Russian Ministry of Transport Unveils Draft Rules for Centralized Passenger Data with Unique Per-Trip IDs
The Russian Ministry of Transport has released a draft order introducing updated procedures for maintaining centralized databases of personal data belonging to passengers and crew members across all transport modes.
Under the proposed rules, a unique identifier will be generated for every passenger and crew member on each specific trip. This code cannot be reassigned to another individual or reused on a subsequent journey and will accompany all recorded operations involving the ticket and the carriage itself.
The draft significantly broadens the list of operations that must be logged. In addition to existing requirements, authorities will now receive data on boarding cancellations, online check-in events, additions of passengers to group tickets, and removals from such tickets.
The regulation also mandates the inclusion of schedule information for both regular and charter services. This covers planned and actual flight or trip details, cancellations, and any schedule changes.
Personal data retention periods stay unchanged at seven years. Transmission deadlines remain the same: information about ticket purchases for air or rail travel must reach the system within 15 minutes, while data for road, sea, or river transport must arrive within 30 minutes. Crew data must be submitted no later than 24 hours before departure.
The draft includes detailed tables specifying the composition of data fields for each transport type and classifies operations as mandatory, conditionally mandatory, or exempt from transmission. If approved, the new order will supersede the current 2024 rules. Public discussion of the document continues until 29 August.
Related articles
Ozon Data Security Team Details Audit Framework to Eliminate Paper-Only Compliance
Alena, head of the Data Security group at Ozon, describes how the company built an internal audit process that focuses on actual risk reduction instead of producing lengthy formal reports. The team examines personal data, financial records, and other sensitive information across hundreds of microservices while checking role-based access, logging, encryption, and data flows. They analyzed more than 84,000 user-role pairs in one review and identified overly broad permissions on product tagging that could cause major financial losses. A notable case led to the removal of customer names, phones, and addresses from delivery boxes even though the practice was formally allowed under Federal Law 152-FZ. The group uses a scoring model based on data sensitivity, business importance, user count, and potential monetary impact to prioritize which systems to audit first. Additional criteria such as past incidents and critical information infrastructure status can be added to the model. The approach emphasizes real implementation of recommendations, cross-team communication, and hiring analysts who care deeply about practical security outcomes.
Microsoft to Make Passkeys Default Authentication in Entra ID Starting September 2026
Microsoft will transition Entra ID users to passkeys as the standard authentication method beginning September 1, 2026. The change aims to eliminate reliance on phishing-prone SMS and voice call codes. Existing SMS and voice users will be prompted to register passkeys during their next multifactor authentication. Passkeys rely on public-key cryptography and avoid shared secrets, blocking phishing, interception, credential reuse, and SIM swapping attacks. Support includes synced passkeys via iCloud Keychain and Google Password Manager, plus device-bound options like Microsoft Authenticator, Windows, and FIDO2 hardware keys. Native SMS and voice services will be fully retired on February 1, 2027, forcing affected tenants to adopt passkeys with no opt-out option.
Multiple Ozon Apps Removed from Google Play Following Sanctions on Ozon Bank
Several Ozon applications have been removed from the Google Play store, affecting Android users who can no longer download the main Ozon client along with Ozon Fresh, Ozon Seller, Ozon Job and Ozon Travel. Ozon stated that the company did not violate Google Play rules, yet the exact reasons for the removals remain undisclosed. The action follows the earlier disappearance of the Ozon Bank app after the bank was placed under European Union sanctions, although no official connection has been confirmed. Apple users continue to access Ozon services through the App Store, while Android users are directed to alternative stores including RuStore, AppGallery and Galaxy Store. The company also warned against downloading APK files from unverified sources due to security risks. The removals come amid a broader wave of app store purges that also affected Yandex Pay on the App Store. Already installed applications generally continue to function, but users may face difficulties with future updates and reinstalls.
Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support
A developer has released Ruthenium, a modified Chromium browser for Android that embeds the Russian Trusted Root CA certificate issued by the Ministry of Digital Development. The build restricts trust to .ru and .рф domains only, avoiding changes to the system-wide Android certificate store. The project patches four Chromium source files to include the root with DNS constraints via CertWithConstraints, disables Google sign-in by default, and removes XR-related code for successful compilation. Ruthenium uses the official Chromium TLS verification logic without introducing a custom verifier. The APK is distributed with SHA-256 checksums, build metadata, and reproducible release tags tied to the exact Chromium revision and certificate digest. Users can install it alongside stock Chrome and use it selectively for Russian government and banking sites that rely on the state root.