Yandex and MegaFon: find all SMS

It is clear that not all, but even eight and a half thousand messages sent from the site and "leaked" to the Internet make you think. Whatever the technical reasons and whoever is declared a "switchman", the conclusion is obvious: the Internet space is very vulnerable, and search robots are merciless and do not forgive mistakes. Think about what and where you write, this is the only guaranteed way to avoid trouble.

SMS leaked to the Internet

On Monday, July 18, in the afternoon, the forums began to discuss the texts of SMS messages “published” on the Internet sent from the MegaFon website. The search request, built in a certain way, produced 8750 results, of which, according to the operator, about eight thousand were real SMS messages along with the recipients' phone numbers. By two or three o'clock in the afternoon, the Internet community was already seething, the cherished link spread through the Twitter forums and the topic became the most discussed in Runet. The screenshot of the third page (see above) quickly bypassed all online media and the process became unmanageable.

As expected, there were plenty of fans to dig into someone else's underwear. SMS messages were read, tweeted, retweeted, and retweeted. I even saw the phrase “read all day today” on the forum. The hashtag #Megafon has turned into an all-Russian rubbish heap, in which fans of this kind of “literature” dug with rapture until late in the evening.

Further - worse. Of course, there were craftsmen who carefully collected and sorted all the messages into Excel files with their "innate" convenient search scheme. It was, one might say, the final chord in this short but stormy story. According to some estimates, about one and a half thousand messages managed to “spread out” on the Internet in one form or another, they could not or did not manage to pull out more from the Yandex search engine. About three hours passed from the moment a wide discussion began to the blocking of the display of SMS sent by Yandex, which is a very long time for the Internet space. Apparently, for such situations, it is time to develop some kind of emergency response schemes. To first quickly eliminate the consequences of technical mistakes, and then slowly figure out who is to blame and how this could happen.

MegaFon's official comment:

“In the process of interaction between the operator’s website and Yandex Internet services, a technical failure occurred, as a result of which a certain number of customer messages sent through the MegaFon website got into the Yandex search database. The problem was localized by technical specialists and quickly fixed. We emphasize that the failure did not affect client SMS messages sent via phones and other mobile devices. For comparison, the problem affected about 8,000 messages, while about 2 million SMS messages pass through the MegaFon network every hour, and all of them are securely protected.

Please note that information about the content of customer SMS messages is not stored on the operator's website. Thus, unauthorized access to the texts of our clients' messages could have occurred through some Yandex Internet services. This information did not fall into any other search engines.

From the numerous discussions and comments of experts, it can be assumed that there was no file on the operator's website that prohibited the indexing of messages. And, perhaps, the Yandex-toolbar installed in many browsers played a certain role. However, the technical details are of interest to specialists. For subscribers and users of the service, it is important that the SMS messages sent from the official website of the operator are in the public domain, and in any case, the operator is primarily responsible for this.

Legal field

Mistakes were, are and will be, it is inevitable. The trouble is that Internet manuscripts are extremely fire resistant and can be aged for years in order to materialize in all its glory at the most inopportune moment. SMS-correspondence is not a public forum, the content of letters is not subject to wide publicity in any case, and limited access to this information can only be obtained by a court decision or as part of operational-search activities (SORM system). It is the responsibility of the operator to ensure the confidentiality of correspondence, this is enshrined in Article 63 of the Communications Law:

  1. On the territory of the Russian Federation, the secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is guaranteed.
    Restriction of the right to secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is allowed only in cases provided for by federal laws.
  2. Communication operators have an obligation to ensure that communication secrecy is respected.
  3. Inspection of postal items by persons who are not authorized employees of the telecom operator, opening of postal items, examination of attachments, familiarization with information and documentary correspondence transmitted over telecommunication networks and postal networks, are carried out only on the basis of a court decision, with the exception of cases established by federal laws.
  4. Information about messages transmitted over telecommunication networks and postal networks, about postal items and postal money orders, as well as these messages themselves, postal items and money transfers can be issued only to senders and recipients or their authorized representatives, unless otherwise provided by federal laws.

The obligation of the telecom operator to maintain the secrecy of communication begins from the moment when the message is at the disposal of the operator, regardless of the form of its transmission. This means that the telecom operator, for example, cannot invoke the impossibility of ensuring the secrecy of communications in cases where the form of postal items is open.

Also, Article 138 of the Criminal Code clearly speaks of the consequences of violating the secrecy of correspondence, quote:

“Article 138. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other messages

  1. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other communications of citizens, - one hundred and eighty hours, or corrective labor for up to one year. »

It is not surprising that the event was taken seriously by the authorities. Quote from Lenta.ru message:

“The Investigative Committee of the Russian Federation will check how the text messages sent from the website of the Megafon company to its subscribers got into the public domain, RIA Novosti reports. According to the representative of the RF IC Vladimir Markin, the head of the committee, Alexander Bastrykin, gave the corresponding order to his subordinates.

