Someone else's number will not work. How will identification work in messengers? Interviewed by Anna Semenets
Back in October last year, Dmitry Medvedev signed a decree according to which, as of May 5, 2019, new rules for identifying subscribers in all popular instant messengers began to work in Russia. We propose to understand in more detail what the innovation is connected with and what will change for users of Viber, Skype, WhatsApp, Telegram and other widely used applications.
Signed on 10/27/18 and published on 11/06/18, the resolution “on identifying messenger users by personal phone number” is one of the stages of the program to combat fraudsters using cellular communications for illegal purposes. According to the text of the document, the new rules come into force 180 days after publication, which means 05/05/19. During this period, cellular operators operating outside of Russia must technically prepare for the implementation of new authentication rules.
Recall that in order to protect citizens of the Russian Federation from telephone swindlers and scammers, as well as to simplify the work of the Ministry of Internal Affairs in the course of investigating various types of crimes, since 2018, each SIM card of a mobile operator that assigns a certain phone number to a subscriber must be officially registered on a specific person. To complete the registration procedure, the owner must provide passport data, which the operator enters into a single database, to which law enforcement agencies have access.
This means that after the introduction of mandatory authentication for messenger users, a clear connection will be established between a person's account in a particular application and his passport data.
The innovation has several goals:
- Improving the security of subscribers, because in the absence of anonymity, the number of people who want to break the law will significantly decrease.
- Simplifying the work of employees of the Ministry of Internal Affairs and providing the fastest access to information about customers of the cellular network and the applications used.
- Creation of a single database, which, in addition to many other functions, will allow collecting statistics on the use of certain instant messengers by mobile users.
Practical implementation
The process of authenticating a messenger subscriber will become mandatory, both for those who want to create a new account, and for those who already use Viber, Skype, WhatsApp or Telegram applications.
The procedure will take no more than 20 minutes. That is how much it will take to check the user data in the base of the mobile operator. The whole process will take place according to the following algorithm:
- The user installs the application and specifies his data during registration.
- The messenger system sends a request to the mobile operator to confirm the data.
- After receiving confirmation that the data matches, the subscriber is granted access to the messenger, and the mobile operator enters into the database information that the client is using a particular application.
Naturally, in the event of a negative response from the mobile operator, the use of the application on a smartphone, tablet or computer will be impossible.
What will change for subscribers
Anyone who, according to the innovations of last year, successfully completed the procedure for registering a telephone number, having provided the mobile operator with their passport data, has absolutely nothing to fear.
Surveys of the population show that the biggest fear in Russia is that after new tougher rules for identifying users in messengers by phone number came into force on May 5, 2019, people will lose their previously guaranteed privacy.
Answering journalists' questions back in November last year, Alexander Zharov (head of Roskomnadzor) explained that "anonymity" in mobile applications is a beautiful myth for users. It's simple - at the time of installing the messenger, you yourself provide the program with full access to the device (without this, the installation will not be completed), which means that the employees of the mobile operator can easily identify the user. This can be confirmed by the official data on the use of instant messengers by smartphone owners for 2018, collected by mobile operators.
What will change with the introduction of new rules?
- Employees of the Ministry of Internal Affairs will be able to receive the necessary information much faster.
- The number of offenses will decrease, because people will know that their actions will be punished.
Who might have problems
Problems with the use of instant messengers may arise for those who, after the introduction of mandatory SIM card authentication by passport, continue to use phone numbers registered to third parties. Unfortunately, the process of re-registering a number for a new user requires the presence of two people - the one who owned the SIM card earlier and the new owner. If there is no possibility to find the person to whom the number of the opportunity is recorded, an insoluble problem arises.
It is easier for anyone who finds themselves in a similar situation to change their number by registering a new SIM card on their passport. Although for many people changing the number is associated with some inconvenience, neither the authors of the innovations nor the mobile operators of the Russian Federation can offer any other way out.
On November 6, Prime Minister Dmitry Medvedev signed a government decree that will complicate the work of instant messengers in Russia: by May next year, their management will have to conclude “identification agreements” with all Russian operators and check whether the authorized user is really the owner of the number and SIM- card with which you registered. IT experts interviewed by Novaya Gazeta doubt that the bill will work.
