Yarovaya Law, Big Data, and the End of Net Neutrality: The Last Stand

What could the implementation of the “Yarovaya Law” from July 1, 2018, mean for us? Higher internet provider fees? Increased government surveillance? The end of net neutrality?

Very soon, with the introduction of new regulations for total online surveillance in Russia, negative scenarios may become reality: we may pay more for internet and other communications, and resources disfavored by the government or certain corporations could be legally slowed down or blocked, simply because they’re not in the “fast lane” of providers. You might have to pay extra for access to YouTube, WhatsApp, or Skype, while being pushed toward “import-substituted” services instead.

Net Neutrality

Net neutrality is the principle that all internet traffic should be treated equally, with no restrictions unless the content is illegal. Under full net neutrality, operators must transmit traffic at the same speed, regardless of whether it comes from a small website or a giant service.

In 2015, the U.S. Federal Communications Commission (FCC) introduced full net neutrality, banning providers from blocking sites or discriminating against any internet traffic. But at the end of 2017, the FCC began the process of repealing these rules, calling it a “Restoring Internet Freedom” measure (sic!).

It’s astonishing how politicians can twist concepts: restricting and limiting websites and services is now called “restoring internet freedom.”

The FCC press release stated: “Restoring a favorable climate for investment in network construction is key to closing the digital divide, stimulating competition and innovation that benefits consumers.”

In short, providers (especially mobile operators) want more money, particularly by taking a bigger share of media companies’ revenue, sharing it with politicians who lobbied for the end of net neutrality—all under the banner of freedom.

The possible repeal of net neutrality sparked outrage in the U.S.: Silicon Valley, digital rights activists, and the media industry all strongly opposed the initiative.

Tim Berners-Lee, creator of the World Wide Web, spoke out against the changes: “Net neutrality—the principle that internet providers do not favor some types of traffic over others—is the foundation of the internet as we know it today.”

More than 2.4 million people have signed a petition in support of net neutrality! Tech giants have also announced their readiness to participate in upcoming lawsuits against the FCC.

Most U.S. senators are also set on overturning the FCC’s decision. All 49 Democrats support the resolution, along with a Republican senator from Maine. Net neutrality supporters in Congress have just 60 days to use the review law. The deadline is June 12. On May 9, senators filed a petition to allow a vote to overturn the FCC’s decision.

What About Russia?

Currently, Russian providers only formally observe net neutrality—there’s no legal definition. At the end of 2017, the Media Communications Union, representing Russia’s largest telecom and media companies, began developing the Infocommunications Code—a single document intended to replace existing laws on communications, information, and personal data.

The new legislation will consider not only technology and industry relations, but also the opportunities and risks in their development, including device-to-device information exchange, constitutional privacy rights, and personal data protection.

The draft Infocommunications Code includes a “soft” interpretation of net neutrality, allowing “reasonable restriction and traffic control.” For example, operators could manage traffic during network overloads and give priority access to their own or partners’ content.

“We’re creating regulation not for the sake of regulation, but to create a unified competitive environment. The first goal. The second is to protect national content.” — Pavel Stepanov, President of the Media Communications Union.

He said this while lobbying for laws on online movie theaters and SMS registration in messengers (essentially, de-anonymizing all users of these services).

In other words, if the Infocommunications Code takes effect, a new film by Nikita Mikhalkov could download faster than a blockbuster by Steven Spielberg.

The first version of the Code was expected by April 2018, developed by Boston Consulting Group (BCG) under a $600,000 contract. It hasn’t appeared yet. However, some reports suggest the Code will actually enshrine the current principle of net neutrality, but developers note the need to address traffic management during network failures and the possibility of slowing certain types of traffic, especially P2P protocols used by file-sharing and torrent trackers.

“Forbid or allow”—the comma is up to you.

What’s the Connection?

The “Yarovaya Law” requires providers to record and store all user traffic—text messages, voice, images, sounds, videos, and other communications—for up to six months.

• Providers’ costs increase.
• Communication becomes more expensive.
• Subscribers protest.
• Government approval ratings drop.

That’s one possible scenario. Another is filtering traffic by content type and limiting speeds to certain resources and services.

Most traffic is video content. Whether or not the law requires it to be stored, it makes sense to charge media resources extra for normal-speed access. This way, overall subscriber rates don’t rise, and costs are covered by online movie theaters and other video sites. They, in turn, may pass costs to end users—but providers and the government are no longer directly involved.

Torrent trackers will also be filtered, in line with the “Anti-Piracy Law.” This will push audiences toward legal online movie theaters, which are already under tight control. Music and gaming content will also be monitored.

Either way, users will suffer. How this will affect the political climate is hard to predict (unlike in Europe or the U.S., where any attempt to restrict internet freedom brings hundreds of thousands, even millions, to the streets).

The Big Game, Big Data

Since September 1, 2015, Russian law requires personal data of Russian citizens to be stored in Russia. Many foreign companies simply moved their servers out of the country in response.

Ms. Kaspersky has long openly stated that Russians’ “big user data” should be considered state property. Her “Internet+Society” subgroup also proposes regulating the collection of anonymized big data that can be used to identify users.

