FSB information security center. Podolsk Department of the FSB

Based in a monumental building on the corner of Lubyanskaya Square and Myasnitskaya Square, built in the 1980s for the KGB's computer center, the CIB not only protects computer networks and catches hackers, but also carefully monitors the Internet.

In particular, in the FSB, it is the CIB that decides what materials need to be removed from access on the Web.

Activities

Operational management of the CIB is the most combative division of the CIB, which today is engaged not only in the technical protection of computer networks, but also conducts active operational work on the Internet.

To do this, the CIB FSB uses special search analytical systems created by Russian programmers. For example, on June 2, 2010, military unit 64829 (that is, the CIB) announced tender No. 147 / I / 1-133 for the supply of a software product with a maximum price of 450 thousand rubles. The contract explains what exactly the CIB is interested in - the Semantic Archive information and analytical system of the Analytical Business Solutions company.

Story

2017: Arrest of the head of the 2nd department Sergey Mikhailov

In January 2017, it became known that the head of the 2nd department of the CIB FSB, Sergei Mikhailov, was arrested on suspicion of receiving money from a foreign organization through the mediation of an employee of a Russian company in the field of information security. The investigation is being conducted on suspicion of violating Article 275 of the Criminal Code of the Russian Federation (“high treason”). Read more.

Officially, the essence of the case is not disclosed. According to various versions, the suspects could “hand over” to the States the hackers of the Democratic Party servers, participate in hacking the mailboxes of Moscow near-political celebrities by the Humpty Dumpty group (the case is being investigated separately and there is no direct connection between the cases), or in other stories, for example, sabotage the investigation of a DDoS attack to the Assist payment system (the founder of the Chronopay payment system Pavel Vrublevsky was found guilty of it, he has already served his sentence). More about the case.

2011: An attempt to find out the data of the reader of the site Roem.ru in the interests of Odnoklassniki

On April 28, 2011, 30-year-old journalist Yuri Sinodov received a call from an employee of the Information Security Center (TSB) of the FSB. Sinodov is the owner and editor-in-chief of the website Roem.ru, which specializes in covering the market for Internet companies and social networks, and an FSB officer asked him to disclose the data of one of the authors of the site, who wrote about the internal conflict in Odnoklassniki.

Sinodov had already been approached with such questions in 2007, and this time he decided to demand official confirmation. Soon he received it - in the form of a request with the coat of arms of the FSB from the address [email protected], signed by the head of one of the divisions of the CIB Sergey Mikhailov.

Then Synodov turned to the Internal Security Department of the FSB with a request to check whether such attention to the authors of his site was legal. In the response of the first deputy of the Operations Department of the CIB, A. Lyutikov, it was stated that the request was legitimate and was of a reference nature.

Synodov did not stop there and asked the same question to the Prosecutor General 's Office . The answer was completely unexpected: the conducted inspection established a violation of the law "On operational-search activity" by the employees of the CIB, and the leadership of the CIB has already been told that violations of the law are inadmissible.

After that, Synodov, with a clear conscience, posted his correspondence with the FSB and the Prosecutor General's Office on the website.

In his opinion, the interest of the FSB is explained by the fact that the officers were most likely used by employees of private companies who wanted to find out where the classified information was leaked:

“It seems to me that the company mentioned in the post (“Odnoklassniki”) is very interested in the channels for leaking unofficial information about them, while the CIB itself does not need it. This is not a matter of national importance, this is a problem of the company itself.”

Arrests at the Information Security Center of the FSB and Kaspersky Lab could be the result of a confrontation within the special services, according to RBC sources close to the leadership of the FSB.

The criminal case, in which the arrested employee of Kaspersky Lab Ruslan Stoyanov and the head of one of the departments of the Information Security Center (CIB) of the FSB of the Russian Federation Sergey Mikhailov, could be initiated due to an internal conflict in the Russian special service, two interlocutors close to the leadership told RBC FSB.

The case of treason

Kommersant reported on the arrest of Stoyanov and Mikhailov on Wednesday, January 25. According to the publication, they have been in custody since December 2016. The publication does not report what particular case they are involved in, but notes that one of the deputies of the head of the CIB FSB is being investigated under Article 275 of the Criminal Code (“Treason”), he is being handled by the Department of Internal Security (CSB) of the FSB. The interlocutors of the publication specified that information is being checked about “the receipt by an employee of the CIB of money from one of the foreign organizations through the mediation of an employee of a certain Russian company in the field of information security.”

