Law on Biometric Identification and Expanded Extrajudicial Website Blocking Adopted

At the end of the year, the State Duma passed another “legal hodgepodge,” merging extrajudicial website blocking with a biometric data system. The original bill (No. 986111-7) only expanded the Prosecutor General’s authority to block “extremist” content, but by the second reading, it had accumulated so many amendments that it became nearly unreadable without a bureaucratic dictionary. Nevertheless, we tried to make sense of it.

Key Provisions and Concerns

The bill clearly shows the influence of Alexander Khinshtein, head of the Duma’s Information Policy Committee, who, together with his United Russia colleague Sergey Boyarsky, has a history of creating legal hybrids that combine barely related amendments. As a result, the final law strays far from its original explanatory note.

Media coverage has been largely one-sided and positive, but the law’s implications are much deeper and, frankly, concerning. Initially, a group of deputies led by Vasily Piskaryov sought to extend extrajudicial blocking not only to information calling for mass unrest or extremist activity, but also to content that “justifies or excuses” such activities. This means not only direct calls to action, but also any information that could be interpreted as justification (recall the case of Svetlana Prokopyeva).

By the second and third readings, the bill included requirements to block false reports of terrorism, offers to purchase fake documents, and information about organizations banned in Russia. “Access to such resources will be restricted by decision of the Prosecutor General or their deputies. The same procedure applies to sites with false terrorism reports or justification of terrorist activity,” Khinshtein explained.

Contrary to some media reports, the law is not limited to blocking sites with fake COVID certificates. The Prosecutor General can now restrict access to any information about obtaining documents that “grant rights or exempt from obligations.”

The main danger lies in blocking “justification of justification,” which could affect even analytical discussions or journalistic investigations about extremism and terrorism. Khinshtein noted that, in theory, this could include publications from the Anti-Corruption Foundation, which Russian authorities have labeled as extremist and banned.

Stanislav Seleznev, senior partner at the “Network Freedoms” project, pointed out that currently, such status does not automatically ban an organization’s content. Prosecutors must go to court for each publication, and authors can contest bans. Under the new rules, the Prosecutor’s Office can automatically block not only extremist organizations’ materials but also any reposts without critical commentary. Seleznev also noted that the definition of extremist activity is so vague that almost any sharp statement could qualify. The number of people prosecuted for inciting hatred (Article 20.3.1 of the Administrative Code) is rising: 383 in 2019, 757 last year, and possibly up to 1,000 in 2021.

Sarkis Darbinyan, lead lawyer at Roskomsvoboda, observed that these legislative changes largely formalize existing practices. For example, after mass bomb threats in 2020, email services like Startmail.com and ProtonMail.com were blocked and remain inaccessible. According to Roskomnadzor reports, materials from banned terrorist and extremist organizations are already being blocked extrajudicially under the so-called Lugovoy Law. The new law seems to align with this practice and may even expand it, including the ambiguous concept of “justification of terrorism,” which is not defined in the Criminal Code. If lawmakers intend to use this term, they should at least clarify its meaning, says Alexander Verkhovsky, director of the SOVA Center (listed as a foreign agent by the Ministry of Justice).

Roskomsvoboda media lawyer and attorney Ekaterina Abashina is convinced the new amendments will not yield positive results: “It seems the legislative strategy is to selectively ban certain types of information deemed dangerous. But this doesn’t solve the problem. These measures are unlikely to be effective against false bomb threats. Last year, several email services were blocked at the Prosecutor General’s request. In the StartMail case, the reason was false bomb threats sent from several mailboxes. The services were blocked without the possibility of restoration, and the actual ‘spammer’ was never found.”

Biometric Data Amendments

Curiously, lawmakers did not mention in their reports that the bill also amends Federal Law 479-FZ on the use of biometric data—a major part of the legislation. This amendment was added by the second reading and is only loosely related to the main topic of extrajudicial blocking.

The document states that the Unified Biometric System is a state information system, with its regulations to be approved by the Russian government. The bill grants individuals registered in the Unified Identification and Authentication System (ESIA) the right to upload their biometric data to the Unified Biometric System using Russian equipment, provided their identity is confirmed with a Russian passport containing an electronic data carrier, even if they are outside Russia.

The government, in coordination with the federal security authority and the Central Bank, will set the procedures for individuals to upload their biometric data, including verification requirements and rules for the use and storage of such data.

Government agencies may use this data for identification and/or authentication if it falls within their authority. The processing of such data must comply with organizational and technical measures to ensure personal data security, as required by Federal Law No. 152-FZ “On Personal Data.”

Sarkis Darbinyan believes this part of the law is also aimed at censorship and strict regulation of the digital space: “At first glance, the amendments seem unrelated to blocking and filtering. But looking deeper, it’s clear that the state is signaling that biometrics are now a government monopoly. Any work with biometrics through online services will go through the Unified Biometric System, now a state information system. The state is moving to the next stage—identifying all citizens via biometrics. The idea of ‘internet by passport’ is getting closer. The state will be able to do whatever it wants.”

Stanislav Seleznev, senior partner at “Network Freedoms,” noted: “By the third reading, the bill became a kind of nesting doll, with biometric provisions added to those on justifying extremism. For some reason, this document was used to push through the biometric identification system. Legally, it makes no sense—one law will regulate two completely different areas: internet censorship and biometric surveillance.”

He added, “Given that biometric identification was added to an anti-extremism bill, maybe lawmakers are hinting that anyone suspected of extremism will be tracked through the biometric system? That’s the only logic I can see.”

Seleznev criticized the legislative process: “It’s normal for a bill to be amended between readings, but to suddenly increase its size fivefold and add unrelated content by the third reading is nonsense. This clearly goes beyond standard legislative procedure.”

Both parts of the law take effect upon official publication, except for certain biometric provisions.