home › Installation and setup › Law-abiding netizen. Keyloggers and the law: on other people's mistakes. Full access to social media data

Law-abiding netizen. Keyloggers and the law: on other people's mistakes. Full access to social media data

The Ministry of Internal Affairs published documents on surveillance of users of social networks.

Evgeny Biyatov/RIA Novosti

Police headquarters of Russia are buying software which allows them to follow users social networks, including reading private messages, collecting geolocation data, and analyzing relationships between different users. Znak.com found out that "gray" access to social media data can be used for this. The Ministry of Internal Affairs says that they are not going to read users' correspondence without a court decision.

The Main Directorate of the Ministry of Internal Affairs for the Sverdlovsk Region announced the purchase of a software and analytical module for information system"Zeus", which is already used by the Sverdlovsk police. The competition will take place on August 8, the initial price of an annual license is 1 million 850 thousand rubles.

In the terms of reference, the police without cuts painted all the functionality of the new software, which is designed to spy on users of social networks. Thanks to the new module, the police will be able to put any user on constant automatic monitoring: keep track of who he adds as friends, what he writes posts about, whether search words are found in his publications; what groups the user joins, what photos and videos he adds and deletes, with whom and how often he communicates.

One of the points of the terms of reference directly states that the Zeus system should provide a text search through the archive of the user's personal messages.

Analysts of the Main Directorate of the Ministry of Internal Affairs will be able to search for photos posted on social networks by geotags, the time the image was uploaded to the network, and the keywords that described the photo. The module will also display on the map the place where this or that picture was taken.

Some of the functions described in the terms of reference can theoretically be provided using open data from social network users. At the same time, a significant part of the terms of reference can be completed only if the module gets access to classified information, including users' personal correspondence. Theoretically, this is possible if social networks themselves give access to such data. For social networks, especially foreign ones, this would be a serious reputational risk.

Zeus already operates in seven regions

During a survey of experts, Znak.com was able to contact individuals who have an idea about the operation of the spying program. According to them, in seven regions of the Russian Federation, the specified software module has already been successfully tested and started working. In particular, Zeus is used in the Novosibirsk, Samara and Tyumen regions, KhMAO, Samara, Altai and the Lipetsk region. In the latter region, during testing of the system, the police, for example, reported identifying “latent” members of informal extremist associations who “allegedly carried out protest actions.” In addition, the Lipetsk police managed to identify users who place ads for highly paid jobs for girls (presumably pimps). This is stated in the review of the tests of the Zeus system carried out in July 2016 by the Lipetsk police.

Find information about public procurement systems for the listed regions we failed. It is possible that closed public procurement procedures were carried out (FZ No. 44 allows for such a possibility). So far, the only region in which the auction documentation has been published is the Sverdlovsk region.

Police: Law-abiding citizens have nothing to worry about

Valery Gorelykh, spokesman for the Main Directorate of the Ministry of Internal Affairs for the Sverdlovsk Region, confirmed that the department is purchasing software for monitoring social networks, and noted that police officers need it "to fulfill the tasks assigned to them by law, including in the field of countering terrorism and extremism."

“Law-abiding citizens have no reason to worry about correspondence on social networks, unless, of course, it contains something criminal. Those who do not like a calm and peaceful life in our state need to be afraid,” said Gorelykh. - Work on such equipment will be carried out only by decision of the courts, so that there is no violation of the legal rights of citizens. Work in this direction is necessary both for the security of the state as a whole, and for the inhabitants of the Sverdlovsk region.”

"VKontakte": "We act within the law"

Press Secretary of VKontakte Yevgeny Krasnikov, having familiarized himself with terms of reference purchase of the analytical module, noted that, most likely, we are talking on monitoring the public activity of social network users: their own posts on personal pages, posts of friends on the same walls, reposts and publications in social network communities.

“VKontakte has a flexible system of privacy settings for user pages, which, in particular, allows you to block public access to your posts on the wall and exclude your personal page from the search results of search sites,” a representative of the social network noted. The safety of the personal data of our users is a priority for the company. VKontakte strictly adheres to the current legislation and fully respects the constitutional rights of citizens, ”said a spokesman for the social network.

Internet Ombudsman: "Normal Purchase"

Dmitry Marinichev, an adviser to the Russian president and Internet ombudsman, told Znak.com that the purchase of the Sverdlovsk Main Directorate of the Ministry of Internal Affairs was “quite normal.” “It's like buying a car to patrol the area. Do not forget that monitoring will be carried out in "public" places. Everything that people write, photograph, and so on, they make public,” the Internet Ombudsman noted. - Look at it this way. Facial recognition technologies have evolved very powerfully in recent years. Monitoring and automatic recognition can stumble upon photos you have taken at the resort. And in the background, the robot recognizes the criminal who fled the scene of the crime. Based on this assumption, a check will be carried out and a criminal who may be a threat to your life and your health will be detained.” Marinichev did not comment on the point about the ability of Zeus to read users' private messages.

