{"id":54535,"date":"2019-12-28T00:00:00","date_gmt":"2019-12-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hishhnik-ili-zhertva-kto-zashhitit-udostoveryayushhie-tsentry"},"modified":"2020-02-18T14:02:33","modified_gmt":"2020-02-18T11:02:33","slug":"hishhnik-ili-zhertva-kto-zashhitit-udostoveryayushhie-tsentry","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/hishhnik-ili-zhertva-kto-zashhitit-udostoveryayushhie-tsentry","title":{"rendered":"Predator or prey? Who will protect the certification authorities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

What\u2019s happening?<\/h4>\n

\nThe topic of fraudulent activities committed using electronic signature certificates has gained widespread public attention recently. Federal media outlets have taken it upon themselves to periodically share alarming stories of instances of unlawful use of electronic signatures. The most common crime in this area is the registration of a legal entity or individual entrepreneur in the name of an unsuspecting Russian citizen. Another popular method of fraud involves transactions that alter property rights (this is when someone sells your apartment in your name without your knowledge).<\/p>\n

However, let\u2019s not get carried away with describing potential illegal activities with electronic signatures, so as not to provide creative ideas to fraudsters. Instead, let\u2019s try to understand why this issue has grown to such proportions, and what practical measures can be taken to eliminate it. For this, we need to clearly understand what certification authorities are, how they operate, and whether they are as frightening as the media and interested parties portray them.
\n<\/a><\/noindex><\/p>\n

Where do signatures come from?<\/h4>\n

\n\"Predator
\n
\nSo, you are a user. You need an electronic signature certificate. It doesn\u2019t matter what tasks you have or what your status is (corporation, individual, entrepreneur) \u2014 the process of obtaining a certificate is standard. You approach a certification authority with the aim of purchasing an electronic signature certificate.<\/p>\n

A certification authority is a company that Russian legislation imposes a number of strict requirements upon.<\/p>\n

To be authorized to issue a qualified electronic signature, a certification authority must undergo a special accreditation procedure with the Ministry of Digital Development. This accreditation process requires adherence to a series of stringent rules that not every company can meet.<\/p>\n

In particular, the certification authority must have a license granting it the right to engage in the development, production, and distribution of encryption (cryptographic) means, information, and telecommunication systems. This license is issued by the Federal Security Service after the applicant undergoes a series of rigorous checks.<\/p>\n

Employees of the certification authority must have higher education in the field of information technology or information security.<\/p>\n

The law also requires certification authorities (CAs) to insure their liability for \"damages caused to third parties due to their trust in the information specified in the electronic signature verification key certificate issued by such CA, or the information contained in the certificate registry maintained by such CA\" for an amount of at least 30 million rubles.<\/p>\n

As you can see, it's not that simple.<\/p>\n

Currently, there are about 500 CAs in the country authorized to issue qualified electronic signature certificates (QES). This includes not only private certification centers but also CAs associated with various government agencies (including the Federal Tax Service, the Ministry of Foreign Affairs, etc.), banks, and trading platforms, including state-owned ones.<\/p>\n

An electronic signature certificate is created using encryption algorithms certified by the FSB of Russia. It allows legal entities and individuals to exchange legally significant documents electronically. According to official CA data, most (95%) qualified electronic signatures are issued to legal entities, while the remainder goes to individuals.<\/p>\n

After you contact the CA, the following happens:<\/p>\n

    \n
  1. The CA verifies the identity of the person who applied for the electronic signature certificate;
    \nOnly after confirming the identity and checking all documents does the CA create and issue the certificate, which includes information about the certificate holder and their verification public key;<\/li>\n
  2. The CA manages the certificate's life cycle: it ensures its issuance, suspension (including at the request of the holder), renewal, and expiration termination.<\/li>\n
  3. Another function of the CA is service-oriented. Simply issuing a certificate isn't enough. Users regularly need various consultations on the issuance and use of the signature, advice on applying and choosing the type of certificate. Large CAs, such as the CA of the 'Business Network' company, provide technical support services, create various software, improve business processes, monitor changes in the fields where certificates are applied, etc. Competing with each other, CAs work on improving the quality of IT services, advancing this sector.<\/li>\n<\/ol>\n

    <\/p>\n

    The Cossack is indeed a spy!<\/h4>\n

    \n\"Predator
    \n
    \nLet's consider point 1 of the algorithm for obtaining an electronic signature mentioned above. What does it mean to \"verify the identity\" of a person requesting a certificate? It means that the individual whose name the certificate is issued under must personally appear either at the Certificate Authority (CA) office or at a designated issuance point that has a partnership agreement with the CA, and present original documents there, particularly a passport of a Russian citizen. In some cases, particularly regarding signatures for legal entities and individual entrepreneurs, the verification process is even more complex and requires additional documents.<\/p>\n

