[Russian Internet Censorship] Fed Up With Roskomnadzor, pt3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# A Short Letter on Continuing Assault on Internet Freedom in Russia

_April 28, 2018_
_Anonymous IT Guy <[email protected]>_

Remember that you can always use Google Translate to view links that are in
Russian.

## Previous posts:

  * https://news.ycombinator.com/item?id=16937311 (the original Hacker News
    post).
  * https://pastebin.com/Etp2TNBi - part 1.
  * https://pastebin.com/3ZLZJMwd - part 2.

## Links
  * http://www.consultant.ru/document/cons_doc_LAW_28399/ - First, a link to a
    copy of Russian Constitution, in case RKN's shills are too busy 'fighting'
    Telegram and forgot what this document means.
  * https://usher2.club/en - here you can monitor RKN's activity.
  * https://antizapret.info - A site with RKN's blocked address dumps, here
    you can see what's blocked right now.
  * https://roskomsvoboda.org - A Russian privacy activist group. I'm not
    (yet) affiliated with them, but they seem like they're fighting for the
    right cause.
  * https://github.com/zapret-info/z-i - a downloadable list of addresses
    blocked in the Russian Federation. Updated on a best effort basis but
    mostly current.

## Glossary
  * [FSB](http://fsb.ru) - FSB, The Federal State Security Service of Russia.
  * [RKN](http://rkn.gov.ru) - Roskomnadzor, the state's regulatory agency for
    communications.
  * [FNS](http://nalog.ru) - Russian Tax Agency.

## Preface
First, an apology to you, dear netizens. I was tired, I haven't had a good
night's sleep and my first two letters were panicked and full of knee-jerk
comments.

Since then, I decided, I'll just try keeping you guys in the loop on local
news. If anybody's interested, thanks for reding this. If you'll repost this,
I (and many IT people and ordinary netizens in Russia) would be really
grateful.

As always, you are free to repost this -- this is what information freedom is
for, right?

## Acknowledgements
I would like to thank [EFF](https://eff.org) for its work in protecting the
world's digital freedoms. Even if they're only mainly affecting the US,
they're setting the mark of what should be possible. Thanks guys.

Also I would like to thank [Roskomsvoboda](https://roskomsvoboda.org) and the
[Pirate party of Russia](https://pirate-party.ru/).

Kudos to the hard-working people of Agora(http://agora.legal), without you
there wouldn't have been a torrent of legal action aimed at punishing RKN and
the russian Government's illegal attempts to censor, block and disrupt the
Internet, among other things. Seriously guys, you are awesome.

## Background
On April, 16, 2018, RKN has been blocking access to entire swaths of IP space
in a series of (pretty vain) attempts to block the Telegram messenger. They
blocked about 20 million IP addresses in a week's span.

It is estimated that profit loss from its direct actions had totaled $2
billion. (https://www.kommersant.ru/doc/3614069).

Services such as Amazon, Google, PSN, Digital Ocean were affected. Sites
couln't load fonts from fonts.google.com and some of Mastercard's processing
was down. Google translate was down.

People started saying it's like hitting a city with a thermonuclear warhead
because of a sole criminal they wanted to catch in that city.

RKN has opened a hot line where you can complain about a service not working:
[email protected].

## Timeline of Events:
Here is an (obviously incomplete) timeline of Russian government's efforts to
censor the Internet and free speech in general. I will add relevant
information to it in future posts.

