Is it possible to get rid of electronic surveillance?
Despite much talk in Russia about the notorious "traditional values," the authorities actively use all manner of advanced digital technologies and methods to control their citizens, especially those dissatisfied with the existing system and opposed to the war.
How can society be protected from such control? And is it even necessary? After all, the real danger of terrorism and actual terrorist attacks remains. This is what they say. Farida Kurbangaleeva, data journalist for The Insider Dada Lindell and executive director Internet Protection Society Mikhail Klimarev.
FARIDA KURBANGALEEVA
How big is the scale of the problem? That is, how actively are the Russian authorities currently using all sorts of surveillance and control systems against dissenting voices and dissent. It's clear that there are face recognition system, and all kinds of bugs, and malware, which are being implemented into various gadgets. How relevant is all this for Russia now?
DADA LINDELL
The surveillance problem is indeed a huge one, but it would be odd to say it's unique to Russia. I probably can't say it's the same in all countries, but many countries employ all of the things you mentioned, in some combination. But I think it's also important to say—and Mikhail can probably explain this better—that the problem with the internet, people's personal data in Russia, and the way companies operate isn't just the kind of state influence you mentioned. While surveillance affects everyone in one way or another, serious, intense surveillance affects only a small number of people. And everyone faces problems.
MIKHAIL KLIMAREV
At the same time, we shouldn't exaggerate the scope of this surveillance. Yes, it's serious, but not comprehensive. But it's not as if everyone is being monitored. There is data accumulated by various information systems, including non-governmental ones—for example, food delivery companies. All this data can be aggregated, but that doesn't mean it's already been collected and used to control you. In general, what's happening in Russia right now, to put it simply, is terrorism. Literally, it's terror. The authorities are truly terrorizing, creating the impression that they are omnipotent and can get to everyone. But in reality, as Dada said, this affects a small number of people who are actually being monitored and pressured. Nevertheless, just because you're paranoid doesn't mean you're not being monitored.
FARIDA KURBANGALEEVA
When I leave my personal information, say, in an online store or a company that provides certain services—and this happens literally everywhere—could this information be used against me at some point? I left my first name, last name, phone number, home address…
DADA LINDELL
Providers of any services are obliged by Russian, European, and to some extent American laws provide Your privacy, so your data is stored encrypted. Naturally, they don't. Companies do collect data about you, and the biggest problem, in my opinion, isn't that they recorded exactly what you bought on Ozon and put it in a box with your name, phone number, and address. It's that they've simultaneously collected a huge amount of other data about you: who you are, where you go, what your interests are, what products you prefer to buy, what day you get paid, and so on. And then they process this data and sell it to each other, and it doesn't even matter that you can't be identified from it.
MIKHAIL KLIMAREV
Yes, there is a particularly strong interest from law enforcement... Although it's probably hard to call these people in uniform "law enforcement"...
DADA LINDELL
In Belarus they say "weaklings".
MIKHAIL KLIMAREV
For the "weakers," of course, the places where big data is accumulated are of particular interest. For example, a law called "On the organizers of information dissemination (ORI)". From all the companies on the ORI list—there are currently about 500 organizations, I think all the largest companies, including Wildberries, Yandex, and other companies involved in sales—these same "weaklings" can easily, completely legally, obtain data. In some places it's done more easily, in others it's more difficult, but they can do it. They can really take a person, track what they bought, when, what their salary is, what card they use to pay. Remember, there was a leak from Yandex.Food, when this data was used, among other things, to expose the same Medvedev?
DADA LINDELL
My colleagues have made many revelations about GRU and FSB officers based on this kind of data, because they, so to speak, ordered pizza to their safe houses.
MIKHAIL KLIMAREV
There you have it! So this data can actually be used in some way, including to put pressure on people and trace connections. Therefore, this data is truly dangerous and accessible. And the more the state is interested in this data, the more it leaks. There's a direct correlation: companies that are accessed by "weak" people are more likely to have leaks. At least, there's some correlation.
FARIDA KURBANGALEEVA
Are these electronic surveillance technologies more characteristic of dictatorships, like what Russia has now become? Or are democratic countries guilty of this too?
DADA LINDELL
What are the criteria of a democratic country?
FARIDA KURBANGALEEVA
Where there is a change of power, first of all.
DADA LINDELL
It seems to me that this whole story with government surveillance started in the US earlier than in Russia?
FARIDA KURBANGALEEVA
So this doesn't mean anything?
