Starting on September 1, 2023, the FSB will gain round-the-clock access to user data collected by Yango, a Yandex-owned ride-hailing and delivery app also operating under the brand name Yandex Go. The order that will give Russia’s secret police extraordinary new powers of surveillance has already been signed by the country’s prime minister, Mikhail Mishustin, and this time it won’t be just the residents of Russia who come within the scope of surveillance, since Yango’s services are also available in Georgia, Armenia, Israel, Kazakhstan, Finland and 15 other countries where Yandex Go (Yango) operates, Russian media Meduza reports.
The source of the media publication said that all the data of taxi users is stored in Russia - in three data centers located in the Moscow, Ryazan and Vladimir regions. Another one is being built in Kaluga. The incoming information is duplicated in all data centers without division into trips within Russia and abroad.
Before the war in Ukraine, part of the data was also stored in the Finnish city of Mäntsälä. But three sources at Yandex confirmed that it no longer works. “We can’t possibly let NATO find out about Kremlin officials taking rides to strip clubs,” quips a source connected to Yandex’s corporate leadership.
Come September, the secret police will have unrestricted 24/7 access not only to information generated by their devices (IP addresses, device serial numbers, etc.), but also their user-generated data, including names, phone numbers, email addresses, bank accounts, user comments, and, of course, the addresses of their trips.
After receiving Meduza’s query about Russia’s plans to grant the FSB access to Yandex user data, the Finnish Data Protection Authority (DPA) ordered Yandex to suspend transferring Yango user data to its Russian servers between September 1 and November 30, 2023. The order also spotlighted a Dutch data processing company, Ridetech International B.V.: “The data protection authorities of Finland and Norway are cooperating closely with the Dutch Data Protection Authority,” said the DPA’s press release.
