To Native Clouds: Russian Companies Return Customer Data To The Russian Federation

According to the interviewed experts, many Internet resources owned by Russian legal entities that use foreign cloud platforms and hosting providers can be blocked and risk losing all stored user data. Fearing a blockade of their business, many Russian companies moved to Russian technical infrastructure in 2022. But not everyone did this, and more than 300,000 customers from Russia may start to have problems.

Why Cloud Platforms Are Needed

For the operation of any Internet services, a hardware infrastructure is required: this is hosting – a server space for storing multimedia data (video, photo, text, audio, etc.); СDN (content delivery network) – due to servers located in different parts of the country and the world, the loading of content from users is accelerated; DNS servers – a system that allows you to open sites in a browser by the domain name; DDoS protection service.

Many large companies have begun to refrain from using classic hosting in favor of cloud hosting. These are more advanced and flexible storage systems compared to classic hosting. They allow you to quickly increase and change various parameters, such as increasing disk space, bandwidth, etc.

Along with Russian hosting service providers, foreign ones, including American ones, have become widespread, offering all the necessary services to their customers simultaneously through cloud platforms. These include cloud hosting, DDoS protection, CDN, DNS, and more. Popular service providers include Amazon (USA), CloudFlare (USA), Akamai (USA) and Hetzner (Germany).

Problem Areas

Mikhail Shurygin, head of the Russian cloud platform EdgeCenter, spoke about some problems in the work of Russian clients with foreign cloud platforms at the end of last year at a meeting of the Board of Trustees of the Skolkovo Foundation. The event was attended by Deputy Chairman of the Security Council Dmitry Medvedev, Chairman of the State Development Corporation VEB: RF Igor Shuvalov and Head of the Ministry of Digital Development Maksut Sadayev.

At that meeting, Shurygin said that foreign platforms working with Russian citizens and organizations do not comply with the data storage requirements prescribed by the law “On Personal Data”, and the 21st order of the FSTEC regulates the security of personal data. Thus, foreign firms are in unequal competitive conditions.

To discuss all the problems cloud platform operators have, Shurygin suggested that Medvedev create a cloud market council under the Security Council.

“It was logical to create such a council under the Ministry of Digital Development. And if there are any difficult problems, I will always gather with my colleagues. Let’s do it,” Medvedev said, addressing Shadayev.

Also Read: Protection Of Personal Data With Encryption

Don’t Take It Personally

Since the start of the special military operation in Ukraine, numerous sanctions have been imposed against Russia. As a result, in March, many American and European companies began to refuse to provide services to Russian companies. The contract was broken in a day, and about another day, at best, was given to transfer data to another hosting. 

For example, at the end of October, Russian users began to complain en masse that they had received a letter from the German hoster Contabo, who announced the termination of the contract and offered to move to another hosting within seven days. If this is not done, then all data will be destroyed.

“I regret to inform you that we are currently terminating your contract with Contabo. Under the current circumstances, the cost and effort required to perform KYC checks have reached a level where we can no longer provide you with the opportunity to continue using the services. Please do not take this personally as it has nothing to do with you as a person,” the company said in a legal notice. They noted that if the user has citizenship of another country, you need to change this information in your account, and then the company will reconsider the decision to block.

One of the most popular companies in the world, CloudFlare, which provides cloud platform services, joined the sanctions in March.

Cloudflare CEO Matthew Prince said on March 7 that they have “developed a robust and comprehensive sanctions compliance program” and are also using third-party tools, including working with government experts inside and outside the US to search for the company’s customers or individuals under sanctions.

“We closed paid access to our network and systems in new regions under comprehensive sanctions. We have also terminated the activities of all clients that we know were associated with the sanctions, including clients associated with Russian financial institutions, Russian public impact companies, and the Russian-linked governments of Donetsk and Luhansk,” he said. 

Over the next few days, large Russian companies began to look for services to which they could move. 

According to Shurygin, in early March, the 12 largest Russian companies and hundreds of small companies and individuals who faced various problems came to them for help.

With someone who broke the contract and needed to move to a new cloud platform within a few days and transfer the data of hundreds of thousands of their customers without loss, others could not pay for foreign cloud hosting services since Russian bank cards stopped working abroad, explains Shurygin.

“We heard, including from our clients, that some foreign providers simply stopped working with Russian companies without warning, without the ability not only to pay and continue using the service but even without the ability to withdraw their data that the foreign supplier stored,” Shurygin said.

As a result, many had to restore the database from a backup (a system for archiving and backing up data in case of an unforeseen situation) if it was not stored on this hosting. Some companies tried to persuade hosting providers to allow them to take the data, but this, according to Shurygin, “was unsuccessful in almost all cases,” Therefore, they had to start doing business again. 

Problems with Russian clients with foreign cloud platforms and hosting spurred migration to similar Russian services. For example, according to Anton Savelyev, the Filanco hosting provider, the number of customers has grown, but only a little. In contrast, EdgeCentre has increased the growth of new customers by more than 300% compared to 2021.

Nevertheless, foreign cloud platforms continue to be used by many companies and individuals from Russia who were not affected by previous sanctions and who found a way to make payments in favour of foreign companies. According to the StatDom analytics system, over 300,000 domains in the RU, SU and RF zones are connected to foreign cloud platforms.

The eighth package of sanctions adopted in October 2022 imposes a ban on providing architectural and engineering services, IT consulting services, and legal advice for Russian companies. According to the document, a ban is introduced on the provision of consulting services related to “the installation of computer equipment, including services to assist customers in installing computer equipment and computer networks and consulting services for the implementation of software, including all services related to consulting services for the development and implementation of software”.

An interlocutor in the hosting market said that almost all commercial licenses for cloud platforms come with a certain amount of technical support obligations, which can be attributed to IT consulting. Thus, contracts with clients of foreign cloud services can be terminated. Shurygin agrees with these concerns, suggesting that foreign cloud platforms may begin to eliminate Russian customers with impunity under the pretext of “prevention assistance to circumvent sanctions.” Under such wording, it will be possible to block the work of any organization.

“Russian companies that use services (clouds, hosting and any other IT services) owned by European companies will at least lose the opportunity to contact technical support, as a result of which they will not even be able to collect data in the event of a failure, and companies may lose access to their data and services and will not even receive an answer about what happened. Judging by the description of the sanctions, which is somewhat vague, a European company can be punished for any consultation with a Russian company,” Shurygin said.

According to Arseny Shcheltsin, CEO of ANO Digital Platforms, Russian companies are better off playing it safe and moving to the infrastructure of domestic services.

“Russian services have more advantages over foreign ones, namely: they accept payments in rubles, including from Russian bank cards, obey the laws of Russia, and therefore, any conflict situations can be resolved in the Russian legal field. In addition, it is easier to negotiate with domestic companies, and they often meet customers’ needs,” said Shcheltsin.

Also Read: The Cloud As A Tool To Improve The Security And Reliability Of Information Systems