DADA LINDELL
This doesn't mean anything. Since 2001, the so-called fight against terrorismIf you see something being done to combat terrorism—or to protect children's rights—then know that, most likely, your civil rights will now be severely infringed.
MIKHAIL KLIMAREV
That's a slightly different approach. A lot still depends on the purpose of using this data. You buy a hammer. If your goal is to hammer nails, that's one thing. But if your goal is to hit someone over the head with that same hammer, that's another. It's impossible to say that a hammer is dangerous. The attitude here is exactly the same. If your goal is specifically to intimidate the population by collecting this data, that's one approach. If the goal is to fight crime—and what you're doing actually aligns with that—it's a completely different one. Yes, it's true that everyone collects data. But in the US, for example, they don't put people in jail for some kind of correspondence. They are more or less protected by law there. A change of power guarantees and ensures the implementation of these laws; otherwise, the entire system would collapse. When all these institutions are absent, when they don't work or, conversely, are structured in such a way as to infringe on rights, then naturally... "Everything you say will be used against you."They don't just say that. And in Russia, when you say: "I have right to make a call"—this makes the cops laugh. Have you been watching too many American movies? You're not entitled to a phone call, you're entitled to a baton to the head.
DADA LINDELL
It's a slightly different story; it's about what you can jail someone for, or what you can hit someone on the head with a truncheon for. But that doesn't make the collection of information any more legitimizing. Under the pretext of how well we're fighting crime, laws legitimizing the practice have been passed everywhere. In Russia too, although not all practices are legitimized. We know for sure that FSB officers and ordinary police investigators use leaked databases. But where is this legal? Nowhere, but they do it. Simply because it's easier for them. I understand the concept that you can hammer nails with a hammer or hit someone on the head with a truncheon, but I think there are tools for which it should be obvious—primarily to their developers—that they will primarily hit someone on the head. For example, this is everything that concerns spywareThe most famous of them is Pegasus, everyone has probably already heard about it.
Pegasus is a highly sophisticated piece of malware that is very difficult to detect. Moreover, the very fact that it became infected A person's phone remained undetected. And they mainly infected political activists, journalists around the world, politicians, current officials, and so on. And no matter what the company that developed it declared, it's perfectly clear that it was developed specifically for such cases. Moreover, the developers later had to justify themselves by saying that they wouldn't sell their product to dictatorships. It's not entirely clear whether this is being implemented or not, and what their criteria for a dictatorship are that they don't sell to. For example, yes, they don't sell to Russia, but maybe they do sell elsewhere. Or, for example, what really worries me now is the development of technologies for forging photographs of people. The developers are proud that the photos are absolutely realistic, unlike five years ago. I don't understand what legitimate and good goals this could have, but I understand only too well what bad goals there could be, and already exist. This is all sorts of fraud, extortion, deepfake, fake porn. It has countless bad, malicious applications. It's the kind of hammer that hits you on the head first, even if it could be used to hammer nails.
FARIDA KURBANGALEEVA
It turns out that the line between a state's genuine desire to protect its citizens—for example, by fighting terrorism—and the kind of abuses it might resort to is very fine. Is it possible to regulate the use of these technologies for surveillance and control?
MIKHAIL KLIMAREV:
In general, many countries require judicial approval for the use of such technologies, just like any search. They're no different—they're exactly the same search, just electronic. Therefore, any procedure involving the overt or covert acquisition of data about a specific individual must be accompanied by specific documents and a specific procedure. If this procedure is followed during the establishment of a rule-of-law state, then rights will be respected. Or at least, it will be possible to later identify areas where abuses occurred.
Obviously, there are some things right now that aren't clear how to manage. Deepfakes, for example, and artificial intelligence—how to use them. But on the other hand, we can't stop them. One way or another, whether we ban them or not, they will continue to develop because there's a high demand, because they offer advantages, including military advantages, to states. Therefore, development will continue.
Of course, some procedures are necessary. But there's no need to be paranoid. For Amazon to deliver a book to you, it needs to know your bank details. To pay for that book, you need to know Amazon's bank details. The concept is simple enough, but yes, all this data can later be used for malicious purposes. This is a rather philosophical approach, because some things really are impossible to foresee from the start. An incident happens, and we start thinking about how to deal with it. I don't see any way to live differently without going back to the caves.
FARIDA KURBANGALEEVA
So, we are being asked to let the situation go?
MIKHAIL KLIMAREV
Why? No. Of course, we shouldn't let anything slide. We need to keep a close eye on all of this. People like us, like Dada and me, exist precisely to ensure that states don't overreach themselves, and that corporations don't abuse their power. This is important. But to say that we need to stop technological development is probably foolish.
