A controversial new Russian law on the retention of personal computer data has gone into force, raising questions about the possible impact on the world's largest Internet companies and the privacy of the customers they serve -- and whether the law can even be effectively enforced.
The law, which took effect on September 1, requires Russian and foreign companies to store data for customers who are Russian citizens on servers housed on Russian territory.
That has sparked concerns among privacy advocates who fear the law will further restrict speech in Russia, where the Internet has served as a freewheeling and largely unhindered forum for public debate, particularly compared with traditional media outlets.
Michael Sulmeyer, director of The Cyber Project at the Harvard Kennedy School's Belfer Center, said Russia isn't the first country to explore asserting more control over computer users' personal data.
But, he said, "the big test for the principle is certainly Russia, and it's not too terribly surprising given what's been happening in Russia recently."
Despite earlier efforts by former Russian President Dmitry Medvedev, now the prime minister, to instill a Silicon Valley-style ethos in Russia, the Kremlin's attitude toward the Internet has cooled since Vladimir Putin's return to the presidency in 2012. Last year, Putin publicly called the Internet a "CIA project."
Regulators have also adopted increasingly strict regulations on bloggers, requiring them to register if they reach a certain threshold of readerships or followers.
Earlier this year, Russia's media oversight agency, Roskomnadzor, threatened to shut down Wikipedia's Russian site because it contained material about marijuana.
Companies that don't comply with the new law will be included in a blacklist, under court order by Roskomnadzor, and subject to a fine of up to 300,000 rubles, or around $5,000. Roskomnadzor can also order Internet providers to block access to violators.
'Race To The Bottom'
It was unclear exactly what impact the law would have on major international Internet companies, and which ones would comply the law.
According to Roskomnadzor, eBay and PayPal are among the most notable companies agreeing to house data on Russian-based servers, along with hardware makers Lenovo and Samsung, and the web-based taxi service Uber.
"The challenge that Russia finds itself in, is how you enforce your law on companies and services that aren't based in Russia?" said Danny O'Brien, international director for the nonprofit advocacy group Electronic Frontier Foundation.
"If Russia is requiring Facebook and Google house servers in their territory, what's to stop any other country from requiring the same thing?" he added. "It's a race to the bottom."
Among those whose compliance was in doubt, however, was Facebook. The Russian newspaper Vedomosti reported on August 26 that the U.S.-based social media giant did not intend to comply with the law.
Roskomnadzor confirmed in a statement that its chief had met with a Facebook representative but declined to characterize the discussions.
Facebook, which is headquartered in California, refused repeated requests to comment. A spokesman told RFE/RL in an email: "We regularly meet with government officials and have nothing more to share at this time."
Microsoft said only that some of its services were subject to the new law and that the company would comply with those services.
"We don't believe we customize or market our consumer services to Russian citizens in a way that makes them subject to the new law," a company spokesman said in a statement.
Google refused to comment on the law, as did other major companies, such as IBM.
Samantha Lein, a spokewoman for the Wikimedia Foundation, said the site had built-in privacy protections that help protect users anonymity: both their names and their Internet Protocol addresses, which can be used to locate specific computers.
"We have been following the development of [the new law] but don't believe it affects Wikipedia given that we intentionally keep as little information as possible about our users," she said in an email. "However, we do think that overly strict territorial requirements are problematic for the future of the Internet."
Online auctioneer eBay declined to make a representative available for questions, but said the company "makes every effort to comply with applicable laws and regulations around the world, in order to best serve our customers. eBay is committed to the Russian market, and looks forward to continuing to connect customers there."
Anton Nossik, a widely read blogger whom many consider the godfather of the Russian blogosphere, said that the law's many faults included the lack of a sensible way to distinguish between the citizenship of users.
In a September 1 blog post, Nossik said that Wayback Machine -- a San Francisco-based online archive for other websites -- had been blocked briefly by at least one Russian Internet service provider. It was unclear if the reported blockage was specifically related to the new law.
The website reportedly holds about 150 billion iterations of different sites worldwide going back to 1996.
Nossik called the new law a "crooked and moronic normative act" that, from a legal standpoint, is about as useful as toilet paper.
