12 ms·

I didn't know about this crazy new regulatory requirements until now. Quoting from an article [1] describing the new law: > “When collecting personal data, inc

I didn't know about this crazy new regulatory requirements until now. Quoting from an article [1] describing the new law: > “When collecting personal data, including through information and the internet telecommunications network, the operator is required to provide a record that the systematization, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation, is held on databases located in the territory of the Russian Federation.” I could imagine that complying to this regulation wont be worthwhile for most companies. Edit: The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also. [1] https://techcrunch.com/2014/07/02/russia-moves-to-ban-online-services-that-dont-store-personal-data-in-russia/ https://techcrunch.com/2014/07/02/russia-moves-to-ban-online...

pavel_lishin 10y ago
I wonder what sort of onus is on the operators to determine the citizenship of its users. How do I know that Andrey Zhukov is a citizen of the Russian Federation? Does a Russian name and a home address of Saint Petersburg suffice?
- baybal2 10y ago
  They don't. That's the trick
devoply 10y ago
At the end of the day, creating many of these services is trivial. Creating a LinkedIn clone is trivial, and one will pop up in Russia giving some Russian owners profit and creating jobs for Russians. So how it's bad for the Russian economy, or the economy of any country to do this, is beyond me. On the other hand, dictatorships and capitalist democracies love to gather as much information as they can on their citizens, so it will allow Russians to get more information on their citizens. Which may be bad for some of them.
- frozenport 10y ago
  Because a large part of the Russian software market is overseas.and many developers work on contract. Further, this helps the Kremlin's agenda which has lead to economic stagnation, and the average gdp of Russians dropping below that of China.
  - devoply 10y ago
    Doesn't seem like it: https://www.google.ca/search?q=russia+gdp https://www.google.ca/search?q=russia+gdp
    - baybal2 10y ago
      Well, the Chinese median income is double that of Russia though
    - raquo 10y ago
      Are you hoping people won't look past the misleading google chart that ends in 2013? Russia's GDP has been reliably falling since then. http://www.tradingeconomics.com/russia/gdp-per-capita-ppp http://www.tradingeconomics.com/russia/gdp-per-capita-ppp
      - devoply 10y ago
        Are you hoping I won't type /china/ in the URL? The statement "average gdp of Russians dropping below that of China" is still not true. Though I am not an expert on the subject, nor do I have a interest in Russia. http://www.tradingeconomics.com/china/gdp-per-capita-ppp http://www.tradingeconomics.com/china/gdp-per-capita-ppp
        raquo 10y ago
        I thought you were contesting the bigger argument that Russia's economy is stagnating, since the link you provided did not contradict anything else (there was no reference to China).
- 10y ago
togus 10y ago
> The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also. Correct! I was on a team trying to architect a solution for this and the requirements was really diffuse. We ended up doing a DB "replication" (via triggers) to a Russian cloud provider after the data had been committed in a european data center. The lawyers signed off on it but there were no clear guidelines from the Ministry of Communication (http://minsvyaz.ru/ http://minsvyaz.ru/) on what was OK from an tech implementation view. However, I feel that the best solution for solving it was to have all Russian traffic routed through something like a reverse web proxy which would first write the data to servers located in Russia or fail the request.
- ivan_gammel 10y ago
  Since you may not reliably determine the citizenship via traffic routes, probably, it's better to ask user during signup about his country (simple pre-filled "Where are you from?" question, true answer on which is required by ToS) and then route his data through a native (Russian, Chinese etc) server, which can store it and "request" further processing overseas (this fulfills all the requirements of the law, including both storage and primary processing).
- deleted 10y ago
  [deleted]
cr0sh 10y ago
I wonder if there is any requirement that the data be readable? I mean, you could store it in encrypted format, but keep the keys outside of Russia...
- optimuspaul 10y ago
  it would be foolish to not encrypt the data at rest and probably just as silly to keep the keys in the same location.
  - tobltobs 10y ago
    This is from another article [1] about the “Yarovaya package": > Finally, any online service (including social networks, email, or messaging services) that uses encrypted data is now required to permit the Federal Security Service (FSB) to access and read their services’ encrypted communications, including providing any encryption keys. It is not clear from this article also if you can encrpyt the user data and keep the key. But I guess that wouldn't be along of the spirit of this law. [1] https://www.eff.org/deeplinks/2016/07/russia-asks-impossible-its-new-surveillance-laws https://www.eff.org/deeplinks/2016/07/russia-asks-impossible...
AlfeG 10y ago
As a contractor outside of EU/USA I stuggle a lot to handle those regulations for PII(personal identify information). We have no rights to transfer even a single bit of PII out of EU/USA networks. So I just don't understand, why it's such a news after all.
- tobltobs 10y ago
  Apple and Oranges. You still can transfer the data out of Russia, you just have to "give" them a copy.
Sacho 10y ago
Aren't these crazy new regulatory requirements only a step up from the ones in place in the EU[0]? [0]http://ec.europa.eu/justice/data-protection/international-transfers/index_en.htm http://ec.europa.eu/justice/data-protection/international-tr...
JumpCrisscross 10y ago
> I could imagine that complying to this regulation wont be worthwhile for most companies. In all likelihood, a crony-backed service handling this for foreign tech companies doing business in Russia will emerge.

