Rospotrebnadzor and FAS to Extend Oversight to Websites: Automating Foreign Word Replacement Using LLM
Russian compliance specialists have created an automated system to help websites comply with Federal Law No. 168-FZ on protecting the Russian language ahead of expected enforcement actions by Rospotrebnadzor and the Federal Antimonopoly Service.
The law prohibits the use of foreign words when common Russian equivalents exist and bans both Latin script and transliterations written in Cyrillic. It requires identification of prohibited borrowings by comparing text against four official dictionaries approved by the Russian Academy of Sciences: orthographic, orthoepic, explanatory, and the dictionary of foreign words.
The developed microservice, named Normograph, implements a five-stage pipeline that significantly reduces the volume of text sent to the language model. First, HTML pages are cleaned of markup and tokenized. Second, primary filtering removes words present in normative dictionaries, user-defined white lists, and registered trademarks. Third, the system flags potential issues including words absent from dictionaries, known anglicisms, and Latin-script terms.
Only after these algorithmic filters does the LLM receive small relevant fragments. The model determines whether a word qualifies as an impermissible borrowing, considers context, and proposes accurate Russian synonyms that match in gender, number, and case. The pilot uses GigaChat API but the architecture allows easy substitution with other models such as YandexGPT.
An additional OCR module based on Yandex Cloud Vision extracts text from images collected by a crawler. The same multi-stage filter is applied to recognized text, with caching and size-based filtering to control costs. Logos and registered trademarks are automatically excluded from checks.
Testing showed that manual review of one page previously took about one hour, while the automated system reduces the process to between two and ten minutes. The solution is positioned as a corporate compliance tool for pharmaceutical, fintech, and large e-commerce platforms that must adapt hundreds of pages before regulatory inspections begin.
Related articles
AKIT Requests Temporary Permission for Russian Companies to Transfer Personal Data Abroad After Data Center Incidents
The Association of Internet Trade Companies (AKIT) has sent a formal letter to Russian Prime Minister Mikhail Mishustin proposing a temporary exemption from strict data localization rules. The measure would allow affected companies to move critical systems and Russian citizens' personal data to data centers in friendly countries when domestic infrastructure is unavailable due to accidents or damage. Members including Ozon, Wildberries, Cooper, and Yandex Market argue that services must continue operating even if Russian facilities are compromised. The proposed special regime would apply only after an officially confirmed incident, require compliance with information security standards, and end no later than March 1, 2028. After recovery, companies would be required to return to normal data processing within Russia. Expert Alexey Muntyan noted that the mechanism activates only after incidents occur and questioned whether countries should be selected based on data protection levels rather than political alignment.
Anthropic Model Reconstructs NSA Seeds for NIST Elliptic Curves in Under 30 Minutes
An internal Anthropic research model traced the origins of the five seeds used by the NSA to generate the NIST elliptic curves P-192, P-224, P-256, P-384, and P-521. The discovery resolves a 25-year-old question that arose when the curves were standardized in FIPS 186-2 for ECDSA in 2000. Researchers combined analysis of 1990s random number generators, 34 generator-output combinations, and lattice reduction techniques to identify lrand48 initialized with Unix timestamps from May 1997 to April 1998. The P-256 seed corresponds to the 1842nd candidate from a run started on 16 August 1997, and example seeds from ANSI X9.62 follow the same pattern. The work does not demonstrate any cryptographic break or backdoor in the curves and does not recommend changes to production systems. Several questions remain open, including the seed for curve B-163 and the reason certain candidate values were discarded.
Bitget Bans Residents of Russia, Kazakhstan and Belarus, Sets Strict Deadlines for Position Closure and Asset Withdrawal
Cryptocurrency exchange Bitget has updated its user agreement to prohibit residents of Russia, Kazakhstan and Belarus from using its services. The changes took effect on 16 October, with affected users receiving individual notifications via email, the mobile app and push alerts. New trading, orders and subscriptions were disabled at 10:00 Moscow time on 18 October. Users must close all positions and withdraw assets by 10:00 Moscow time on 21 October, after which remaining positions will be liquidated automatically and account access will be restricted. The exchange has not disclosed the specific reason for the decision in its public statement. The move underscores how access to crypto platforms can be terminated by changes in terms of service rather than technical issues or user credentials.
Encrypt Don't Trust: Securing Palm Vein Biometrics from Sensor to Access Control Server
An in-depth technical analysis explores how to protect palm vein biometric data in access control systems using a security-by-design approach. The article emphasizes that biometric templates cannot be changed like passwords, making robust protection essential against physical theft, insider threats, and presentation attacks. It details the application of Zero Trust principles, minimizing the Trusted Computing Base, and implementing hardware roots of trust such as Secure Boot and encrypted non-volatile memory. Russian regulatory requirements including 152-FZ, Government Decree No. 1119 for data protection levels, FSTEC Order No. 21, and FSB Order No. 378 are mapped directly to technical controls like mTLS, OSDP v2.2, and liveness detection. Threat actor profiles ranging from external attackers to privileged insiders are analyzed with specific countermeasures for each segment of the data path. The piece concludes that trust must be compressed to the hardware root, server room, and dual-operator registration process while everything else relies on verifiable cryptography and auditing.