Google and Mozilla Block Kazakhstan Government Security Certificate
Developers of the Google Chrome and Mozilla Firefox browsers have blocked the use of a government-issued security certificate that was downloaded by citizens of Kazakhstan, according to a joint statement from both companies. The decision follows research conducted by the Censored Planet platform, which revealed that Kazakhstani internet providers only allowed users to access the internet if they installed a digital certificate developed by the authorities on all their devices and used it in all browsers. With this certificate, the government could monitor citizens’ activity on certain websites, including Facebook, Twitter, Google, and 34 other sites.
“We take such decisions very seriously, but protecting our users and the internet as a whole is what Firefox exists for,” said Marshall Erwin, Senior Director of Trust and Security at Mozilla, in a statement.
“We will not allow any organization to compromise the personal data of Chrome users, whether it is a government or a commercial entity. We will implement protection against this certificate and will always take appropriate measures for people around the world,” added Parisa Tabriz, Senior Technical Director at Google.
In response to recent actions by the government of Kazakhstan, Chrome, along with other browsers, has taken steps to protect users from interception or modification of TLS connections to websites, according to a company blog post.
Background of the Certificate Requirement
In mid-July of this year, mobile operators began sending notifications to residents of Kazakhstan about the mandatory installation of a special security certificate on computers and mobile devices. Citizens were also warned that refusing to install the certificate could result in reduced connection quality. The government claimed that the installation was necessary to protect against cyber threats.
Following this, Kazakhstani lawyers filed several lawsuits against the country’s three largest mobile operators, arguing that restricting free internet access is a violation of the law. They also noted that the government certificate allows interception of various data, bypassing the encryption used in email and messaging services.
In early August, the National Security Committee of Kazakhstan announced the suspension of the certificate’s implementation, calling the event a beta test.