Russia's Top Investigator Proposes AI, VPN and Other Technologies as Aggravating Circumstances in Criminal Code
Alexander Bastrykin, Chairman of the Investigative Committee of Russia, has proposed amending the Criminal Code to classify the use of artificial intelligence, VPN services and other information technologies as an aggravating circumstance in criminal cases.
The committee has already drafted the corresponding bill, Bastrykin told Interfax. At present, the Criminal Code contains no universal norm that would allow courts to take into account the application of such tools when determining punishment.
According to Bastrykin, these technologies are increasingly helping offenders achieve their objectives, from fraud and illegal circulation of personal data to terrorism, murder and sexual offences.
The head of the Investigative Committee considers it ineffective to insert separate references to AI, proxy servers and similar tools into dozens of individual articles of the Criminal Code. By the time legislators list specific technologies, the IT sector will have changed several times and the wording will have become outdated.
Instead, the committee advocates a systemic solution: recognising the use of technology as a standalone aggravating factor. The new provision would apply only when the technology served as the principal instrument of the crime or enabled a substantial increase in the harm inflicted, for example by scaling cyber fraud or organising the illegal trade in personal data.
Bastrykin emphasised that the measure would not punish citizens for simply having a VPN enabled, carrying a smartphone or running a neural network on their computer. The norm is intended solely for situations in which digital tools materially facilitate or intensify criminal activity.
Related articles
Bill Gates Calls for Stronger External Oversight and Regulation of AI
Bill Gates stated in an NBC News interview that self-regulation by AI developers is no longer sufficient and urged Congress to pass binding laws on artificial intelligence. He warned that AI tools in the hands of malicious actors could trigger catastrophic events capable of causing up to a billion deaths, emphasizing the unprecedented power of combining bad intentions with modern AI systems. Gates advocated for mandatory rules, audits, and monitoring, particularly in critical sectors such as medicine, finance, and government infrastructure, while acknowledging that some added bureaucracy would be necessary. Leaders from Anthropic and OpenAI have similarly suggested slowing AI development, with former Anthropic employee Jacob Coxon publicly accusing companies of playing roulette with lives by pursuing self-improving superintelligence. House Speaker Mike Johnson prefers to wait for industry proposals, whereas Mark Zuckerberg opposes coordinated oversight and believes individual labs should decide on pace. Several U.S. states including California, Maryland, and New York have already begun launching their own AI regulatory initiatives and expert panels.
Implementing DevSecOps in Unprepared Teams: A Practical Three-Month Roadmap
Many development teams face resistance when security tools are introduced without proper process changes, leading to bypassed checks and unresolved findings. The article outlines a structured approach for small teams of five to eight developers without a dedicated security specialist, focusing on one service as a pilot. It emphasizes assigning clear roles including a Security Champion, selecting initial checks such as secret scanning with Gitleaks and dependency analysis, and converting scanner reports into actionable tasks with owners and deadlines. The plan covers the first eight weeks of setup, including baseline handling for legacy issues, automated blocking rules, and incident rehearsal exercises. Metrics recommended include time to first triage, age of open critical defects, and false positive rates, aligned with DORA indicators for release performance. The guidance draws on OWASP SAMM practices and stresses that security requirements must be integrated into daily workflows rather than added as extra gates.
Why Technically Strong CISOs Lose to Weaker Peers: The Hidden Role of Internal Politics
A new analysis from independent expert Andrey Biryukov explains why technically proficient CISOs frequently fail to secure budgets and executive support while less technical peers succeed. The core issue lies not in technical knowledge but in the ability to translate security risks into business language that resonates with CFOs, CEOs, and boards. Biryukov details how influence, rather than formal authority, determines whether security initiatives gain traction or stall in endless approvals. He emphasizes building coalitions in advance, crafting compelling narratives, and preparing concrete business cases that quantify revenue impact and regulatory exposure. The article also highlights common pitfalls such as relying on fear-based arguments or ignoring stakeholder KPIs. Ultimately, the piece argues that selling security internally is essential for any CISO who wants both resources and long-term survival in the role.
Bybit Restricts Transfers to Sanctioned Entities Including Lazarus Group and CryptoPro
Cryptocurrency exchange Bybit has notified users that transfers to or from entities on its Restricted Counterparties list are prohibited, regardless of amount or whether conducted directly or through intermediaries. The list includes the North Korean state-sponsored Lazarus group and Russian cryptographic software developer CryptoPro due to their presence on sanctions lists from the United States, European Union, and United Kingdom. Bybit will automatically reject outgoing transfers to listed counterparties and may freeze incoming funds from them or related addresses, with potential account suspension or closure for users involved. The exchange emphasizes that blockchain transparency allows tracing of funds without user confessions and reserves the right to block transactions even with counterparties not yet explicitly listed. These measures are embedded in Bybit's terms of service to ensure compliance with international sanctions regimes.