How is it now and how will it be
The idea of the government is to oblige messengers to check with mobile operators whether the phone number is really registered to a particular user.
The ruling does not say exactly how the new procedure should take place, only the time it should take is 20 minutes.
If the user is not in the operator's database or the check will last longer than the specified time, he is ordered not to be allowed to work with the messenger. In addition, each Russian telecom operator will have to indicate in its special database which messengers the phone number is linked to, as well as the “unique identification code” of the user. In case of termination of service of the number, the telecom operator must also notify the messenger - so that the user indicates a new number.
Now in most instant messengers, to connect, you need to pass verification by SMS. In this case, the user can use a number registered to another person, a SIM card of a foreign telecom operator, or, for example, use special services that temporarily provide a virtual phone number to receive a one-time SMS.
Why is it needed
The resolution was supposed to clarify the ban on anonymous messengers in the country, adopted in July last and entered into force on January 1 this year. The law obliged all users to provide phone numbers, access to instant messengers that violate the law was supposed to be blocked, and their owners were to be fined up to a million rubles under Article 13.39 of the Code of Administrative Offenses that came into force at the same time.
“It’s hard to imagine how messengers can be brought to a common denominator, because many of them initially provide users with the maximum range of anonymization and, for example, allow you not to indicate your contact phone number,” Novaya Gazeta told Novaya Gazeta. Head of the Roskomsvoboda project Artem Kozlyuk.
An additional complication: it is still unclear what the amendments to the law “On Information” mean by “the organizer of the instant messaging service” – not only instant messengers fall under this description. The corresponding register in Russia has not appeared since then.
Representing in court the interests of one of the most popular instant messengers — Telegram — the head of the international group "Agora" Pavel Chikov believes that in the face of legal uncertainty the law applies to “organizers of the dissemination of information”. But their status is not fully defined by Russian law: a failure in the definition of the concept just happened on Telegram.
“The procedure for entering the ARI into the register involves voluntary participation, which was first violated in the case of Telegram, which was the first and so far the only one to be included in the register by force. Perhaps the rest of the authorities will also be included [in the register], - suggests the interlocutor of Novaya Gazeta. “But they are unlikely to do this, because the confidentiality of communication is now an element of the business model of any messenger, and no one will run to disclose data to the Russian authorities.”
Chikov notes that
the legislation on messengers will apply to a greater extent to loyal Internet services, such as VKontakte,
who are already actively cooperating with law enforcement agencies. It will make it possible to receive information about users of instant messengers and social networks not directly from the organizations themselves, but from telecom operators, which will simplify their work without that: “Now, in the case of the same VKontakte, law enforcement officers need to manually formulate, send request and then wait for a response for some time.
Last year's ban on anonymous messengers and a new government decree can be used to put pressure on services that until the last moment refuse to use a phone number to identify users, believes IT expert, founder of the TgVPN service Vladislav Zdolnikov. “The authorities are afraid that against the background of some upcoming repressions due to terrorism, for example, against the backdrop of the events in Arkhangelsk ( a teenager detonated a homemade bomb in the reception room of the FSB — Ed.) - but then people will start switching to some completely anonymous messengers - Signal or Threema, ”the expert concludes.
According to Zdolnikov, acts to tighten control over messengers are being adopted in conjunction with the Yarovaya package, which obliges telecom operators to store voice messages and SMS for 30 days, and Internet companies for six months. “None of these laws work: neither the Yarovaya package, nor the law obliging the FSB to provide encryption keys, nor the register of organizers of disseminators of information, nor this one,” said the interlocutor of Novaya Gazeta. “These laws are initiated from a complete misunderstanding of how the modern Internet works, encryption mechanisms and modern instant messengers.”
“Up to a certain point, the Russian authorities believed that blocking threats worked, but with the example of Telegram, we saw that blocking can also be resisted. And everyone will forget about this law in a few years,” Zdolnikov is sure. And suddenly he remembers: “Who will say now what became the register of bloggers of Roskomnadzor?”
The course to combat anonymity on the Internet continues. Today, in the first reading, the State Duma adopted a bill on the regulation of instant messengers. According to the document, users will have to be identified by phone number. Amendments will be made to the law "On Information, Information Technologies and Information Protection".
In addition to identification, the bill deals with the possibility of sending electronic messages on the initiative of public authorities. This is necessary for emergencies, when the population needs to be promptly warned of the danger.