Surveillance began before the "Yarovaya Law"

It is worth noting that in November 2015, the Main Directorate of the Ministry of Internal Affairs of the Sverdlovsk Region already tried to buy a similar module for spying on social network users. Then the department expected to purchase software for 1 million 420 thousand rubles. However, the auction did not take place, as no applications were submitted for it. At the same time, it is impossible to open the file with the protocol for considering applications for participation in the auction, and the only member of the tender commission, according to the public procurement website, was a man named Ivan Ivanovich Ivanov.

A credible source of Znak.com, who is aware of the principles of Zeus and is associated with its developers, said that the work uses access to a closed interface of Russian social networks, “which social networks shared with the security forces quite a long time ago.” According to him, the FSB and the Ministry of Internal Affairs had the opportunity to study the personal data of users in Russian social networks long before the adoption of the sensational “Yarovaya law”. “The Yarovaya Law has only legalized current practice, including allowing the collected data to be used as evidence in court,” the source says. According to him, the use of "Zeus" cannot be considered legal operational-search activity, it is rather a primary collection of information, on the basis of which it will already be possible to determine targets for a legal search operation, including using the norms of the Yarovaya law. If you believe the source, you can say that the illegal collection of information by employees of the Ministry of Internal Affairs is implied.

At the same time, the Znak.com source believes that Zeus will be used for the benefit of society: to search for pedophiles, recruiters of extremist organizations, or, for example, to prevent propaganda of child suicides.

Dmitry Kolezev Lyolya Mingaleva

“For a law-abiding user, this will not only change nothing, a law-abiding user will only benefit from this,” Denis Davydov, director of the Internet Security League, told VZGLYAD newspaper, commenting on new measures to deanonymize users on social networks. In his opinion, the measures will help prevent new terrorist attacks on Russian territory.

At the end of last week, the Ministry of Telecom and Mass Communications published for discussion a draft version of its order on the regulation of requirements for equipment used in information systems by information dissemination organizers (ARI) on the Internet (messengers, social networks, and so on, the ARI register is maintained by Roskomnadzor). So far, the text of the document has only been put up for public discussion (until September 6) on the federal portal of draft regulations, and anyone can express their wishes.

The order has already caused a wide public outcry - it lists what data about users of the ORI will be required to transfer to special services, in particular the FSB, upon request. Such user information includes a nickname (pseudonym), passport details, residential address, Email, IP address, payment information, message texts, files sent and received, ownership information foreign languages, as well as other social media users listed as relatives.

About what goals the new measures pursue and why Russians should not worry about their introduction, as well as similar practices in other countries, Denis Davydov, executive director of the Safe Internet League, spoke in an interview with the VZGLYAD newspaper.

VZGLYAD: Denis Nikolaevich, can the proposed set of measures help prevent new terrorist attacks on Russian territory?

Denis Davydov: Yes that's right. This is the real, true purpose of these innovations. Finally, our law enforcement agencies and intelligence agencies will receive normal, effective tools in order to respond in a timely manner to terrorist threats. This is exactly what was missing. If such a system is created, then it is clear that its main area of application is anti-terror.

VZGLYAD: Will this facilitate the conduct of operational-search activities?

D.D.: Yes, significant. Previously, businessmen did their secret dark deeds - robbed, scammed - on the Internet, and in order to find them, police officers had to perform feats. Now it will be much easier to do it.

VZGLYAD: In order to analyze such a large amount of information, you will probably need a large number of specialists? But there are always not enough people, and besides, it can be very costly.

D.D.: The thing is, thanks to modern technologies analysis of large data arrays, most will be performed by algorithms and - in the future - artificial intelligence programs. The intervention of living people, specialists will be required only in cases where the information is really of value, importance - and is necessary to fulfill the duties assigned to law enforcement officers.

VZGLYAD: Thus, the system will, in fact, be sharpened for the analysis of all this information using Big data technology?

D.D.: In general, any similar systems, which store hundreds of millions of records, metadata and other information, of course, are focused primarily on storage and convenient information retrieval. That is, such systems can offer some conclusions that need additional verification by law enforcement and special services. When conducting operational-search activities or when investigating some crimes, this data will be very useful.

VZGLYAD: A year ago, there were reports that the authorities in Russia are already using Big data technologies (big data technology).