With this approach, soon we ourselves may be considered state property. In fact, we already are, unofficially, and have been for a long time…

But what does “the state” mean in this context? Who exactly should own this data?

With such user data, it’s possible to create a very accurate “digital portrait” of a person. In 2012, Michal Kosinski proved that analyzing just 68 Facebook likes is enough to determine a person’s skin color (with 95% accuracy), sexual orientation (88%), and political views (85%).

Now, Kosinski’s model can know more about a person after ten likes than their colleagues do; after 70 likes, more than a friend; after 150, more than their parents; after 300, more than their partner. More data reveals more than the person knows about themselves.

There’s a theory that by analyzing data on 200 million Americans using Kosinski’s model, a group specializing in election campaigns was able to influence the outcome of recent elections through targeted messaging—another argument for opponents of the current U.S. president.

Russia is not behind in big data analysis. It’s standard practice worldwide. For example, Yandex’s “Crypta” technology, launched in 2011, allows the company to estimate a user’s gender, age group, income level, and other personal characteristics based on online behavior. You could even check yourself back then. The results weren’t always accurate, but much has changed since.

I just want to emphasize the power of Big Data—and why government officials are so eager to get it. Domestic social networks and search engines are already in their pocket; now they want Google, Facebook, and Twitter.

Since they can’t get data directly from these resources, they want to do it legally through providers, under the guise of fighting crime and terrorism.

Rostelecom has already expressed interest in this market and is ready to invest 40 billion rubles in building data centers. It also plans to acquire a controlling stake in SafeData from Gazprombank. Rostelecom and SafeData aim to create a truly nationwide big data storage and analysis network.

Encrypted Traffic

The groundwork is laid: by law, Russian user data is stored in Russia (theoretically), online movie theaters are under control, soon providers will store and hand over traffic to the “owners,” and messenger registration must be done via SMS.

Now, the goal is to access user data in messengers for analysis. But there’s a snag: end-to-end encryption, used by many modern messengers like Telegram, doesn’t allow easy access to messages. Authorities need decryption keys, supposedly for law enforcement backdoors.

Millions use Telegram—a juicy target for analysts and security agencies. After Pavel Durov refused to provide keys, Roskomnadzor was unleashed, blocking everything except Telegram itself.

Accessing users’ devices has never been a problem for security agencies or hackers. It’s much easier to get access to your device or account than to decrypt traffic. The difference is that the state wants legal access to information it previously obtained illegally—and to collect all data in one place, so hackers can later sell it on the black market…

On July 28, 2017, the “Digital Economy” program was approved, aiming to create a global system for processing all personal data of Russian citizens and developing artificial intelligence. The core idea is to assign each citizen a number (personal code, electronic ID), which will serve as a key to a complete dossier with information from various databases across all areas of life.

What to Do? The Last Stand

A tough question. For now, it’s possible to bypass restrictions using anonymous networks and VPNs, though strict regulation is already being introduced. How the law will be enforced is unclear. Although it took effect on November 1 last year, it still doesn’t work, as even Roskomnadzor admits. Nevertheless, new legislative measures are being considered to sanction VPNs, proxies, and search engines for not complying with traffic filtering and data disclosure requirements.

If, by some miracle, authorities manage to eliminate access to anonymous technologies, freedom will end. This is the last stand.

There’s also a bill to block online information that damages the honor, dignity, or business reputation of individuals or legal entities. Who is being protected first, I wonder? Soon, blocking will happen without trial or investigation.

But as we know, the more pressure, the stronger the resistance. Anonymous networks and VPNs are alive and well. Importantly, VPNs not only provide access to blocked resources but also hide all traffic from providers. The government, of course, blames anonymous technologies and cryptocurrencies for all the world’s ills.

But only anonymous technologies and cryptocurrencies, combined with cash, can save the world from Big Trouble. Those who gain almost unlimited power by mindlessly implementing technology in government will pay dearly. Any system can be hacked.

I also wonder: why, in the name of fighting terrorism, don’t they install cameras and microphones in our homes to analyze and store everything for years? Isn’t reading and storing our correspondence just as much an invasion of privacy? What will come after the “Yarovaya Law” under a noble pretext? Will we all be tagged like animals with microchips, have our homes put under surveillance, and be required to report to an investigator once a month? In the name of “countering something,” any idea can be pushed through.

Can you imagine a news story: “Terrorists planned an attack, actively discussing it on Telegram/Viber/Email (insert your own), were tracked by FSB agents, and arrested the same day.” Who are the idiots here—the terrorists or the readers? Or do officials really want us to believe terrorism is organized on open communication channels?

Did you know that besides cryptography, there’s also steganography, which allows encrypted messages to be exchanged as seemingly ordinary images? With some tweaks, this method could enable very fast secret messaging. Even I, not being an expert, could suggest a dozen ways to have completely secret online conversations in real time. And no one could get the decryption key—it’s only with the sender and receiver.

This Is Global Policy, This Is Global Marketing

In summary, the state wants to monitor our every move, sell and use our data, and most importantly, do it at our expense. And this is just the beginning.