It is planned to equip the STATS information system with new functionality, launched in 2017, initially it was intended to analyze the behavior of visitors to online portals and services of the Moscow government. After revision, which “Software Product” will perform for 276 million rubles, the system will be able to collect data on what the user did on other resources.
According to government procurement documents, the system will have modules for downloading geodata, downloading anonymized data on payments for services and fines, data of WiFi sessions in public transport, information on violations of medical restrictions, data on travel documents. In addition, the system will be able to analyze indicators of loyalty and participation in events. The tools will help “quickly identify emerging trends” and “form targets for user activity,” the documents say. The system will be loaded with data “from information systems of the Moscow government and other sources.”
The tender for the improvement of STATS was announced last autumn, the supplier was determined a month ago. The work must be completed by October 31, 2022, the contract says.
In addition to this contract, Software Product received in February two more contracts from DIT and the Infogorod subordinate to it, totaling 730 million rubles. One of them provides for the development of an information system for the development of entrepreneurship and industry (IS RPP) for 602 million rubles, and the other provides for the completion of an information management system for data in a distributed computing environment (IS UDRVS) for 132 million rubles.
Analysis of the behavior of users of a particular service is a standard practice for many state and commercial organizations that provide services and services for residents and seek to improve their quality and convenience, the press service of DIT explained to Vedomosti. The department assures that the data will be stored in an impersonal format: “The profile and personal recommendations are formed not for a specific person, but for a device. The system works without reference to the user’s personal data and does not encroach on the secret of his personal life. “
The main task of the system is to improve the convenience and quality of services provided based on data on their use received from various devices – smartphones, tablets and other gadgets, says DIT: “For this, the city does not need detailed information about fines or travel documents. It is important to understand whether the user goes to the page of the service for paying fines, or whether he has indicated information about the travel document in any section. For the analysis of Internet activity within the framework of STATS operation, the very fact of the user’s device accessing a particular service, banner or other element of the site is important, and not specific information specified when using the service. ” The information received will not be compared with any other data, emphasize in DIT: “The analysis of the interests of users will continue to be carried out on the basis of their activity on the city’s Internet resources.”
At the same time, the terms of reference for the STATS upgrade states that “the module for generating personalized content should provide the formation of data marts of Internet visitors’ interests based on the results of analytics of the resources of the Moscow government and other data sources visited by users, as well as a service for providing the generated content to external consumers.”
What is meant by “other” data sources, the press service of DIT did not answer. The terms of reference also mentions the possibility of identifying a unique Internet visitor “without using cookies to increase the accuracy of matching profiles.”
Cookies allow the system to find out what the user was interested in on a particular site in the event that these files are synchronized on different sites, a person close to DIT explains the principle of the system. In order for the STATS system to have access to such analytics, one line of code must be added to the site’s program code, another former employee of DIT confirms.
Instead of cookies, a phone number could serve as an identifier to track a user’s digital footprint, he says. By impersonality, DIT means identifiers that are stored in the system, however, if necessary, at the request of law enforcement agencies, for example, identifiers from different systems and resources can be linked and de-anonymous, says a person familiar with the functionality of the system.
Modern technologies make it possible to accurately identify a specific person by a set of such data, agrees a senior lawyer at Digital Rights Center, an expert at Roskomsvoboda, Vladimir Ozherelyev: the aggregate will allow you to identify a specific person to whom these data relate. The realization of the possibility of identifying a unique Internet visitor indirectly confirms that all data in the aggregate either initially will not be impersonal, or will have the prerequisites to become such. “
The data that DIT wants to aggregate in one system is redundant for the stated goals of personalizing content on the websites of the Moscow government, says Alexey Lukatsky, business security consultant Cisco Systems: “The more data, the higher the risks: DIT has repeatedly had data leaks, for example , about coronavirus patients, and STATS plans to store a digital client profile with information from a variety of systems. “
.