Russia's МВД Proposes Mandatory Purchase of Special Smartphones for Migrants to Enable Permanent Digital Location Tracking
Russia's Ministry of Internal Affairs is developing a new system of permanent digital surveillance over labor migrants that would require them to purchase a special smartphone upon entering the country.
Deputy Minister Igor Zubov told the Federation Council Committee on International Affairs that foreign nationals arriving for work or long-term stays would be obliged to buy a government-approved device. An electronic profile would be created on the smartphone, enabling police to track the owner's location continuously and block any move from one settlement to another without prior approval.
The same device would also deliver automatic notifications about expiring documents, reducing unintentional violations of migration rules.
The proposal extends an existing control framework. Since September 2025, migrants in Moscow and the Moscow region have been required to install the "Amina" application, which transmits geolocation data to the МВД. Failure to transmit location information for more than three working days results in removal from migration registration and placement on a controlled-persons list, which can lead to deportation.
By mid-December, authorities reported that more than 139,000 individuals had been deregistered through this mechanism. Starting 1 July 2026, all visa-free foreign nationals must register their entry via the RuID application and create a digital profile. A centralized state database operated by the МВД, containing information on documents, employment, housing, fines, and telephone numbers of every foreigner, has been active since 30 June.
The key distinction of Zubov's initiative is that current regulations only require installation of software on a migrant's existing phone, whereas the new plan would make purchase of a dedicated device a mandatory condition of entry itself.
Similar ideas have previously drawn criticism from human rights defenders. In 2020, activist Svetlana Gannushkina argued that obliging people to buy an expensive device is unlawful, as many migrants lack the necessary funds, technical skills, or access to such technology.
The latest proposal has been presented only as a long-term plan and has not yet been formalized in legislation; therefore, the compulsory purchase of a special smartphone is not currently required for entry into Russia.
Related articles
Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections
Telegram Desktop has received an initial implementation of a new WEB proxy designed to conceal messenger connections within ordinary HTTPS and WebSocket traffic. The feature makes user activity appear as simple website browsing to network providers while MTProxy continues to operate underneath. Developers inserted more than 3,000 lines of code, including a dedicated WEB-proxy transport, domain configuration options, and interface elements such as “Open browser” and “Waiting for browser.” The mechanism works by opening an embedded web page that establishes a secure WebSocket link to a domain resembling a regular site. Multiple MTProxy connections are multiplexed into a single stream and sent through this channel. On the server side an intermediate node demultiplexes the stream and forwards the individual connections to a standard MTProxy instance without decrypting message content.
Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA
A new open-source CAPTCHA system called Aptogon replaces traditional image-based challenges with analysis of hand gesture dynamics to verify human users. Instead of clicking on traffic lights or buses, visitors draw a free-form gesture for about ten seconds while the system measures velocity variance, pause entropy, rhythm irregularity, and micro-corrections that distinguish human motor patterns from bots. The solution addresses recent reCAPTCHA restrictions, including Google's reduction of free monthly verifications from one million to ten thousand and tightened GDPR data responsibility rules starting in April 2026. An iframe architecture loaded from the vendor origin eliminates cross-origin issues and CORS blocks while supporting public and secret key pairs for domain validation. Machine learning relies on a local gradient boosting model for confident decisions and an LLM only for borderline cases, with fail-closed behavior returning 503 errors when the classifier is unavailable. Coordinates never leave the browser; only derived statistics are sent, satisfying GDPR requirements without cookie banners or biometric templates. The project is released under AGPL-3.0 with a free tier of one thousand checks per month and integration examples for HTML, React, Node, Python, and PHP.
Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia
The operators of the decentralized Cat Tunnels service faced a sudden wave of blocks that disabled all several dozen of their tracker nodes inside Russia. Without these anchor relays, new user connections slowed dramatically and existing sessions degraded. The team responded by building Kotator-Rotator, an automated system that continuously evaluates node reachability from the client side and replaces failing relays with fresh instances. The decision engine relies on Grohotator, an aggregated availability metric derived from client technical logs that also triggers an audible alarm when thresholds are crossed. Analysis of the logs revealed that blocking activity follows a clear weekday pattern, pausing on Friday evenings and resuming Monday mornings. The experience demonstrated that server-side health checks alone are insufficient when censors interfere with paths between clients and relays.
Google Chrome Tests Visible Global Privacy Control Toggle in Canary
Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are required—one to show the toggle and another to actually transmit the signal—because enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.