Based on the results of the audit, the issue of initiating a criminal case will be decided. Representatives of the Consumers Union of Russia have already announced their intention to file a lawsuit against Megafon, Interfax reports. The chairman of the organization, Petr Shelishch, called the incident "an obvious violation of the requirements of the consumer protection law."

Shelishch explained that if the Consumer Union wins a lawsuit in defense of an indefinite circle of consumers, then all subscribers affected by the data breach will be able to claim compensation for moral damages or other losses through the district court.

. Representatives of the company explained that the messages were made public due to the lack of a robots.txt file on the website www.sendsms.megafon.ru, which contains instructions for search robots. Thus, search engines could index messages sent by users through the site. Representatives of the Megafon company emphasized that the leak affected only part of the messages sent from the site.

Roskomnadzor also did not stay away from the event, seeing in it a violation of the legislation on communications and, possibly, a violation of the law on personal data. This was reported to Interfax by Roskomnadzor representative Mikhail Vorobyov. Currently, Roskomnadzor specialists are analyzing the information received and finding out whether it is possible to identify personal data subjects based on the information that has appeared in the public domain.

Consequences

It is too early to talk about administrative and criminal consequences for the operator. But the damage to the image is serious, that's for sure. As for you and me, this is an extremely sad event for those directly involved and a good lesson for others. Surely some SMS contained very “sensitive” personal information, some messages could contain passwords, logins, credit card numbers, etc. SMS is a convenient channel for transmitting information that is difficult to dictate and write down from a voice without errors. You can talk for a long time about the ethics of reading and the subsequent distribution of other people's messages, but there are people without moral brakes among us, you can't get away from this fact. And among the tens of thousands of "readers" there will easily be a hundred or one and a half unkind jokers who will enjoy mocking the innocent recipients of published messages.

Indirectly, content scammers who distribute their Trojan-filled "programs" for smartphones will turn out to be "profitable". To date, once numerous Internet resources that offer "reading other people's SMS" have managed to fade and lose popularity, but in connection with these events, a surge in the activity of scammers is almost guaranteed. The media replicated this story and put into the heads of millions of readers / viewers the fact that other people's SMS messages can be read on the Internet. The field is plowed and sown, you can reanimate fraudulent sites and harvest.

Water circles

In the wake of what happened, other interesting details began to surface, also related to sending SMS messages over the Internet. The Perm portal, which provides a service for free sending SMS messages to mobile phones of all operators in the Perm Territory, has fallen under the distribution. All sent messages, regardless of the recipient's operator, were perfectly indexed by the same wonderful Yandex.

True, not as impressive as in the case of the MegaFon website and the "issuance" of results in the form of a message feed. To read messages sent from the Perm site, each link had to be opened separately. But we will not engage in a comparative analysis of the taste qualities of radish and horseradish, the senders of messages are not laughing. Sit now and remember to whom you sent what and who now owns this information.

On this occasion, MTS has already managed to respond with an informational message, quote:

". due to numerous requests to Children's Clothing in Ghana about the situation with sending messages from the Perm site www.prm.ru, I would like to note that:

MTS has no agreements with www.prm.ru on the organization of sending free SMS messages from this site, and is not responsible for the site's actions to ensure the confidentiality of information sent through the site. Please note that the user agreement on the site www.prm.ru states that:

“The information and service portal PRM.RU is not responsible for maintaining the confidentiality and integrity of the message, for delivering it to the addressee, as well as for possible losses or damage (direct or indirect) that may occur in connection with the use of this service”< /p>

Preliminary summary

As for the Perm site, I can only repeat the proverb about the location of free cheese. Any gateways, programs and sites for sending free SMS should definitely not be considered as a reliable transport for transferring confidential information. Maximum - for everyday chatter on the topic "warm up dinner, I'll be there soon."

As for the situation with the MegaFon website, the conclusions will be drawn and the “holes” will be closed, this is understandable. Although already affected by this is not easier. The question is where and who will have a hole next time, the age of information technology has not canceled simple human sloppiness. It remains to be advised to use SMS from the phone for more or less important and / or confidential information, the risk is incomparably smaller. Yes, and once again to remind that the text typed on the Internet begins to live its own, sometimes unpredictable, life. Probably, even anonymously it is not worth writing on the net what it would be embarrassing to show to friends, relatives and loved ones. Online manuscripts do not burn.