According to Kommersant, the investigation of this case may affect the career of the head of the FSB CIB Andrei Gerasimov - he may leave his post.

​Kaspersky Lab confirmed the arrest of the employee, but clarified that the case refers to the period when Stoyanov did not work for the company yet. The company could not answer which court chose the measure of restraint.

The press service of the Moscow City Court told RBC that they did not have information about which district courts considered the requests of the investigation in the case of Stoyanov and Mikhailov.

Former operative

Stoyanov, as follows from his profile on the social network LinkedIn, has been working at Kaspersky Lab since July 2012. Prior to that, he had been on the staff of the Indrik-PRO company for almost three years. As follows from the SPARK-Interfax database, he still owns a 19% stake in this software development company. The latest revenue data is dated 2014 - 14 million rubles.

From 2006 to 2010, Stoyanov led the network security department of RTComm.RU, a subsidiary of Rostelecom. Prior to that, he served for six years in the Department of Special Technical Measures (USTM) of the Central Internal Affairs Directorate for Moscow and left it with the rank of police major.

At Kaspersky Lab, Stoyanov headed the Computer Incident Investigation Department (ORCI). “At the request of our clients, we are investigating incidents related to the activities of cybercriminals. Let me clarify: we are not subjects of operational-search activity, we are not law enforcement agencies and do not investigate crimes. Our task includes establishing the technical aspects of what happened, identifying the criminal infrastructure behind the incident and assisting law enforcement officers in identifying. We are working to help businesses and society counteract cybercrime,” Stoyanov said in 2014.

Kaspersky is actively cooperating with law enforcement agencies. In June 2016, the FSB and the Ministry of Internal Affairs announced the arrest of members of the Lurk hacker group. The group included 50 hackers who stole 3 billion rubles from banks and large businesses. The unit led by Stoyanov was involved in the capture of the alleged criminals. “The operation of the Ministry of Internal Affairs and the FSB took place simultaneously in several cities of Russia. It was the largest operation to apprehend a cybercriminal group since at least 2000. I think that it will go down in textbooks as an example of the well-coordinated work of its participants, ”he noted then. In August, Stoyanov released a report on Lurk's activities, stating that Kaspersky Lab employees had been studying the group for six years.

Current counterintelligence officer

The CIB FSB deals with cybercrime, including in the field of e-commerce and the illegal distribution of personal data. Legally, the center is registered as a separate military unit No. 64829. Data transmission services to this division of the FSB in 2016 were provided by the RTComm.RU company, where Stoyanov worked in 2006-2010.

As follows from the documentation on the public procurement portal, the contract was concluded for a little over 3 million rubles. The acts of acceptance of work were signed every month by the deputy head of the unit Pravikov D.I. In November, the responsible person changed - he became deputy head S.V. Kravchenko.

CIB employee Mikhailov was mentioned several times in the media in connection with various scandals. So, in 2011, the founder of the site Roem.ru, Yuri Sinodov, said that in 2007 he received a request from Mikhailov demanding to disclose the data of one of the users of the site. He received a similar request in 2011, also signed by an FSB operative. Synodov complained to the Prosecutor General's Office. The supervisory agency said that the FSB violated the law "On operational-investigative activities." The leadership of the CIB was pointed out the inadmissibility of such violations, it was said in the document published by the Synods.

In 2013, Mikhailov spoke in court at the trial of Chronopay, an entrepreneur Pavel Vrublevsky. The businessman was accused of organizing a DDoS attack on the Assist payment system in 2010. As a result, during the week it was impossible to pay for electronic tickets on the website of the main client of "Assista" - "Aeroflot". Vrublevsky spoke of his innocence, and explained the initiation of the case by "a slander on the part of Sergei Mikhailov," with whom he had a "personal conflict." Mikhailov during the hearing confirmed that he had known the entrepreneur since 2007, and their relationship was both professional and personal.

Conflict between two centers

The criminal prosecution against the CIB employee is connected with the confrontation within the special services, two interlocutors close to the leadership of the FSB told RBC. According to them, the CIB has always had tense relations with the Center for Information Protection and Special Communications of the FSB (legally it is military unit No. 43753), which is headed by Andrei Ivashko. The center is engaged in licensing, including cryptographic equipment, and helps the Central Election Commission (CEC) to transmit information about the voting results via secure communication channels. At the end of 2016, Ivashko was awarded for the help of the CEC.

