The Russian bill on Internet Sovereignty adopted by the State Duma in first reading

By Dr. Andrey A. Shcherbovich (See russian version here)

On 12 February 2019, the State Duma, the lower house of the Russian Federal Parliament, adopted in the first reading the draft bill on Internet “sovereignty” in Russia. 334 deputies voted in favor and 47 against the document. At the same time, representatives of the private sector, civil society, and the Accounting Chamber (Russian parliamentary controlling authority) expressed criticism regarding this bill, because its implementation may require billions of dollars from the national budget.

The explanatory note to the bill states that the draft federal law, which is officially called “On Amendments to Certain Legislative Acts of the Russian Federation”, was prepared taking into account the aggressive nature of the US National Cybersecurity Strategy, adopted in September 2018.

Under these conditions, the note argues, protective measures are necessary to ensure the long-term and stable operation of the Internet in Russia and to increase the reliability of the Russian Internet resources. The bill determines mandatory rules for traffic routing and organizes control over their compliance. It creates an opportunity to minimize the transfer abroad of data exchanged between Russian users.

The bill also identifies cross-border connection lines and traffic exchange points. Their owners and operators will be obliged to provide opportunity for centralized traffic management in case of emergency. In other words, the bill creates a special emergency infrastructure to guarantee performance of Russian digital resources in case of impossibility to connect to foreign root servers.

Control over the implementation of the provisions established by the new law will be entrusted to the Federal Service for Supervision in the Sphere of Communications, Information Technologies and Mass Communications (Roskomnadzor).

There is a need to be ready if the country will be disconnected from of the global Internet – said the President of Russia, Vladimir Putin, meeting with representatives of Russian agencies and the press. At the same time, according to the Russian leader, the new cyberdefence is supposed to be utilized only as a reaction to threats coming from foreign states. The President called the Internet an “invention of intelligence services” listen, see and read what you say”, reinforcing that with no Internet they will not be able to do so.

In this sense, the President continued, the isolation of Russia from the global network will impose “tremendous harm to itself” not only economically, but also politically, but such a scenario is “theoretically possible”.

Adoption and implementation of the law on “Internet sovereignty” may create uncertainty for Russian digital businesses and expand require significant budget expenditures including to expand the powers of Roskomnadzor. These observations are clarified in the response to the bill, issued by the Expert Council under the Government of Russian Federation.

Notably, the experts pointed that the requirement for telecom operators to “transfer the complete scheme of their network and traffic routing to Roskomnadzor” is technically impracticable. They explained that this is not possible, as the network is constantly expanding and updating.

In addition, the experts stressed that the bill’s authors refer to the potential threat to the Russian segment of the Internet, but do not specify what such threat is. The government also considered that the amendments would expand the powers of Roskomnadzor, entrusting it with functions to eliminate all menaces to the integrity and security of the Internet, which the law now assigns to the ministerial level or the Government of Russia. The transfer and consolidation of the functions of regulation, supervision and direct management of the communications industry to Roskomnadzor “carries unacceptable risks” they say.

In November 2017, President Putin demanded to engage in the development of autonomous Internet control systems, which would remove the “domination” of the United States from the Russian portion of the network.

Importantly, the Ministry of Communications and Mass Media together with the Ministry of Foreign Affairs was tasked to develop an agreed position with the BRICS countries on creation of a BRICS domain name root server  system, which would “duplicate” the existing domain name system, would be independent of the control of international organizations and protect the number of Russian users from “targeted impacts”.

Lastly, it should be noted that this draft law is not the first legislative initiative aimed at deploying “sovereignty” on the Russian segment of the Internet. On June 24, 2016, the State Duma adopted a package of anti-terrorism provisions, developed by Deputy Irina Yarovaya and Member of the Federation Council Viktor Ozerov. After the first reading, some of the most resonant norms of the bill were relaxed or deleted. However, some of the provisions, at the time criticized by ICT industry representatives, remained in the document.

These amendments, better known as the “Yarovaya law” included provisions obliging telecom operators and Internet companies to store text messages, user conversations, as well as “the image, sound, video and other communications” up to six months. Since the introduction of these norms, telecom operators are required to provide access to all information to law enforcement agencies without a court order.