Google and online marketplace eBay may be caving to Russia's controversial new data retention law that requires Internet companies to store Russian users’ data in Russia. Shifting data centers into Russian territory could leave Google and eBay customers vulnerable to greater levels of surveillance.
On April 10, RBC news agency reported that Google allegedly agreed to comply with the new law and had already moved some of its user data storage facilities to data centers on Russian soil.
RBC said the announcement was made at a conference hosted by the Communications Ministry in late March, and noted that a representative of Rostelecom, one of Russia's leading telecommunications providers, claimed they were hired by Google to store their data at a “high-security data-server facility with close ties to the state” in Russia. Later, Rostelecom refused to comment on the matter and said it does not disclose its clients’ information without their consent.
How the policy will affect users
The policy would mark a big shift for Russian Google users, creating new vulnerabilities when it comes to personal data that they send and store using services like Gmail. At present, if Russian authorities wish to access Google user data, they must present a court order to the United States Department of Justice, which will determine its legitimacy. Google's Law Enforcement guidelines explain that if the order satisfies US law and Google's policies, it will be fulfilled — but if not, the user's data will remain undisclosed. As the company is located in the US, Google is beholden to US law.
Under the new policy, there would be a much lower threshold for Russian authorities to obtain user data. Although Google presumably would still require a court order, the order would not have to meet the standards of the US judicial system.
Global Voices contacted Google policy staff for comment, but they had not responded at the time of this story's publication.
eBay is doing it too
On April 7, the Russian newspaper Kommersant reported that eBay is taking steps in the same direction. Russia eBay representative Vladimir Dolgov met last week with officials from Roskomnadzor, the Russian Internet regulator. Dolgov added that this was the first face-to-face meeting with the Russian authorities about the law, though the company has been part of the working group for a while.
Основной целью eBay было получить ответы на ряд вопросов по закону о персональных данных, который вступит в силу с 1 сентября 2015 года. По итогам встречи eBay подтверждает готовность собирать и хранить требуемую информации в полном соответствии с законом.
The main purpose [of the meeting] for eBay was to receive answers about aspects of the data retention law, that comes into effect on 1 September, 2015. After the meeting eBay confirms its willingness to collect and store required information in full accordance with the law.
Independently, a spokesperson for the media watchdog Vadim Ampelonsky confirmed to Kommersant that eBay agreed to comply with the law.
According to Kommersant sources, eBay has already begun to transfer user data from Switzerland to Russia. A representative for the online payment system PayPal, owned by eBay, was also present at the meeting and said they were “in touch with the regulators and working on an optimal solution” in regards to the data law.
Putin's push for “Internet sovereignty”
Signed by Russian president Vladimir Putin in July 2014, the data localization law comes into power on September 1, 2015. Representatives of Internet businesses working in Russia previously criticized the data localization law, saying it was an unreasonable restriction that could make working in Russia impossible for many popular Internet services, including travel websites, ticket agencies and e-commerce sites.
Some MPs and officials in Russia have been pushing for “Internet sovereignty” for quite a while. The idea got a second wind when the confrontation between Russia and the West, fueled by the conflict in Ukraine, intensified. According to Forbes, the Russian Ministry of Communications prepared a report about the sovereignty of the Russian Internet that includes measures allowing the government to prevent “external attacks” on the RuNet. Indeed, the policy cuts in the direction of isolating the Russian Internet and its users from the rest of the world.
In particular, the ministry suggests tightening regulation of Internet companies and even establishing direct state control of some entities, including major traffic exchange points. According to Forbes, the report also recommends prohibiting Russian Internet companies from transferring data out of Russian territory. This could mean, for instance, that Yandex would not be able to use its data center in Finland, because the government wouldn't be able to control data once it leaves Russia's jurisdiction.
On April 7 in Moscow, officials, businesspeople and various Internet personalities came together for the Russian Internet Governance Forum. The most remarkable speech was given by a former Kremlin youth group organizer and senator Ruslan Gattarov, who now works as deputy governor of Chelyabinsk region. He said he actually liked that the Ministry of Communications had become less liberal—”in the best sense.”
Gattarov claimed the Internet was currently “ruled” by the West, citing the example of recent US economic sanctions imposed on Crimea in protest of Russia’s annexation of the peninsula. These restrictive measures obliged all American companies to cease “import or export of goods, services, or technology” to or from “the Crimean region of Ukraine.” In compliance with the sanctions tech companies like Apple and Google suspended the accounts of web developers in Crimea and blocked the use of many of their products in the region.
Speaking at the Forum, Gattarov said he was sure that the West is preparing for a cyber war against Russia.
Мы ведь все понимаем, что Запад не дремлет. Он проводит учения у наших границ с какими-то экспертами, которые копаются в Эстонии. Великобритания хочет использовать соцсети для информационной войны. Мы, может, это тоже делаем, но хотя бы не говорим об этом публично.
We understand that the West does not sleep. They hold military exercises near our borders with some experts who rummage about in Estonia. UK wants to use social networks for information war. We might be doing the same, but at least we are not talking about it publicly.