According to RBC sources, the functionality of the two centers largely coincides, which was the cause of the conflict. “Duplication of functions in the FSB is necessary. It is an opportunity to receive information from different sources. The duplication is purely pragmatic, there is no competition here,” said retired FSB Major General Alexander Mikhailov in a conversation with RBC. - The divisions have different functions, but very often they overlap in some sectors. At the same time, any intersection is, to a certain extent, an increase in the level of information reliability.

“There is never a complete duplication in the special services. One unit can be engaged in operational work, and the second - counterintelligence. They can only intersect at the level of the director of the FSB,” retired FSB Major General Valery Malevanny told RBC.

Mikhailov does not believe in the conflict between the leadership of the units. “In the FSB, there have never been internal squabbles that would lead to criminal prosecution. There is always an opportunity to resolve these conflicts elementarily by changing managers, layoffs, and changing the structure. I don't see any intrigue here. When two divisions cannot find common ground, this is resolved surgically and without the use of procedural measures. The FSB is a powerful power structure with a clear vertical line. Connecting third-party tools is stupid, ”Mikhailov emphasized.

The last of the well-known conflicts within the FSB - between the Economic Security Service (SEB) and the internal security department - ended with the resignation of several SEB generals in the summer of 2016, and Sergei Korolev, who had previously headed the CSS, became the new head of the service.

Society, 26 Feb, 17:05

Technology and media, 13 Feb 2018, 07:39

Society, 03 Mar 2017, 15:29

Society, 02 Mar 2017, 12:28

Society, 20 Feb 2017, 00:00

Society, 09 Feb 2017, 14:36

Cybersecurity officer Andrey Gerasimov defeated by offline generals.

The IT industry of Russia is supervised by military unit 64829 - the Center for Information Security of the FSB. Since November 2009, the CIB has been headed by Andrey Vasilyevich Gerasimov, deputy head of the 1st service of the department, Alexander Bortnikova. Gerasimov historically did not have a relationship with the FSB's Department of Internal Security (OSB), which until last year was led by General Sergei Korolev and his deputy Oleg Feokstov.

Earlier, the CIB investigated a DDoS attack on the Assist payment system. Because of this crime, passengers could not purchase Aeroflot tickets for several days. The main suspect was the owner of the Chronopay payment system, Pavel Vrublevsky, who tried to establish contacts with a number of employees of the FSB CSS. The hardware confrontation within the special services influenced the fact that the Vrublevsky case dragged on for three years - in 2011 the suspect was placed in a pre-trial detention center, then released from there, arrested again in 2013, and then sentenced to 2.5 years of general regime. All this time, Vrublevsky criticized the CIB operatives, whom he considered to be the executors of the order from his business partner Igor Gusev, also associated with the FSB.

Now Vrublevsky, in an interview with Kommersant, reports that “all companies in the field of information security are building a strategy and planning development with an eye on the CIB, informally this division oversees the entire industry. Close interaction with the CIB affects the quality and independence of the expertise that private companies conduct in cybercrime investigations."

Ilya Sachkov

In the new year, the CSS FSB managed to achieve a change in the leadership of the CIB. The reason for Andrey Gerasimov's possible departure should be the results of the CSS investigation against one of his deputies. At the same time, Gerasimov's contacts with private companies are being checked, including Kaspersky Lab (owner - Evgeny Kaspersky) and Group-IB (owner - Ilya Sachkov). Andrey Sporov, an expert, is sure that the businessman Sachkov has little understanding of technical issues - the entrepreneur is more competent in choosing fashion brands. But friendship with Andrey Gerasimov and his colleagues remains the main resource, in relation to it other factors are secondary.

According to journalist Andrei Soldatov, "the CIB has its own operational department, which deals with everything from cyber fraud to finding out the identities of the authors of important leaks on the social network." According to Soldatov, the appointment of Andrei Gerasimov was lobbied by Lieutenant General of the FSB Boris Miroshnikov. He participated in the creation of the FSB CIB and the national information security infrastructure.

Andrey Gerasimov is a member of the Board of Trustees of the Safe Internet League. The organization was created to filter the Runet by Konstantin Malofeev with the participation of the main patron of his business - the former KGB officer of the USSR, Minister of Communications and Assistant to the President of the Russian Federation Igor Shchegolev.

