The main provisions of the doctrine of information security of the Russian Federation
The vision of the future at the state level is expressed in the creation of documents reflecting the official views and goals for the implementation of a strategically important concept. The changes that have taken place in recent years and have turned the world around them into a digital one have become the basis for the adoption of the Doctrine of information security of the Russian Federation. This document provides the basic guidelines for the implementation of a complex of legal, economic and organizational measures aimed at protecting Russia's positions in the world and ensuring information security.
Document acceptance and the needs of the time
The first edition of the Doctrine was published in 2000. It was created in the wake of the end of the 2nd Chechen war, increased terrorist threat, conflict with NTV, Russia's leading television channel, which categorically refuses to support state policy. As a result, threats relevant to the situation were included in the document on information security.
Foreign intelligence services, terrorist and criminal groups were named among the main subjects that threaten Russian sovereignty and information security. The information space was seen as one of the factors that enhance the manifestation of threats. Among the risks was the monopolization of information, the process of its creation and distribution by one person, which meant NTV.
16 years later, the Security Council developed a new version of the document on information security of the Russian Federation. It was approved by presidential decree on December 5, 2016 and entered into force the next day after signing. Digital reality is considered in it already as a space in which most communications, managerial influences and financial transactions take place.
In connection with the change in the meaning of information resources, their perception in the Doctrine of Information Security of the Russian Federation has also changed. It was recognized that information technologies contribute to economic growth and improve the quality of public administration, but at the same time become the basis for the active manifestation of threats. Among the subjects from which the main danger for the domestic and foreign policy and information infrastructure of Russia comes, there were also named individual states striving to dominate the international geopolitical and information arena.
Russia's interests
An essential part of the document is occupied by a detailed listing of the interests of countries in the digital world. The realization of these interests meets the needs not only of the state, but also of citizens and business. The interests are quite specific, their implementation is achievable with the help of information and organizational means at the disposal of state bodies.
It is important that from the concept of using only protection measures against attacks already being implemented, the developers of the Doctrine came to an understanding of the need to take preventive measures, which were supposed to provide complete protection against information attacks. In particular, these include the need to adopt international law instruments that would allow prosecution of foreign and cross-border authors of attacks.
Among the main provisions of the Doctrine, covering state interests, are named:
- protection of the rights and freedoms of the individual from any encroachments carried out using information means, including from attempts to violate the inviolability of private life, from attacks on property expressed in electronic form (non-cash funds on bank cards), the security of personal data;
- ensuring the protection and inviolability of critical objects of the information infrastructure from any types of encroachments committed with the use of information weapons;
- protection of the financial sector from any information attacks, ensuring sustainable economic development, reducing the level of any threats aimed at undermining economic stability;
- creating a sovereign Runet and strengthening control over the Russian sector of the Internet. At the time of the adoption of the Doctrine, the experts noted that this idea is difficult to implement, since it contradicts the cross-border concept of the world information network, nevertheless, the government is preparing a draft law on a sovereign Runet;
- complete autarchy in the field of creating software aimed at protecting information security, as well as components for the electronics industry.
Threats
The document names the types of information security threats that were identified by the Security Council during the preparation of the concept. Whereas in earlier versions the threats were private, now an attack on the foundations of the state structure was revealed. Attacks have become cross-border, it is almost impossible to identify the specific subject of the attack, all the more difficult to determine who exactly is behind the attack. For these purposes, the United States has implemented the practice of creating traps for hackers by simulating externally unprotected infrastructure objects and logging all hacker actions. In one case, attacks from the Chinese cyber war were identified.
In a changed world, the document describes the following threats:
- the desire of the governments of some countries to use the advantage in the field of information technology to organize attacks on critical infrastructure of the Russian Federation, and such attacks are clearly of a military-political nature;
- influence on international politics by foreign intelligence through information and psychological pressure on the citizens of the Russian Federation, aimed at undermining sovereignty, internal stability, initiation and escalation of religious and ethnic conflicts;
- undermining the country's reputation in the international arena, its deliberate deterioration, obstruction of the activities of Russian news agencies and media abroad.
A separate and significant threat is called a strong backwardness of Russia in the field of scientific research carried out in the field of information security, in the development of modern software products, in the production of components for the electronic industry. Among the reasons for the lag, the first place was given to the weak personnel potential. The weakness of the academic base, the lack of relevant scientific works were also noted.
Not all experts agreed with this point of view. Some noted that domestic software products are in many ways superior to Western ones. The concept of import substitution introduced under the Doctrine has significantly reduced the gap in the software sector, and in some sectors Russia comes to the fore, for example, in the production of DLP systems.
