Hacker News Reader

Comment by tobltobs | Hacker News Reader

I didn't know about this crazy new regulatory requirements until now. Quoting from an article [1] describing the new law:

> “When collecting personal data, including through information and the internet telecommunications network, the operator is required to provide a record that the systematization, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation, is held on databases located in the territory of the Russian Federation.”

I could imagine that complying to this regulation wont be worthwhile for most companies.

Edit: The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also.

[1] https://techcrunch.com/2014/07/02/russia-moves-to-ban-online...

View on HN

> The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also.

Correct! I was on a team trying to architect a solution for this and the requirements was really diffuse. We ended up doing a DB "replication" (via triggers) to a Russian cloud provider after the data had been committed in a european data center. The lawyers signed off on it but there were no clear guidelines from the Ministry of Communication (http://minsvyaz.ru/) on what was OK from an tech implementation view.

However, I feel that the best solution for solving it was to have all Russian traffic routed through something like a reverse web proxy which would first write the data to servers located in Russia or fail the request.

Since you may not reliably determine the citizenship via traffic routes, probably, it's better to ask user during signup about his country (simple pre-filled "Where are you from?" question, true answer on which is required by ToS) and then route his data through a native (Russian, Chinese etc) server, which can store it and "request" further processing overseas (this fulfills all the requirements of the law, including both storage and primary processing).

As a contractor outside of EU/USA I stuggle a lot to handle those regulations for PII(personal identify information). We have no rights to transfer even a single bit of PII out of EU/USA networks.

So I just don't understand, why it's such a news after all.

Apple and Oranges. You still can transfer the data out of Russia, you just have to "give" them a copy.

Aren't these crazy new regulatory requirements only a step up from the ones in place in the EU[0]?

[0]http://ec.europa.eu/justice/data-protection/international-tr...

I wonder if there is any requirement that the data be readable? I mean, you could store it in encrypted format, but keep the keys outside of Russia...

it would be foolish to not encrypt the data at rest and probably just as silly to keep the keys in the same location.

This is from another article [1] about the “Yarovaya package":

> Finally, any online service (including social networks, email, or messaging services) that uses encrypted data is now required to permit the Federal Security Service (FSB) to access and read their services’ encrypted communications, including providing any encryption keys.

It is not clear from this article also if you can encrpyt the user data and keep the key. But I guess that wouldn't be along of the spirit of this law.

[1] https://www.eff.org/deeplinks/2016/07/russia-asks-impossible...

At the end of the day, creating many of these services is trivial. Creating a LinkedIn clone is trivial, and one will pop up in Russia giving some Russian owners profit and creating jobs for Russians. So how it's bad for the Russian economy, or the economy of any country to do this, is beyond me. On the other hand, dictatorships and capitalist democracies love to gather as much information as they can on their citizens, so it will allow Russians to get more information on their citizens. Which may be bad for some of them.

Because a large part of the Russian software market is overseas.and many developers work on contract. Further, this helps the Kremlin's agenda which has lead to economic stagnation, and the average gdp of Russians dropping below that of China.

Doesn't seem like it: https://www.google.ca/search?q=russia+gdp

Well, the Chinese median income is double that of Russia though

Are you hoping people won't look past the misleading google chart that ends in 2013?

Russia's GDP has been reliably falling since then. http://www.tradingeconomics.com/russia/gdp-per-capita-ppp

Are you hoping I won't type /china/ in the URL? The statement "average gdp of Russians dropping below that of China" is still not true. Though I am not an expert on the subject, nor do I have a interest in Russia.

http://www.tradingeconomics.com/china/gdp-per-capita-ppp

I thought you were contesting the bigger argument that Russia's economy is stagnating, since the link you provided did not contradict anything else (there was no reference to China).

> Creating a LinkedIn clone is trivial

Sure, but reaching a critical mass isn't. And for Russian freelancers looking for work outside of Russia a Russian LinkedIn isn't helpful. Maybe the problems with this regulation will be more obvious if a service like Github is blocked.

We actually had Github banned in Russia once or twice for short periods of time (like hours or days). Because of some repository contained joke text about how to commit suicide.

It's not about the economy, it's about control. Give them control or get out. Eventually the only companies left are those that will acquiesce to Russian demands.

From how I understanding "Russian state philosophy" (if there's such a thing) I'd even intuitively assume they're not necessarily primarily interested in gathering everything-about-everyone but in ensuring no other party (especially private western/multinational corps) gain potentially such an information advantage over them. We've arrived in an age when non-sovereign entities can gain leverage over sovereign entities and thus become "geopolitical players", to be "reckoned with".

That's my understanding of it, also. Just the other day I was discussing with a work colleague about what would have happened had FB not been blocked in China almost from the very beginning. Imagine all the Chinese' people data sitting on a server a couple of keystrokes away from entities like the NSA. Our example, made half-jokingly, was something along the lines of: "Imagine how much information you can gain just by tracking the GPS positions of the personal secretaries attached to important Chinese Communist Party power figures".

Totally. It's about control now, the possibility of control in the future, and taking away opportunities for control over you from your adversaries.

Same as National Security Letter. You give the government what it wants, or else. At the end of the day the difference is soft power vs. hard power. The thugs dressing in nice suits and having their agents mess your business up through audits or lawsuits, or thugs sending their secret police to mess you up. The end result is they get what they want no matter what.

Uh... You can't send a national security letter to a foreign company that has no presence in the US. Well, you can probably send it, but since the foreign company is not bound by US laws, they can ignore it and even publish it (this is my understanding, IANAL).

The whole point of this Russian law is to remove this limitation.

I guess the question is what qualifies as presence in your view. LinkedIn has a presence in Russia due to it's Russian clientele, that's why Kremlin is going after them in the first place.

This is only party relevant, but in the past few years the US started going after people solely based on the fact that they have some money in a US bank (and no other ties, i.e. 'presence'). So now you have the US Federal court in Brooklyn prosecuting the FIFA corruption scandal.

The original point stands, I think. If a state actor has interest in your affairs, they will find legal ways to spy on you, or create new laws so they can. Honestly, the NSA scandal, and the gross violation of personal privacy in the US after 9/11 should have taught people that. And the US is the bastion of modern democracy (saying this w/o sarcasm) to boot.

The State department has gone after companies that had no US presence, they did so on the basis of Americans using the website which they feel gives them jurisdiction. It's very similar to that.

What are some of those companies? I'd be curious to read about that. Because it doesn't sound like the state dept. has any legal basis here, just American specialism.

At any rate, US is not the bastion of freedom that Russia's actions should be compared to. Especially so when it involves three-letter agencies.

To clarify the distinction I'm trying to make - yes, US doing some shady shit, mostly trying to keep it in secret. Russia is explicitly legalizing such shady shit. And doing even shadier shit in secret.

LinkedIn clone already exists for quite a long time. The professionali.ru service even copied the original design when it was launched. Not successful. :)

The real alternative - startup MoiKrug.ru ("my circle"), that was launched in mid-2000s - was purchased by Yandex, made irrelevant by lack of clear strategy and finally sold to some other investor.

Oh my, are they still around? I was one of the volunteers on the team back in 2006.

I wonder what sort of onus is on the operators to determine the citizenship of its users. How do I know that Andrey Zhukov is a citizen of the Russian Federation? Does a Russian name and a home address of Saint Petersburg suffice?

They don't. That's the trick

> I could imagine that complying to this regulation wont be worthwhile for most companies.

In all likelihood, a crony-backed service handling this for foreign tech companies doing business in Russia will emerge.

Reply on news.ycombinator.com