  * 2007: The [Federal List of Extermist
    materials](https://en.wikipedia.org/wiki/Federal_List_of_Extremist_Materials)
    was created.
  * 2012: A
    [law](https://giod.consultant.ru/documents/1621853?items=1&page=12) was
    passed, that mandated the creation of nationwide black list of sites.
  * 2016: The infamous [Yarovaya
    law](https://en.wikipedia.org/wiki/Yarovaya_law) was passed, of course its
    stated purpose was to fight terrorism. The law mandated operators to STORE
    RECORDINGS OF THE CONTENT OF ALL PHONE CONVERSATIONS and ALL DATA TRAFFIC
    GOING THROUGH. To me, this is blatantly anti-constitutional.
    If you're at least moderately technically minded, you should know that a)
    it's a horrible blow to privacy, the human rights in general and b) it
    would require such enormous data storage capabilities that were not exitsent
    in any country in the world (maybe except the Utah's data center?!).
  * 2016-2017: In accordance to this law, RKN ordered Telegram to hand out the
    encryption keys to FSB. First, this isn't technically possible, and
    second, it's again against our 'beloved' constitution.
  * April 16, 2018. RKN begins blocking Telegram's addresses. Telegram evades.
    RKN begins blocking entire /15's of IPv4 address space. The largest prefix
    I've seen was /10 I think.
    Many services are thrown offline. Among the few are parts of EC2 (not
    surprising!), parts of Google, PSN, Digital Ocean. And much, much more.
    Sites couldn't load Google fonts, Google translate was down, and a lot of
    things was going haywire. I couldn't pay with my debit card because they
    blocked some of MasterCard's stuff.
  * April 16, 2018. RKN threatened that owners of Telegram SOCKS proxies would
    be [blocked]
    (https://mbk.news/news/proksi-serveri-blokirovka-za-ekstremizm/) as
    'extermism propaganda'.
    Somewhere along this madness RKN opened a hotline for businesses affected
    with the mass blocks.
  * April 27, 2018 00:00: RKN accidentally blocked addresses of Yandex,
    Twitter, VK, Facebook, Odnoklassniki, a major time server located at
    Moscow's MSK-IX and a bunch of others.
    They were quick to unblock that and it's obvious this was a technical
    error on their part.
  * April 28, 2018: RKN promised not to block large prefixes anymore. They
    also unblocked about 3 million addresses of Amazon and some others. They
    continued to block /32s though.
  * April 28, 2018: [First lawsuit against
    RKN](https://www.novayagazeta.ru/news/2018/04/27/141306-protiv-roskomnadzora-podali-pervyy-isk-iz-za-blokirovki-telegram)
    by a commercial entity.

# Future efforts
  * On April 30th, 2018, there will be a protest organized by the Libertarian
    party of Russia (http://digitalresistance.moscow) against unlawful
    blocking of Telegram.
    As I see it, we can't turn the issue of Telegram into a political one, we
    should instead defend the freedom of speech and information as a whole,
    but these guys are still doing the good work.
    It's just if you plan to go to these protests, or monitor them, remember:
    it's not only for Telegram, it's for defending the right for the freedom
    of speech in Russia.

## My thoughts on the so-called Yarovaya Law.
IMHO, this law blatantly violates the Constitutions and is a huge threat
not only to our citizens' data privacy, but to the integrity of the already
failing Russian economy. Just think about huge resources that are needed for
its execution.

The law also opens up enormous possibilities of misuse and is simply
dangerous to Russian businesses and individuals, since anybody well bribed
could listen in on not only our metadata (which I've witnessed numerous times
in the past), but our data too.

Moreover, about 51% of today's IP traffic is already encrypted, making
short-term storage of such traffic simply impractical.

IMO again, handing this data over into the hands of some corrupt officers is
way more dangerous for Russia than all NSA efforts combined were for the US.
There is already a monkey with a grenade situation going on with RKN, just
imagine how much worse it'd be when YL goes into effect.

## Some extra information

### QR coded cash slips

To fight economical crime, the FNS mandated that ALL new cash registers are to
be so called online cash registers. It means that as soon as a purchase is
made, they upload information about it to the cloud, including:

  * The contents of the purchase (if available)
  * The date and time of the purchase
  * The serial of the cash register
  * The taxpayer ID of the merchant.

An example of such a slip is here: https://imgur.com/a/iCzuiK7

Including in the internet shops - there are farms of these online registers
churning out paper slips for e-purchases that are then distributed to the
client.

The 'cloud' is operated by commercial entities, the so-called Fiscal
Operators, who have almost uncontrolled potential for abusing this data and
mining it. Today, with the advent of Big Data, having (even anonymized)
purchase data for ALL OF THE COUNTRY effectively turns these commercial firms
into the Big Brother. What could possibly go wrong, right?