Gerasimov also sits on the executive committee of the Documentary Telecommunications Association (ADE), established in 2000. The chairman of the executive committee and the head of the basic department of ADE at MTUCI is Arkady Kremer. According to him, Chekist Gerasimov works in ADE, but missed the last meeting on December 13th.

At the end of last week, it became known that a new head was appointed at the Information Security Center (TSB) of the FSB, which specializes in investigating cybercrime: Sergey Skorokhodov replaced Andrey Gerasimov, who headed the center since 2009.

Gerasimov, according to RBC sources, retired. They attribute this to the scandal in which the CIB was involved - the center's employees were accused of treason. “If not for the arrests, maybe I would have worked for a few more years; he was a little over 60 years old, which is not the age for the special services, ”a source in the IT market told RBC. ​

Under Gerasimov, the CIB became an active player in the Russian IT industry, and the center's employees were called curators of Russian Internet companies. Andrey Gerasimov's family members also work in the IT field. RBC found out what IT assets the Gerasimov family owns and how his resignation could affect the family business.

[Kommersant, 01/13/2017, “Cybersecurity is changing its curator”: According tokartoteka. en, Andrey Gerasimov has been the head of the FGKU "Military unit 64829", as which the FSB CIB is legally registered, since November 2009. Until that moment, for several years in open sources, he was repeatedly mentioned as the deputy head of the CIB.
The CIB specializes in the investigation of cybercrime, including in the field of e-commerce and the illegal distribution of personal data. “The CIB has its own operational department, which deals with everything from cyber fraud to finding out the identities of the authors of important leaks on the social network,” says Agentura editor-in-chief. enAndrey Soldatov.

According to him, Andrey Gerasimov was a "protege" of the Lieutenant General of the FSBBoris Miroshnikov, who was directly involved in the creation of the CIB and building the information security infrastructure in the country.[…]

One of the most famous criminal cases investigated by CIB operatives was related to DDoS-attack on the Assist payment system in July 2010, due to which citizens could not purchase Aeroflot electronic tickets for several days. The founder and CEO of a competing payment system was found guilty of it.Chronopay Pavel Vrublevsky, who was sentenced in 2013 to two and a half years in a penal colony.[…]

In addition to the leadership of the CIB, Andrey Gerasimov also participates in the work of public organizations. He, in particular, is on the board of trustees of the Safe Internet League (LBI), created by a businessmanKonstantin Malofeev with the participation of the former head of the Ministry of Telecom and Mass Communications, and now an assistant to the President of the Russian FederationIgor Shchegolev, for filtering content on the Internet. The LBI declined to comment.

Andrey Gerasimov is also a member of the executive committee of the Association of Documentary Telecommunications (ADE), established in early 2000 by order of Prime Minister Vladimir Putin. - Inset K.ru]

Family IT

In July, when the head of the CIB FSB was replaced, the website of the small company Lintechno (lintechno.ru), or the Laboratory of Innovative Technologies at the Moscow State Technical University named after M.V. N.E. Bauman". Among its founders, according to RBC sources, is the son of Andrei Gerasimov, and one of the current co-owners of Lintechno is his daughter. The linshop.ru domain, where the company's online store is located, was down for the whole of July, but is now back on. The phone number, which was previously indicated on both sites, has recently been transferred to the Amethyst jewelry company. The official Lintechno group on the VKontakte social network has been deleted.

Lintechno is a developer of information security tools. According to SPARK-Interfax, LLC Lintechno at MSTU im. N.E. Bauman" was established in July 2013. The founders of the company were the university (34%), associate professors of its Information Security department Anton Andreevich Gerasimov (26%) and Alexei Viktorovich Astrakhov (25%), as well as Kirill Konstantinovich Zdiruk (15%).

Top managers of two large companies in the field of information security claim that Anton Gerasimov is the son of Andrei Gerasimov. In one of the open traffic police databases posted on the Internet, it appears that a person with a name, surname and date of birth that matches those indicated by Anton Gerasimov on the MSTU website. Bauman, registered at the same address as Andrey Gerasimov.

