Net Effects: Roskomnadzor’s Telegram missteps set up Runet chaos

By Allen Maggard

Most Russia watchers are aware of the recent commotion surrounding Russian media and telecoms watchdog Roskomnadzor’s (RKN) efforts to block the encrypted messaging app Telegram. The spectacle surrounding this campaign has attracted considerable attention in the press, largely because of RKN’s clumsy implementation. The debacle looks all but certain to have sealed the fate of RKN director Aleksandr Zharov, although Zharov himself has denied having any intention of leaving his post. Yet recent developments indicate that the tumult around Telegram has not deterred the Kremlin from seeking to further moderate and discipline the Russian internet. Indeed, the disastrous rollout may encourage other official figures and branches within the Russian government to undertake similar initiatives of their own to demonstrate their worth to Putin.

On 16 April 2018, RKN ordered Russian internet service providers to begin blocking access to Telegram. RKN obtained legal approval for the measure from Moscow’s Taganskiy District Court on 13 April 2018 (case number 02-1779/2018) under Section 2 of Article 15.4 of the Federal Law on Information, Information Technologies, and Information Defense (Information Law). The latter statue enables RKN to block access to “organizers of online information dissemination” (dissemination organizers) who fail to comply with Article 10.1 of the Information Law, which obliges such dissemination organizers to turn over security information and communication data to security services engaged in “operational-search activity” (ORD). The legal definition of this latter term is rather vague, but it generally refers to preliminary investigations carried out by law enforcement organs for the purpose of acquiring information to substantiate criminal charges being brought against a particular person or entity.

The debacle looks all but certain to have sealed the fate of RKN director Aleksandr Zharov, although Zharov himself has denied having any intention of leaving his post

In this particular case Telegram breached its obligations under Article 10.1 of the Information Law by refusing to share its encryption keys with the Federal Security Service (FSB). The matter began on 19 July 2016 when the FSB issued an order mandating that Telegram and other dissemination organizers provide it with information “necessary for decoding electronic messages received, transmitted, delivered, and/or processed by internet users,” with non-compliance being treated as an administrative offense.  In October 2017, Moscow’s Meshchanskiy District Court fined the company RUB 800,000 for violating Article 13.31, Section 2 of Administrative Offenses Code (KoAP), which assigns penalties for dissemination organizers who refuse requests to support security agencies engaged in ORD investigations. Relevant court materials accessed by Republic’s editorial team indicate that the fine stemmed from Telegram’s refusal to provide the FSB with data associated with the perpetrators of the 3 April 2017 bombing of the St. Petersburg Metro.

Telegram attempted to appeal this decision to no avail, and on 20 March 2018 Supreme Court Justice Alla Nazarova upheld the lower courts’ rulings. That same day RKN called on Telegram to render its encryption keys unto the FSB within 15 days. Acting with the imprimatur of the Taganskiy District Court, RKN moved to remove Telegram from the Russian internet – resulting in what can only be described as a comedy of errors. Despite (reportedly) managing to cut Telegram’s traffic by 76.5%, RKN’s initial efforts resulted in millions of unrelated IP addresses being blocked, including those for its own website. RKN then upped the ante on 27 April 2018 by adding IP addresses associated with Facebook, Twitter, VKontakte, Odnoklassniki, and Yandex to its blacklist. The agency (partially) reversed course the following day, but reiterated its continued commitment to bring down Telegram.

The ramifications of this escapade are as embarrassing as they are politically combustible. Preliminary estimates indicate that the agency’s efforts to block Telegram may result in up to $2 billion in losses for Russian companies. RKN has been named a defendant in at least one legal action related to the agency’s mass takedown of IP addresses. Further litigation is likely to follow. Even erstwhile political opponents have united in voicing their disdain for RKN’s persecution of Telegram: liberal reformer Aleksey Kudrin stated that RKN’s battle with Telegram threatened to undermine Russia’s digital economy, while Chechen strongman Ramzan Kadyrov maintained that the agency’s campaign against the app was “not very Russian.” RKN meanwhile appears to have perturbed a not-inconsiderable cohort of the Russian public with its antics, as recent polling by VTsIOM shows that 24% of Russians believe that it is important to preserve access to Telegram. Tens of thousands of demonstrators have already taken to the streets of downtown Moscow to protest against the crackdown on Telegram, although it remains to be seen whether similar actions will sprout up outside the capital.

Time will tell if RKN will end up issuing a proper mea culpa. Sergey Grebennikov of the Regional Public Center for Internet-Technologies (ROTsIT) previously promised that RKN would unblock important “subnetworks” and refine its overall approach to blocking IP addresses. RKN and ROTsIT have already begun to liaise with representatives of Google and other members of the information technology industry for the express purpose of addressing “issues connected with the implementation of the court order blocking access to Telegram.” Notably, RKN Deputy Director Vadim Subbotin characterized RKN’s dialogue with Google as “constructive” but bemoaned the relative absence of progress in talks with Amazon, going so far as to insinuate that the retail giant was refusing to cooperate for certain unspecified “political reasons.”

