MFCs in Russia faced an influx of people wishing to abandon biometrics

In recent weeks, public service centers have faced a boom in demand for the service of refusing to collect and store biometric data. Tens of thousands of citizens across Russia lined up even before the opening of the MFC to write the appropriate applications. The reason was a message in messengers that a refusal to collect biometrics can be issued only until August 31, after which citizens will allegedly be forcibly photographed through ATM cameras and record their voice on the phone. Officials’ explanations about the fake, as well as that the legislation allows you to apply without time limits, did not help. Moreover, banks are really obliged to transfer face samples to the state Unified Biometric System by the end of September, while only Sberbank has accumulated data on 30 million people.

Citizens began to show increased demand for the service of refusing to collect and store biometric data from mid-August. Thus, the MFC of Bashkortostan called what is happening a hype, explaining that in July 5,000 “refuseniks” applied to the republican offices, and already 14,000 in August. In Dagestan, according to the head of the press service of the republican MFC, Elmira Huseynova, only By August 30, 11 thousand applications were accepted (against 4 thousand for the entire previous year 2023), including 5.4 thousand in Makhachkala. The MFC of Buryatia diplomatically reported that the load on the centers was “above average.” Since August 24, the MFC of Udmurtia has accepted 4.7 thousand applications. In the Amur region, only on August 28, 1.6 thousand “refuseniks” turned to the MFC. In the Irkutsk region, according to the local government, the work of a number of MFCs was practically paralyzed due to their influx.

Biometric personal data is a face image and a voice recording. Among the services currently available using biometrics are obtaining an electronic signature, access to government facilities, business centers, a contract for communication services, remote examinations, remote opening of accounts, loans and deposits, obtaining a fan card, authorization on “State Services”.

The reason for the excitement was the forwarded message in instant messengers that the “refusal” statement could allegedly be written only until August 31, after which they would allegedly start following the citizens who did not do this, forcibly photographing their faces through ATM cameras and recording their voices through calls from Rostelecom “.

In Nizhny Novgorod, citizens, mostly pensioners, lined up at the MFC in the city center for several days before it opened. One of the applicants told a Kommersant correspondent that he spent several hours waiting, having learned about the need to submit an application “from a neighbor”. In the MFC of Rostov-on-Don, the number of “refusal” applications for the month increased by more than 100 times: for example, by August 28, 11 thousand applications were collected. In Dagestan, according to Ms. Huseynova, the waiting time for an appointment at an MFC has increased to 40–50 minutes (against the maximum 20 minutes on “normal days”). “We had the same excitement during the announcement of mobilization for the service of obtaining a foreign passport,” she added.

The State Unified Biometric System (GIS EBS) was launched in 2018. In December 2022, President Vladimir Putin signed Law No. 572 on the operation of the EBS. All organizations that collect biometric data (apart from banks, for example, notaries) must transfer them to the state system, notifying their customers of the transfer of such information at least 30 days in advance. Sberbank, the largest in terms of the volume of biometrics collected on its own, as Kommersant previously reported, began to send out such notifications from June 22. At the same time, the bank assured that customers can refuse to transfer data – you just need to notify Sber about this.

It is noteworthy that from June 1, the rule of law No. 572 came into force, allowing citizens to submit applications “on refusal to collect and place biometric data” at the MFC. The rules and submission form were approved in March 2023 (Decree of the Government of the Russian Federation No. 478). So, the application must be submitted “on paper” along with the citizen’s passport and SNILS. In the MFC, in turn, they must issue a written confirmation to the “refusenik” and send the information to the EBS GIS within a day. At the same time, there are no reservations in the text of the law and the government decree that the acceptance of applications ends on August 31. “You can opt out at any time. Any reports about the time limit are unreliable, ”the Center for Biometric Technologies (CBT, acts as the operator of the EBS GIS) said. The Ministry of Digital Development of the Russian Federation has repeatedly emphasized that the delivery of biometric data was and remains voluntary. RBC noted that most often “refusal” applications are written by citizens whose biometric data is not at all in the databases.

Officials have spent the last week trying to refute rumors of a deadline for biometrics. So, in the press service of the centers of public services in Moscow, the “absence of restrictions and disseminated false information” was reported on August 26, and on the CBT website they published instructions on the refusal procedure on August 25. Nevertheless, on August 30, a Kommersant correspondent discovered a queue of 30–40 “refusenik” citizens at the MFC in the capital Belyaevo. However, the center staff sent them home, citing a non-working program. “I heard that it was a fake, but I didn’t understand it – it’s better to play it safe,” the applicant told a Kommersant correspondent in line at the Nizhny Novgorod MFC.

However, banks still have a deadline: by law, they must complete the transfer of biometric information to the EBS by September 30, 2023.

Positive Technologies information security consultant Aleksey Lukatsky previously estimated the number of entries in the EBS GIS at “hundreds of thousands”. Whereas Sberbank alone, according to the CBT, had 30 million biometric records. The total number of accumulated biometric samples in commercial systems, according to the CBT, could reach up to 75 million (these are exclusively face images).

According to Kommersant’s interlocutor, who is close to the Ministry of Digital Transformation and familiar with the procedure for transferring data to the CBT, out of 75 million casts collected by companies, primarily banks, there will be a “certain number” of non-unique, that is, duplicate casts. The procedure is as follows: companies first synchronize their databases with the Unified Identification and Authentication System (ESIA) of the public services portal to confirm the authenticity of data about the cast and its owner, as a result of the procedure, companies receive a unique identifier from the ESIA. The data is then transferred to the CBT. “It is now difficult to estimate exactly how many casts will be duplicated. The CBT will understand this in the process of receiving data from companies, but there will certainly be duplications, ”added the interlocutor of Kommersant.

The CBT said that you can delete previously registered biometrics in the “Biometrics” section in your account on the public services portal. The Kommersant correspondent has so far found both himself and his colleagues who handed over biometrics in one of the banks, the same signature in this section: “Biometric data is not registered.”

Alexander Voronov, Nikita Korolev; correspondent network “Kommersant”