    It is precisely at this stage, that is, at the very beginning when the issuance of the certificate has not even reached the signature stage, where the main problem lies. The key word here is: \"passport.\"<\/p>\n

    The leak of personal data in the country has reached truly industrial proportions. There are online resources where you can get scanned copies of valid Russian passports for a small fee or even for free. And indeed, scanned passports in our country, burdened by the post-Soviet legacy of \"show your documents\", can be collected from citizens practically everywhere \u2014 not just in banks or other financial institutions, but also in hotels, schools, universities, railway and airline ticket offices, children's centers, and service points of mobile operators \u2014 everywhere a passport is required for service, which is virtually everywhere. With the development of digital technologies, this vast channel for accessing personal data has been exploited by those in the criminal sphere.<\/p>\n

    There are also very common \"services\" for stealing personal data from specific individuals.<\/p>\n

    In addition, there exists a whole army of so-called \"nominals\" \u2014 people, usually very young, or very poor and uneducated, or simply those who have fallen into despair, whom criminals promise a modest reward if they appear at the CA or a point of issuance with their passport and order a signature in their own name as, for example, the director of a company. It goes without saying that such a person has no real connection to the company's activities and cannot provide any actual assistance to the investigation once the scam is uncovered.<\/p>\n

    So, a passport scan is not an issue. But to authenticate, the original passport is required; how can this be, a keen reader might ask? To circumvent this problem, there are unscrupulous issuance points in the world. Despite a rigorous selection process, criminal characters occasionally obtain the status of an issuance point and subsequently engage in illegal activities with citizens' personal data.<\/p>\n

    These two factors combined lead to all the problems we currently face with the criminalization of using electronic signatures.<\/p>\n

    One in the field is not a warrior?<\/h4>\n

    \n\"Predator
    \n
    \nThis, without exaggeration, army of fraudsters is currently filtered only by certification centers. Every certification center has its own security services. Everyone who applies for a signature undergoes a thorough identity verification process. Those who wish to cooperate as an issuance point for a specific certification center are also carefully checked both at the stage of concluding a partnership agreement and subsequently during business interactions.<\/p>\n

    It cannot be otherwise, as negligent certification threatens the certification center with closure \u2014 the legislation in this area is strict.<\/p>\n

    However, it is impossible to cover everything, and some unscrupulous issuance points still 'leak' as partners to the certification centers. Moreover, there might be no reason for the 'nominal' to refuse the issuance of a certificate \u2014 after all, they apply to the certification center completely legally.<\/p>\n

    Additionally, in the event of a signature fraud involving a specific individual, only the certification center can help resolve the issue. In this situation, the certification center revokes the signature certificate, conducts an internal investigation to track the issuing chain of the certificate, and can provide the necessary documents to the court regarding fraudulent activities during the issuance of the electronic signature key. Only materials from the certification center can aid in resolving the case in favor of the genuinely affected party: the person whose name was fraudulently used to issue the signature.<\/p>\n

    However, overall digital illiteracy does not benefit the victims here either. Not everyone perseveres in protecting their interests. Nevertheless, illegal actions involving electronic signatures must be contested in court. And certification centers are the main support in this.<\/p>\n

    Eliminate all certification centers?<\/h4>\n

    \n\"Predator
    \n
    \nIn our country, it has been decided to make changes to the operation of certification centers and the requirements for them. A group of deputies and senators has developed a relevant draft law, which was even adopted by the State Duma in its first reading on November 7, 2019.<\/p>\n

    The document provides for a large-scale reform of the electronic signature certification system. In particular, it stipulates that legal entities and individual entrepreneurs (IE) will be able to obtain a qualified enhanced electronic signature (QES) only from the Federal Tax Service, while financial organizations can obtain it from the Central Bank. Accredited certification centers (CC), which currently issue electronic signatures, will only be able to issue them to individuals.<\/p>\n

    At the same time, the requirements for such certification centers are expected to be significantly tightened. The minimum size of the net assets of an accredited certification center must be increased from 7 million rubles to 1 billion rubles, and the minimum size of financial support must be increased from 30 million rubles to 200 million rubles. If a certification center has branches in at least two-thirds of the Russian regions, then the minimum size of net assets can be reduced to 500 million rubles.<\/p>\n

