19 October 2017
The Meshchansky District Court of Moscow (‘the Court’) decided, on 16 October 2017, to impose an administrative penalty of RUB 800,000 (approx. €12,000) on Telegram Messenger LLP (‘the Decision’), for failing to provide the Federal Security Service (‘FSB’) with the information necessary to decode messages, as required by Article 10.1(4.1) of the Federal Law of 27 July 2006 No. 149-FZ on Information, Information Technologies and the Protection of Information (‘the Information Law’). The Decision, which was issued after the FSB sent Telegram an unrequited request to provide it with certain users’ phone numbers in July 2017, signifies an additional compliance burden for messenger operators to ensure the accessibility of user information to state authorities.
Vyacheslav Khayryuzov, Counsel at Noerr LLP, told DataGuidance, “This is the first time a messenger operator [was publicly brought to court] for failing to comply with a request from the authorities. According to the owner of Telegram, Pavel Durov, this was an intentional violation, since Telegram considers the requirements of the Information Law to be in breach of Article 23 of the Russian Constitution, which enshrines the privacy of communications. Given the popularity of Telegram, immediately blocking the messenger could be too harsh, although it is likely that this could be the next step. While the FSB is entitled to issue fines from RUB 800,000 to RUB 1,000,000 (approx. €12,000 to €15,000) for violations of Article 10.1(4.1) of the Information Law, they used the lowest figure here. It appears that the authorities want to give Telegram a chance to comply.”
Under Article 10.1 of the Information Law, most recently amended in July 2017, organisations that operate instant messaging services are required to register with the state authorities, collect the identification data of users, and retain and store the content of user communications in Russia. Although the Information Law requires messenger operators to ensure the confidentiality of users’ communications, the FSB is entitled to request that they provide it with access to such communications, which is the provision Telegram refused to comply with.
[Under the Information Law], messenger operators need to be able to decrypt users’ messages and provide the FSB with the relevant information on how the messages can be decrypted
Khayryuzov outlined, “[Under the Information Law], messenger operators need to be able to decrypt users’ messages and provide the FSB with the relevant information on how the messages can be decrypted. Durov claims that the requirement to provide decoding information (ie. decoding keys) cannot be complied with, since Telegram is not in control of the encoding/decoding process. However, if the relevant technology does not allow [providing the authorities with decoding information], this situation may be considered as a breach of the law.”
Telegram was previously warned by the Federal Service for the Supervision of Communications, Information Technology and Mass Communications (‘Roskomnadzor’) that its services may be blocked for failing to provide the Roskomnadzor with information on its processing of electronic messages in Russia. It has been assigned a period of 15 days to pay the fine.
Khayryuzov concluded, “Telegram has announced that it will be contesting the Decision, however, it appears that its chances of winning the case are very low, if [it has] any chance at all. Most likely, another court would argue that the Information Law’s provisions have already passed an examination for compliance with the Constitution during the legislative process and that such provisions are aimed at protecting public security, which may override the right to privacy. There will certainly be other similar cases, since the amended Information Law is rather new and the authorities have only started active enforcement during the last couple of years. It would be interesting to see how the situation develops with Telegram and whether the authorities do the same against WeChat and the most popular messengers, such as Viber and WhatsApp.”
Kaveh Lahooti | Privacy Analyst