Subbotin’s passive aggression notwithstanding, RKN’s interaction with western IT companies in the wake of the Telegram imbroglio merits further attention. RKN has already demanded that Apple and Google remove Telegram from their respective app stores. Zharov has also suggested that RKN could block Facebook by the end of 2018 for non-compliance with the Information Law. All of which raises the question of whether the Kremlin is using RKN’s struggle against Telegram as a means of laying the groundwork for a broader crackdown on western tech giants. Journalist Andrey Soldatov seems to subscribe to this notion: “If you have a government agency being so brutal attacking Telegram, taking down millions of IP addresses, after that you can do what you want. After they have faced this much heat, they can go after Facebook and Google.” Soldatov may be on to something, as RKN already appears to be developing additional legal frameworks to govern if not pressure foreign IT firms.

On 23 April 2018, Kommersant reported that RKN was preparing an amendment (administrative amendment) to a previous order that outlined the formal procedure for blacklisting online “information resources,” a move that the newspaper explicitly linked to the Telegram fiasco. Per Kommersant, the amendment in question would empower RKN to cite administrative offenses – not just criminal infractions – as a legal basis for blocking access to information dissemination platforms. RKN subsequently denied that this was the case, and claimed that the bill was actually intended to provide legal grounds for blacklisting sites in instances where relevant court orders contained “technical errors.” Whatever the case, the Federal Antimonopoly Service (FAS) separately proposed adopting implementing legislative changes (pre-installation concept) that would not only oblige smartphone and tablet manufacturers to allow Russian customers to delete pre-installed apps, but would further require these same manufacturers to provide Russian users with locally produced analogues of the same programs, ostensibly so as to help Russian app developers compete with “digital giants.”

Although these proposals amount to separate initiatives on paper, one can easily imagine how they might complement each other in practice. Suppose that FAS’ pre-installation concept was to enter into law, yet Apple refused to comply with it. Although FAS has not specified any specific statutes behind the pre-installation concept, Apple’s theoretical non-compliance would very likely expose it to administrative liability under Article 37 and the Law on Competition Protection (Competition Law). Per Article 51 of the Competition Law, FAS could then levy a fine against Apple were it to persist in its non-compliance; alternatively, under Article 39.1 of the Competition Law, FAS may issue a warning to Apple. Finally, Article 39 of the Competition Law would enable FAS to initiate formal administrative proceedings against Apple in accordance with Section 28 of KoAP.

Here it is worth noting that the abovementioned RKN amendment as described by Kommersant merely stipulates that the agency could initiate blacklisting procedures on the basis of “court rulings and decisions concerning administrative offense cases.” Because this language does not explicitly refer to “administrative offenses” in specific jurisdictional terms, it opens the door to RKN blocking the various online resources of foreign IT companies on the basis of administrative offenses identified and pursued by FAS. Thus, it is entirely conceivable that RKN’s administrative amendment might one day allow the agency to justify blocking the online stores of foreign “digital giants” like Apple and Google by citing the latter companies’ culpability for administrative offenses arising from their non-compliance with the FAS pre-installation concept. RKN and FAS already maintain a cooperation agreement technically committing both agencies to inform each other about legal actions where their respective jurisdictions overlap, so on paper both agencies are already primed to coordinate regulatory enforcement activities against common targets.

The scenario described above is admittedly entirely hypothetical. There certainly exist more straightforward ways of bringing the Apples and Googles of the world to heel. On 24 April 2018, for example, President Putin ratified a bill enabling RKN to block websites accused of libeling public figures. Only 24 hours later, St. Petersburg lawmaker Andrey Anokhin introduced a draft bill of his own that, inter alia, would require Russian users to access social networks like Facebook through web portals controlled by federal and municipal authorities. The political capital required for undertaking such heavy-handed approaches, however, might prove lacking in the wake of Telegramgate. Citing obscure administrative infractions as a pretext for blocking an online platform may provide a convenient ruse for RKN, especially if the infractions in question are not covered under the Information Law.

Taken as a whole, these developments suggest that Soldatov was correct in his assessment that the Telegram affair has not slowed the Russian government in its efforts to control the domestic digital landscape. Indeed, RKN’s failure to block Telegram may stimulate entrepreneurialism amongst various branches of the Russian state by incentivizing lawmakers and agencies alike to enact measures aimed at directly or indirectly disciplining and regulating access to the Runet in order to gain the Kremlin’s favor. If one accepts the premise that the standoff between RKN and Telegram has plunged Russia into an “internet civil war,” then it stands to reason that the ensuing battles will be waged using similar tactics of legislative encirclement, regulatory ambush, and judicial barrage. Russia’s netizens should expect extensive collateral damage.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s