Experts estimated the share of American trackers in RuStore

Almost 90% of applications from the RuStore store use foreign trackers - they can collect both technical errors and user data. The creator of the marketplace, VK holding, emphasizes:

Among the applications available for download in the domestic marketplace RuStore, which is being developed by the VK holding with the support of the Ministry of Digital Development, only 12% do not have a built-in tracker. This is stated in the study of the ANO Information Culture (RBC has the study).

Trackers are understood as a tool that monitors the operation of a mobile application and / or the behavior of its user. Trackers may collect technical data about errors and failures, service performance assessment, etc., as well as data on the user's geographic location, his browsing history on the Internet, a list of installed applications, and other information. With their help, it is also possible to determine the "digital identity" and correlate the actions of a person online and in the analog world, calculating his pseudonym.

Ivan Begtin, HEAD of the ANO Information Culture, says that, according to his observations, Russian companies uploaded “approximately” the same version of applications to RuStore as they had for GOOGLE Play. In the study, they did not try to compare different app stores, and in principle there are no requirements in Russian legislation on how much information apps can collect, what permissions can be requested, and what permissions are prohibited.

Who and how thought

ANO "Information Culture" was established in 2012. Its activities are aimed at conducting analysis and expertise in the field of open data, creating information portals and educational portals. Among the ANO projects is the National Digital Archive (created for the conservation and archiving of Russian digital resources of public value).

RuStore was chosen for the analysis, because, according to ANO Information Culture, it is he who claims to be the main Russian application store, an alternative to Google Play and App Store, which introduced restrictions for Russian users and developers after the start of Russia's military operation in Ukraine (applications of companies that fell under sanctions were removed from the App Store; Google banned developers in RUSSIA from downloading and updating paid applications, etc.). The beta version of RuStore was launched on May 25th.

The marketplace is available to users of Android devices and is recommended for pre-installation on devices imported into the country. "The only organization that ensures the creation and operation of a single application store", defined by VK.

At the time of the study at the end of July, there were 1014 applications in RuStore, but only 934 applications were taken into account in the statistics (different versions of the speech therapy application from Novator LLC are not taken into account).

What trackers are in RuStore

The vast majority of trackers built into applications belong to foreign legal entities. These are installed in 94.6% of applications that have trackers. In 93.8% of cases, these trackers are owned by US companies .

Most often, these are trackers from Google - Google Firebase Analytics and Google CrashLytics, which are used to analyze the performance of a mobile application and optimize user experience, track application crashes and errors, as well as Google AdMob - for advertising monetization of the application. The Russian AppMetrica from the Yandex company is also used, which collects depersonalized data about user actions in the application to optimize marketing campaigns. In addition, Meta Platforms trackers (recognized as an extremist organization in Russia; owns FACEBOOK and Instagram social networks) are in the top for identifying users and collecting analytics about them.

In addition to Yandex, there are also VK-owned trackers among Russian trackers. In total, domestic trackers are used in 58% of applications, in most cases along with foreign ones. Only 5.3% have only Russian trackers installed.

The Ministry of Digital Development and VK announced the launch of the RuStore app store Technology & Media

The top applications with the largest number of trackers were first of all games: six from VK Play, including Guild of Heroes: Action MMO RPG, the leader of the anti-rating, which contains 37 trackers; two from HeroCraft, one each from D.Dream Games and Bold Cat. Google trackers are also contained in government applications, for example, in "Gosuslug". But the study notes that government applications contain the fewest trackers - an average of 2.5 pieces.

At the same time, only 112 applications from the marketplace do not contain a single tracker, which is 12% of the total number. For example, Galaxy Dating Chat, Lenta.ru, Rambler / Horoscopes, the Orenburg Digital School application of the Ministry of Digital Development and Communications of the Orenburg Region, the State Support for Agroindustrial Complex NSO application of the Ministry of Digital Development and Communications of the Novosibirsk Region, etc.

What permissions are requested by application owners from RuStore

In addition to trackers, ANO "Information Culture" also analyzed what permissions applications from RuStore request, that is, access rights, to which device functions a mobile application receives. Permissions can be benign, that is, not related to access to personal data, such as using the Internet; and may carry a potential threat of surveillance or malicious use, the study indicates. Potentially dangerous ones include access to the camera, contacts, calendar, approximate or exact location data, microphone, sensors, storage, making calls, sending SMS, etc. At the same time, some of the permissions may be related to the functionality of some applications, which is necessary for their operation. But if, in the absence of user-friendly functions for working with the image from the camera, the application asks for access to it,

Only 1.7% of the total number of RuStore applications do not have any tracker and do not ask for any permissions. 88% request at least one potentially dangerous permission. At the same time, 74% of applications request permission to write to an external data storage (memory card), to access images, video, audio and media files. Of the potentially dangerous permissions in RuStore applications, the most common access is to read and write data on a memory card, access to the camera, to the exact and approximate location, obtain information about the device and record audio.

The most potentially dangerous permissions are requested by applications owned by VK: “VK Calls: unlimited communication” and “Odnoklassniki: social network” (14 permissions each), “ICQ - video calls, chats” (13), “Marusya - voice assistant” ( 12), "VK Messenger: Communication, calls" (12), etc. Other banking applications include VTB Online, Tinkoff Junior and Tinkoff Mobile Bank, as well as Yandex Navigator.

Foreign services appeared in the Russian app store NashStore Technology & Media

A VK representative did not answer RBC's question why there are so many trackers and permissions in the company's applications, and whether they consider their presence acceptable. He only said that for them "it is of fundamental importance that the applications hosted in RuStore do not violate applicable law, the requirements of the user agreement and are safe."

Ivan Begtin pointed out that RuStore currently has a minimal amount of information available about moderation rules, requirements for developers, etc. Although government applications contain a minimum number of trackers, they are uncontested and "should protect the user as much as possible from possible data leakage," the head of the Information Culture ANO believes.

Experts announced the practice of transferring data of Russians through government applications Politics

A Yandex representative said that the version of Yandex Navigator for RuStore is no different from versions in other app stores. “Navigator has many features that require user permissions to work. For example, geolocation is needed for accurate route guidance, and voice input requires access to a microphone. With the permission of users, we process the necessary data for the correct operation of the service,” he explained.

A VTB representative explained to RBC that their application asks customers for mandatory phone access to ensure security while working with the mobile application. “Other permissions can be optionally set by clients, for example, access to the geolocation while browsing ATMs and branches or to the address book for easy search of the recipient of transfers by phone number. The requirements for such access are identical for both RuStore and other marketplaces,” VTB said.

RBC sent a request to the Ministry of Digital and Tinkoff.