    The accreditation period for certification centers is reduced from five years to three years. Administrative liability is introduced for violations of the technical operations of certification centers.<\/p>\n

    All of this is supposed to reduce the amount of fraud with electronic signatures, believe the authors of the draft law.<\/p>\n

    What is the result?<\/h4>\n

    \n\"Predator
    \n
    \nAs can be easily seen, the new draft law does not address the problem of criminal use of documents of Russian citizens and the theft of personal data in any way. It does not matter whether the signature is issued by a certification center or the Federal Tax Service, the identity of the signature's owner will still need to be verified, and the draft law does not provide for any innovations on this issue. If an unscrupulous issuing point operated under criminal schemes for a regular certification center, what would stop it from doing the same for a government one?<\/p>\n

    The current version of the bill does not specify who will be held accountable for issuing an electronic signature certificate (UKEP) if this signature was used in fraudulent activities. Moreover, even the Criminal Code lacks an appropriate article that would allow for criminal liability for the issuance of an electronic signature certificate based on stolen personal data.<\/p>\n

    A separate issue is the overload of government certification authorities (U\u0426), which will inevitably arise under the new regulations, making the provision of services to individuals and legal entities very slow and complicated.<\/p>\n

    The service function of certification authorities is not addressed in the bill at all. Whether subscriber service departments will be created within the proposed large government certification authorities, how long this will take, and what material investments it will require, as well as who will handle customer support while such infrastructure is being developed, remains unclear. Clearly, the disappearance of competition in this sector could easily lead to stagnation in the industry.<\/p>\n

    In other words, we are facing the monopolization of the certification authority market by government structures, creating an overload of these entities, which will slow down all activities related to electronic document management (EDO), absence of support for end-users in cases of fraud, and the complete destruction of the current certification authority market along with the existing infrastructure (which accounts for about 15,000 jobs nationwide).<\/p>\n

    Who will suffer? Those who will be affected by the adoption of such a bill are the same as those currently suffering, namely, end-users and certification authorities.<\/p>\n

    A business thriving on identity theft will continue to flourish. Isn't it time for law enforcement and legislators to pay attention to this issue and adequately respond to the challenges of the digital age? The opportunities for stealing personal data and its subsequent criminal use have increased manifold over the last 10-15 years. The level of criminal preparation has also risen. It is essential to respond to this by implementing stringent penalties for any illegal actions involving others' personal data, both for companies and their employees as well as for private individuals. To truly address the issue of criminal use of electronic signature certificates, it is necessary to create a bill that would impose liability, including criminal liability, for such actions. Not a bill that merely redistributes financial flows, complicates the process for end users, and ultimately provides no protection for anyone.
    \n
    Source:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0427\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442? \u0422\u0435\u043c\u0430 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0441\u043e\u0432\u0435\u0440\u0448\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f. \u0424\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0421\u041c\u0418 \u0432\u0437\u044f\u043b\u0438 \u0441\u0435\u0431\u0435 \u0437\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u0441\u0442\u0440\u0430\u0448\u043d\u044b\u0435 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043e \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u043d\u0435\u043f\u0440\u0430\u0432\u043e\u043c\u0435\u0440\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u0421\u0430\u043c\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0435 \u0432 \u044d\u0442\u043e\u0439 \u0441\u0444\u0435\u0440\u0435 \u2013 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u044e\u0440. \u043b\u0438\u0446\u0430 \u0438\u043b\u0438 \u0418\u041f \u043d\u0430 \u0438\u043c\u044f \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0438\u043d\u0430 \u0420\u0424. \u0422\u0430\u043a\u0436\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-54535","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Predator or victim? Who will protect the certification authorities | ProHoster","description":"What's happening? The issue of fraudulent actions carried out using electronic signature certificates has garnered significant public attention recently.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/hishhnik-ili-zhertva-kto-zashhitit-udostoveryayushhie-tsentry","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0425\u0438\u0449\u043d\u0438\u043a \u0438\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430? \u041a\u0442\u043e \u0437\u0430\u0449\u0438\u0442\u0438\u0442 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0435 \u0446\u0435\u043d\u0442\u0440\u044b | ProHoster","og:description":"\u0427\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442? \u0422\u0435\u043c\u0430 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0441\u043e\u0432\u0435\u0440\u0448\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/hishhnik-ili-zhertva-kto-zashhitit-udostoveryayushhie-tsentry","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54535","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:45:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:03:57","updated":"2026-01-24 11:45:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=54535"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54535\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=54535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=54535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=54535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}