FARIDA KURBANGALEEVA
Who should be monitoring this? Should some special body be created to somehow ensure compliance with the regulations?
MIKHAIL KLIMAREV
And then create another body to oversee this body. No, of course not. This must be done comprehensively. Civil society institutions must be created, a functioning judiciary, independent of the executive, must be in place. Naturally, the press must also function—it plays a very important role in this. All these institutions must exist. Perhaps some kind of cyber police should eventually emerge. Everything is moving in that direction, in fact. Of course, independent investigators must emerge—and they already exist—who also deal with abuses. All of this must be widely publicized. These institutions are being consistently built, developed, and complement each other.
DADA LINDELL
Let's take the hypothetical "beautiful Russia of the future," as they say online. As in all other spheres, I believe civil society, which has been completely destroyed literally from the very beginning of Putin's rule in Russia, must play a major role in regulating relations between the state, corporations, and information technology. The story of surveillance, data collection, leaks, leaks, and data sales is the same old story.
Take for example, technology recognition persons — one of the most controversial technologies, which is also used in Russia not exactly legally. There are no legal grounds for what is being done. Similar technologies have been used or intended to be used. in other countriesBut since 2019, for example, various US cities have consistently abandoned it, as I understand it, under pressure from their local politicians and civil society. They effectively banned the use of facial recognition technology in public places. Yes, this was also violated. Already, this year, a report was released showing that even in these cities, police were abusing it, but one way or another, civil society is trying to regulate it. In the European Union, there are also organizations trying to regulate it. In Russia, Roskomsvoboda is trying to combat this within the legal framework. In other words, everything is regulated by civil society, by organizations that take on the function of oversight, both over corporations—because a huge part of this is the responsibility of corporations—and over states. In Russia, this is simply a stunning ecstasy of the merger of the state and corporations.
But at the same time, I think the average person can breathe a sigh of relief. Yes, companies are tracking you, websites are tracking you, they're selling all your data to each other, and some of this can be prevented. We all need to understand that if a government—any government—wants to find out something about us, they'll find a way to do it. In the US, this is regulated. There, as Mikhail said, in order to, say, seize mail, an investigator must obtain a document like a warrant. After that, they send a request to, say, Google. Google issues He's given a person's correspondence and other identifying data, their digital footprint. In Russia, there's some sort of procedure, but I know for sure that if an investigator wants to know who someone's calling, who they're talking to, or what IP address they're using to access something, and so on, they'll likely know a regional FSB officer and call him and say, "Check out Petya for me." The FSB officer "checks out" Petya and provides him with data that the investigator can later use in their own work, although, in principle, the court shouldn't accept such evidence at all because it was obtained illegally. The existence of such a mechanism, the fact that any FSB officer, police officer, or even just a telecom operator employee can "check out" someone, leads to systemic information leaks. Most leaks are simply "checks" like this.
FARIDA KURBANGALEEVA
So, in the “wonderful Russia of the future,” phrases like “we checked it out and found out that...” simply shouldn’t exist?
DADA LINDELL
It shouldn't exist anywhere. I'm telling you this as someone whose publication might even actually use it.
FARIDA KURBANGALEEVA
Really?
DADA LINDELL
Well, what do you think? Bulk узнал about your poisoners?
FARIDA KURBANGALEEVA
But this is a definite moral dilemma. How to resolve it?
DADA LINDELL
Just like any other moral dilemma, it's resolved by public importance and, of course, some kind of regulation. When it comes to journalists, it's regulation within the editorial office. In many editorial offices around the world, this is simply unacceptable and prohibited. A journalist won't receive and use such data. Therefore, some publications that use and receive such data—well, we're kind of outsiders in this regard, I guess.
FARIDA KURBANGALEEVA
What are your reasons for doing this? Do you lack more legal tools?
DADA LINDELL
I think that when colleagues do such things, they already have sufficient grounds to believe that such and such a person is doing something catastrophically illegal. For example, those who poisoned Navalny, the murderer Krasikov And so on. You have some information in advance, which you verify this way. But before, especially before 2022, I would never have used such data, because it was unacceptable. Now, it turns out that you're partly investigating war crimes, and your personal ethics are already clashing with the fact that if you don't do it, no one else will, and the criminals might not be identified. That's most likely how it will be.
MIKHAIL KLIMAREV
No freedom for the enemies of freedom. What kind of dilemma could there possibly be if someone is committing an absolutely obvious crime? What's there to think about?