The financial and credit sector also suffers from information threats. The degree of protection of banking information systems is increasing, which increases the risks for enterprises. According to experts, in 2018, losses of Russian companies from information attacks exceeded 1.4 billion rubles. As part of the implementation of the Doctrine, FinCERT was created - a division of the Central Bank of the Russian Federation responsible for monitoring and protecting against computer attacks.
Purposes of Doctrine Adoption
The developers named the goals, the achievement of which is provided for in the Doctrine. They are not only informational in nature, each of them is global, consisting of several relevant sub-goals.
In the new version of the document, information threats are linked to the military. The solution of tasks related to information security, when they are referred to the military sphere, becomes to some extent easier, due to the high importance of defense issues for the whole society.
Taking into account this specificity, the goals of the adoption and implementation of the Doctrine are as follows:
- influence on international information security by participating in the development and adoption of fundamental international legal documents;
- exclusion of the possibility of encroachment on the information infrastructure that ensures the management of technological and production processes. Attempts to take over control of large enterprises, where an accident could lead at least to environmental problems, have already been recorded. The task of protecting this area from attacks is solved by the adoption of a law on critical infrastructure facilities and the development of methodological recommendations approved by orders of the FSTEC of the Russian Federation, which are designed to establish technical and organizational measures used for protection;
- uninterrupted functioning of all information infrastructure facilities, as well as power generation facilities. The possibility of being without communications or electricity can undermine the resilience of the economy;
- control over the image of Russia in the eyes of the international community, the ability to influence international information policy. Within the framework of this goal, there is a sub-goal of bringing to the international community reliable and complete information about Russia's position on all issues related to world security and socio-economic development. Here it is necessary to overcome the opposition of the Russian media, for example, Russia Today, to work abroad. Domestically, this goal is expressed in the desire to understand what is happening in the media, in the system of supervision of news aggregators, and in the adoption of a law on countering fake news;
- development of the digital technology and software industry, achievement of complete import substitution in this area, full national independence in these key industries;
- development of science and human resources in the field of information technology. Already, it is necessary to create more than a million jobs for qualified IT specialists.
International aspect
Despite the fact that the use of information resources in the field of international law and geopolitics is not allocated in a special section, many provisions of the Doctrine are devoted to this issue. The need to increase participation in the development of fundamental documents in the field of international information security was noted. Within the framework of the thesis about the insufficient participation of organizations uniting the world community in the regulation of this sphere, it is proposed to strengthen the role of the UN in developing the norms of international law regulating the field of information security.
Implementing its strategy in this area, Russia has developed a Convention on ensuring international information security, which is planned to be turned into a document of international law after the resistance of individual states has been overcome.
The document includes the following main provisions:
- modern threats arising in the information sphere are incompatible with ensuring world security, and they are realized not only in the military, but also in the social and economic spheres;
- the need to create a single information space in which all states could freely interact within the framework of protecting their and common interests, human rights and freedoms;
- the need for legal regulation of the sphere of international information security and scientific research carried out in it;
- recognition that the activities of all states in a single information space should be aimed only at global socio-economic development.
If the concept is accepted at the UN level, the level of threats arising in the information field may become less sensitive for each specific country. This task also lies in the mainstream of national interests.
Implementation and monitoring
There is no supplement to the Doctrine in the form of a schedule for the implementation of the tasks set in it. In practice, it is implemented through the implementation of separate assignments that each involved department receives. The implementation of such orders is monitored by the Security Council of the Russian Federation, the head of which prepares an annual report to the president.
In parallel with monitoring the implementation of the provisions of the Doctrine, monitoring of the implementation of other documents that also regulate the field of information security is carried out.
It:
- The main directions of state policy in the field of ensuring the safety of automated control systems by production processes of critical infrastructure facilities. The norms of this document, together with the norms of the Doctrine of Information Security of the Russian Federation, were embodied in the creation of the "GosSOPKA" system, which allows protecting all information systems of objects connected to it from computer attacks.
- Fundamentals of the state policy of the Russian Federation in the field of international information security until 2020.
- The main directions of scientific research in the field of information security in the Russian Federation. The document names all the problems existing in the field of scientific research: from the development of means to combat destructive information influences to the creation of new means of cryptographic protection of information - and the ways of their solution are indicated.
Responsible for the implementation of the provisions of each document:
- federal government bodies;
- business;
- scientific and educational institutions.
The well-coordinated work of all interested persons and bodies should lead to the implementation of the main provisions of the Doctrine of Information Security of the Russian Federation and ensure a high level of protection of the interests of the individual, society and the state. The time required for the full implementation of all provisions of the document has not been determined. It is assumed that it will take about 10 years, but the interests of the participants in the process of ensuring information security and protecting Russia's sovereignty are to ensure that the main provisions of the Doctrine are implemented as soon as possible.
