6 ms·

This is probably just Russian auditors starting to actually look at big companies' implementations of 242-FZ. There was precious little guidance given on exact

by dmoy 9y ago

This is probably just Russian auditors starting to actually look at big companies' implementations of 242-FZ. There was precious little guidance given on exactly what a kosher implementation would be, so devs pms and lawyers just get together and make a good faith effort at it. Best guess from me is that auditors are disagreeing with that first round good faith effort from Facebook. My guess at the original purpose of 242 fz: This has absolutely nothing to do with the balkanization of the web, and everything to do with Russian law enforcement wanting a physical location they can easily roll into with a warrant. Nothing else really made sense to me at the time. Source: worked at big company on 242 fz compliance when it was about to hit. Edit: I remembered the ordering of number-letter incorrectly

tryingagainbro 9y ago
There was precious little guidance given on exactly what a kosher implementation would be, so devs pms and lawyers just get together and make a good faith effort at it. I imagine that in Russia and similar countries, lack of guidance is by design. If you don't tow the FSB line, don't pay the bribes or if someone else wants your business, you've broken the law by not implementing federal law zxy52n. Edit: USA places a gazillion requirements for businesses (especially banks all over the world) so what Russia is doing is nothing extraordinary, on itself. They have their own FB so I doubt they'll miss much even if FB was banned tomorrow.
- dmoy 9y ago
  Well to be fair, even the US doesn't always given an abundance of guidance on everything. For a random example, up until irs notice 2014-54, it was a bit shady exactly how you could get away with roth ira backdoor from your 401k. I lack enough info and context to say where this particular law lies.
  - tryingagainbro 9y ago
    True, but the idea is that in USA eventually you can go to an independent court and sort it out. or the agency will explain it more--something that applies to everyone.
    - adrianratnapala 9y ago
      You say that is the idea. It is indeed an idea. Is it the reality?
      - tryingagainbro 9y ago
        large companies absolutely do take the government to court. Smaller ones, maybe, if ACLU etc help them. But yeah, any problem can be solved in court by an non-corruptible judge. If he isn't then the appeals court is
        zdkl 9y ago
        Provided you're rich enough to bankroll the judiciary action and the adverserial shakedowns. Which would also typically mean you don't care that much about the outcome of the trial, if you've got that much cash to throw around.
        labster 9y ago
        Yes, but in the USA you don't have to be an oligarch. Even double-digit millionaires have effective access to the legal system.
        Nuzzerino 9y ago
        It didn't keep Shkreli out of trouble though.
        tryingagainbro 9y ago
        Well he did break quite a few laws and was an ass about it. Access to courts doesn't mean to ignore the laws. And he was guilty of poking the bear or something... If he was in Russia he would have been warned to pay Igor and to stop making fun of the regime. Given his attitude, he might have been somewhere in Siberia, pulling his hair out.
- trhway 9y ago
  >USA places a gazillion requirements for businesses (especially banks all over the world) so what Russia is doing is nothing extraordinary, on itself. i really doubt that you have ever dealt with any Russian legal/compliance/etc process, be it a personal or a business issue. As i have been there and done that, i can tell you it is night and day difference between US and Russia here. "Nothing personal, just business" - this is how it works in US, and "Nothing business, everything is personal" - this how it works everywhere in Russia.
  - tryingagainbro 9y ago
    "Nothing personal, just business" - this is how it works in US, and "Nothing business, everything is personal" - this how it works everywhere in Russia. More or less that's what I said. In Russia, no but am very familiar how Russia-like countries work. A phone call to the right person or cash solves you issues. Or you can bang your head against the wall