D.D.: It is difficult to say how direct Big data technology is. Now, as far as I know, the state is only discussing the architecture and those authorized bodies and organizations that will collect and process such data. However, it can be said that both the state and private business are partially engaged in this.

If we look at the operators, for example, cellular communication or to credit and banking institutions, for example, to Sberbank, why are they not operators of "big data" who process them and draw some conclusions based on this analysis?

VZGLYAD: Is it true that for this system all personal information will be a kind of "white noise", and certain constructions and phrases that may be associated with plans for terrorist attacks will be "highlighted"?

D.D.: The fact is that the information that is collected will not affect the right of citizens to privacy and privacy of correspondence. This will be, first of all, data that allows you to identify a particular user. In general, this is a system that will collect and store this data.

Such information will be processed only upon request, only by court order. So law enforcement and intelligence officers will not just have access, for example, to letters that users send to each other.

The government is talking about a ban on anonymity. It means that for the state, for law enforcement agencies and special services there should be no anonymous users. But, nevertheless, each of these users has the right to privacy, to the secret of communication. Therefore, the state demonstrates and declares in every possible way that it will protect this right. Meanwhile, various transnational Internet giants violate this right.

A lot of people say: "That's all gone, now the FSB will know the user's login and IP address." So what? This will help us all avoid problems with terrorists. At the same time, for some reason, few people say that the same companies Google, Amazon, Facebook not only store users' personal messages, but also use them at their own discretion. That is, they read private messages. Google directly says, they say, “yes, we read your correspondence.”

It turns out that opposition activists are outraged by the fact that the FSB has the authority to request personal data of users, although this ensures our safety, and for some reason they are not outraged by the fact that an American Internet company calmly reads the correspondence of all users of its services. This is a very strange approach.

VZGLYAD: For an ordinary law-abiding user, this will not change anything at all?

D.D.: For a law-abiding user, this will not only change nothing, a law-abiding user will only benefit from this. I can confidently cite China as an example. Many begin to laugh and giggle when it comes to China, they tell some scary stories about censorship, how bad everything is there. In fact, in China, after the ban on anonymity, the Internet economy began to grow faster, the number of frauds on the network decreased. And ordinary citizens benefit from this, primarily in terms of security.

I am sure that the introduction of such a system will allow us to win not only in terms of security and peace of mind in relation to the terrorist threat, but also, thanks to new tools and opportunities that law enforcement agencies will receive, it will increase the detection of many crimes that are committed using the Internet.

Here it seems to me, by the way, that it is logical if not only the FSB, but also the Ministry of Internal Affairs will get access to these tools. And, for example, those cases of online pedophiles who seduce children will get off the ground. Just because now it is thanks to the Internet that they are encrypted, they exchange advice on how to seduce children at some closed, secret sites.

VZGLYAD: You have already touched on this in part. Many bloggers and other critics, when discussing this project, forget that our life, our security often depends on those people who guard our peace - from the special services, from internal organs. Why?

D.D.: It really is. Our security depends entirely on the efficiency and effectiveness of the system of operational-search measures, as well as on the interaction of society with law enforcement agencies and special services. Because it is not the task of the security agencies to solve these issues exclusively. Alone, without relying on society, this is very difficult to do. It turns out to be a very strange story. A lot is being done to ensure that the authorities have modern tools to ensure our security, but here there are some people who are dissatisfied with everything and say strange things that this should not be done. Although in general the whole world is on the path of tightening control.

In general, activists who advocate online anonymity somehow do not understand one thing. It lies in the fact that anonymity from the network is gone forever. She is no more - and never will be.

VZGLYAD: Did she ever exist at all?

D.D.: She was very conditional. And law enforcement agencies with a high degree of probability could establish this or that person in the network, even if it took some amount of time. Now it will need to be spent less, and the freed time can be used to search for criminals, terrorists and extremists.

VZGLYAD: You said that the whole world is following the path of limiting anonymity on the Internet. The British Parliament last year approved a law that obliges telecom operators to keep data for a year about all the sites visited by their users and the communication services used by subscribers, and also determines under what circumstances the authorities have the right to hack users' computers. Why do our opposition-minded bloggers ignore this fact?

D.D.: Some bloggers have an idea that the whole world is different, but here in Russia the “bloody regime” is strangling the rights and freedoms of man and citizen. This is such an artificial world in which they live. They created it for themselves. And they don't even bother to follow the news from other countries. And the news from other countries is about the same order. The state in all these countries provides control over the network, over data transmission.

