Every hour counts! Russian officials drafted legislation that would allow the police to access people’s geolocation data without judicial oversight. Useful streamlining or dangerous surveillance?
Federal officials in Russia want to jettison privacy protections that currently require law enforcement agencies to obtain a court order before accessing cell-phone users’ geolocation and billing data. The Digital Development, Communications, and Mass Media Ministry says streamlining this process would save lives in searches for missing persons (when speed is crucial). Experts warn, however, that the ministry’s proposal could simplify the expansion of mass surveillance in Russia.
Meduza first published this article in Russian on February 4, 2021.
As reported by the newspaper Vedomosti, the amendments drafted by the Digital Development Ministry would revise Article 63 on the “secrecy of correspondence” codified in Russia’s law on communications. Meduza also obtained a copy of the proposal, which calls for changes to the types of information safeguarded under Article 63 and would allow extrajudicial access to cell-phone users’ geolocation information and telecom billing data.
The bill hasn’t yet been introduced to the State Duma, but the Digital Development Ministry says its proposals were drafted in accordance with President Putin’s instructions, meaning it is likely only a matter of time before the legislation comes before deputies.
Digital Development Deputy Minister Oleg Ivanov also confirmed the drafting of this bill, arguing that the reforms are needed to expedite searches for missing persons “when it’s a matter of hours”:
“Every year, tens of thousands of people go missing in this country. Federal agencies responsible for operative investigative activities are used as resources in searching for them, as are voluntary search parties and telecom operators. Telecom operators can provide information on individuals’ communications, including the GPS coordinates from missing citizens’ devices.”
In 2018, a group of deputies and senators led by Federation Council President Valentina Matviyenko submitted a similar bill to the State Duma, but the initiative stalled and never passed. An explanatory note attached to the bill cited statistics from the Interior Ministry stating that roughly 120,000 people disappear every year in Russia. Approximately 90 percent of the people who go missing are apparently carrying a mobile phone when they disappear. Typically, after a search has begun, the person’s phone remains powered-on for the first two or three days, but “missing persons cannot [contact emergency services] in remote areas due to the lack of network coverage.”
“An effective way to conduct search activities would be to use the information about the mobile user’s location stored by telephone communication networks, including data recorded up to the moment of the user’s last connection,” argued Matviyenko and the other lawmakers.
The Digital Development Ministry claims that it is simply “finalizing” this draft legislation by taking into account comments from Russia’s Public Chamber about specific conditions for data recovery and “measures for increasing the accuracy of determining mobile users’ locations.”
How does this kind of thing work right now?
Currently, the Russian authorities can obtain billing data and phone geolocation information only by court order when opening criminal cases, conducting preliminary investigations, or compiling a police dossier, says Anatoly Loginov, a partner at the law firm “Pen & Paper.” There are some loopholes here, however, Loginov told Meduza:
“That said, there are a few exceptions [to this rule]. Special cases arise when there’s a high likelihood of grave or especially grave crimes, threats to state security, or the disappearance of a minor. So, with the parents’ consent, information about the child’s call and text records and geolocation can be requested immediately, and then a court order must be obtained within 48 hours.”
If these data cease to be protected under Russia’s privacy laws, as the Digital Development Ministry is proposing, accessing the data will become much easier. “If the amendments are signed into law, agencies that carry out operative investigative activities will be able to obtain location data for anyone’s mobile device upon request — no court order needed,” says Loginov.
According to data from the Russian Supreme Court’s Judicial Department, Russian courts received 514,700 requests from law enforcement agencies in 2019 for “limitations to the confidentiality” of written and call conversations. In almost all these cases (514,000), the courts approved the requests. That same year, the courts received another 268,000 requests for access to billing information about connections made between clients. Out of these requests, the courts approved 259,600.
What happens if the amendments become law?
In their current form, the amendments would open up avenues for abuse, says Pen & Paper’s Loginov:
“The lack of judicial review would lead to law enforcement agencies having unregulated and uncontrolled access to information. And this means that not only will we find ourselves under tighter scrutiny, but there will also be a considerably increased risk of data leaks when it comes to the phone calls and movements of mobile users. As a result, data will be sold on black markets, the procurement of information will become monetized, and there will be other undesirable consequences.”
Speaking to Meduza, Internet Research Institute General Director Karen Kazaryan pointed out that the Digital Development Ministry’s revisions to the senators’ bill have made it even less suitable for its stated purpose of searching for people:
“For instance, the bill doesn’t have any provisions that would allow telecommunication operators to provide geolocation data to volunteer search-and-rescue organizations like ‘Liza Alert,’ which the deputy minister of digital development mentioned in his comments. In other words, they still wouldn’t be able to request geolocation data when looking for missing persons — only law enforcement agencies would be able to do that. The senators’ original version of the bill actually provided for providing geolocation data to third parties. It would have been permitted as long as the mobile user in question had given prior consent.”
Kazaryan says the Digital Development Ministry’s bill will make it easier in the future for police and federal agents to include individuals’ geolocation data in investigations. “You have SORM and the Yarovaya law, so even now law enforcement agencies are able to obtain geolocation data without too much hassle. But they’re constantly running into problems when they try to add this information to their case materials because the law on operative investigative activities doesn’t clearly specify the procedure for obtaining these data. This bill can partially solve that problem,” Kazaryan explains.
Ivan Begtin, an open-data specialist and the director of the “Information Culture” nonprofit organization, also warns that granting such access to geolocation data without judicial oversight will open the door to nearly unlimited snooping. On Facebook, Begtin wrote: “It’ll be possible to create dashboards showing thousands of people in real-time and track and set notifications for when they appear in certain places or with certain people and so forth.”
As a result, Russia’s authorities will be able to monitor not just opposition politicians and activists, but also government employees, entrepreneurs, and virtually anyone. The police will then be able to “monetize” that same information on the black market, says Begtin.
Story by Maria Kolomychenko
Translation by Sydney Lazarus
A police dossier
This refers to all documents on a specific issue that are collected during the process of conducting operative investigative activities. These documents are necessary for collecting and systemizing information for the purpose of making further decisions, such as initiating a formal case.
What’s SORM?
SORM, the Russian acronym for “System for Operative Investigative Activities,” refers to a system of equipment designed for law enforcement agencies to monitor information passing through Russia’s communication networks. The system is subdivided into SORM-1 (a wiretapping system), SORM-2 (Web-traffic logging), and SORM-3 (a collection of all types of communication information, including telecom billing).
Any communications company that is licensed to operate by Roskomnadzor is required to install SORM equipment.
The Yarovaya law
The Yarovaya law refers to a pair of laws passed in 2016 that was designed to fight terrorism. They contain provisions requiring telecom operators and Internet companies to keep records on phone calls for up to six months, Internet traffic for one month, and various metadata, including geolocation and calls and texts between mobile users, for three years.