- The Stable Runet law passed Russia's parliament this week.
- It appears to give the Kremlin greater control of communication flows in the country.
- Russia is positioning the law as a necessity to maintain the country's security from cyberthreats.
- The law will likely put obligations on any U.S. company that operates networks in Russia to replace equipment, and possibly raise concerns about government-sponsored surveillance of enterprises with offices there, one expert says.
A new law that could further cordon Russia from the global internet passed the country's parliament this week and awaits President Vladimir Putin's signature.
Moscow has positioned the law as a security and privacy measure, meant to counter what it has said is an increasingly aggressive cybersecurity stance by the U.S. and increasingly risky threat landscape generally. But activists and other international observers outside Russia say the law would give Putin's government far greater control over internet traffic within the country, despite measures already in place to tamp down on dissent.
Russia already keeps a relatively tight grip on allowing U.S. social media companies there, providing government-backed alternatives to popular services like Facebook (VKontakte or VK in Russia) and Google's Gmail (Mail.ru in Russia).
However the law is executed, it could further contribute to what Eugene Kaspersky — CEO of the eponymous security company that has been censured in the U.S. for its alleged Kremlin ties — calls the "Balkanization of the internet," and what Google's Eric Schmidt said is a trend toward an internet split between hostile countries, creating separate internets based on geopolitics.
The new Stable Runet law would give the Russian communications regulator, known as Roskomnadzor, broader powers to monitor network traffic and potentially provide a "kill switch" to disconnect Russia from the wider internet in the event of cyberattack. Essentially, the law is meant to help create a digital drawbridge between Russia and the rest of the world that the country can raise in an emergency.
While the Kremlin says the law is meant to increase security, many observers, especially human rights groups, have speculated it will further increase censorship initiatives from Putin's government.
That's because the law was proposed by the same group of lawmakers in Russia who recently passed a law criminalizing the spread of online news that disrespects the government, said Aleksandr Yampolskiy, CEO of network security rating company SecurityScorecard.
"First, they made the language very broad. If you operate a network in Russia, you are required to create a way to have government oversight of that information," he said.
The law also lacks specifics, Yampolskiy said, an indication the Kremlin is building in some wiggle room for how exactly it will be enforced.
"The language is deliberately vague and broad, so that will also be something for [business] to consider, since it's unclear what you are going to have to do to comply," he said.
But it will probably become another tool to enforce positive messaging about Putin's government, Yampolskiy said.
The law also doesn't provide much information as to how it will be accomplished technologically, said Natalia Gulyaeva, head of the Moscow intellectual property, media and technology practice group for law firm Hogan Lovells.
"Theoretically, the law encompasses installing new equipment on data transfer points in order to secure functionality of [the] Russian part of Internet in case of any global shutdowns," she said. "The authors of the law have not provided any comments on the technical side of the law."
Russia and China are frequently put into similar categories as countries racing to further limit speech on the internet.
But the new Russian law is not as restrictive as "The Great Firewall of China," which allows Beijing to monitor communications and prohibits access to a wide range of U.S. and global websites.
"China's Great Wall was established when the Internet came to China, so it developed along with the development of the internet in China," said Gulyaeva.
China's system provides direct control of internet traffic to the Communist Party government in Beijing, while the Russian proposal gives indirect control to several bodies — including the Roskomnadzor, the Federal Security Service and the central Russian government.
"For instance, the law imposes obligations on communications service providers to filter information received from cross-border data transfers and purchase special equipment which will create autonomy of the Russian part of the internet," she said.
However, the move is riskier for foreign business interests in Russia than similar censorship moves are for businesses in China. The law will likely put obligations on any U.S. company that operates networks in Russia to replace equipment, and possibly raise concerns about government-sponsored surveillance of enterprises with offices there, said Yampolskiy.
However, Russia has a lot less leverage because many foreign businesses could withdraw. "Obviously, this is a much smaller economy, and there are a lot fewer incentives to negotiate with any onerous new requirements," he said.