Protection without protection

What is a man? From a legal point of view, this is a legal entity with characteristics that allow it to be identified: gender, date, place of birth, passport number, place of registration. These are all personal data that has a certain value for merchants (because a person also has value as a subject of consumption), creditors (for the purpose of searching for your assets), fraudsters (in order to get money at the expense of you). Accordingly, the State is trying to protect our personal data (PD) from illegal use. Administrative fines since July 1, 2017 increased significantly. Thus, officials can be fined in the amount of 3,000 to 20,000 rubles, individual entrepreneurs - in the amount of 5,000 to 20,000 rubles, organizations - in the amount of 15,000 to 75,000 rubles.



There is also criminal liability:

• for unlawfully collecting or disseminating information about the private life of a person constituting his personal and family secrets, without his consent (Part 1 of Art. 137 of the Criminal Code of the Russian Federation) - from fines to 200,000 p. Until imprisonment for a term of two to four years.
• unauthorized access to computer information, which resulted in the destruction, blocking, modification (modification) or copying of information (part 1 of article 272 of the Criminal Code of the Russian Federation);

The above acts are punishable by fines of up to 200,000 rubles or imprisonment for a term of two to four years. Of course, protection includes not only the adoption of certain legal norms providing for liability. An important factor is how the state actually applies these norms. An indicator of how serious a state protection is is the cost of services related to overcoming one or another legislative barrier. They ask a lot, it means that the barrier is serious, the costs of overcoming it are large. Few ask- means the state itself is not particularly concerned about the observance of these laws.



So how effective is the protection of our personal data? Judge for yourself. At the end of last year, DeviceLock (one of the leading manufacturers in the Russian Federation of DLP systems) conducted a study of the Russian black market for personal data and related criminal services. In the course of the study, proposals posted on Darknet resources (the “shadow Internet” accessible via the TOR browser) were collected and analyzed.

Main conclusions:

• the cost of personal data without document scans did not change much as compared to the beginning of 2018, the cost of document scans decreased, on average, by 25%, and the cost of “break through” (not legal provision of personal data), on the contrary, increased in different segments from 25% up to 400%.
• personal databases in EXCEL format by region, containing full name, gender, telephone number, full passport data, SNILS, registration and residence address for 2017-2018. sold at 20-25 cents per record. Compared with the beginning of 2018, prices have not changed. A scan of a passport with a photo of a passport holder with a passport is offered at a price of 150 rubles per set, and a set consisting of scans of a passport, SNILS, rights and TIN - is “pushed” at a price of 300 rubles. Remarkably, it was in this area that prices dropped markedly, by about 25%, and the number of offers increased markedly (all according to market laws).

Services “punch” data on a person from mobile operators has grown, not less than 25%. Detail calls and SMS subscriber for the month offered at prices ranging from 2 000 to 20 000 rubles. Rising prices by about 50%. In this area, the widest choice of both the data itself and their sellers: everything is offered, ranging from all sorts of statements to constantly tracking the location of the subscriber.

Services to “break through” banking information also increased significantly in price (at least 50% per year). The availability of “services” strongly depends on the region of the Russian Federation. To get an extract from the bank customer’s account (from the Top 10) is offered starting from 8,000 rubles per month / 10,000 rubles in six months. In this area, there are a lot of intermediaries who offer an initial price 4 times higher than the real one. Moreover, the cost of these "services", the list of banks where this can be done very quickly changes. Apparently there is a human factor.

Based on the research, DeviceLock makes the following conclusions:

• The value of PD without scans of documents is quite low, due to the fact that such PDs are usually used for spam or telephone fraud, which in principle does not bring a serious income. Document scans are used to obtain online loans, fictitious transactions and therefore have an increased demand for fraudsters.
• One of the largest channels of leakage of document scans is microfinance organizations (MFIs). Moreover, the share of leaks from the MFI is constantly increasing. For example, in the last quarter, the share of MFIs increased from 3% to 5% in the total number of data leakage cases.
• Proposals for PD on the black market not only did not decrease, on the contrary, their number increased visibly. Prices for almost all types of PD increased. Especially noticeably increased prices for "breakthrough" in banks.

I think the state has something to work on.