You’ve Lost Control Again

Black Lists and Total Monitoring: Agora’s New Report on the Surveillance of Russians
A person’s life is utterly transparent to the secret services
Damir Gainutdinov
Republic
August 22, 2017

The Agora International Human Rights Group has released a report entitled “Russia under Surveillance 2017: How the Authorities Are Setting Up a Total System for Monitoring Citizens.” Damir Gainutdinov, the report’s co-author, discusses its key points. The Russian state has been harvesting an unprecedented amount of information about its citizens and wants to collect other kinds of information. It maintains a system of black lists that categorize different types of citizens and has been engaged in a relentless assault on internet anonymity. (You can read the full report in Russian.)

In recent years, Russia has been assembling a complex system for monitoring grassroots activists, reporters, and members of the opposition, a system that encompasses at least several thousand people. Under the pretext of public safety, and fighting extremism and terrorism, the security forces have been monitoring people’s movements around the country and when they cross national borders, wiretapping their phone conversations, intercepting their SMS and email messages, staking them out and surveilling them with audio and video equipment, and analyzing and systematizing biometric information. They have made vigorous use of illegal methods, for example, hacking internet accounts.

The key problem is the absolute lack of control over the state’s invasion of our private lives. The courts rubber stamp decisions taken by the security services. There is almost no chance of successfully challenging the decisions in court. Hence, over the past ten years, the courts have on average approved 98.35% of motions by the state to limit a person’s privacy of correspondence. The upshot is that any law-abiding resident of Russia is now constantly exposed to the risk of arbitrary access to her private life through the internet, mobile telephones, video surveillance, random contacts with the police, when using money, pubic transportation, and driving her car, and applying for a job at a number of workplaces, as well as traveling abroad, carrying weapons, and exercising her other rights.

Privacy and the presumption of innocence are meaningless, and the intensity of the interference has been constantly increasing. The number of requests to eavesdrop on telephone conversations and intercept correspondence have alone more than tripled since 2007.  A person is faced with a choice: either accept total surveillance as a given or look for ways of guarding her privacy. The state, however, regards the latter as illegal, the attempt to hide something criminal.

Complusory Biometrics
The Russian authorities have been vigorously engaged in gathering biometric information: fingerprints, DNA samples, and photographs. By law, this can be done without the individual’s consent if it is a matter of national security, for example. Aside from voluntary fingerprinting (anyone can go to a police and submit his fingerprints), the procedure is obligatory for a large number of people ranging from security services officers to people applying to work as private detectives, from suspects in criminal cases to people who have only committed administrative offenses if there is no other way to identify them, from large numbers of foreigners to stateless persons. Since 2015, anyone over the age of twelve who applies for a biometric foreign travel passport must also submit prints of two fingers. Meaning that, currently, we are talking about at least 25 million people. [Russia’s current population is approximately 143 million.]

Despite the clear list of grounds for compulsory biometric registration, there are regular reports of patently illegal attempts to fingerprint, photograph, and do saliva swipes for DNA tests. Participants of public events such as protest rallies, political activists, and reporters have been the victims of these attempts.

For example, on March 23, 2017, in Moscow, police detained supporters of Alexei Navalny who were handing out stickers in support of his campaign to be allowed to run in the 2018 presidential elections. The detainees were all taken to the Arbat Police Precinct for “preventive” discussions, during which the information in their internal passports was copied and they were fingerprinted. In another incident, which took place on April 6, 2017, at a market in Simferopol, around fifty people of “non-Slavic appearance” were detained, allegedly, because they were mixed up with Crimean Tatar activists in Crimea. Lawyer Edem Semedlyaev said all the detainees were forcibly fingerprinted, photographed, and swabbed for DNA samples.

Video Surveillance
As of 2015, the so-called Secure City complex has begun to be installed in all regions. Secure City is an extensive system of video surveillance and facial recognition. In Moscow alone, 184.6 billion rubles [approx. 2.6 billion euros] have been allocated on implementating the program until 2019. As of 2016, 86.3% of residential neighborhoods in Moscow were covered by CCTV systems. 128,590 cameras had been installed, 98,000 of them in stairwells. The Secure City video archive is stored for five days, and direct access to the recordings is enjoyed not only by the Interior Ministry [i.e., the police] but also by other state agencies.

Under the pretext of getting ready for international sports events, the authorities have improved their surveillance capacities. Sports complexes are equipped with CCTV systems featuring facial recognition functions, even in towns not hosting sporting events. Moscow’s railway stations have been expanding the areas covered by cameras that identify faces and record car license numbers. The Russian government has issued a decree ordering local authorities to draw up lists of places where more than fifty people can gather. They all must be equipped with CCTV systems. The recordings will be stored for thirty days.