Yandex and MegaFon: find all SMS

It is clear that not all, but even eight and a half thousand messages sent from the site and "leaked" to the Internet make you think. Whatever the technical reasons and whoever is declared a "switchman", the conclusion is obvious: the Internet space is very vulnerable, and search robots are merciless and do not forgive mistakes. Think about what and where you write, this is the only guaranteed way to avoid trouble.

SMS leaked to the Internet

On Monday, July 18, in the afternoon, the forums began to discuss the texts of SMS messages "published" on the Internet, sent from the MegaFon website. The search query, built in a certain way, produced 8750 results, of which, according to the operator, about eight thousand were real SMS messages along with the recipients' phone numbers. By two or three o'clock in the afternoon, the Internet community was already seething, the treasured link spread through the Twitter forums and the topic became the most discussed in Runet. The screenshot of the third page (see above) quickly bypassed all online media and the process became unmanageable.

As expected, there were plenty of fans to dig into someone else's underwear. SMS messages were read, tweeted, retweeted, and retweeted. I even saw the phrase “read all day today” on the forum. The hashtag #Megafon has turned into an all-Russian rubbish heap, in which fans of this kind of “literature” dug with rapture until late in the evening.

Further - worse. Of course, there were craftsmen who carefully collected and sorted all the messages into Excel files with their "innate" convenient search scheme. It was, one might say, the final chord in this short but stormy story. According to some estimates, about one and a half thousand messages managed to “spread out” on the Internet in one form or another, they could not or did not manage to pull out more from the Yandex search engine. About three hours passed from the moment a wide discussion began to the blocking of the display of SMS sent by Yandex, which is a very long time for the Internet space. Apparently, for such situations, it is time to develop some kind of emergency response schemes. To first quickly eliminate the consequences of technical mistakes, and then slowly figure out who is to blame and how this could happen.

MegaFon's official comment:

“In the process of interaction between the operator’s website and Yandex Internet services, a technical failure occurred, as a result of which a certain number of customer messages sent through the MegaFon website got into the Yandex search database. The problem was localized by technical specialists and quickly fixed. We emphasize that the failure did not affect client SMS messages sent via phones and other mobile devices. For comparison, the problem affected about 8,000 messages, while about 2 million SMS messages pass through the MegaFon network every hour, and all of them are securely protected.

Please note that information about the content of customer SMS messages is not stored on the operator's website. Thus, unauthorized access to the texts of our clients' messages could have occurred through some Yandex Internet services. This information did not fall into any other search engines.

From the numerous discussions and comments of experts, it can be assumed that there was no file on the operator's website that prohibited the indexing of messages. And, perhaps, the Yandex-toolbar installed in many browsers played a certain role. However, the technical details are of interest to specialists. For subscribers and users of the service, it is important that the SMS messages sent from the official website of the operator are in the public domain, and in any case, the operator is primarily responsible for this.

Legal field

Mistakes were, are and will be, it is inevitable. The trouble is that Internet manuscripts are extremely fire resistant and can be aged for years in order to materialize in all its glory at the most inopportune moment. SMS-correspondence is not a public forum, the content of letters is not subject to wide publicity in any case, and limited access to this information can only be obtained by a court decision or as part of operational-search activities (SORM system). It is the responsibility of the operator to ensure the confidentiality of correspondence, this is enshrined in Article 63 of the Communications Law:

  1. On the territory of the Russian Federation, the secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is guaranteed.
    Restriction of the right to secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is allowed only in cases provided for by federal laws.
  2. Communication operators have an obligation to ensure that communication secrecy is respected.
  3. Inspection of postal items by persons who are not authorized employees of the telecom operator, opening of postal items, examination of attachments, familiarization with information and documentary correspondence transmitted over telecommunication networks and postal networks, are carried out only on the basis of a court decision, with the exception of cases established by federal laws.
  4. Information about messages transmitted over telecommunication networks and postal networks, about postal items and postal money orders, as well as these messages themselves, postal items and money transfers can be issued only to senders and recipients or their authorized representatives, unless otherwise provided by federal laws.

The obligation of the telecom operator to maintain the secrecy of communication begins from the moment when the message is at the disposal of the operator, regardless of the form of its transmission. This means that the telecom operator, for example, cannot invoke the impossibility of ensuring the secrecy of communications in cases where the form of postal items is open.

Also, Article 138 of the Criminal Code clearly speaks of the consequences of violating the secrecy of correspondence, quote:

“Article 138. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other messages

  1. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other communications of citizens, - one hundred and eighty hours, or corrective labor for up to one year. »

It is not surprising that the event was taken seriously by the authorities. Quote from Lenta.ru message:

“The Investigative Committee of the Russian Federation will check how the text messages sent from the website of the Megafon company to its subscribers got into the public domain, RIA Novosti reports. According to the representative of the RF IC Vladimir Markin, the head of the committee, Alexander Bastrykin, gave the corresponding order to his subordinates.

