In September, Federal Law No. 242-FZ came into force in Russia. In a nutshell, the law requires all foreign businesses that handle the personal data of Russian citizens to keep this data on servers located within the country. 

To comply with this measure, anyone collecting or processing such data has to notify the Federal Supervision Agency for Information Technologies and Communications – Roskomnadzor – about the exact location of the servers.

Web giants get an extension

The new rules apply to email services, social networks and search engines, although there are reports that the likes of Facebook and Google have been granted an extension until the end of the year.

To investigate the impact of the regulation, we contacted Guy Willner, chief executive of IXcellerate – a company that owns one of the largest carrier-neutral data center campuses in Moscow and is currently planning to build another one. Willner is a British-born data center entrepreneur with decades of experience: he co-founded IXEurope in 1999, grew the company to 14 facilities, and sold it to Equinix in 2007 for $482m.

He told DatacenterDynamics that foreign businesses have been slow to comply, but the local data center market was well equipped to weather this particular storm.  At the same time, the country could face a real capacity crisis soon, brought about by the economic sanctions over Russia’s involvement with Ukraine.

Most Russian language websites (collectively known as Runet) are hosted offshore, in places such as Amsterdam, Helsinki or Frankfurt, so the law will send shockwaves through global markets.

It will affect any organization that stores the data of Russian customers, and according to Willner that’s around 2.4 million businesses, including everyone who takes credit card payments. In accordance with the law, domain names or net addresses not registered with Roskomnadzor will be hit by fines; repeat offenders will be blacklisted and could be cut off.

Wait and see?

Willner says many foreign firms have chosen to ‘wait and see,’ irrespective of these Draconian measures. “There’s no chaos or panic, but there’s disregard. Often when a country comes up with a law like this, the guys in head office just think, ‘That’s a load of bulls**t,’” he says.

“It’s only when there are problems that they realize maybe they should take it seriously.”

When the US Patriot Act came into force, most of the industry fell into line, but there were exceptions. Some notoriously secretive Swiss banks only started to comply with requests for information when the Americans started blocking their accounts.

So how does it work exactly? If the company in question maintains an official presence in Russia, Roskomnadzor is likely to send a polite letter to its registered address in order to negotiate its registration. Things could be a lot more abrupt if the company is not officially registered. If the company is not registered in Russia, then Roskomnadzor has nowhere to write to, so the site gets blocked because the company could potentially be operating illegally. “If it has no registered office in the country and is taking payments, the implication is it’s not paying any taxes, and there’s no protection [for the customer]. I think we will gradually see more and more people complying.”

It might not have been the master plan at all, but it’s  on-shoring the internet into Russia, which means it’s going to give lots of jobs to software engineers and to hardware people. There’s going to be investment in data centers.

Guy Willner, IXcellerate

Russia currently has enough capacity to satisfy the comparatively modest demands of data residency. “If you’re talking about storing some personal data, it’s a couple of servers – it’s not like moving your heavy artillery to Moscow. These are not massive installations. Even if it’s a website with 100,000 hits a day, we are talking about half a rack. This is not going to flood the system, but there is very little capacity in Russia, that’s clear. We have a couple of thousand square meters spare at the moment, and most of our competitors have between 500 and 1,000 [square] meters spare. In the whole market in Moscow, there’s probably less than 6,000-7,000 meters of available space currently,” explains Willner.

Taking advantage of the underdeveloped market is tricky. Willner says Russian banks are charging exorbitant credit fees, while getting investment from the US is simply impossible due to economic sanctions. The situation could benefit the larger industry players that don’t need to collect additional funds to build a facility – but there are no big data center players native to Russia, and the ‘Big Five’ cloud vendors are hesitating to enter the market at the moment, though Apple is complying (see News, page 13).

“It’s difficult to find capital for expansion. It’s a strange situation, where there’s strong demand, but supply is definitely getting restricted. Pricing is not very high yet, but my guess is it will start creeping up. So the guys who turn up latest will pay the most – but it’s like that in any market.”

At the same time, businesses that already have some roots on Russian soil are flourishing due to the lack of competition. Willner’s advice? Whatever Facebook or Google might be doing, non-compliance in Russia is not an option. “I’d say get your servers in Russia: a) because it is going to get more expensive; and b) because you might end up being strapped with a fine. If you’re not registered in Russia, you might want to reconsider whether you want to do business in Russia. If you do want to do business in Russia, you might want to register your company or localize – you know, create a local office.”

Commercial fallout

Media reports have made the law look more complicated than it really is, says Willner, and some analysts predict that the Federal Law No. 242-FZ could harm the Russian economy, but the situation is not that clear.

Willner thinks the commercial fallout has been a blessing for local cloud and IT providers that are growing while digital resources come home to Russia. “It might not have been the master plan at all,” says Willner. “But what it’s actually doing is on-shoring the internet into Russia, which means it’s going to give lots of jobs to software engineers and to hardware people. There’s going to be investment in data centers.”

Actually, maybe the unintended consequence of this is Russia taking a large step forward technologically. “If you remove the political situation, Russia is an amazing market. It’s growing faster than any other European country in terms of internet users – there are already 80 million, and the growth is in double digits,” says Willner.

“Geographically, Russia’s fantastic for finance because you’re halfway between South East Asia and Europe, and it’s got its own economic group [the BRICs]. But at the moment, it’s kind of… on hold.”  

This article appeared in the October 2015 issue of DatacenterDynamics magazine