DADA LINDELL
Well, yes, but that doesn't make it any less disgusting or shameful. But then, basically, everyone who does such things does it only for that reason. I hope that someday we'll have the opportunity to stop doing this.
But then some people come to journalists and say, "Oh, well, you do this kind of thing, but can we get through to so-and-so?" I know a lot of cases like this, because people have approached me and my colleagues about it too. And there's always some strange reason: they've offended me...
FARIDA KURBANGALEEVA
Take revenge?
DADA LINDELL
Yes, but the scariest thing, perhaps, is that, in principle, it's considered normal. You're in your white coat, covered in ketchup, tormenting yourself all night, and most people think it's normal. But I can't say it was the media or the creators of these services that normalized it. Rather, it was so normal that, ultimately, the average person doesn't even have any ethical doubts about whether it's okay to use these methods. That's scary.
And there's another reason, as far as I can imagine, the same as with other corruption-related issues. It's simply low wages and a general lack of confidence in the future. Therefore, every opportunity to earn some money is essential now. For example, these leaks at mobile operators, when someone comes to a store and asks for a statement, which the employee obtains illegally. They cost pennies. In large companies, like MTS or Beeline, they at least have some kind of tracking system to make it easier to track who went where, who downloaded what, and so on. The employee is caught fairly quickly, and they usually get a criminal sentence. There are simply an insane number of these court cases. But what motivated an employee to engage in criminal, illegal activity in the first place, when they can be jailed for three thousand rubles or less? Probably because that's a large sum of money for them. I think that, in many ways, all these leaks and leaks exist also because of poverty.
FARIDA KURBANGALEEVA
What can we do about this mentality? Does that mean society's attitudes need to change too?
MIKHAIL KLIMAREV
There is no mentality whatsoever, what are you saying?
FARIDA KURBANGALEEVA
So it's not part of the cultural code?
MIKHAIL KLIMAREV
Of course not. It's not part of anything, not cultural, not even close to code.
FARIDA KURBANGALEEVA
Well, it's clear that I'm being ironic.
MIKHAIL KLIMAREV
People simply have no other way to protect themselves. Fraudsters are never caught; they enjoy complete impunity. It turns out that the police, the judicial system, and the institutions of power in general simply don't work. As soon as they start working, as soon as all these checks become truly illegal, this will disappear. Of course, it won't die out completely, because fraudsters will always exist, but that's a matter for sociologists and anthropologists to figure out how many criminals there are in society. The same problem exists in Western countries, but we must understand that people don't use these methods because they want to snoop on their neighbors. No, they want to protect themselves. Remember. Maslow's pyramidOn the first level, it's food, and on the second, it's ensuring one's own safety. People have reached this level and want to protect themselves.
DADA LINDELL
This happens because you know nothing about the people you deal with. You don't know who you're renting from, who you're buying from, or who you're selling to. Yet you know how many scammers there are, how often you're cheated out of a job, how often you're underpaid, and you're trying to find out anything you can. This also applies to personal relationships: if you meet someone on a dating site, you immediately have to check them out because you don't trust anyone at all. It's hard for me to say, I'm not that old, but somehow I think this total mistrust is also a consequence of the Putin era. No one trusts anyone; everyone suspects everyone of everything. You have the opportunity to find out something about someone; it seems easy and costs pennies. Why not do it? And you don't even question whether it's legal or not. The logic is perfectly clear.
Perhaps schools should teach ethical questions about whether it's okay to learn anything about a person. On the other hand, schools should definitely teach people digital hygiene and basic digital security. You should know how to behave online, what can be learned about you, and what is known about you. I think this is very important. If we're talking about a beautiful Russia of the future, this is one of the most important things: I want education to include what people really need. This isn't in education right now. And if it is, it's not to the extent it should be, and it's not about what it should be about. If the Russian authorities are currently promoting... it is harmful to use VPNBecause this will get you caught by scammers, who are simply spreading harmful information. The same, in fact, as in other areas, for example, that using condoms is harmful. When you understand this, it sounds like nonsense. But when you don't understand it, or when you're 12 years old...
FARIDA KURBANGALEEVA
Is there any country that can be emulated in this regard? Where is such a healthy balance maintained between, on the one hand, state non-intrusion into the private lives of citizens and respect for human rights, and, on the other, the state's commitment to the safety of its citizens and their protection from all kinds of criminals?