According to the results of the audit, the issue of initiating a criminal case will be decided. Representatives of the Consumers Union of Russia have already announced their intention to file a lawsuit against Megafon, Interfax reports. The chairman of the organization, Petr Shelishch, called the incident "an obvious violation of the requirements of the consumer protection law."

Shelishch explained that if the Consumer Union wins a lawsuit in defense of an indefinite circle of consumers, then all subscribers affected by the data breach will be able to claim compensation for moral damages or other losses through the district court.

. Representatives of the company explained that the messages were made public due to the lack of a robots.txt file on the website www.sendsms.megafon.ru, which contains instructions for search robots. Thus, search engines could index messages sent by users through the site. Representatives of the Megafon company emphasized that the leak affected only part of the messages sent from the site.

Roskomnadzor also did not stand aside from the event, seeing in it a violation of the legislation on communications and, possibly, a violation of the law on personal data. This was reported to Interfax by Roskomnadzor representative Mikhail Vorobyov. Currently, Roskomnadzor specialists are analyzing the information received and finding out whether it is possible to identify personal data subjects based on the information that has appeared in the public domain.

Consequences

It is too early to talk about administrative and criminal consequences for the operator. But the damage to the image is serious, that's for sure. As for you and me, this is an extremely sad event for those directly involved and a good lesson for others. Surely some SMS contained very “sensitive” personal information, some messages could contain passwords, logins, credit card numbers, etc. SMS is a convenient channel for transmitting information that is difficult to dictate and write down from a voice without errors. You can talk for a long time about the ethics of reading and the subsequent distribution of other people's messages, but there are people without moral brakes among us, you can't get away from this fact. And among the tens of thousands of "readers" there will easily be a hundred or one and a half unkind jokers who will enjoy mocking the innocent recipients of published messages.

Indirectly, content scammers who distribute their Trojan-filled "programs" for smartphones will turn out to be "profitable". To date, once numerous Internet resources that offer "reading other people's SMS" have managed to fade and lose popularity, but in connection with these events, a surge in the activity of scammers is almost guaranteed. The media replicated this story and put into the heads of millions of readers / viewers the fact that other people's SMS messages can be read on the Internet. The field is plowed and sown, you can reanimate fraudulent sites and harvest.

Water circles

In the wake of what happened, other interesting details began to surface, also related to sending SMS messages over the Internet. The Perm portal, which provides a service for free sending SMS messages to mobile phones of all operators in the Perm Territory, has fallen under the distribution. All sent messages, regardless of the recipient's operator, were perfectly indexed by the same wonderful Yandex.

True, not as impressive as in the case of the MegaFon website and the "issuance" of results in the form of a message feed. To read messages sent from the Perm site, each link had to be opened separately. But we will not engage in a comparative analysis of the taste qualities of radish and horseradish, the senders of messages are not laughing. Sit now and remember to whom you sent what and who now owns this information.

On this occasion, MTS has already managed to respond with an informational message, quote:

". due to numerous requests to Children's Clothing in Ghana about the situation with sending messages from the Perm site www.prm.ru, I would like to note that:

MTS has no agreements with www.prm.ru on the organization of sending free SMS messages from this site, and is not responsible for the site's actions to ensure the confidentiality of information sent through the site. Please note that the user agreement on the site www.prm.ru states that:

“The information and service portal PRM.RU is not responsible for maintaining the confidentiality and integrity of the message, for delivering it to the addressee, as well as for possible losses or damage (direct or indirect) that may occur in connection with the use of this service”< /p>

Preliminary summary

As for the Perm site, I can only repeat the proverb about the location of free cheese. Any gateways, programs and sites for sending free SMS should definitely not be considered as a reliable transport for transferring confidential information. Maximum - for everyday chatter on the topic "warm up dinner, I'll be there soon."

As for the situation with the MegaFon website, the conclusions will be drawn and the “holes” will be closed, this is understandable. Although already affected by this is not easier. The question is where and who will have a hole next time, the age of information technology has not canceled simple human sloppiness. It remains to be advised to use SMS from the phone for more or less important and / or confidential information, the risk is incomparably smaller. Yes, and once again to remind that the text typed on the Internet begins to live its own, sometimes unpredictable, life. Probably, even anonymously it is not worth writing on the net what it would be embarrassing to show to friends, relatives and loved ones. Online manuscripts do not burn.

Yandex and MegaFon: find all SMS

It is clear that not all, but even eight and a half thousand messages sent from the site and "leaked" to the Internet make you think. Whatever the technical reasons and whoever is declared a "switchman", the conclusion is obvious: the Internet space is very vulnerable, and search robots are merciless and do not forgive mistakes. Think about what and where you write, this is the only guaranteed way to avoid trouble.

