Russia's Top Investigator Proposes AI, VPN and Other Technologies as Aggravating Circumstances in Criminal Code
Alexander Bastrykin, Chairman of the Investigative Committee of Russia, has proposed amending the Criminal Code to classify the use of artificial intelligence, VPN services and other information technologies as an aggravating circumstance in criminal cases.
The committee has already drafted the corresponding bill, Bastrykin told Interfax. At present, the Criminal Code contains no universal norm that would allow courts to take into account the application of such tools when determining punishment.
According to Bastrykin, these technologies are increasingly helping offenders achieve their objectives, from fraud and illegal circulation of personal data to terrorism, murder and sexual offences.
The head of the Investigative Committee considers it ineffective to insert separate references to AI, proxy servers and similar tools into dozens of individual articles of the Criminal Code. By the time legislators list specific technologies, the IT sector will have changed several times and the wording will have become outdated.
Instead, the committee advocates a systemic solution: recognising the use of technology as a standalone aggravating factor. The new provision would apply only when the technology served as the principal instrument of the crime or enabled a substantial increase in the harm inflicted, for example by scaling cyber fraud or organising the illegal trade in personal data.
Bastrykin emphasised that the measure would not punish citizens for simply having a VPN enabled, carrying a smartphone or running a neural network on their computer. The norm is intended solely for situations in which digital tools materially facilitate or intensify criminal activity.
Related articles
Japan's IPA Opens Special Consultation Desk for Suspected Cyberattack Data Leaks
The Information-technology Promotion Agency (IPA) has launched a dedicated Unauthorized Access Special Consultation Desk to assist companies and organizations affected by cyber attacks resulting in information leaks. The service accepts inquiries from entities that only suspect they may have been victimized, providing initial response guidance even before confirmed incidents. Consultations cover advice on whether unauthorized access or data exfiltration is likely, recommended immediate containment steps, lists of incident response vendors, and reporting obligations to relevant authorities. The hotline operates on weekdays from 9:30 to 17:30 excluding the lunch hour, while email replies may take until the next business day. Separate channels exist for non-access incidents, general security advice, and individual personal data breach concerns. The move responds to a rising number of breaches targeting online services handling personal information.
Russian State Duma Approves Outsourcing of Banking Secrecy and Client Data Without Consent
The State Duma has passed legislation in its second and third readings permitting Russian banks to transfer client data processing, including banking secrecy and personal information, to external IT contractors and cloud providers. No separate client consent will be required for such transfers. Only accredited Russian IT companies and banks holding a universal license that meet strict domestic control criteria may act as processors, with all servers required to remain inside Russia. Banks must notify the Central Bank of Russia in advance, and contractors must undergo audits by organizations licensed by FSTEC or FSB Russia. Special approval procedures involving the Central Bank, FSB, and Rosfinmonitoring apply to banks under foreign control. The law preserves banking secrecy while expanding the circle of authorized handlers under defined security obligations.
Russia's MinTsifry Drafts Security Requirements for Trusted Domestic Software
The Russian Ministry of Digital Development has published a draft set of requirements for trusted Russian software that go beyond simple domestic origin. The proposals focus on resilience against external interference, absence of known unpatched vulnerabilities, and full development and build processes conducted inside Russia under controlled conditions. Additional rules cover up-to-date component inventories, in-country technical support, and timely disclosure of software updates. Special compatibility mandates are included for Russian browsers and electronic signature tools across multiple product classes such as operating systems, databases, office suites, and communication applications. Compliance verification would be voluntary through expert review, with results recorded in the official Russian software registry and internal-use software lists.
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.