Russian Lawmaker Clarifies Apple and Microsoft ORI Registry Listing Does Not Ban Products
State Duma deputy Anton Nemkin has clarified that the addition of Apple and Microsoft to Russia's registry of organizers of information dissemination (ORI) does not equate to an automatic ban on their products in the country.
According to Nemkin, the registry entry imposes obligations related to data storage and the provision of information to authorized agencies in cases stipulated by law. These requirements apply uniformly to both Russian and foreign participants in the digital market, with no exemptions based on the scale of business operations or country of registration.
The deputy stressed that the measure does not turn devices such as iPhones into non-functional units or disable operating systems like Windows. He called for avoiding the substitution of real regulatory consequences with sensational media headlines.
Apple and Microsoft were added to the Roskomnadzor ORI registry on October 2, 2026. Google has been included since January 26 with its Google Meet service. The ORI status requires storage in Russia of user data and records of message exchanges for three years, along with message content for up to six months.
These records must be provided to authorized bodies when required by law. While the listing does not prove that the corporations will transmit correspondence of Russian users to the state, it also offers no guarantee against future restrictions, as separate enforcement measures exist for non-compliance.
Related articles
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.
Russia Hands Out 2.2 Million Rubles in Data Leak Fines During First Half of 2026
Russian companies received 13 fines totaling 2.195 million rubles for personal data leaks between January and June 2026, according to new research from InfoWatch. This amount represents a 1.6-fold increase compared to the entire previous year, when total fines reached only 1.385 million rubles. The study shows that Russian penalties accounted for roughly 11 percent of the 115 global fines recorded during the same period. Approximately one quarter of the Russian cases involved violations caused by employee negligence. Organizations in the IT and information security, industrial, and trade sectors were fined most frequently. InfoWatch notes that turnover-based fines have not yet been applied and expects broader enforcement to begin in 2027.
Fines for Telegram Advertising May Be Delayed Beyond Transition Period
Russian authorities are reportedly considering delaying enforcement of new fines targeting advertisers in Telegram after the end of the announced transition period. According to sources cited by the Post- outlet, the government has not yet reached a clear decision on practical application of the advertising ban. Law enforcement agencies are also said to have stepped back from demanding strict punitive measures. Without official confirmation, advertisers and channel owners continue to operate under existing rules. The Federal Antimonopoly Service (FAS) had previously signaled stricter oversight starting in 2027, but current indications point to a possible extension of the status quo. Industry participants are advised to monitor developments closely as the situation remains fluid.
TLS Encrypted Client Hello Officially Standardized as RFC 9849
In March 2026 the IETF published RFC 9849, formally adopting TLS Encrypted Client Hello (ECH) as an official standard for protecting the Server Name Indication field during TLS handshakes. The specification replaces the earlier Encrypted SNI proposal and uses Hybrid Public Key Encryption (HPKE) as defined in RFC 9180 to encrypt the inner ClientHello. Major browsers including Chrome, Edge, Firefox, and Brave now enable ECH by default when Encrypted DNS (DoT or DoH) is active, while Safari remains an exception. Adoption on the server side remains limited; Cloudflare continues to be the only major CDN offering production ECH support, and real-world usage hovers around 0.06 percent of connections despite 20 percent of devices using encrypted DNS. The change breaks SNI-based traffic filtering, proxy inspection, and host-name-driven security analytics, prompting organizations to reassess monitoring architectures. OpenSSL added ECH support immediately after standardization, and Nginx introduced configuration options in version 1.29.4.