For almost a year a database containing the passport details of 16.5 million current and former residents of the Russian capital has been on sale. Under the current laws, those selling the data cannot be prosecuted, though serious questions remain as to where the information came from in the first place. Despite claims by the Interior Ministry that the database could have been compiled from several other sources available on the market, the InfoWatch analytical center is convinced that the data was leaked from state agencies.
According to the Russian business daily Vedomosti, staff from the Moscow Center for Economic Security (MCES) contacted the newspaper offering a new database named Larix – 10.0 Professional with the passport details of over 16 million current and former Moscow residents for $1,200. In fact, anyone who wants to purchase the database can do so on the MCES Web site at www.businessinfo.ru.
The database, which was released in June 2005, is described as containing 16.5 million records dating from May 2005. The recent offer made to the Vedomosti journalists is most likely an attempt to increase sales through media publicity. As well as the passport database MCES also sells a number of other information products that violate the privacy rights of Russians.
Though passport details are not considered a state secret, state agencies forbid their employees to sell such information to anyone. The law, however, does not prohibit the accumulation and distribution of information on other people, though it is highly unlikely that any organization other than the state passport service could have collected such a huge amount of data. Moreover, MCES has refused to name the source of their information, which suggests it was most probably leaked from a state body, which leaves some very important questions unanswered.
According to a representative of the Interior Ministry, the MCES database could have been put together using information from other sources such as traffic police databases, permits and so on. That theory is far-fetched to say the least, with experts at the InfoWatch analytical center fairly sure that the database was acquired illegally.
Despite the obvious lack of ethics surrounding the sale of passport details, MCES seems to have no doubts as to the legality of its activities. An announcement on the MCES site stresses that it has the relevant license permitting the sale of databases, which have reportedly been vetted by state bodies, including the Russian patent agency, and approved for sale.
The patent agency, however, says it has not registered the MCES's right to sell databases, and that in any case the agency only registers the basic right to sell and not the actual information contained in such databases.
“Society can do nothing with these shady salesmen until the law 'On personal data' is adopted. So, right now it is not a question of the legality of selling peoples' private details but how exactly those details were obtained. I'm certain that every professional salesmen of personal records has connections to insiders in the state agencies. This is where all the information is leaking from. In line with the current law, a crime occurs when a civil servant receives money for passing on a database and not when the information is sold. It will be very interesting to see what all these shady salesmen do when the law 'On personal data' comes into force," says Denis Zenkin, marketing director at InfoWatch.
The draft law “On personal data", proposed by the Russian Ministry for Information and Communications, should put an end to the ambiguity surrounding the sale of private information. The State Duma is due to examine the bill at a second reading later this month. Once the law is adopted the likes of MCES will have to gather written permission from all those people whose information features in any database that goes on sale, with the threat of lawsuits if they don't.