Special systems for identifying people have been used at authorized public events [i.e., permitted protest rallies]. For example, officials have admitted they could have identified absolutely everyone who passed through the inspection line on June 12 on Sakharov Avenue.

Tracking Movements
When you buy a ticket, stay at a hotel or use public-access Wi-Fi in Russia, you are informing the regime about your whereabouts.

When you have anything to with with almost any form of long-distance public transportation, the authorities will at very least learn your name, date of birth, type and number of identity card, sex, nationality, departure and destination points, route, and other information using a round-the-clock interactive system.

The practice of scanning passports is widespread in hotels, since management is obliged to inform the Interior Ministry about the registration of guests within twenty-four hours.

The information obtained is sufficient to determine the whereabouts of a person of interest at any moment. The information is used, among other things, to track the movements of activists and human rights workers, and exert pressure on them. This was how Agora lawyer Alexander Popkov was followed when he arrived in one of the regional centers of Krasnodar Territory to take part in the trial of a police officer accused of rape and murder. Arrivign at the train station, Popkov was swiftly met by police investigators, who immediately informed him he was listed in a Russian Interior Ministry database, and so they wanted to know his purpose for visiting the city. The policemen knew his route and means of transportation, his place of residence, and the particulars of his documents.

Eight Years of Administrative Supervision
In May 2017, the use of administrative supervision for persons released from imprisonment increased. A court has ordered that an acknowledged political prisoner, Tatar activist Rafis Kashapov, will be placed under administrative supervision for eight years after being released from prison. In 2015, Kashapov was sentenced to three years in a prison colony for publishing texts critical of Russia’s actions in Ukraine. Now, after he is released, Kashapov must register with the police within three days, inform them of all his travel plans and changes of places of residence and work, and report to a police station to give testimony when required by the police. Police officers can conduct individual preventive work with him, ask his employer about his behavior, freely enter his house, and forbid him from making short trips even, for example, when a relative dies.

In addition to administration supervision, which is on the record, there is also clandestine surveillance. Formally, putting someone on preventive registration is part of the beat cop’s routine work. In practice, it has turned into a means for surveilling “suspicious” people, which includes not only ex-cons and registered drug addicts but also people who have committed crimes against public safety at mass events [i.e., committed minor or wholly fictitious infractions at protest rallies], as well as members of “informal youth organizations.”

Lists of the Disloyal
Aside from putting people on preventive registration, the Russian authorities maintain a number of different lists and databases, chockablock with “unreliable” people and organizations. If you end up on one of these lists, you are guaranteed increased attention from law enforcement, including constant checks, detentions, and inspections. Here are only a few of these lists.

Rosfinmonitoring (Federal Financial Monitoring Service) publishes a list of organizations and peoples involved, allegedly, in extremism or terrorism. The list includes the names, dates and places of the birth of the people, and the relevant information about the organizations. A court order banning an organization or sentencing someone for a crime is not required for inclusion on the list. The list features not only people convicted of terrorism but also people suspected of terrorism. It suffices that a prosecutor or the Justice Ministry has suspended an organization’s work or brought charges or declared someone a suspect in the commission of one or more of twenty-two crimes listed in the Criminal Code, including the most “popular” anti-“extremist” crimes. Currently, the list includes 7,558 Russian citizens, 411 foreign nationals, and 182 organizations.

Inclusion in the list means the state has total control of your financial transactions and disposal of your property. All transactions to which a person on Rosfinmonitoring’s list is a party are subject to mandatory control by banks. If they fail to exercise this control, they will be punished by the Russian Central Bank. By default, all transactions are frozen, but you can spend 10,000 rubles per month per family member [approx. 143 euros]  from the wages you earn, and you can also spend the welfare payments you receive. It often happens that people placed on the list discover it after the fact, when they call the bank to find out why a transaction has not been completed.

Of course, there is also the list of NGOs declared “foreign agents,” which the Justice Ministry requires to submit additional reporting on property, expenditures, and management. The Justice Ministry also keeps lists of “undesirable” and “extremist” organizations (currently, there are 11 and 61 of these organizations, respectively). When they are accorded this status, the authorities are obliged to identify their rank-and-file members. When it is a matter of large organizations, thousands and, sometimes, hundreds of thousands of people find themselves targets of surveillance. Thus, in the wake of the banning and forced closure of the Jehovah’s Witnesses in Russia in 2017, up to 150,000 of its followers in Russia face the prospect of criminal investigations and criminal prosecutions.

