This government action was legitimized through the Sovereign Internet law of 2019, which empowers the RKN to respond through appropriate measures to “security threats to the Internet’s functioning inside Russia” such as “changing the configuration/routes of communications/telecommunications.”
Over the past few years, the Russian Parliament has passed over fifty pieces of legislation in an attempt to further control and hegemonize the Russian Internet infrastructure, both internally and externally. While the official justification for these laws is to create a more ‘reliable’ internet, in actuality, some of these laws have provided nearly unfettered freedom to the government to preemptively block and filter content and independently — without relying on Internet intermediaries, or on securing prior judicial sanctions.
This article hopes to shed light on the top five most important of these laws or combination of laws and their consequential effect in crippling Russian democracy, freedom of speech, and privacy rights.
Number 1: Laws mandating identification and de-anonymization
A 2017 law and the following government regulation in 2018, have effectively eliminated any means for Russian citizens to raise their concerns with the government anonymously without the fear of facing backlash. The law has mandated that every user of an online application which can be used for “receiving, transferring, delivering or processing users’ electronic messages on the internet” has to link their account with a registered mobile number so that they can be identified and tracked if need be. Non-compliance by platforms leads to an imposition of a fine amounting to USD 82 for individuals, USD 800 for officials, and USD 16,500 for companies. Per the law, non-compliance may also lead to the blocking of the platform in Russian territory. It is a small respite that at the moment, these laws are only applicable to online messaging platforms, relieving other OSPs from the compulsory linking of accounts for the time being.
Further, the 2018 regulation, which is yet to be implemented, requires such online messaging applications have to partner with mobile operators to ensure that the latter are willing to confirm the identity of any of its users within twenty minutes of such information being sought. As with most other laws discussed in this article, the penalty for non-compliance is the blocking of the online service.
This law hits at the heart of an important way in which online communication can foster open dialogue — the ability to stay anonymous, especially when showing dissent. It would also have a major impact on citizens’ ability to express their religion, faith, and sexuality, which have long been penalized by the Russian government.
Number 2: The double-edged sword of content moderation laws
In 2013, the Logovoy Law was passed, which empowered government officials to block content ‘calling for unsanctioned public events that disturb public order’ within 24 hours and without a court order. In 2019, another draft law, yet to be passed, would give Russian authorities the ability to block websites that censor Russian state media content. Ironically, the reason that the bill provides for this is that such websites violate Russian citizens’ right to access information.
In 2019, four sets of laws were passed that have had the cumulative effect of prohibiting the dissemination of “fake news” and news that is deemed “disrespectful” to the state and government officials. The RKN has the authority to delete such information with immediate effect. The stipulated fine for non-removal amounts to USD 6,400 for individuals and up to USD 24,000 for companies. Repeat offenders “disrespecting” the state could also be imprisoned for up to fifteen days. As a brief aside, the term “disrespectful” being used as a measure for potential jail time brings to mind a 2014 judgment of the Indian Supreme Court that held the word “annoyance”, in the same context and for similar penalties, as vague and overbroad.
In 2020, the Federal law N482-FZ was passed, which was a sophisticated version of the 2019 draft law discussed above. It essentially penalized OSPs such as YouTube, Facebook, and Twitter for censoring Russian state media content. For context, there has been substantial research to show that Russian state media spreads disinformation among its citizens and globally. For instance, this paper highlights how RT (formerly, Russia Today) is an “opportunistic channel that is used as an instrument of state defense policy to meddle in the politics of other states”. However, if any of the tech giants censor content like RT’s, they can now be fined or potentially blocked.
Finally, in January 2021, the Russian parliament has started working on a draft law to fine social media for “illegally blocking users”. This move seems to be a consequence of the ban on USA former President Donald Trump’s Twitter account.
Number 3: Surveillance through laws on forced Data Retention and Data Localisation
The 2016 “Yarovaya amendments”, which have been named after their primary author and member of the State Duma (Russian Parliament’s legislative wing), Irina Yarovaya, provides for compulsory retention of all communications for six months. This includes text messages, voice messages, images, and videos. In addition, it also provides that the metadata that marks the location, timestamp, sender, and receiver of the messages, be retained for three years. The amendments also mandate that this data be stored on Russian territory and that the government be given unfettered access to this data without any prior judicial sanction. Since 2016, LinkedIn, Twitter, and Facebook have been penalized for non-compliance. While Twitter and Facebook were fined approximately USD 50,000 each, the government blocked LinkedIn from the Russian territory entirely. Further, in 2019, the fines for non-compliance with data storage requirements have been increased to USD 78,000.
Additionally, the amendments make way for ‘back door’ access to all such data by requiring companies to provide the government with ‘any information necessary’ to decode electronic messages. This drastically weakens the security of such information and weakens encryption measures.