The only upside of this horrible thing is that people can pull this data into
their personal finance software, it seems.

### Biometrics in Moscow Metro

Today, there was [news](https://sdelanounas.ru/blogs/106529/) that the first
suspect was detained after a positive facial recognition by a camera in Moscow
metro.

They started using some pretty hi-res AXIS stuff everywhere, as I see. Even
inside the cars, which, by the way, have Wi-Fi.

### Voice recognition data to be handed over to the authorities

(http://regulation.gov.ru/projects#npa=80347)[The order of access of FSB and
MIA of Russia to citizen's voice recognition data is developed].

The bill is now at the phase of civil discussion, but I have no doubt that it
will be passed soon.

Now I might add, voice recognition is almost bulletproof and the easiest to
ues of all the mass ID methods because of so much readily available data on
everybody.

This is certainly a threat to every Russian citizen because of, again,
widespread possibilities of abuse of this act.

## Russian Internet Blocking system: A Technical Review

### Domain blocks resolved by ISPs threaten the integrity of Runet

Okay guys, somewhere later I'll post an in depth review of how the blocks
work, but mostly for now they're simple address space blocks for carriers that
don't have DPIs.

In the past it was possible to effectively block an ARBITRARY resource on the
Internet simply by squatting an expired domain on the block list and slapping
the victim's IP addresses as A records. ISP's filters would resolve it and the
victim will get effectively blackholed in Russia. IDK if this works now, but I
think some smaller providers might still use this tactic.

As of now there's a (semi-secret) whitelist containing addresses of critical
infrastructure that should not be blocked. I don't know of its contents but I
know they were mailing it to ISPs before Putin's hotline with Russian citizens
in summer 2017.

Several incidents employing this method have already been reported.

### Revisor ('Inspector') system: fines for ISPs for not blocking

RKN has implemented a simple Revisor system that consists of a modified
TP-Link MR-3020 router that plugs into an ISP's network edge and continuously
monitors resources from the blocking list. If an ISP fails to block something,
they are subjected to a fine and (IIRC) their license might get cancelled for
repeated violations.

## My own thoughts on the blocking system
As a libertarian, I deeply disapprove of any form of violation of human
rights. Right here we do have a blatant violation of Constitution article 23,
which states:

> 'Everyone has the right to privacy of correspondence, telephone
> conversations, postal, telegraphic and other communications.
> Restriction of this right is allowed only on the basis of a court
> decision.'

and Constitution article 24, which states:

> The collection, storage, use and dissemination of information about a
> person's private life without his consent is not allowed.

> Bodies of state power and bodies of local self-government, their officials
> are obliged to provide everyone with an opportunity to get acquainted with
> documents and materials directly affecting his rights and freedoms, unless
> otherwise provided by law.

As such, this and other 'advancements' in censorship in Russia are blatant
violations of human rights, aimed at keeping the status quo of corrupt
officials and companies.

I can't say if they are anti-constitutional as I'm no legal expert, but to me
it seems like they surely are.

Sincerely Yours,
The Anonymous (and pretty sleepless these days) IT Guy.
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJa5Ms7AAoJEM1YFVKB9JzL6mMH/0sYOe4A6dE99Zw4xUUMFHDn
9NTQxejLJbkTTcxKYOuQcZPWJk4534uIAwBqv69C9QrWLf5JOdeVml21xZ88fPPy
QbNZuaXj2IFXqHqOJqznhtES28WeAjB0jpGD7HYP7pGXF3dlmaLwjniBrzqdZxam
ART2Vr7eXMbyruE99srxg6Kp9SbC/+ggu+2IpT8uSjs8tB/zgRPoMnWbkzskU2jI
JVI08BSxuCRY4PRsCOGiJHsKffupEd5rGGI4TT/5FIkWrc1eTScsz3FLQ8ckhFke
eZRnVrJKyx+FJ7R42Z9fe7FYIaN3k6vTzhLl1VhQZZ0gJ3MWJeAgJ/v8601h+fU=
=WE+M
-----END PGP SIGNATURE-----