A Russian law could place the personal data of millions of Internet users, including Americans, at risk if international digital companies comply by the start of next year, analysts say.
The law, enacted last year, requires digital companies to store the personal information of Russians in servers on Russian soil. While officials in Moscow have cited concerns that Russians’ information could be vulnerable to foreign intelligence services such as the National Security Agency (NSA) if it is located outside the country’s borders, critics of the law say it is likely just another attempt to monitor the communications of citizens and political opponents.
To comply with the law, Internet giants such as Google and Facebook would need to move some of their servers to data centers in Russia. There are unconfirmed reports that some major companies have already transferred servers to the country, though most have been reticent to comment publicly.
Under a telecommunication snooping system first developed by the Soviet KGB in the 1980s, Russian intelligence services still have "unfettered access to users’ data and to the technologies that companies field to protect and encrypt communication among their servers and users," wrote Andrei Soldatov and Irina Borogan, two Russian investigative journalists, in a recent Foreign Affairs article. Relocating servers to Russia could thus threaten the security of all online users’ data, not just Russians.
"Big Internet companies, including Facebook and Google, don’t distinguish their Russian users from others; they do not ask for national identity papers to register an account," Soldatov and Borogan wrote. "In other words, if they comply with Russian law and put servers on Russia soil, they may well be subjecting all their users to possible interception or interference by the Russian security services."
Russian authorities say digital companies do not have to be in full compliance with the law until January. Russian media reported that Google and Apple have agreed to shift Russian users’ data to servers in the country, while Facebook has so far resisted such a move. However, the companies have not corroborated those reports.
Google declined to comment when asked by the Washington Free Beacon about its compliance with the Russian law. Apple, Facebook, and Twitter did not respond to requests for comment.
The results of talks between representatives of the Internet giants and the Russian government have not been disclosed.
NSA officials say the agency only monitors phone and email communications to identify and prevent potential terrorist threats. Reports in Russia, by contrast, indicate that security services also conduct surveillance on political opponents.
In 2012, "the Russian Supreme Court ruled that Moscow’s surveillance of Maxim Petlin, a regional opposition leader and a member of the local council in Yekaterinburg, was lawful, since he had taken part in rallies during which calls against extending the powers of Russia’s security services were heard," Soldatov and Borogan wrote. "The court decided that these calls constituted support for ‘extremist actions’ and approved the subsequent spying."
Russian authorities have dramatically increased their requests to Internet companies in recent years to remove content they deem sensitive. According to a Google Transparency Report, Moscow’s removal requests more than doubled from 257 in June 2013 to 745 in June 2014.
No requests would be required if the data is moved to servers in Russia, Soldatov and Borogan said.
"Once international companies give in to Russian demands, they will have no idea how many requests they get," they said. "The Russian security services would be able to help themselves to whatever data they want, without anyone being the wiser."
Russian President Vladimir Putin called the Internet a "CIA project" last year, raising fears that he would seek to create a Russian "intranet" that would be controlled separately from the international system.
China has also imposed strict requirements on international digital companies that seek to operate within its borders. Apple is reported to have deactivated its news app in the country last month due to concerns that Beijing would force the company to censor sensitive content.