In Germany, for example, the question of what can and cannot be written on social networks is already regulated at the legislative level. And that prohibited information in social networks should be deleted by the Internet sites themselves. Of course, if our various bloggers - opposition and non-opposition - were simply more interested in this issue, they would understand that this is such a global trend. It is not associated with any strangulation of freedoms, but is associated with the banal provision of security.

We live in the 21st century, and modern terrorists are not just some bearded men riding a donkey, modern terrorists are competent people with programming and cryptography skills. In addition, they bring in programmers to wage a cyber war against the "infidels" in their understanding. These people have sufficient skills to arrange a blackout in any of the European cities - turn off power plants, water towers, transport. Therefore, of course, all over the world, states are trying to somehow resist this. One solution to this problem is to collect data and store it for a short time.

I would like to draw attention here, we are talking about the short-term storage of this data, while Google, conditionally, or Facebook stores data forever, forever! They don't erase them, they stay forever. That is why they are building giant "data centers" in the US.

VZGLYAD: In the Netherlands, too, since the end of last year, there has been a public discussion of a bill that involves the collection of information about users' messages and calls with the help of local telecom operators and its subsequent storage. The authorities plan to monitor the correspondence and conversations of the Dutch and identify potential terrorists. Do you think they will eventually pass this law?

D.D.: Of course it will be accepted. The fact is that the EU countries have become hostages to the flow of migrants, the flow of refugees. Very many of those who present themselves as refugees are active participants in the gang underground and terrorist cells.

This, in turn, significantly increases terrorist threats. It is simply unrealistic to cope with such a wave of information using traditional methods of operational-search activity. Therefore, this is a question of our near enough future, when European and not only European countries, for the most part, will adopt such laws. I am sure that these laws will be tougher than in Russia.

VZGLYAD: That is, after some time the whole world will move to a more thorough control of the Internet space - in order to protect against terror and crime in general?

D.D.: Yes, and the next issues that will arise before the states, including within the framework of bilateral and multilateral relations, are precisely the regulation of interaction in the field of data transfer. Information about our citizens is inviolable and protected by the state. Therefore, states will have to regulate at the level of some international convention the rules for the use of these data, their cross-border transfer.

If our state guarantees the right to data privacy, it will also have to guarantee it when processed by other participants, including those from abroad. International legislation in this area - European, Russian, American - will gradually be harmonized.

In connection with another news about criminal prosecution for the use of keyloggers, once again I would like to raise the topic of the legality of their use.

And also to tell about one important innovation in the interface of our programs, designed to protect users from unintentional violation of the law.

Last week, a British student at the University of Birmingham named Imran Uddin was sentenced to four months in prison. He was attracted under the article " Misuse of computer technology” for installing four hardware keyloggers on public university computers, stealing teacher passwords with their help, and “improving” his grades in five subjects in the university student record keeping system.

The devices were discovered when updating the hardware of one of the computers, traces of the activities of a particular student were found in the logs of the academic record system, and only then the police found pages on his personal computer in the browser history for buying keyloggers on eBay and authorization in the university system. That was enough for the court.

Journalists who write articles about this incident point out that the student was punished for using keyloggers. In fact, this is at least not entirely true.

Acquisition of hardware devices (as well as software products) to intercept keystrokes is not against the law.

Installing them on your own computer, on the computers of your children or your subordinates (with observance) also not against the law.

The main violation of the law in this story is precisely penetration into the university's accounting system using another person's stolen password and change data in this system.

In the Criminal Code Russian Federation, for example, it is described like this:

Article 272 of the Criminal Code of the Russian Federation. Illegal access to computer information

1. Illegal Access to ... computer information ... if this act entailed the destruction, blocking, modification or copying of information, disruption of the computer, computer system or their network.

Read this definition and try to avoid such situations as much as possible, since the punishment under this article is criminal and quite serious.

Users often call and write to us with a question about how to intercept a password from a social network, or why the program does not intercept numbers bank cards. The answer to these questions lies on the surface: we do not recommend using our programs for illegal purposes.

We sharpen our programs for "peaceful" and legitimate purposes.

Implemented for parents who want to watch their children, protect them from the dangers of the network. The program, for example, has a “Signal words” function that instantly notifies parents if the child used one of the pre-specified stop words in correspondence (personal data, home address, or something that is not recommended to be mentioned on the Internet).

Implemented for leaders of organizations who want to know what their employees are doing in work time. The program creates reports on what programs the employee used, what time, what sites he visited, whether he came to work on time, etc.

As you can see the script "intercept the password from the social network" does not fall into the tasks of users of either the first or second program. Not to mention the numbers of credit cards, accounts, online wallets and other financial information.

To make sure that the user understands what our programs are for and that he has the right to use them on a particular computer, we have applied several solutions that do not affect law-abiding users.