And, of course, the main goal is to limit the transmission of messages with data that violates Russian law, and to prevent terrorist attacks.
About this initiative, as well as about anonymity on the Internet, Tsargrad talked in detail with the director of the Safe Internet League, Denis Davydov.
Everything is possible in technology
- How do you assess the legislative initiative? What do you see as pros and cons?
The initiative is timely at least. Identification in instant messengers (and not only) was discussed in the Safe Internet League several years ago. It's good that the process has moved off the dead center.
First, it is important to prevent terrorist attacks. These are anti-terrorist and anti-extremist actions and measures. Everything that is aimed at ensuring public safety and increasing the level of anti-terrorist resistance.
Head of the Safe Internet League Denis Davydov: "There is no anonymity for the state." Photo: Mikhail Pochuev/TASS
It has long been said that, unfortunately, terrorists and extremists also use these means of communication, messengers. And if law enforcement officers do not have legislative tools for effective struggle, it will be obviously losing.
Therefore, the initiative is very timely and correct. And technically feasible. Any technical initiatives are realizable - this is technology. When someone says that something is impossible in the technological field, this is a lie and distortion - everything is possible there. If there is a technology for disseminating information, then there are technologies to ensure the implementation of laws. Including - about the methods of identification.
There was a lot of controversy on this topic. Much has been said about the fact that authorization in Wi-Fi networks has been operating in some European countries for many years. One way or another, authorization and identification are already operating mechanisms. Therefore, we can say that the law will work. Those who say the opposite are somewhat disingenuous. The main thing is how the regulators will implement this law, because the main thing is the technical implementation.
As for the weaknesses… The weaknesses of any law are, first of all, that technologies develop faster than legislative and law enforcement practice. Of course, it is necessary to keep up with the times: to follow how technologies develop, what malefactors and scoundrels use from this - in order for the state to be fully armed and counter threats in time.
There is no anonymity for the state - even in Telegram
- Many people have a question on popular telegram channels - will anything change after the adoption of the bill. After all, Telegram is also a messenger, but if you want to remain anonymous, no one will recognize the authors of popular blogs ...
The correspondence between users can be encrypted, but users are already using mobile numbers when registering. Telegram does not work without being tied to a mobile number. And for the special services, to be honest, there are no obstacles in order to understand who is behind this or that telegram channel.
Now they are talking about anonymity in Telegram channels, which does not exist. Because there is no problem for the state to remove this anonymity. Everything else is speculation on this topic. Of course, this will not affect these channels in any way - they can be anonymous for a wide range of users, but for the state - for special services, for law enforcement agencies - there is no anonymity. It's just a matter of not very much time and competence in carrying out technical activities. And our special services are great masters of this.
Uberization of crime
- You have already mentioned the simplification of the fight against terrorists. Many also hope that cyber fraudsters will be easier to detect...
It is hard to say. I wouldn't rejoice prematurely. The peculiarity of cybercrime is that the so-called uberization of crime occurs - when entire cyber gangs are formed on the Internet and, as a rule, their members are not even personally acquainted with each other in life. They commit a crime that can be made up of small pieces of a crime - some of the types of work cybercriminals do are not even crimes in the criminal codes of some countries, including ours.
Therefore, it is still premature to say that we will defeat cybercrime. I would consider the security system of our country as a set of measures. Because the bill on instant messengers itself should be closely related to others - for example, the initiative to ban anonymizers and VPN channels that are not registered or unknown to government agencies or regulators.
If we consider the problem of information security as a complex one, then, of course, this will also ensure the fight against cybercrime. The deanonymization measure itself is unlikely, but the set of measures is definitely yes.
There is no reception against Thor? ..
- Still people are haunted by Tor - a space where everything is possible. Where there are also anonymous messengers. There is a lot of debate about whether it can be limited or banned, various arguments are given. In this case, given the deanonymization measures, can we somehow influence Tor?
It’s hard to say… If it becomes impossible to use Tor on the territory of the country, if all Russian operators stop providing access to Tor or its nodes, then it will be impossible to use its messengers. Such initiatives are under consideration.
Therefore, there must be a comprehensive security system. When someone says "it's impossible," think back to your corporate network. For example, is it possible to use Tor in Tsargrad? No.
