Privacy

Pre-installation of mobile apps in Russia - competition or surveillance?

Not a long time ago, Russian paliamentaries adopted the law in the first reading about pre-installation of Russian apps on devices sold in Russia. It's a long time discussed initiative, first time introduced in July 2019 and right now going to be finally adopted till end of this year.

Ivan Begtin

Nov 10, 2019 • 5 min read

New devices sold in Russia should have pre-installed software adopted for russian services. It covers such devices like computers, smarphones, smart-TV and other type of devices.
Final list of software (apps) and rules of pre-installation should be decided by Government of Russia (Cabinet of ministers)

In the explatnation note [2] for this bill it's written as following:

Bill written to provide feature for Russian Internet and telecom ability to use users to use bought devices (smartphones, computers, tv with "smart-tv" funtion) without need to install additional mobile apps and other computer programs, for Russian users of such devices.

Before blaming or praising this initiative I would like to explain how world economy organized aroud electrotonic devices, especially smartphones.

This economy could be explained via following list of market players:

hardware vendors of devices. Companies like Apple, Samsung, Sony, Xiaomi, Huawei and others.
ecosystems owners, especially operating systems with ecosystems. Biggest are Apple, Google, Microsoft
application owners and developers (ecosystem players). Thousands around the world: Facebook, Twitter, Russain companies like Yandex and Mail.ru
developers of services for application owners. It's adtech and surveillance tools, SDK, services like: AdColony, Teemo, Tealium and hundreds others.
government regulators that protect consumers of digital services and devices and government anti-monopoly regulators.
enforcement agencies, police, special agencies interested in obtaining so much data as possible for common security, anti-terroristic actions and so on.
civil society organizations that acts against corporate and government surveillance

Sometimes organizations have multiple roles. For example, Google (Alphabet) is a hardware vendor, owner of the biggest ecosystem (Android), application developer and developer of services for application developers.

Each type of players have their own interests and strategy.

1. Device vendors

to keep current market share and to expand
to effectively integrate into existing ecosystem
to obtain more cash, for example via contracts on pre-installation of apps
to create own ecosystems

Example: Samsung produce Android based devices and should install Google services since they use Android (Google) ecosystem. At the same time they produce their own applications and they try to create own sub-ecosystem with Galaxy Store [3] that they promote to install new mobile apps

2. Ecosystem owners

to keep current share of their ecosystem and to expand it to the new devices
to get maximum revenue from their ecosystem
to attract more device vendors to the ecosystem
to attract more software developers to the ecosystem
to protect from government regulators and to cooperate with them
to keep the balance between people fears about privacy and requests of government agencies to get peoples data via surveillance and forensic requests.

Example: Google created Android ecosystem and cooperates with device vendors and sotware developers and government regulators to keep ecosystem growing and to exploit it for maximum profitabilty.

3. Application developers and owners

to integrate into existing ecosystems effectively
to get maximum revenue from apps from any possible revenue sources like ads, paid apps, selling users data and so on
to protect from monopoly of ecosystem owners in most competitive topics
to collect data, for apps optimization, and to sell data
to create own sub-ecosystems for major developers and app owners;

Example 1: Russian Yandex company doesn't produce any popular devices and haven't own mobile ecosystem. Yandex integrates into Apple, Google and Microsoft ecosystems and collaborates with government regulators when they habve to compete with apps created by monopoly of ecosystem owner.

Example 2: Chinese regulators limit usage of Google Play (application store for Android ecosystem). That's why in China a lot of device vendors and major software companies create own app stores [4]

4. App SDK and services developers

to cover so much apps as possible in all ecosystems
to get maximum revenue from app owners and from selling users data
to get protection from government regulators from ecosystem owner monopoly
to avoid government regulation of personal data usage and selling

Example: Company Segment [5] provides services for app owners to integrate users data from all sources.

5. Government regulators

should be interested in development of their local economies and market share of their own app owners and developers, ecosystem owners and device vendors on global mobile market;
should be interested in competition on digital markets;
should be interetted in protecting civil/customer rights
limited by country and market value of their countries

Example: EU adopted antimonopoly regulation against Microsoft and now Microsoft should follow number of rules to provide alternative browsers and other default apps for users.

6. Enforcement and surveillance government agencies

to obtain in near-realtime data about specific persons, groups of persons, companies from all possible data sources;
to use any legal and mostly legal way to collect this data
to have access to the data of all companies in their country jurisdiction

Example: MInistry of Interior in Russia can get access directly or via court decision to any company data in Russia if it's needed to it's investigation.

7. Digital civil rights organizations

to help people to understand how data surveilance organised
to influence corporation to use ethical practices
to influence government regulators to adapt best privacy regulation

Example: EFF or Exodus privacy collect private donations and do research how corporations organize surveillance using mobile apps.
—
Let's get back to our russian bill. Let's review current Russian context:

There is no any company that acts as ecosystem owner in Russia
There is no any company with any serious market share device vendors
There are some major application owners like Yandex or Mail.ru Group (MRG) and some other government or quasi-government organization could join this list soon.
It's diffent to other countries, but Russian government spends a lot of money to create government-applications like Gosuslugi (government services) or tax payers apps.
Russia has long story of regulation and government spending for advanced government surveillance like "Yarovaya law" and "Souverigh Runet Law"
Right now protection of consumers rights for privacy is inactive. There is no proper laws and other regulation and there is no digital consumers rights organizations.

What do we have as result?:

all decisions transferred from parliament to executive powers (cabinet of ministers). We don't know yet how app preinstallation will be organized.
bill is not about competition and not about users choice. It's about just pre-installation, but a lot of apps highly competitive like search apps, email and news apps or food delivery services between MRG and Yandex.
bill doesn't clarify transparency of app choosing process. Since app preinstallation affects market share of the companies so corruption is possible.
there are a lot of risks of surveillance from these apps. For example if antivirus software will be required to install.
most likely government will demand to install government apps like tax payers apps and Gosuslugi and it could cause direct government surveillance even without any third party apps.

Final conclusions
Before this bill we had a sitation when citizen had right to choose who is tracking him and how. Government could be protector of civil and consumer rights. Since adoption of the law we will have the situation that corporate surveillance will be organized by will and force of Russian federal government. Even more, government apps on mobile devices could cause new level of government surveillance and censorship by tracking apps used by users, tracking and blocking sites visited by users and so on.

Links:
[1] https://sozd.duma.gov.ru/bill/757423-7
[2] http://sozd.duma.gov.ru/download/EA989F41-969E-40C1-A548-A33139B28958
[3] https://www.samsung.com/global/galaxy/apps/galaxy-store/
[4] https://www.24hchina.com/chinese-app-store-list/
[5] https://segment.com/

Sign up for more like this.