Russia: new law on the « Critical Infrastructures of Information »
The Russian State Duma has passed a new “package of laws” on the « Critical Infrastructures of Information », CII (« o Krititcheskoï Informatsionnoï Infrastrukture », IIC), at its second reading in session on July, the 7th. This document defines the main security rules which have to be enforced in the domain of CIIs, and the respective roles of the different bodies of the State and governmental authorities. It also specifies the legal rights and obligations of the CIIs owners.
The whole text has been written and established in accordance with the new State “Strategy for the Information Society in Russia, from 2017 to 2030”, which has been adopted by (a) presidential oukaz (executive order), on May, the 5th: it specifies the different responsibilities of the managers and operators of telecommunications infrastructures in the country, especially in the field of the Internet of Things (IoT). The law project also regards the systemization of the protocol and infrastructure type of management known as “GosSOPKA” – which is already officially enforced in Russia, but which is not compulsory yet – for the surveillance and fight against the cyberattacks targeting connected objects, or which use these objects: particularly in case of DDoS attacks.
According to this new legal frame, all companies whose services are related to connected objects, and all managers and owners of systems which allow the connection between this type of objects (like “cloud spaces”), will have the obligation to establish contacts with the FSB. They will also have to keep the authorities informed about any incident they could encounter, and to forbid unauthorized access to any piece of information on their infrastructures. Furthermore, they (already) have to be able to keep on their servers every data in transit, in order to allow the retrieval of any data on the state of the different computers connected to their network by the federal authorities.
During the second reading of the law, several amendments have been added to the first project, which had been introduced to the State Duma in January. Then, the managers and owners of CIIs must be registered by the Russian authorities. They also have to meet specific requirements – which should allow the authorities to categorize their CIIs –, and to communicate the list of all the computers which are connected to their infrastructures to a “Record of the Critical Information Infrastructures”. The registration on this list also regards the scientific organizations and research infrastructures.
Furthermore, financial institutions have to reach the Russian Central Bank, in order to learn about the technical requirements for the installation of security tools on their infrastructures, and about the official protocol of the “procedure to follow in response to incidents”.
Finally, some changes to the Penal Code should stipulate the complete responsibility of the infringers, for “unauthorized access to information about CIIs”, “malware development in order to attack CIIs”, and “violation of the rules related to ICTs and CIIs management”.