  - im3w1l 9y ago
    I am working in the US, and because of that no bank in my homecountry is willing to touch me with a 12ft pole. They will literally not allow me to have an account because FACTA is too much of a bother.
zzzcpan 9y ago
Providing physical access for law enforcement has nothing to do with it. It's more like a part of a kafkaesque process to overpower corporations, one step in a long-term strategy to force surveillance and censorship on all communication channels.
- ThrustVectoring 9y ago
  It's more about corruption than forcing surveillance, IMO. Corruption in Russia works approximately like this: 1. The legal rules for operating any business are intentionally set at a very complex and onerous level. 2. Unofficial license to flout those rules is sold through bribery or otherwise supporting the corrupt actors in Russian government. These bribes are necessary for business to function, because otherwise it's impossible to operate legally. 3. When someone refuses to play bribes or otherwise bow to the will of the corrupt actors, the unofficial license to flout those rules is rescinded and the persecution of that person is entirely within the "rule of law". I don't remember the exact specifics, but this was used pretty much exactly against a Russian oligarch who refused to sell his multi-billion dollar business below market price. He was investigated and prosecuted for some sort of crime, because everyone is always guilty of some sort of crime, because the only way to run a profitable business is to break the law and pay for the privilege of doing so.
- fish_fan 9y ago
  It’s difficult to parse out the difference here. The need to physically roll in is both the stick they’re using and the means with which they’ll retain control. Naturally, facebook doesn’t have much to stand on here. Russia of course has control of ingress they’ve been ratcheting up.
smueller1234 9y ago
I ran that very same project for a large tech company as well and our assessment was the same as yours. Intent is not having to deal with other countries authorities when making information requests. Oh, and the guess-what-they-really-want-so-we-can-even-comply-at-all game was fun here, as well. We made a genuinely good-faith effort in no small part because the Russian market does really matter to us. I think/hope it'll hold up. Sidenote: There's a similar (in hilarity not content) guesswork coming up with the new EU privacy regulations (GDPR and the new e-privacy regulation that isn't done yet). Sigh.
- int_19h 9y ago
  Out of curiosity, how do you determine whether a particular user is within the scope of this law, or not? (The problem with the law is that, by the literal meaning of its wording, it is applicable to all Russian citizens anywhere in the world, not just in Russia proper.)
  - smueller1234 9y ago
    Geo-IP minus any cases of "we know they're not Russian" due to accounts/etc. In other words: as conservative as possible heuristics. Edit: Clarification. Simply having an account on some website is obviously not what I meant. I meant cases where we legitimately have and are allowed to use (see GDPR consent requirements wrt what you can and can not do with PII under EU regulations) users' PII to decide this.
    - int_19h 9y ago
      Is there a case where "you know they're Russian", but geo-IP doesn't support that?
      - smueller1234 9y ago
        What I wrote earlier ought to be symmetrical. But in practice, having certainty is exceedingly rare. It's not like we require passports for our service. What I meant is more that simply because an existing customer uses the services while travelling on Russia, we don't just move all data there.
int_19h 9y ago
> everything to do with Russian law enforcement wanting a physical location they can easily roll into with a warrant Or better yet, without one. https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/Yarovaya_law#Surveillance_provisions https://en.wikipedia.org/wiki/Yarovaya_law#Surveillance_prov...