SMS leaked to the Internet

On Monday, July 18, in the afternoon, the forums began to discuss the texts of SMS messages "published" on the Internet, sent from the MegaFon website. The search query, built in a certain way, produced 8750 results, of which, according to the operator, about eight thousand were real SMS messages along with the recipients' phone numbers. By two or three o'clock in the afternoon, the Internet community was already seething, the treasured link spread through the Twitter forums and the topic became the most discussed in Runet. The screenshot of the third page (see above) quickly bypassed all online media and the process became unmanageable.

As expected, there were plenty of fans to delve into someone else's underwear. SMS-kami were read, they were quoted on Twitter, retweeted and re-tweeted. I even saw the phrase “read all day today” on the forum. The hashtag #Megafon has turned into an all-Russian rubbish heap, in which fans of this kind of “literature” dug with rapture until late in the evening.

Further - worse. Of course, there were craftsmen who carefully collected and sorted all the messages into Excel files with their "innate" convenient search scheme. It was, one might say, the final chord in this short but stormy story. According to some estimates, about one and a half thousand messages managed to “spread out” on the Internet in one form or another, they could not or did not manage to pull out more from the Yandex search engine. About three hours passed from the moment a wide discussion began to the blocking of the display of SMS sent by Yandex, which is a very long time for the Internet space. Apparently, for such situations, it is time to develop some kind of emergency response schemes. To first quickly eliminate the consequences of technical mistakes, and then slowly figure out who is to blame and how this could happen.

MegaFon's official comment:

“In the process of interaction between the operator’s website and Yandex Internet services, a technical failure occurred, as a result of which a certain number of customer messages sent through the MegaFon website got into the Yandex search database. The problem was localized by technical specialists and quickly fixed. We emphasize that the failure did not affect client SMS messages sent via phones and other mobile devices. For comparison, the problem affected about 8,000 messages, while about 2 million SMS messages pass through the MegaFon network every hour, and all of them are securely protected.

Please note that information about the content of customer SMS messages is not stored on the operator's website. Thus, unauthorized access to the texts of our clients' messages could have occurred through some Yandex Internet services. This information did not fall into any other search engines.

From the numerous discussions and comments of experts, it can be assumed that there was no file on the operator's website that prohibited the indexing of messages. And, perhaps, the Yandex-toolbar installed in many browsers played a certain role. However, the technical details are of interest to specialists. For subscribers and users of the service, it is important that the SMS messages sent from the official website of the operator are in the public domain, and in any case, the operator is primarily responsible for this.

Legal field

Mistakes were, are and will be, it is inevitable. The trouble is that Internet manuscripts are extremely fire resistant and can be aged for years in order to materialize in all its glory at the most inopportune moment. SMS-correspondence is not a public forum, the content of letters is not subject to wide publicity in any case, and limited access to this information can only be obtained by a court decision or as part of operational-search activities (SORM system). It is the responsibility of the operator to ensure the confidentiality of correspondence, this is enshrined in Article 63 of the Communications Law:

  1. On the territory of the Russian Federation, the secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is guaranteed.
    Restriction of the right to secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is allowed only in cases provided for by federal laws.
  2. Communication operators have an obligation to ensure that communication secrecy is respected.
  3. Inspection of postal items by persons who are not authorized employees of the telecom operator, opening of postal items, examination of attachments, familiarization with information and documentary correspondence transmitted over telecommunication networks and postal networks, are carried out only on the basis of a court decision, with the exception of cases established by federal laws.
  4. Information about messages transmitted over telecommunication networks and postal networks, about postal items and postal money orders, as well as these messages themselves, postal items and money transfers can be issued only to senders and recipients or their authorized representatives, unless otherwise provided by federal laws.

The obligation of the telecom operator to maintain the secrecy of communication begins from the moment when the message is at the disposal of the operator, regardless of the form of its transmission. This means that the telecom operator, for example, cannot invoke the impossibility of ensuring the secrecy of communications in cases where the form of postal items is open.

Also, Article 138 of the Criminal Code clearly speaks of the consequences of violating the secrecy of correspondence, quote:

“Article 138. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other messages

  1. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other communications of citizens, - one hundred and eighty hours, or corrective labor for up to one year. »

It is not surprising that the event was taken seriously by the authorities. Quote from Lenta.ru message:

“The Investigative Committee of the Russian Federation will check how the text messages sent from the website of the Megafon company to its subscribers got into the public domain, RIA Novosti reports. According to the representative of the RF IC Vladimir Markin, the head of the committee, Alexander Bastrykin, gave the corresponding order to his subordinates.

