The State Duma will reject the bill on cyber protection of educational institutions

The State Duma will most likely reject the bill of the Kurultai of Bashkiria on strengthening cyber protection measures in schools, universities and social institutions. To achieve this, it was proposed to amend the law “On the Security of Critical Information Infrastructure of the Russian Federation”, establishing a special status for systems in educational and social institutions. The initiative received negative feedback from relevant Duma committees and the Russian government, whose representatives indicated that such a measure would require the allocation of significant additional funding from the federal and regional budgets.

The State Duma will reject the bill on protecting the information systems of educational and social institutions from hacker attacks, developed by the Kurultai of Bashkiria. Amendments to the Federal Law “On the Security of Critical Information Infrastructure of the Russian Federation” were sent to the State Duma in June 2023. The authors of the initiative proposed changes to the list of subjects of critical information infrastructure. The latter include government bodies and institutions, owners and operators of information systems in the field of healthcare, science, transport, energy, banking, defense, rocket and space and others. It was also proposed to include the objects of “social security” and “education”.

“The change will make it possible to extend to the spheres of education and social security a set of measures that are used by the state to protect critical information infrastructure,” says the explanatory note to the bill. The authors assured that the implementation of these measures would not require additional budget funding.

However, the head of the State Duma Committee on Information Policy, Information Technologies and Communications, Alexander Khinshtein, in his response to the bill, noted that strengthening cybersecurity in educational organizations, which include preschool kindergartens, schools, vocational schools, universities and others, will require additional funding from the federal and regional budgets. In addition, the authors of the bill did not attach to the document calculations of possible damage from computer attacks. And the State Duma Committee on Security and Anti-Corruption pointed out the unsettled issues of financing the purchase of technical equipment to ensure the security of facilities whose infrastructure is proposed to be considered critical. The classification of information systems as such “should be based on the social, political, economic and environmental significance of the object, as well as its significance for ensuring defense, national security and law and order,” the document notes. The bill also received negative feedback from the Russian government. The State Duma was recommended to reject it during its consideration, which is expected to take place on February 20.

The Kurultai of Bashkiria did not comment on the decision of the Duma committees.

Director of Komrunet (specializing in the protection of computer information) Fedor Petrushenko confirmed in a conversation with Kommersant that the implementation of the initiative would require serious funding and the participation of a large number of specialists, who are now in short supply on the labor market. “Critical infrastructure is one whose violation systemically affects the functioning of society,” he explained. “It is clear that schools and kindergartens are important. But if the school does not work for one, two, three days, nothing will happen. If the banking, energy or telecommunications system does not work for three days, social collapse will occur,” he explained. The founder of Ovodov cybersecurity, Alexander Ovodov, agrees with him: “Currently, schools do not fully comply with the requirements for the protection of personal data, and it is necessary not to strengthen the requirements, but to provide funding and resources to fulfill the existing ones.”

Natalya Balykova, Ufa