Groups that used to be on the periphery of public life, for example, football fans, have also faced increased attention from the authorities. After a law was amended in 2016, the Interior Ministry began publishing lists of people banned from attending sporting events. The listed included 319 names at the the end of July.

Schoolchildren are yet another group that has faced increased police surveillance. Thus, in the Education Ministry’s recommendations on criminal subcultures [sic], schoolteachers are practically delegated the role of police investigators vis-à-vis minors. They are obliged to divulge information to the police about the private lives of their pupils and their families. This means that the children are entered into the record and put in various police databases.

The Attack on Anonymity
In 2016, the authorities launched a vigorous campaign against anonymity on the internet. The so-called Yarovaya anti-terrorist package of amendments to existing laws could have supplied the secret services with unsupervised access to all communication among users if it were not for the resistance of some providers and standard end-to-end encryption. The Yarovaya package continued the policy of nationalizing and deanonymizing the Runet, which could provide full control over the information flows inside Russia.

The next steps were the laws on messengers and anonymizers, signed by the president on July 30, 2017. The first law, in particular, stipulates the obligatory identification of users by mobile telephone numbers. The second law is essentially an attempt to establish total control over anonymizers and VPNs.

In August 2017, the Communications Ministry published draft requirements for internet providers, as listed in the register of information distribution companies. The draft includes a list of information that must be accessible to the FSB (Federal Security Service): the date and time the user was registered, and the latest update of the registration form; nickname, date of birth, address, full name, passport particulars, other identity documents, languages spoken, information about relatives, and accounts with other providers; the receipt, sending, and processing of messages, images, and sounds; recipients of messenges; financial transactions, including payees, amounts paid, currency, goods and services paid for; and client programs and geolocation information, among other things. Providers are required to store and transmit to the security services not only sent and received messages, but draft messages as well.

And yet public opinion polls show the majority of Russians are not terribbly worried about maintaining privacy for the time being. [Russian opinion polls are worthless as measures of real opinion—TRR.] For activists, reporters, and members of the opposition, however, the refusal of internet companies to cooperate with the authorities and the capacity to withstand hacking are the only guarantees of their security.

Without access to encrypted correspondence, the Russian state, apparently has had to resort to the services of hackers. Thus, on October 11, 2016, Google and Yandex warned several dozen activists, reporters, and NGO employees about an attempt by “pro-government hackers” to hack their accounts.

The Burden of Information
Despite establishing legal grounds for harvesting information about nearly everyone in Russia, there is a huge amount of evidence the regime is technologically and financially incapable of gathering, storing, and qualitatively processing it.

The most obvious example of this is, perhaps, the Yarovaya package itself. During an economic crisis, the authorities are clearly not willing to incur the huge expenses required to implement the entire range of e-surveillance of the populace, which, according to various estimates, could cost from 130 billion rubles [approx. 1.86 billion euros] to 10 trillion rubles [approx. 143 billion euros]. Consequently, the duties of collecting and saving traffic have been sloughed off onto the telecoms and internet providers, who are likewise not at all happy about such a “gift” and have already begun to raise their rates. Meaning that the surveilled themselves have been asked to pay for the ability of the secret services to read their correspondence and view their personal photographs, to pay a kind of “shadowing” tax. Meanwhile, since more than half the world’s internet traffic is already transmitted in encrypted form, the regime, even though it has access to exabytes of user correspondence, has been forced to demand that providers supply them with encryption keys.

Aware of its limited resources, the Russian state has focused on more diligent work with specific groups. Hence, the enthusiasm over different types of black lists, as well as the delegation of surveillance duties to telecoms, internet providers, banks, and transportation companies. On the one hand, they have access to the information; on the other hand, they depend on the state, make their money from government contracts or receive their licenses and permits from the state.

The authorities are willing to chuck the black lists, which have proved ineffective, just as they gave up on the bloggers register. This would enable them to focus resources on various risk groups. When necessary, they could include people of special interest in the groups while surveilling the populace as a whole.

Consequently, the security departments of many commercial organizations have been ratting on their clients to the security forces, headmasters have been forced to gather dirt on schoolchildren, and internet providers to monitor the traffic of users. Even as it stores this growing mountain of information on Russians, the authorities care little for their safety. Increasingly, user data has become publicly accessible, often deliberately.

Damir Gainutdinov is a legal analyst at Agora. Photo and translation by the Russian Reader