Without a doubt, the twenty-first century can be considered as the era of information accompanied by the worldwide computerization of society. But human civilization’s present dependence on communication technology has made individuals much more vulnerable due to the fact that modern societies represent themselves as fundamentally open and transparent structures. Although constantly developing and improving, information societies struggle to reduce all kinds of threats at a time when the number and intensity of such threats are constantly increasing (Tardy 2010). The information environment is not static, and as a result it faces obvious vulnerabilities and risks. Therefore numerous processes in global communication society are embedded in dialectical relationships of interdependence, relations that are complex and often contradictory.
 
Today’s world witnesses the parallel co-existence of two trends: the formation of large numbers of databases (“big data”) containing specific, discrete information, and at the same time, a torrent of irrelevant and doubtfully useful information.¹  The issue of reliability of received information has become even more urgent, while at the same time there is an overload of information flows involving harmful and prohibited data. The irregular, unbalanced, and rapidly changing character of information technology implementation has a further consequence—the generation of mistrust in the process of implementing e-government infrastructure and providing public and municipal services in electronic form.
 
Communication society in the context of globalization, based on a cross-border, “intercultural” concept² that results in the elevating anonymity in networks, in turn raises a fundamental problem regarding the identification and social construction of subjects. That is, the central subject of communication relations (Peña Acuña 2017)—a person or an identity—is subjected to serious challenges and threats. Hence, the state of its security needs special attention. The most important attributes of the personality in the modern global information world include a set of personal information, which cannot be reliably protected by technical and software means alone. Personal information of the individual will inevitably be accumulated and fixed in the internet environment (or digital space). It can be distorted and supplemented by false information that would harm the individual in terms of her or his reputation, image, breach of secrecy, and so forth. The person in the modern world is deprived of local protection in macro-scale environment with few and often contradictory national, linguistic, cultural, and even ethical boundaries.
 
Ideally, the interests of a person in the information sphere are to meet all his/her possible needs: to ensure the right to access information, to participate as a citizen in law-making activities through developments such as electronic democracy mechanisms, to obtain state and municipal services in electronic form, to secure protection through electronic justice mechanisms (e.g., an electronic system of appeal against court decisions, legal advice online through smartphone apps, electronic feedback forms, etc.), among others.

A Case Example from Russia

As one example, the development of digital financial services has transferred credit institutions' activities into the virtual environment. Since April 2017 the Russian State Duma (the Lower House of the Russian Parliament) has been advancing an initiative to create a legal framework for the use of a remote authentication and identification mechanism through which credit institutions will be able to open accounts to individuals (natural persons) via the Internet. The Draft Law “On amendments to the Federal Law about counteracting legalization (washing) of income gained in criminal conduct and about terrorism financing” also regulates the procedure for collection and transfer of personal data, including biometrics, into a single system—a Unified System of Identification and Authentication (USIA).  USIA is a system created and developed by the Russian Ministry of Communications within the e-government infrastructure in order to streamline and centralize the processes of registration, identification, authentication, and authorization of users.
 
According to the plan of the Russian parliamentarians, a citizen would need to come to the bank just once in order to provide personal data. Soon after that he or she will be able to open accounts without personal presence. The main condition to be satisfied by remote identification of the customer is verification that they are not involved in the legalization and laundering of proceeds from crime, including those derived from extremist or terrorist activities.  And it's not just about personal data. This initiative supports interactive remote authentication and identification by using citizen's biometrics. The pilot project of the mechanism for the law’s implementation is expected to be tested on a limited number of bank operations.

A range of important practical issues was revealed during the adoption stage of this draft law. First of all, the legislation’s agenda includes the establishment of 1) a mechanism or process for face and voice identification, 2) a system for protecting customer biometrics, and 3) the cost of the law’s implementation. The new law has generated widespread reaction that began during the second reading of the bill, involving an amendment according to which banks would be obliged to transfer biometric data of clients to the Russian Ministry of Internal Affairs and the Federal Security Service (FSS) for the sake of national defense, state security, law enforcement and counter-terrorism. The order to initiate this data transfer would be established by the government, yet the draft legislation does not indicate that the consent of banks’ clients is required for this transfer.

As for the problematic issue of creating full-fledged protection of individual bank clients’ biometric data, the law provides that encryption (cryptographic) technologies should be used for such information transfers via the Internet. In this way identification without personal presence is expected to ensure protection of transmitted data from security threats (Tardy 2010, Savenkov 2016).

The digital identification operator for the banking sector would be Rostelecom (Russian state universal telecom operator), which will create the so-called National Biometric Platform (NBP). At the same time, NBP is planned for use in medical, educational, and retail settings, in multifunctional and certification centers, and in departments of the Ministry of Internal Affairs. NBP is supposed to represent a set of specialized information and technological elements that enable the collection, processing, storage, allocation and compliance of biometric data. This platform would be located in the secure cloud infrastructure of “Rostelecom,” which would be accessed by banks through special communication channels of the System of Interdepartmental Electronic Interaction (SIEI).

Problems with the Proposed Data Law

In connection with these initiatives of the Russian parliamentarians, a number of “painful” points should be noted. The creation of remote authentication and identification mechanisms is aimed, according to the government's plan, at ensuring security by countering the financing of terrorism and the legalization (laundering) of proceeds from crime. This represents one side of the scale. On the other, we are witnessing the creation of opportunities for violation of our privacy, the danger of incomplete protection of the biometric data of bank customers, as well as the threat of its loss, theft, and free access. The obligation imposed on banks to transmit client biometric data to the Russian Ministry of Internal Affairs and the Federal Security Service may open up many opportunities for the abuse of such data.
 
There is a danger of repeating previous mistakes. For example, when studying the peculiarities of crimes in the banking sector committed using high technology (based on data from June 2016), we noted that Russia ranks second in the world in the number of information leaks in this sector. In 73 percent of cases, customers' personal data had been lost or stolen from Russian banks. As a result, more than 22.5 million personal data records have been leaked to the Internet.
 
The Russian banking system has more than enough problems without implementing the planned system of remote authentication and identification. Specialist-practitioners in the field of Internet banking and remote banking are right when they state that “the rapid development of Internet technologies does not allow us to predict all the strategic risks...” Considering that personal data security depends on the ability of users, technical systems, and online communication technologies to ensure confidentiality, integrity, and availability of personal data during their processing in personal data communication systems, the switch to a biometric data collection system as currently proposed seems a risk not worth taking. Yet the proposed Russian law is characteristic of worldwide trends toward digitalization of, and vulnerability of, identity in the 21^st century.