According to the results of the audit, the issue of initiating a criminal case will be decided. Representatives of the Consumers Union of Russia have already announced their intention to file a lawsuit against Megafon, Interfax reports. The chairman of the organization, Petr Shelishch, called the incident "an obvious violation of the requirements of the consumer protection law."

Shelishch explained that if the Consumer Union wins a lawsuit in defense of an indefinite circle of consumers, then all subscribers affected by the data breach will be able to claim compensation for moral damages or other losses through the district court.

. Representatives of the company explained that the messages were made public due to the lack of a robots.txt file on the website www.sendsms.megafon.ru, which contains instructions for search robots. Thus, search engines could index messages sent by users through the site. Representatives of the Megafon company emphasized that the leak affected only part of the messages sent from the site.

Roskomnadzor also did not stay away from the event, seeing in it a violation of the legislation on communications and, possibly, a violation of the law on personal data. This was reported to Interfax by Roskomnadzor representative Mikhail Vorobyov. Currently, Roskomnadzor specialists are analyzing the information received and finding out whether it is possible to identify personal data subjects based on the information that has appeared in the public domain.

Consequences

It is too early to talk about administrative and criminal consequences for the operator. But the damage to the image is serious, that's for sure. As for you and me, this is an extremely sad event for those directly involved and a good lesson for others. Surely some SMS contained very “sensitive” personal information, some messages could contain passwords, logins, credit card numbers, etc. SMS is a convenient channel for transmitting information that is difficult to dictate and write down from a voice without errors. You can talk for a long time about the ethics of reading and the subsequent distribution of other people's messages, but there are people without moral brakes among us, you can't get away from this fact. And among the tens of thousands of "readers" there will easily be a hundred or one and a half unkind jokers who will enjoy mocking the innocent recipients of published messages.

Indirectly, content scammers who distribute their Trojan-filled "programs" for smartphones will turn out to be "profitable". To date, once numerous Internet resources that offer "reading other people's SMS" have managed to fade and lose popularity, but in connection with these events, a surge in the activity of scammers is almost guaranteed. The media replicated this story and put into the heads of millions of readers / viewers the fact that other people's SMS messages can be read on the Internet. The field is plowed and sown, you can reanimate fraudulent sites and harvest.

Water circles

In the wake of what happened, other interesting details began to surface, also related to sending SMS messages over the Internet. The Perm portal, which provides a service for free sending SMS messages to mobile phones of all operators in the Perm Territory, fell into the hands of the distribution. All sent messages, regardless of the recipient's operator, were perfectly indexed by the same wonderful Yandex.

True, not as impressive as in the case of the MegaFon website and the "issuance" of results in the form of a message feed. To read messages sent from the Perm site, each link had to be opened separately. But we will not engage in a comparative analysis of the taste qualities of radish and horseradish, the senders of messages are not laughing. Sit now and remember to whom you sent what and who now owns this information.

On this occasion, MTS has already responded with an informational message, quote:

". in connection with numerous requests to Children's Clothing in Ghana about the situation with sending messages from the Perm site www.prm.ru, I would like to note that:

MTS has no agreements with www.prm.ru on the organization of sending free SMS messages from this site, and is not responsible for the site's actions to ensure the confidentiality of information sent through the site. Please note that the user agreement on the site www.prm.ru states that:

“The information and service portal PRM.RU is not responsible for maintaining the confidentiality and integrity of the message, for delivering it to the addressee, as well as for possible losses or damage (direct or indirect) that may occur in connection with the use of this service”< /p>

Preliminary summary

As for the Perm site, I can only repeat the proverb about the location of free cheese. Any gateways, programs and sites for sending free SMS should definitely not be considered as a reliable transport for transferring confidential information. Maximum - for everyday chatter on the topic "warm up dinner, I'll be there soon."

As for the situation with the MegaFon website, the conclusions will be drawn and the “holes” will be closed, this is understandable. Although already affected by this is not easier. The question is where and who will have a hole next time, the age of information technology has not canceled simple human sloppiness. It remains to be advised to use SMS from the phone for more or less important and / or confidential information, the risk is incomparably smaller. Yes, and once again to remind that the text typed on the Internet begins to live its own, sometimes unpredictable, life. Probably, even anonymously it is not worth writing on the net what it would be embarrassing to show to friends, relatives and loved ones. Online manuscripts do not burn.

Yandex and MegaFon: find all SMS

It is clear that not all, but even eight and a half thousand messages sent from the site and "leaked" to the Internet make you think. Whatever the technical reasons and whoever is declared a "switchman", the conclusion is obvious: the Internet space is very vulnerable, and search robots are merciless and do not forgive mistakes. Think about what and where you write, this is the only guaranteed way to avoid trouble.