The Yarovaya amendments requirement to provide a direct and unrestricted back door to access data, coupled with the compulsion to not only localize data but also to retain it for long periods of time effectively means that every conversation/post/discussion can potentially be served on a platter to the Russian government. This is a sticky situation for all involved, but especially for human rights activists, political rights activists, and journalists, such as Alexei Navalny, who will be acutely aware that their conversations and metadata, oftentimes confidential, are exposed to the domestic intelligence agencies. This hampers their ability to work and engage in very important and democratic dialogue freely.
The full implications of such a law were on display in April last year, when the RKN blocked Telegram, a messaging app with over 10 million Russian users, for refusing to provide encryption keys to the government. RKN also ordered the blocking of over 18 million IP addresses, used by Telegram to operate in Russia. This led to chaos and affected many legitimate online services including maps, airline booking, and online shopping, among others.
Number 4: Laws Banning IP addresses and regulating VPNs and Proxys
The various pieces of legislation discussed in this article have been further bolstered by a 2017 law that imposes fines on Virtual Private Networks (VPNs) for allowing users access to content banned by Russian authorities or for providing guidance to access such content. In a bill introduced in 2018, a fine of USD 9,000 was stipulated for non-compliance. This 2018 bill was a result of the above-mentioned ‘Telegram blocking’ incident, after which many Russians turned to VPNs to be able to continue business
Further, a 2019 regulation now requires that VPNs and search engine platforms stay updated with a list of blocked websites maintained by the federal government and on the basis of this list, block access to those websites on their platform.
Number 5: Law creating an independent Russian Internet Infrastructure
The crown for the most restrictive law proposed by the Russian parliament arguably goes to the Sovereign Internet Law of 2019. It seems that the Russian government fully understands and fears the extent to which online foreign threats are able to impact domestic outcomes (wonder why!). Under the garb of ensuring cybersecurity and preventing the Russian territory from such threats, the Sovereign Internet Law has the effect of putting the entire Russian internet infrastructure in a bubble of sorts. The law legitimizes the ‘splinternet’ within Russian territory — it provides that at any time that the Russian government sees the need to cut off Russia from the rest of the world, it can take control of this bubble and isolate it from the rest of the world wide web and the global Internet infrastructure.
While on paper, such a national Internet infrastructure is a reasonable backup plan for “emergencies” to combat any foreign threats, it is left entirely up to the officials to decide what would qualify as such a threat. Hence, the effect of this law will be a complete transfer of control to the Russian government over all aspects of the internet, both content and infrastructure, including, of course, the power to trigger internet shutdowns and removing any content that is deemed undesirable, without any prior judicial authorization.
This is the first global attempt of its kind. Even China has a firewall that filters parts of the Internet but does not create a separate infrastructure of a ‘national’ Internet. Moreover, China’s introduction to the Internet from the very beginning had been controlled, unlike Russia, which has freely provided Internet access to its citizens over the past few decades. This is an additional reason why the ‘internet bubble’ that the Russian government seeks to create may be a problematic endeavor.
Even though the law imposes compulsory installation of certain technical equipment and procedures for all OSPs, including deep packet inspections, to enable the “Russian Bubble” infrastructure, technologists also argue that this may be technically impossible, somewhat like a situation where one expects the first floor of a building to be filled up with water without the ground floor receiving any water influx at all.
Taking stock of this cautionary tale
Russia has some of the most disproportionate laws for Internet regulation in the world and maybe that helps explain why it continues to remain ‘not free’ as per Freedom House’s World Freedom Index 2021. In the same vein, in June 2020, the European Court of Human Rights found in four separate cases brought against Russia by local media outlets and OSPs that blocking entire websites violates the owners’ right to impart information and the public’s right to receive it. Despite this, Russia has, yet again, threatened to ban Twitter in March 2021.
For Russian citizens, Russia’s web of Internet laws is broken and continues to be one of the most disproportionately restrictive in the world. Moving forward, it is imperative that laws restricting a citizens’ right to freedom of speech and/or their right to privacy be weighed against the important and age-old principles carved under human rights instruments such as the European Convention on Human Rights and the International Covenant on Civil and Political Rights. It is not hard to guess what would become of the five-set of laws discussed above if this measure was truly upheld in each of them — they would, without a doubt, either cease to exist or become a lot less restrictive.
Finally, a fact and a thought — Of the three national broadcasting channels in Russia, the government holds over 51% share in one and directly runs the parent companies of the other two. It has also recently introduced a law reducing the permissible percentage of foreign ownership in print media from 50% to 20%. This makes the state’s objective very clear — complete control over public narrative along with unfettered surveillance abilities.
It is worth thinking if this could be a cautionary tale that is potentially paving a misguided path for other countries and for other world leaders, whose objective is abject control over the narrative in their country, both online and offline.
_____________________________
Shreya is an Employee Fellow at the Berkman Klein Center, where she works on the Lumen Project. She is a passionate digital rights activist and uses her research and writing to raise awareness about how digital rights are human rights.
