Rospotrebnadzor and FAS to Extend Oversight to Websites: Automating Foreign Word Replacement Using LLM
Russian compliance specialists have created an automated system to help websites comply with Federal Law No. 168-FZ on protecting the Russian language ahead of expected enforcement actions by Rospotrebnadzor and the Federal Antimonopoly Service.
The law prohibits the use of foreign words when common Russian equivalents exist and bans both Latin script and transliterations written in Cyrillic. It requires identification of prohibited borrowings by comparing text against four official dictionaries approved by the Russian Academy of Sciences: orthographic, orthoepic, explanatory, and the dictionary of foreign words.
The developed microservice, named Normograph, implements a five-stage pipeline that significantly reduces the volume of text sent to the language model. First, HTML pages are cleaned of markup and tokenized. Second, primary filtering removes words present in normative dictionaries, user-defined white lists, and registered trademarks. Third, the system flags potential issues including words absent from dictionaries, known anglicisms, and Latin-script terms.
Only after these algorithmic filters does the LLM receive small relevant fragments. The model determines whether a word qualifies as an impermissible borrowing, considers context, and proposes accurate Russian synonyms that match in gender, number, and case. The pilot uses GigaChat API but the architecture allows easy substitution with other models such as YandexGPT.
An additional OCR module based on Yandex Cloud Vision extracts text from images collected by a crawler. The same multi-stage filter is applied to recognized text, with caching and size-based filtering to control costs. Logos and registered trademarks are automatically excluded from checks.
Testing showed that manual review of one page previously took about one hour, while the automated system reduces the process to between two and ten minutes. The solution is positioned as a corporate compliance tool for pharmaceutical, fintech, and large e-commerce platforms that must adapt hundreds of pages before regulatory inspections begin.
Related articles
T-Bank Masks New iOS Banking App as K8CHEN PRO to Bypass Sanctions
T-Bank has released a new version of its mobile banking application for iPhone users that appears in the App Store under the neutral name K8CHEN PRO. After installation and user authentication, the app automatically renames itself to 8PRO. The application is currently available for download in the Russian, Kazakh, Turkish, Georgian, and American App Store regions. T-Bank confirms the legitimacy of the release through a direct link published on its official website. The disguise is a direct response to repeated removals of official Russian financial apps from the App Store following the introduction of sanctions. Users are strongly advised to obtain the app exclusively via the official site link rather than searching the store, as fraudsters frequently clone banking applications to steal credentials.
Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication
A developer shared a detailed case study on building legally compliant user identification for Telegram Mini Apps targeting Russian audiences. Instead of relying solely on Telegram initData verification, the project routes authentication through established Russian providers including VK ID, Yandex ID and MAX. Identity is handled separately from message delivery channels, with telegram_id used only for notifications after account creation. The implementation employs OAuth 2.1 with PKCE for VK, OAuth 2.0 for Yandex, and deep links for MAX while enforcing short-lived cryptographic state values and HttpOnly session cookies. Additional measures include consent checkboxes required by Russian law and polling-based result delivery to support browser, WebView and extension environments. The same architecture was reused for Home Assistant smart-home login, demonstrating reusable separation of identity and channel concerns.
FSTEC Publishes 35-Point Network Perimeter Recommendations, Most Require No Spending
Russia's FSTEC released non-binding recommendations on protecting network perimeters on March 10, 2026, analyzing real-world intrusion vectors from external networks. The 35-point checklist spans eight sections covering device administration, DDoS resilience, segmentation, configuration backups, vulnerability management, authentication, logging, and incident response exercises. Only four items explicitly require purchasing new tools such as WAF, ZTNA, NAC, and SIEM, while five others depend on existing infrastructure. Twenty-six points can be addressed through policy, inventory, and configuration changes alone, including enforcing unique passwords, disabling legacy protocols like HTTP and SNMP v1/v2, and quarterly backup restoration tests. The document references Order 117 and earlier FSTEC methodologies on vulnerability handling, serving as a practical self-assessment questionnaire rather than a mandatory regulation. Analysts note that many organizations still fail to implement low-cost measures such as excluding remote administration interfaces from DMZ zones and verifying backup recoverability.
Compliant Telegram Mini App Authentication via Russian ID Providers in My Anti-Social Network Project
The project 'My Anti-Social Network' demonstrates a production-grade approach to Telegram Mini App authorization that meets Russian identification requirements by separating user identity from delivery channels. Instead of relying solely on Telegram initData verification, the system routes authentication through VK ID, Yandex ID, and MAX using OAuth 2.0 / 2.1 flows with PKCE. Sensitive tokens never reach the browser; the client receives only short-lived one-time codes exchanged for HttpOnly session cookies. The architecture supports multiple front-ends including PWA, browser extensions, and Home Assistant integration while maintaining cryptographic protections around state parameters and code verifiers. The solution was implemented for an aggregator delivering personalized news feeds through Telegram, MAX, VK bots, and voice assistants.