Leave conversations: online correspondence data will be required to be stored for three years

Online platforms will be required to store data on customer negotiations and correspondence for three years. This provides for a package of anti—fraud amendments to the legislation adopted by the State Duma in the first reading, Izvestia drew attention to the innovation. On the one hand, it will strengthen the fight against online fraud. On the other hand, it may raise prices for taxis, music and game subscriptions, and other online services, market participants say.

Why increase the storage period for user negotiation data

Information dissemination companies (ORI) will have to store data on user negotiations and correspondence for three years. We are talking about information about the reception, transmission, delivery and processing of voice information, written text, images, sounds and electronic messages (the innovations do not apply to their contents). This follows from a package of anti-fraud amendments to legislation submitted to the State Duma by the government and adopted in the first reading on March 18. Izvestia drew attention to these changes. In particular, the amendments to the law "On Information" provide for an increase in the storage period of such metadata: now it obliges them to store them for only one year.

— All measures of the draft law on combating cyberbullying are aimed at reliable protection of citizens. The measure to increase the information storage period from one year to three years is also related to improving user security. This change will make it possible to more effectively identify illegal actions, including through a single anti-fraud platform. It will block the actions of scammers by analyzing their activity. An increase in the storage period will allow taking into account information for a longer period, this is important for detecting complex and multi—stage fraudulent schemes," commented the innovation in the office of Deputy Prime Minister Dmitry Grigorenko.

Photo: TASS/imago images/Sven Simon

The extension of the storage period of ORI information from one year to three years is due to the need to improve the security and protection of users on the Internet, the Ministry of Finance noted. An increase in this period will create a more effective system for investigating and suppressing crimes such as fraud, cybercrime and other illegal activities, they added.

At the same time, officials do not expect an increase in business costs associated with tripling the data retention period: they do not predict changes for ordinary users either.

— Increasing the data retention period allows law enforcement agencies to have longer access to information to investigate complex cases such as fraud, phishing, malware distribution or coordination of criminal groups over the Internet. For example, if the victim discovers the crime a year later," Akhmetzhan Makhmutov, an information security expert and Deputy Minister of Digital Development of the Vologda Region, told Izvestia. — A three-year period gives more time to identify and collect evidence, especially in cases where the investigation requires analysis of long-term patterns or chains of interactions.

Photo: IZVESTIA/Eduard Kornienko

Storing large amounts of data is necessary in order to analyze incidents that occurred several years earlier — fraudsters tend to return to old deception schemes that people have already forgotten about, Denis Kuskov, CEO of TelecomDaily, added. He agrees that the business is unlikely to incur large costs — after all, metadata storage systems were already installed initially, they need to be expanded, not created from scratch.

How much will it cost to combat online fraud

Measures to increase the retention period are logical: telecom operators have already contained facts about connections for three years, in addition, the measure is aimed at investigating incidents of cyberbullying, according to the ANO "Digital Economy". This will make it easier to track and stop the illegal actions of fraudsters, according to his press service.

However, not all market participants and experts agree with the arguments of public figures and officials.

With new code: what attacks to expect from hackers in 2025

The cyber threat landscape could change significantly from next January

The explanatory note attached to the bill does not substantiate the need to increase the data retention period, says Yaroslav Shitsle, head of the IT &IP Dispute Resolution department at the Rustam Kurmaev and Partners law firm. This period is probably tied to the statute of limitations, during which banks, MFIs and consumers can resolve a dispute over loans and borrowings in court, he believes. Obviously, a three-fold increase in the storage period will entail a corresponding increase in the costs of the organizers of the dissemination of information, the lawyer believes.

Photo: IZVESTIA/Anna Selina

Increasing the volume of stored data will require expanding server capacities or renting cloud solutions, agrees Igor Bederov, director of the T.Hunter Investigations Department. For large companies (social networks, messengers) This can result in millions of rubles annually, and small platforms may face unaffordable costs, he believes.

— At the same time, protecting data from leaks and attacks will become more difficult due to the growing volume of information. Investments in encryption, monitoring systems, and software updates will be required. Rather, this will have a negative impact on the market in the form of partial monopolization of the sector by large players, as well as an increase in the cost of services for users," Igor Bederov believes.

In his opinion, the longer the data is stored, the higher the chance that attackers will find vulnerabilities in storage systems. Even without the content of the messages, metadata (time, geolocation, contacts) allows you to analyze user behavior, which makes them a target for leaks, he explains.

Photo: TASS/Andrey Gordeev

Companies already retain huge amounts of information as required by law, a significant part of which is already redundant and duplicated by various actors in the market, a source in a large IT company notes. Increasing the storage period may increase the costs of data operators by billions of rubles, increase demand, and hence purchase prices for data storage systems, he predicts. But how these costs will affect the reduction of cyberbullying is not fully understood.

According to Irina Levova, Director of Strategic Projects at the Internet Research Institute, the expansion of server capacities for metadata storage may cost each of the major Russian digital companies up to 200 million rubles. However, these costs can be distributed rather unevenly — it all depends on what reserve the ORI already has, she points out.

Photo: IZVESTIA/Sergey Lantyukhov

"In any case, additional costs may affect the tariffs for customers: the cost of taxi rides, music and game subscriptions, and so on," the expert notes.

When the rules for storing user communications data were first introduced in the Russian Federation in 2018, it was the storage of content, not the facts of making a call or sending an email message, that caused the most objections and problems for operators, since the first type of information is much orders of magnitude larger than the second, says Leonid Konik, a partner at ComNews Research. New government initiatives to combat fraud do not threaten them with an increase in the shelf life of heavy content, which means they will not require large investments, he believes.

But all the same, a threefold increase in the storage period of such information on the part of the legislator looks excessive. Fraudsters change numbers in a matter of weeks, and sometimes even days, and none of them uses the same phone for several months, and even more so for three years, Leonid Konik noted. Experience shows that any information that has not been useful in a month will never be in demand, the expert added.