SMS leaked to the Internet

On Monday, July 18, in the afternoon, the forums began to discuss the texts of SMS messages “published” on the Internet sent from the MegaFon website. The search request, built in a certain way, produced 8750 results, of which, according to the operator, about eight thousand were real SMS messages along with the recipients' phone numbers. By two or three o'clock in the afternoon, the Internet community was already seething, the cherished link spread through the Twitter forums and the topic became the most discussed in Runet. The screenshot of the third page (see above) quickly bypassed all online media and the process became unmanageable.

As expected, there were plenty of fans to dig into someone else's underwear. SMS messages were read, tweeted, retweeted, and retweeted. I even saw the phrase “read all day today” on the forum. The hashtag #Megafon has turned into an all-Russian rubbish heap, in which fans of this kind of “literature” dug with rapture until late in the evening.

Further - worse. Of course, there were craftsmen who carefully collected and sorted all the messages into Excel files with their "innate" convenient search scheme. It was, one might say, the final chord in this short but stormy story. According to some estimates, about one and a half thousand messages managed to “spread out” on the Internet in one form or another, they could not or did not manage to pull out more from the Yandex search engine. About three hours passed from the moment a wide discussion began to the blocking of the display of SMS sent by Yandex, which is a very long time for the Internet space. Apparently, for such situations, it is time to develop some kind of emergency response schemes. To first quickly eliminate the consequences of technical mistakes, and then slowly figure out who is to blame and how this could happen.

MegaFon's official comment:

“In the process of interaction between the operator’s website and Yandex Internet services, a technical failure occurred, as a result of which a certain number of customer messages sent through the MegaFon website got into the Yandex search database. The problem was localized by technical specialists and quickly fixed. We emphasize that the failure did not affect client SMS messages sent via phones and other mobile devices. For comparison: the problem affected about 8,000 messages, while every hour about 2 million SMS messages pass through the MegaFon network, and all of them are securely protected.

Please note that information about the content of customer SMS messages is not stored on the operator's website. Thus, unauthorized access to the texts of our clients' messages could have occurred through some Yandex Internet services. This information did not fall into any other search engines.

From the numerous discussions and comments of experts, it can be assumed that there was no file on the operator's website that prohibited the indexing of messages. And, perhaps, the Yandex-toolbar installed in many browsers played a certain role. However, the technical details are of interest to specialists. For subscribers and users of the service, it is important that the SMS messages sent from the official website of the operator are in the public domain, and in any case, the operator is primarily responsible for this.

Legal field

Mistakes were, are and will be, it is inevitable. The trouble is that Internet manuscripts are extremely fire resistant and can be aged for years in order to materialize in all its glory at the most inopportune moment. SMS-correspondence is not a public forum, the content of letters is not subject to wide publicity in any case, and limited access to this information can only be obtained by a court decision or as part of operational-search activities (SORM system). It is the responsibility of the operator to ensure the confidentiality of correspondence, this is enshrined in Article 63 of the Communications Law:

  1. On the territory of the Russian Federation, the secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is guaranteed. Restriction of the right to secrecy of correspondence, telephone conversations, postal items, telegraphic and other messages transmitted over telecommunication networks and postal networks is allowed only in cases provided for by federal laws.
  2. Communication operators have an obligation to ensure that communication secrecy is respected.
  3. Inspection of postal items by persons who are not authorized employees of the telecom operator, opening of postal items, examination of attachments, familiarization with information and documentary correspondence transmitted over telecommunication networks and postal networks, are carried out only on the basis of a court decision, with the exception of cases established by federal laws.
  4. Information about messages transmitted over telecommunication networks and postal networks, about postal items and postal money orders, as well as these messages themselves, postal items and money transfers can be issued only to senders and recipients or their authorized representatives, unless otherwise provided by federal laws.

The obligation of the telecom operator to maintain the secrecy of communication begins from the moment when the message is at the disposal of the operator, regardless of the form of its transmission. This means that the telecom operator, for example, cannot invoke the impossibility of ensuring the secrecy of communications in cases where the form of postal items is open.

Also, Article 138 of the Criminal Code clearly speaks of the consequences of violating the secrecy of correspondence, quote:

“Article 138. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other messages

  1. Violation of the secrecy of correspondence, telephone conversations, postal, telegraphic or other communications of citizens, - one hundred and eighty hours, or corrective labor for up to one year. »

It is not surprising that the event was taken seriously by the authorities. Quote from Lenta.ru message:

“The Investigative Committee of the Russian Federation will check how the text messages sent from the website of the Megafon company to its subscribers got into the public domain, RIA Novosti reports. According to the representative of the RF IC Vladimir Markin, the head of the committee, Alexander Bastrykin, gave the corresponding order to his subordinates.

According to the results of the audit, the issue of initiating a criminal case will be decided. Representatives of the Consumers Union of Russia have already announced their intention to file a lawsuit against Megafon, Interfax reports. The chairman of the organization, Petr Shelishch, called the incident "an obvious violation of the requirements of the consumer protection law."

Shelishch explained that if the Consumer Union wins a lawsuit in defense of an indefinite circle of consumers, then all subscribers affected by the data breach will be able to claim compensation for moral damages or other losses through the district court.

. Representatives of the company explained that the messages were made public due to the lack of a robots.txt file on the website www.sendsms.megafon.ru, which contains instructions for search robots. Thus, search engines could index messages sent by users through the site. Representatives of the Megafon company emphasized that the leak affected only part of the messages sent from the site.

Roskomnadzor also did not stand aside from the event, seeing in it a violation of the legislation on communications and, possibly, a violation of the law on personal data. This was reported to Interfax by Roskomnadzor representative Mikhail Vorobyov. Currently, Roskomnadzor specialists are analyzing the information received and finding out whether it is possible to identify personal data subjects based on the information that has appeared in the public domain.

Consequences

It is too early to talk about administrative and criminal consequences for the operator. But the damage to the image is serious, that's for sure. As for you and me, this is an extremely sad event for those directly involved and a good lesson for others. Surely some SMS contained very “sensitive” personal information, some messages could contain passwords, logins, credit card numbers, etc. SMS is a convenient channel for transmitting information that is difficult to dictate and write down from a voice without errors. You can talk for a long time about the ethics of reading and the subsequent distribution of other people's messages, but there are people without moral brakes among us, you can't get away from this fact. And among the tens of thousands of "readers" there will easily be a hundred or one and a half unkind jokers who will enjoy mocking the innocent recipients of published messages.

Indirectly, content scammers who distribute their Trojan-filled "programs" for smartphones will turn out to be "profitable". To date, once numerous Internet resources that offer "reading other people's SMS" have managed to fade and lose popularity, but in connection with these events, a surge in the activity of scammers is almost guaranteed. The media replicated this story and put into the heads of millions of readers / viewers the fact that other people's SMS messages can be read on the Internet. The field is plowed and sown, you can reanimate fraudulent sites and harvest.

Water circles

In the wake of what happened, other interesting details began to surface, also related to sending SMS messages over the Internet. The Perm portal, which provides a service for free sending SMS messages to mobile phones of all operators in the Perm Territory, fell into the hands of the distribution. All sent messages, regardless of the recipient's operator, were perfectly indexed by the same wonderful Yandex.

True, not as impressive as in the case of the MegaFon website and the "issuance" of results in the form of a message feed. To read messages sent from the Perm site, each link had to be opened separately. But we will not engage in a comparative analysis of the taste qualities of radish and horseradish, the senders of messages are not laughing. Sit now and remember to whom you sent what and who now owns this information.

On this occasion, MTS has already managed to respond with an informational message, quote:

". Due to numerous requests from Children's Clothing in Ghana about the situation with sending messages from the Perm site www.prm.ru, I would like to draw your attention to the fact that:

". due to numerous requests for Children's Clothing in Ghana Children's Clothing in Ghana regarding the situation with sending messages from the Perm site www.prm.ru, I draw your attention to the fact that:

MTS has no agreements with www.prm.ru on the organization of sending free SMS messages from this site, and is not responsible for the site's actions to ensure the confidentiality of information sent through the site. Please note that the user agreement on the website www.prm.ru states that:

“The information and service portal PRM.RU is not responsible for maintaining the confidentiality and integrity of the message, for delivering it to the addressee, as well as for possible losses or damage (direct or indirect) that may occur in connection with the use of this service”< /p>

Preliminary summary

As for the Perm site, I can only repeat the proverb about the location of free cheese. Any gateways, programs and sites for sending free SMS should definitely not be considered as a reliable transport for transferring confidential information. Maximum - for everyday chatter on the topic "warm up dinner, I'll be there soon."

As for the situation with the MegaFon website, the conclusions will be drawn and the “holes” will be closed, this is understandable. Although already affected by this is not easier. The question is where and who will have a hole next time, the age of information technology has not canceled simple human sloppiness. It remains to be advised to use SMS from the phone for more or less important and / or confidential information, the risk is incomparably smaller. Yes, and once again to remind that the text typed on the Internet begins to live its own, sometimes unpredictable, life. Probably, even anonymously it is not worth writing on the net what it would be embarrassing to show to friends, relatives and loved ones. Online manuscripts do not burn.