MIKHAIL KLIMAREV
There's a third component. This is the innovative development of the state. That is, economic prosperity. All three are in tension, and a certain balance must be found. Most Western democracies try to maintain this balance in this regard, but it shifts back and forth depending on the political situation, economic development, and how voters vote—this also has a significant impact, that is, how society itself reacts. There's no ideal balance, but in autocracies like Russia or China, the emphasis is skewed toward the state; there, no one cares about the safety of their citizens, it's quite clear, and this balance is not maintained.
DADA LINDELL
When you mentioned the state not interfering, my first thought was: African countries, for example, where internet penetration is very low. That is, there's no point in the state intervening if there's nothing to do. Incidentally, Prigozhin himself took advantage of this in African countries, conducting his numerous information campaigns there. And since internet penetration is low, these campaigns were often conducted through radio stations. But if there's an internet, if you have a lot of digital services, all of them well-developed, someone will want to take advantage of it, one way or another, because it means money, power, and control. That's pretty obvious. Maybe I'm just looking at it from my own perspective, but it's strange to think that the state only means well.
FARIDA KURBANGALEEVA
Russia currently has a significant amount of information collected about citizens, especially those who are undesirable to the Putin regime. In the wonderful Russia of the future that we all so desire, what will be done with this vast amount of data? Create some kind of archive where it will all be stored? Or should it all be somehow destroyed?
DADA LINDELL
How do you imagine this - to liquidate it?
FARIDA KURBANGALEEVA
I can’t imagine this at all, because I’m not an expert, and that’s why I’m asking your opinion.
DADA LINDELL
All my life I've been told that nothing ever disappears from the internet. But it seems that's not true.
MIKHAIL KLIMAREV
Of course it disappears.
DADA LINDELL
People simply won't be considered enemies. And the data—that's all, it's already been collected, frozen and they're stored somewhere. You can't destroy them. Because nothing is stored in just one copy.
MIKHAIL KLIMAREV
Somewhere the flash drive will remain, somewhere the recording will remain. Of course, it's impossible to destroy it, but the targeting will disappear—and these people will no longer be considered enemies of the state, no matter how much data you collect.
DADA LINDELL
It would be simply unpleasant to know that all my data is stored somewhere: what and where I bought on Ozon, what I wrote online, and so on. Some people don't care, while others find it unpleasant that their entire digital life is stored somewhere in one place. But we have no choice but to accept it. Just like the fact that companies collect and store data about you, including data you didn't actually share—your interests, your behavior. This information didn't exist as data; it was converted into data, and it's stored somewhere. So, when it disappears— if It'll disappear—the goal is to determine whether a comment should land you in jail or can be discredited by it. You shouldn't care, or perhaps just be uncomfortable. Yes, it might be an inconvenient truth if all your comments from ten years ago are stored online. But these are entirely ethical questions.
If we're talking specifically about threats to my safety, my freedom, the threat of compromising material, then this story simply disappears when the fact that you wrote something online or traveled somewhere ceases to be evidence of your guilt and becomes the basis for a criminal case. It all has to disappear.
This is a very long-term project that must be thought through by those responsible for government—eradicating the practice of data mining and data selling, so that people understand that selling even one line of data will result in prison, for example. Punishment and law enforcement must be realistic. Currently, even the charges for accessing data are always different, because no one understands what it means. What does it mean when someone has mined data and given it to someone for money? There's not even a legal interpretation, and different articles of the Criminal Code are always applied.
MIKHAIL KLIMAREV
Of course, this whole company called Roskomnadzor needs to be disbanded. Literally, most of them should be jailed. They committed crimes. It's all documented, and I hope that sooner or later I'll be involved in all these trials to ensure that specific individuals are jailed for long terms. The huge number of laws related to surveillance that we've passed in Russia—the Yarovaya package, all these SORMs, the law on operational-weighted activities, and a bunch of others—must, of course, be repealed.
On the other hand, we must understand that crime exists, all these things really do exist Sberbank security services And we need to combat them somehow, too. There needs to be some kind of institution that deals with crimes. But it should deal specifically with crimes—economic crimes, fraud, scams, and so on. The main goal of this institution shouldn't be to say, "We've blocked phone calls from foreign numbers," but to identify specific individuals, bring them to trial, and convict them under the appropriate article.
It's clear that it won't be possible to organize all of this right away. Imagine you had a huge country, a huge river flowing through it, you dammed it, and then the dam suddenly burst. Can you imagine how much mud there would be? And this mud would have to be cleared up somehow, that's for sure.
Sketch of the Future – is a joint podcast of the “NotMoscow Speaks” projects, Radio Sakharov и Country and World