1) Installation options

At the very beginning of the installation of the program, the user needs to choose what he is going to use the program for:

to monitor your own computer,
to monitor your child's computer,
to monitor the computer of his subordinate,
other goals.

If the user selects "other targets" - the program will turn off the invisibility settings, it will be impossible to hide it. In other cases, stealth mode will be available.

2) Requirements for installation

During installation, the program asks for the password of a user with administrator rights. She doesn’t save it anywhere and doesn’t use it in any way - she just checks that it fits.

This eliminates the option that the program is installed on a computer without the knowledge of its owner. (for example, if he forgot to turn off the computer).

3) Interception exceptions

As we wrote above, the program fundamentally does not intercept some things. We hope that our users understand that this is done primarily for their own safety.

The law is harsh, complex, not obvious, and its application is sometimes incommensurate with the scale of violations. Therefore, the program in some cases "turns a blind eye" if it considers that the user is on the verge of violating the law.

Ministry of Internal Affairs released documents on surveillance of social media users Russian police headquarters are purchasing software that allows them to spy on social media users, including reading private messages, collecting geolocation data and analyzing the connection between different users.

Znak.com found out that "gray" access to social media data can be used for this. The Ministry of Internal Affairs says that they are not going to read users' correspondence without a court decision. The Main Directorate of the Ministry of Internal Affairs for the Sverdlovsk Region announced the purchase of a software and analytical module for the Zeus information system, which is already used by the Sverdlovsk police.

One of the points of the terms of reference directly states that the Zeus system should provide a text search through the archive of the user's personal messages.

At the request of analysts, the software module will even draw a graph of the user's social environment and establish a possible connection between users by analyzing friends, relatives, indirect friends, places of residence, common groups and reposts. Analysts of the Main Directorate of the Ministry of Internal Affairs will be able to search for photos posted on social networks by geotags, the time the image was uploaded to the network, and the keywords that described the photo. The module will also display on the map the place where this or that picture was taken.

Zeus already operates in seven regions

In addition, the Lipetsk police managed to identify users who place ads for highly paid jobs for girls (presumably pimps). This is stated in the review of the tests of the Zeus system carried out in July 2016 by the Lipetsk police. We failed to find information on public procurement of the system for the listed regions. It is possible that closed public procurement procedures were carried out (FZ No. 44 allows for such a possibility). So far, the only region in which the auction documentation has been published is the Sverdlovsk region.

Police: Law-abiding citizens have nothing to worry about

“Law-abiding citizens have no reason to worry about correspondence on social networks, unless, of course, it contains something criminal. It is necessary to be afraid of those who do not like a calm and peaceful life in our state, - said Gorelykh. - Work on such equipment will be carried out only by decision of the courts, so that there is no violation of the legal rights of citizens. Work in this direction is necessary both for the security of the state as a whole, and for the inhabitants of the Sverdlovsk region.”

"VKontakte": "We act within the law"

VKontakte press secretary Yevgeny Krasnikov, having familiarized himself with the terms of reference for the purchase of an analytical module, noted that, most likely, we are talking about monitoring the public activity of social network users: their own posts on personal pages, posts of friends on the same walls, reposts and publications in social networks. “VKontakte has a flexible system for setting the privacy of user pages, which allows, in particular, to block public access to your posts on the wall and exclude a personal page from the issuance of search sites,” a representative of the social network noted. The safety of the personal data of our users is a priority for the company.

"VKontakte" strictly adheres to the current legislation and fully respects the constitutional rights of citizens," the press secretary of the social network said.

Internet Ombudsman: "Normal Purchase"

Facial recognition technologies have evolved very powerfully in recent years. Monitoring and automatic recognition can stumble upon photos you have taken at the resort. And in the background, the robot recognizes the criminal who fled the scene of the crime. Based on this assumption, a check will be carried out and a criminal who may be a threat to your life and your health will be detained.” Marinichev did not comment on the point about the ability of Zeus to read users' private messages.

Surveillance began before the "Yarovaya Law"

According to him, the FSB and the Ministry of Internal Affairs had the opportunity to study the personal data of users in Russian social networks long before the adoption of the sensational “Yarovaya law”. “The Yarovaya law only legalized the existing practice, including allowing the collected data to be used as evidence in court,” the source says.

According to him, the use of "Zeus" cannot be considered legal operational-search activity, it is rather a primary collection of information, on the basis of which it will already be possible to determine targets for a legal search operation, including using the norms of the Yarovaya law. If you believe the source, you can say that the illegal collection of information by employees of the Ministry of Internal Affairs is implied.

Popular in category: