Samsung

Inserting Contracts into ChatGPT Risks Major Fines Under Russia's 152-FZ Personal Data Law

A detailed analysis examines the legal consequences of uploading contracts containing personal data into foreign AI services such as ChatGPT under Russian Federal Law 152-FZ. The article clarifies that even standard supply agreements include names, positions, passport details, INN numbers, phones and emails that qualify as personal data. It breaks down applicable administrative penalties from Article 13.11 of the Code of Administrative Offenses, including 150-300 thousand rubles for processing without a proper legal basis and separate fines for failing to notify Roskomnadzor. Cross-border transfer rules under Article 12 require a dedicated notification to the regulator before sending data to services hosted in the United States or European Union. The piece also reviews recent court practice, including a Moscow district court ruling that treated uploading commercial information to DeepSeek as disclosure of trade secrets. No criminal liability under Article 272.1 of the Criminal Code applies to ordinary business use, yet the absence of a data processing agreement with OpenAI or similar providers creates ongoing compliance exposure.

Employee Fired After Uploading Corporate Documents to DeepSeek: How Data Security Works in AI Services

A Moscow engineering company dismissed a top manager after she uploaded internal documents to the public DeepSeek service, with the court ruling it a breach of trade secrets. The case highlights a sharp rise in corporate data being sent to public AI models, with one study showing a 30-fold increase in 2025 compared to the previous year. Technical director Yaroslav Shmulyov of integrator R77 AI explains the full processing pipeline, from file ingestion and text extraction to embedding generation and potential use in training. Sensitive data can persist in multiple forms including original files, logs, third-party infrastructure, and model parameters even after deletion requests. Major incidents at Samsung and a U.S. cybersecurity agency demonstrate that even well-resourced organizations struggle with uncontrolled AI usage. Companies are increasingly turning to local and hybrid models to regain control over confidential information while regulators and internal policies lag behind adoption.

Yandex Apps Leak Pre-Trigger Audio Buffers, Payment Data, and Contacts via Reverse Engineering

Reverse engineering of Yandex Search and Yandex Browser APKs reveals extensive data collection practices on Android devices. The apps maintain a server-controlled pre-trigger audio buffer that captures up to three seconds or more of microphone input before the wake word Alice is detected. WiFi fingerprinting, full contact book synchronization via ContentObserver, and transmission of PAN and CVV details to mobpayment.yandex.net occur before tokenization. Additional findings include 94 JavaScript Bridge methods, logcat exfiltration with AES encryption, hardcoded Yandex DNS servers, and a native surveillance library named libquarkenstein_daemons.so. The analysis also covers passive geolocation, cell tower data collection, and inventory of installed applications including competitors such as Chrome, Firefox, WhatsApp, and Telegram. These mechanisms operate under remote configuration flags and bypass several Android privacy restrictions through manifest queries.

Google's Android Developer Verification Rollout: Implications for Russian Devices and MDM-Managed Phones

Google is introducing mandatory Android Developer Verification on certified devices starting in select countries in September 2026, requiring developers to register and sign apps with verified identities. The policy aims to curb fraudulent and malicious applications by linking package names to registered developer signatures checked via the new Android Developer Verifier system component. Devices without Google services, including many Russian and Chinese firmware builds as well as AOSP variants, remain completely unaffected since the verification mechanism relies on Google Play services. Russia is explicitly excluded from the initial rollout and subsequent waves due to sanctions, allowing continued distribution of in-house and third-party applications. Corporate MDM deployments are also exempt because administrators are considered to have already vetted the apps for safety. Google plans to offer both full registration requiring D-U-N-S numbers for organizations and a limited option for hobbyists capped at 20 devices. The company has already registered SafeMobile as a verified developer, ensuring seamless installation of its client on supported devices.

VK and MAX Apps Removed from Google Play Store Amid EU Sanctions on Russian Company

VK and its national messenger MAX have been removed from the Google Play Store following the European Union's decision to add the parent company to its sanctions list. The company confirmed that the apps are no longer available for new downloads or updates through Google, but existing installations continue to function normally with full access to messaging, calls, events, and push notifications. Users can obtain updates and new installations through alternative Android stores including RuStore, Huawei AppGallery, Samsung Galaxy Store, and Xiaomi GetApps, or receive in-app update prompts when new versions become available. The removal comes shortly after similar apps such as Dzen and VK Video disappeared from the Apple App Store last month. Although the exact reasons were not disclosed in VK's statement, the sanctions were triggered specifically by the development of the MAX messenger as a national platform. This development highlights how regulatory actions are reshaping app distribution channels for Russian digital services, positioning RuStore as a primary rather than backup marketplace.