This wording raises a number of questions
Posted: Sat Feb 08, 2025 3:58 am
What needs to be clarified or changed
The draft decree states that owners of critical information infrastructure must audit their software and equipment, and foreign products can only be used if they have no analogues in domestic registries. At the same time, Russian organizations that are not under the direct or indirect control of foreign companies or individuals must be responsible for technical support and modernization of software and equipment.
How should an audit be conducted? What is meant by analogues? The term “preferential use” is also unclear. Experts point out that clarifications will significantly reduce the number of conflict situations.
Dmitry Burlakov believes that one of the main provisions of the import substitution concept is the definition of criteria for the presence or absence of domestic analogues of imported products. Anton Lensky agrees with him, also pointing out that clear wording is certainly important, as in any regulatory legal act. If there is no precise definition of what is considered a Russian analogue of a foreign IT product for conducting a critical information infrastructure audit, then there will be the possibility of various interpretations of the definition.
Clear criteria are also necessary to overcome the belarus mobile database pointed out by Andrey Volkov, head of the trusted platform development department at Aladdin R.D.: “Here, a huge niche is emerging for all sorts of businessmen offering a ‘domestic’ product, but bearing virtually no costs for its creation and development. How much better will a ‘Russified’ Chinese third-tier router be than a Cisco or Juniper product? Is it fair to give preferences to a company that renames Linux or LibreOffice and is not even capable of providing high-quality support for its product? Where does the money that the state wanted to give to real domestic developers in the form of benefits and subsidies end up? I think that in this situation, both critical information infrastructure operators and domestic developers will only lose.”
But Nikita Shablykov believes that "there is a fairly clear definition of Russian software, it is fixed in the register of domestic software. I think it can be used as a guide."
The draft decree states that owners of critical information infrastructure must audit their software and equipment, and foreign products can only be used if they have no analogues in domestic registries. At the same time, Russian organizations that are not under the direct or indirect control of foreign companies or individuals must be responsible for technical support and modernization of software and equipment.
How should an audit be conducted? What is meant by analogues? The term “preferential use” is also unclear. Experts point out that clarifications will significantly reduce the number of conflict situations.
Dmitry Burlakov believes that one of the main provisions of the import substitution concept is the definition of criteria for the presence or absence of domestic analogues of imported products. Anton Lensky agrees with him, also pointing out that clear wording is certainly important, as in any regulatory legal act. If there is no precise definition of what is considered a Russian analogue of a foreign IT product for conducting a critical information infrastructure audit, then there will be the possibility of various interpretations of the definition.
Clear criteria are also necessary to overcome the belarus mobile database pointed out by Andrey Volkov, head of the trusted platform development department at Aladdin R.D.: “Here, a huge niche is emerging for all sorts of businessmen offering a ‘domestic’ product, but bearing virtually no costs for its creation and development. How much better will a ‘Russified’ Chinese third-tier router be than a Cisco or Juniper product? Is it fair to give preferences to a company that renames Linux or LibreOffice and is not even capable of providing high-quality support for its product? Where does the money that the state wanted to give to real domestic developers in the form of benefits and subsidies end up? I think that in this situation, both critical information infrastructure operators and domestic developers will only lose.”
But Nikita Shablykov believes that "there is a fairly clear definition of Russian software, it is fixed in the register of domestic software. I think it can be used as a guide."