pavel_lishin 10y ago

I wonder what sort of onus is on the operators to determine the citizenship of its users. How do I know that Andrey Zhukov is a citizen of the Russian Federation? Does a Russian name and a home address of Saint Petersburg suffice?

baybal2 10y ago
They don't. That's the trick

devoply 10y ago

At the end of the day, creating many of these services is trivial. Creating a LinkedIn clone is trivial, and one will pop up in Russia giving some Russian owners profit and creating jobs for Russians. So how it's bad for the Russian economy, or the economy of any country to do this, is beyond me. On the other hand, dictatorships and capitalist democracies love to gather as much information as they can on their citizens, so it will allow Russians to get more information on their citizens. Which may be bad for some of them.

frozenport 10y ago
Because a large part of the Russian software market is overseas.and many developers work on contract. Further, this helps the Kremlin's agenda which has lead to economic stagnation, and the average gdp of Russians dropping below that of China.
- devoply 10y ago
  Doesn't seem like it: https://www.google.ca/search?q=russia+gdp https://www.google.ca/search?q=russia+gdp
  - baybal2 10y ago
    Well, the Chinese median income is double that of Russia though
  - raquo 10y ago
    Are you hoping people won't look past the misleading google chart that ends in 2013? Russia's GDP has been reliably falling since then. http://www.tradingeconomics.com/russia/gdp-per-capita-ppp http://www.tradingeconomics.com/russia/gdp-per-capita-ppp
    - devoply 10y ago
      Are you hoping I won't type /china/ in the URL? The statement "average gdp of Russians dropping below that of China" is still not true. Though I am not an expert on the subject, nor do I have a interest in Russia. http://www.tradingeconomics.com/china/gdp-per-capita-ppp http://www.tradingeconomics.com/china/gdp-per-capita-ppp
      - raquo 10y ago
        I thought you were contesting the bigger argument that Russia's economy is stagnating, since the link you provided did not contradict anything else (there was no reference to China).
10y ago

togus 10y ago

> The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also. Correct! I was on a team trying to architect a solution for this and the requirements was really diffuse. We ended up doing a DB "replication" (via triggers) to a Russian cloud provider after the data had been committed in a european data center. The lawyers signed off on it but there were no clear guidelines from the Ministry of Communication (http://minsvyaz.ru/ http://minsvyaz.ru/) on what was OK from an tech implementation view. However, I feel that the best solution for solving it was to have all Russian traffic routed through something like a reverse web proxy which would first write the data to servers located in Russia or fail the request.

ivan_gammel 10y ago
Since you may not reliably determine the citizenship via traffic routes, probably, it's better to ask user during signup about his country (simple pre-filled "Where are you from?" question, true answer on which is required by ToS) and then route his data through a native (Russian, Chinese etc) server, which can store it and "request" further processing overseas (this fulfills all the requirements of the law, including both storage and primary processing).
deleted 10y ago
[deleted]

cr0sh 10y ago

I wonder if there is any requirement that the data be readable? I mean, you could store it in encrypted format, but keep the keys outside of Russia...

optimuspaul 10y ago
it would be foolish to not encrypt the data at rest and probably just as silly to keep the keys in the same location.
- tobltobs 10y ago
  This is from another article [1] about the “Yarovaya package": > Finally, any online service (including social networks, email, or messaging services) that uses encrypted data is now required to permit the Federal Security Service (FSB) to access and read their services’ encrypted communications, including providing any encryption keys. It is not clear from this article also if you can encrpyt the user data and keep the key. But I guess that wouldn't be along of the spirit of this law. [1] https://www.eff.org/deeplinks/2016/07/russia-asks-impossible-its-new-surveillance-laws https://www.eff.org/deeplinks/2016/07/russia-asks-impossible...

AlfeG 10y ago

As a contractor outside of EU/USA I stuggle a lot to handle those regulations for PII(personal identify information). We have no rights to transfer even a single bit of PII out of EU/USA networks. So I just don't understand, why it's such a news after all.

tobltobs 10y ago
Apple and Oranges. You still can transfer the data out of Russia, you just have to "give" them a copy.

Sacho 10y ago

Aren't these crazy new regulatory requirements only a step up from the ones in place in the EU[0]? [0]http://ec.europa.eu/justice/data-protection/international-transfers/index_en.htm http://ec.europa.eu/justice/data-protection/international-tr...

JumpCrisscross 10y ago

> I could imagine that complying to this regulation wont be worthwhile for most companies. In all likelihood, a crony-backed service handling this for foreign tech companies doing business in Russia will emerge.