securitylab_n•July 15, 2026•🇷🇺Translated from Russian

Russia's МВД Proposes Mandatory Purchase of Special Smartphones for Migrants to Enable Permanent Digital Location Tracking

Russia's Ministry of Internal Affairs is developing a new system of permanent digital surveillance over labor migrants that would require them to purchase a special smartphone upon entering the country.

Deputy Minister Igor Zubov told the Federation Council Committee on International Affairs that foreign nationals arriving for work or long-term stays would be obliged to buy a government-approved device. An electronic profile would be created on the smartphone, enabling police to track the owner's location continuously and block any move from one settlement to another without prior approval.

The same device would also deliver automatic notifications about expiring documents, reducing unintentional violations of migration rules.

The proposal extends an existing control framework. Since September 2025, migrants in Moscow and the Moscow region have been required to install the "Amina" application, which transmits geolocation data to the МВД. Failure to transmit location information for more than three working days results in removal from migration registration and placement on a controlled-persons list, which can lead to deportation.

By mid-December, authorities reported that more than 139,000 individuals had been deregistered through this mechanism. Starting 1 July 2026, all visa-free foreign nationals must register their entry via the RuID application and create a digital profile. A centralized state database operated by the МВД, containing information on documents, employment, housing, fines, and telephone numbers of every foreigner, has been active since 30 June.

The key distinction of Zubov's initiative is that current regulations only require installation of software on a migrant's existing phone, whereas the new plan would make purchase of a dedicated device a mandatory condition of entry itself.

Similar ideas have previously drawn criticism from human rights defenders. In 2020, activist Svetlana Gannushkina argued that obliging people to buy an expensive device is unlawful, as many migrants lack the necessary funds, technical skills, or access to such technology.

The latest proposal has been presented only as a long-term plan and has not yet been formalized in legislation; therefore, the compulsory purchase of a special smartphone is not currently required for entry into Russia.

Related articles

Habr•Privacy & Surveillance

Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware

The Free Software Foundation announced in September 2026 that it is providing financial and legal support to the GNU Boot project, which aims to deliver a completely open-source replacement for traditional BIOS and UEFI firmware. GNU Boot builds on coreboot to initialize hardware at boot time and layers a free bootloader such as GRUB or SeaBIOS on top, ensuring no proprietary binary blobs are required. The initiative emerged after a 2022 split from Libreboot, which began accepting closed-source components to broaden hardware support, while GNU Boot strictly adheres to GNU licensing criteria that prohibit any non-free code. Supported platforms remain limited to older systems from roughly 2008–2012, including specific ThinkPad models, certain early Apple MacBooks, and a handful of AMD and Intel desktop boards, because newer Intel Boot Guard and AMD equivalent mechanisms enforce signed firmware that prevents unsigned replacements. Closed firmware from Intel Management Engine and AMD Platform Security Processor runs before the main operating system, possesses unrestricted memory access, and cannot be audited or disabled on most modern hardware. By offering reproducible builds and clearer installation instructions, GNU Boot seeks to lower the barrier for users who want to eliminate potential backdoors, Wi-Fi whitelist restrictions, and forced updates found in vendor firmware.

AntiMalware•Privacy & Surveillance

WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References

Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.

Habr•Privacy & Surveillance

WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws

Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.

Habr•Privacy & Surveillance

Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305

A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.