by dmoy 9y ago

tryingagainbro 9y ago

There was precious little guidance given on exactly what a kosher implementation would be, so devs pms and lawyers just get together and make a good faith effort at it. I imagine that in Russia and similar countries, lack of guidance is by design. If you don't tow the FSB line, don't pay the bribes or if someone else wants your business, you've broken the law by not implementing federal law zxy52n. Edit: USA places a gazillion requirements for businesses (especially banks all over the world) so what Russia is doing is nothing extraordinary, on itself. They have their own FB so I doubt they'll miss much even if FB was banned tomorrow.

dmoy 9y ago
Well to be fair, even the US doesn't always given an abundance of guidance on everything. For a random example, up until irs notice 2014-54, it was a bit shady exactly how you could get away with roth ira backdoor from your 401k. I lack enough info and context to say where this particular law lies.
- tryingagainbro 9y ago
  True, but the idea is that in USA eventually you can go to an independent court and sort it out. or the agency will explain it more--something that applies to everyone.
  - adrianratnapala 9y ago
    You say that is the idea. It is indeed an idea. Is it the reality?
    - tryingagainbro 9y ago
      large companies absolutely do take the government to court. Smaller ones, maybe, if ACLU etc help them. But yeah, any problem can be solved in court by an non-corruptible judge. If he isn't then the appeals court is
      - zdkl 9y ago
        Provided you're rich enough to bankroll the judiciary action and the adverserial shakedowns. Which would also typically mean you don't care that much about the outcome of the trial, if you've got that much cash to throw around.
        labster 9y ago
        Yes, but in the USA you don't have to be an oligarch. Even double-digit millionaires have effective access to the legal system.
        Nuzzerino 9y ago
        It didn't keep Shkreli out of trouble though.
        tryingagainbro 9y ago
        Well he did break quite a few laws and was an ass about it. Access to courts doesn't mean to ignore the laws. And he was guilty of poking the bear or something... If he was in Russia he would have been warned to pay Igor and to stop making fun of the regime. Given his attitude, he might have been somewhere in Siberia, pulling his hair out.
trhway 9y ago
>USA places a gazillion requirements for businesses (especially banks all over the world) so what Russia is doing is nothing extraordinary, on itself. i really doubt that you have ever dealt with any Russian legal/compliance/etc process, be it a personal or a business issue. As i have been there and done that, i can tell you it is night and day difference between US and Russia here. "Nothing personal, just business" - this is how it works in US, and "Nothing business, everything is personal" - this how it works everywhere in Russia.
- tryingagainbro 9y ago
  "Nothing personal, just business" - this is how it works in US, and "Nothing business, everything is personal" - this how it works everywhere in Russia. More or less that's what I said. In Russia, no but am very familiar how Russia-like countries work. A phone call to the right person or cash solves you issues. Or you can bang your head against the wall
- im3w1l 9y ago
  I am working in the US, and because of that no bank in my homecountry is willing to touch me with a 12ft pole. They will literally not allow me to have an account because FACTA is too much of a bother.

zzzcpan 9y ago

Providing physical access for law enforcement has nothing to do with it. It's more like a part of a kafkaesque process to overpower corporations, one step in a long-term strategy to force surveillance and censorship on all communication channels.

ThrustVectoring 9y ago
It's more about corruption than forcing surveillance, IMO. Corruption in Russia works approximately like this: 1. The legal rules for operating any business are intentionally set at a very complex and onerous level. 2. Unofficial license to flout those rules is sold through bribery or otherwise supporting the corrupt actors in Russian government. These bribes are necessary for business to function, because otherwise it's impossible to operate legally. 3. When someone refuses to play bribes or otherwise bow to the will of the corrupt actors, the unofficial license to flout those rules is rescinded and the persecution of that person is entirely within the "rule of law". I don't remember the exact specifics, but this was used pretty much exactly against a Russian oligarch who refused to sell his multi-billion dollar business below market price. He was investigated and prosecuted for some sort of crime, because everyone is always guilty of some sort of crime, because the only way to run a profitable business is to break the law and pay for the privilege of doing so.
fish_fan 9y ago
It’s difficult to parse out the difference here. The need to physically roll in is both the stick they’re using and the means with which they’ll retain control. Naturally, facebook doesn’t have much to stand on here. Russia of course has control of ingress they’ve been ratcheting up.

smueller1234 9y ago

I ran that very same project for a large tech company as well and our assessment was the same as yours. Intent is not having to deal with other countries authorities when making information requests. Oh, and the guess-what-they-really-want-so-we-can-even-comply-at-all game was fun here, as well. We made a genuinely good-faith effort in no small part because the Russian market does really matter to us. I think/hope it'll hold up. Sidenote: There's a similar (in hilarity not content) guesswork coming up with the new EU privacy regulations (GDPR and the new e-privacy regulation that isn't done yet). Sigh.

int_19h 9y ago
Out of curiosity, how do you determine whether a particular user is within the scope of this law, or not? (The problem with the law is that, by the literal meaning of its wording, it is applicable to all Russian citizens anywhere in the world, not just in Russia proper.)
- smueller1234 9y ago
  Geo-IP minus any cases of "we know they're not Russian" due to accounts/etc. In other words: as conservative as possible heuristics. Edit: Clarification. Simply having an account on some website is obviously not what I meant. I meant cases where we legitimately have and are allowed to use (see GDPR consent requirements wrt what you can and can not do with PII under EU regulations) users' PII to decide this.
  - int_19h 9y ago
    Is there a case where "you know they're Russian", but geo-IP doesn't support that?
    - smueller1234 9y ago
      What I wrote earlier ought to be symmetrical. But in practice, having certainty is exceedingly rare. It's not like we require passports for our service. What I meant is more that simply because an existing customer uses the services while travelling on Russia, we don't just move all data there.

int_19h 9y ago

> everything to do with Russian law enforcement wanting a physical location they can easily roll into with a warrant Or better yet, without one. https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/Yarovaya_law#Surveillance_provisions https://en.wikipedia.org/wiki/Yarovaya_law#Surveillance_prov...