Developer Builds Decentralized Messenger to Navigate Russian Laws 149-FZ and 152-FZ
A solo developer has released Gram, a lightweight messenger built entirely alone using the $mol framework and HyperBaza technology. The application enables encrypted messaging without logins, passwords, or any personal data collection and is intended only for home or personal use.
The project serves as a practical case study of Russian Federal Law 149-FZ, which defines an instant messaging service organizer as any entity providing systems for exchanging electronic messages where the sender selects the recipient and no public information is hosted. The developer notes that Gram can function offline, does not guarantee instant delivery, and performs all decryption exclusively on user devices.
Key features include direct dialogs by known ID, creation of invite-only conversations, and public registries that users can join voluntarily. All correspondence is end-to-end encrypted via HyperBaza, while push notifications cannot access message content. A built-in proof-of-work mechanism requires CPU effort for each message to deter spam bots.
Under 152-FZ on personal data, the application collects nothing, so no obligations arise. However, 149-FZ obligations fall on whoever operates public HyperBaza nodes because those nodes handle message relay without decryption. The law explicitly exempts citizens acting for personal, family, or household needs, allowing private use but requiring public nodes to be disabled.
The application cannot technically satisfy several legal requirements: identifying users by phone number, providing decryption keys, or storing readable message content for six months. Source code is published on GitHub, and users outside Russian jurisdiction may run their own nodes on gh-pages or local instances.
Metadata such as sender, recipient, and timestamps remains visible on servers. Due to the decentralized architecture, revocation of access to old messages in group chats is impossible. A poll on the original post showed most respondents believe the public node operator would be considered the organizer of information distribution.
Related articles
Bitrix24 Releases Fully On-Premise BI Constructor for Regulated Enterprises
Bitrix24 has introduced a new delivery model for its BI Constructor that allows complete deployment inside a customer's own infrastructure. The update eliminates any requirement for external servers, cloud APIs, or internet connectivity, ensuring that all corporate data remains within the organization's closed perimeter. Previously, even the boxed version of the platform needed access to external infrastructure for updates and auxiliary services, creating conflicts with internal security policies and regulatory demands in highly regulated sectors. The new on-premise variant performs all data processing and storage exclusively on customer servers, giving organizations full control over access rights, backups, updates, and integration with internal protection tools. The solution is compatible with the boxed edition of Bitrix24 running on PostgreSQL and does not connect to external CDNs or cloud services. Bitrix24 expects strong interest from large enterprises and organizations handling restricted-access data that must stay inside the corporate network. Pilot implementations have already been completed, with broader customer pilots planned in the coming months.
Russia's Data Leak Penalties: 2.6 Million Rubles in Fines Despite 1.58 Billion Records Exposed in 2025
Russia introduced turnover-based fines for personal data leaks through Federal Law 420-FZ in late 2024, fundamentally altering the economics of information security investments. Over the first 18 months, Roskomnadzor opened 52 administrative investigations and issued 40 protocols totaling just 2.6 million rubles in penalties, with zero turnover fines applied. This occurred against a backdrop of 1.58 billion compromised records in 2025 alone. Public data leaks dropped fourfold in the first half of 2026, yet trading activity on underground forums rose nearly 60 percent as operators shifted to private sales. The law now ties penalties directly to the number of affected individuals and adds a turnover component for repeat violations under Article 13.11 of the Code of Administrative Offenses. Analysts note that the mere threat of larger fines has prompted companies to reassess data retention policies and risk models even without actual enforcement precedents.
Russia Authorizes Temporary State Takeover of Unprotected Critical Infrastructure
President Vladimir Putin has signed a decree that empowers the Russian government to appoint temporary managers for critical infrastructure facilities whose owners have failed to ensure adequate security. The measure directly targets operators of objects classified as critical infrastructure who have not met protection requirements. Under the new rules, the state can intervene by installing an interim administrator to oversee operations until security standards are satisfied. This approach aims to prevent potential disruptions or threats arising from insufficiently defended assets. The decree provides a legal mechanism for rapid governmental response without permanent nationalization of the facilities. It reflects ongoing efforts to strengthen oversight of sectors deemed essential to national security and stability.
Microsoft Removes Reinstallation Requirement for Enabling Smart App Control in Windows 11
Microsoft has eliminated the primary restriction on Smart App Control, allowing home users to activate or reactivate the Windows 11 security feature without performing a clean installation of the operating system. Previously, toggling the setting effectively required users to reinstall the entire system. Smart App Control leverages Microsoft's cloud-based reputation system and analyzes digital signatures to block suspicious, potentially dangerous, or unsigned files before execution. The toggle is now accessible through Windows Security under App & browser control. The update is being rolled out gradually via Windows 11 updates, though users who have disabled optional diagnostic data may still need a reset or reinstallation. The feature can interfere with developers and enterprise users working with rare or unsigned tools, as there is no option to whitelist individual blocked applications.