The state and its regulators can also turn things on and off. Therefore, if something can be done in a corporation, why not at the country level? There are no problems here. Yes, it will be more expensive - but the scale will be different. Yes, it will be more costly and more players will be included, including carriers…
Of course, there will be those who will use the satellite communication system. Those who will try to hide. But their number in the total number of criminals will tend to zero. By and large, we are reducing the room for maneuver for various attackers. If you make it very difficult for attackers to use services, if an attacker thinks: why should he use Tor, if the FSB finds him there, then they will use less or make a mistake and be caught. In any case, it will have a beneficial effect on our security. Definitely.
On Amendments to the Federal Law "On Information, Information Technologies and Information Protection". This document, in fact, proposes to prohibit anonymity in instant messengers by introducing mandatory user identification by the telecom operator.
The ban on anonymous
According to the explanatory note to the document, this bill is intended to regulate the activities of the organizers of the exchange of electronic messages, that is, instant messengers.
“The bill defines the concept of an organizer of instant messaging and imposes on this subject the obligation to ensure the transmission of electronic messages only to those Internet users who are identified in the manner established,” the text of the draft says.
Thus, a user who is not identified according to all the rules will not be able to use the services of the messenger and exchange messages.
User identification is required to be carried out by telecom operators on the basis of a mobile phone number under an agreement concluded with the organizer of the exchange of electronic messages.
In addition, messengers must provide the user with the technical ability to refuse to receive messages from another user, and also be ready to provide mass mailing on the initiative of public authorities. The draft law also specifically spells out the obligation to ensure the confidentiality of transmitted electronic messages.
The organizer of the exchange of electronic messages is obliged to restrict the sending and transmission of messages containing information, the dissemination of which is contrary to the laws of the country. As told "Interfax" one of the authors of the project, such information includes, for example, a call to participate in unauthorized street protests.
If the messenger refuses to comply with the requirements of the authorized federal executive body, it may face blocking on the territory of the Russian Federation. In addition, in parallel, it was introduced bill on administrative fines for non-performance of duties: 3-5 thousand rubles. - for individuals, 30-50 thousand rubles. - for officials and from 800 thousand to 1 million rubles. - for legal entities.
Both laws should come into force on January 1, 2018, by which time the organizers of the exchange of electronic messages must bring their activities into line with the requirements set out in the legal document.
The press service of the Media Communications Union (ISS) told Gazeta.Ru that
the need for a bill on the regulation of messengers is caused by the presence of legal relations that are outside the framework of Russian legislation, which includes communication in messengers.
For users of such services, there are no tools to protect their rights, for example, in case of receiving threats in messengers or a mailing list to which the user did not subscribe. With the introduction of instant messengers into the legal field, users can finally count on the fact that their rights will be respected.
The proposed draft law as a whole relies on the expert developments that were proposed by the ISS, finalized by the deputies, taking into account the additions and recommendations of industry regulators.
“De facto, most messengers already use the subscriber number to identify the subscriber, and he will not be required to take any additional actions when the law comes into force,” the ISS explained.
The PR director also confirmed to Gazeta.Ru that
most instant messengers already ask for a phone number during registration, so the State Duma, in fact, "formalizes what already exists."
“The bottom line is that there is a certain legislation in the field of communications in the country. But the world is changing, new forms of communication are emerging that need to be brought under existing laws, ”Lidov explained.
The law only applies to ARI
The effect of the law, if adopted, will apply only to those messengers that are in the register of information dissemination organizers (ARI), formed by Roskomnadzor. At the time of the release of the note, there are 81 resources in the ARI list, including services, VKontakte and some others.
The main part of the list consists of exclusively Russian websites, but in the spring of 2017, the Swiss messenger Threema appeared on it, which supposedly has increased personal data security thanks to end-to-end encryption.
In early May, Roskomnadzor blocked the well-known Chinese messenger WeChat in Russia, adding it to the register of prohibited resources. A few days later, the owners of the messenger provided the data requested by the supervisory authority, and access to it was restored.
Viber, WhatsApp, Telegram and Facebook Messenger messengers, popular in Russia, are not yet in this register of information dissemination organizers. The spokesperson had previously declined to say whether the agency had approached these companies with a request to provide data for inclusion on the ARI list.