Lintechno has a license issued by the Federal Service for Technical and Export Control for technical protection of confidential information, follows from SPARK-Interfax data. According to the company's presentations on the now defunct website (available to RBC), among its customers are the Federal Agency for the Supply of Arms, Military, Special Equipment and Materiel, OJSC RTI (a defense concern that is part of AFK Sistema) and etc. According to SPARK-Interfax, Lintechno's revenue in 2014 amounted to 58.5 million rubles, later data were not disclosed.

In October 2014, Anton Gerasimov, as the general director of Lintechno, gave an interview to the Pro Business TV channel. In it, he, in particular, said that Lintechno was formed in accordance with the federal law on the creation of small innovative enterprises at universities; it is engaged in the commercialization of developments made by students and graduate students of the Moscow State Technical University. N.E. Bauman. “We have the opportunity to work with talented guys who have created something in their free time from school. We support them in this, we conclude a license agreement with them, according to which they receive profit, benefit from the sale of this product. We bring this product to market conditions and sell it,” Gerasimov said.

Sergey Sherstobitov, CEO of Angara Technologies Group, who then interviewed Anton Gerasimov, told RBC that he was chosen as a hero, as he served as deputy head of the information security department at Moscow State Technical University. Bauman. “Our dialogue was based on his work in this direction, as there is an acute shortage of personnel in the field of information security on the market. That was then, and now the deficit is only getting worse. The position he held at Lintechno became known already on the set, ”said Sherstobitov. According to him, Lintechno is not a very prominent player on the market. “There are a lot of companies, well-known or not, that we regularly encounter in tenders, Lintechno is not on this list.

Perhaps they have some special licenses to work in the field of state secrets. This is a separate, rather large segment of the market. But it is not so public, the vast majority of market participants may not know about it. Not all companies are ready to develop in this segment, since working with state secrets imposes certain restrictions, for example, on traveling abroad,” Sherstobitov says.

In February 2015, Anton Gerasimov left the co-founders of Lintechno - his 26% share was transferred to Olga Andreevna Gerasimova, who still owns it. Olga Gerasimova is the sister of Anton Gerasimov and the daughter of Andrey Gerasimov, two top managers in the information security market say. The market players interviewed by RBC refused to talk about how much a share costs and whether this deal was cash. In addition to Lintechno, Olga Gerasimova owns 34% of the RestLab travel agency.

Olga Gerasimova did not respond to RBC's request. RestLab only confirmed that Olga Gerasimova is one of its co-founders and declined to comment further. According to Olga Gerasimova's profile on the Professionals.ru social network, she specializes in corporate events and travel, and worked for several years as the head of training and personnel development at Rostelecom. Prior to receiving a share in Lintechno, she had no relation to the field of information security.

Moscow region official

In April 2015, by order of the Governor of the Moscow Region, Anton Gerasimov was appointed Deputy Minister of Public Administration, Information Technology and Communications of the Moscow Region, where he oversees the direction of special systems and information security. He holds this position now, according to the website of the ministry. When comparing the photograph of Deputy Minister Anton Gerasimov and the image from the interview with the general director of Lintechno, it is obvious that this is one and the same person.

In December 2016, Anton Gerasimov was awarded a certificate of honor from the Governor of the Moscow Region Andrey Vorobyov "for high professionalism and great contribution to the socio-economic development of the Moscow Region." In July 2016, he also joined the Council for Import Substitution of the Moscow Region, the chairman of the council is the Minister of Investments and Innovations of the Moscow Region Denis Butsaev.

The Council is called upon to promote the growth of the percentage of production of import-substituting products in the region and develop measures to support organizations involved in the implementation of import substitution plans. According to the official websites of several regional administrations of the Moscow Region, on December 2, 2016, this Ministry of Investments and Innovations, together with the Bauman Moscow State Technical University, held an event at which the heads of industrial companies were supposed to present the developments of seven enterprises, among which Lintechno is listed. The ministry said in a statement that Lintechno had made “unique, completely ‘trusted’ software created by university developers under the control of the 8th center of the FSB and successfully implemented in a number of structures of the Ministry of Defense.”​

First Deputy Minister of Public Administration, Information Technology and Communications of the Moscow Region Andrey Borodin, in response to a request from RBC, said that Anton Gerasimov "complies with the requirements of anti-corruption legislation" and annually submits information on income and property. RBC was unable to find Anton Gerasimov's income declaration in the public domain.

"Violations of prohibitions related to the state civil service were not allowed by Anton Andreevich, he did not have any conflict of interest by the commission of the Ministry of State Administration of the Moscow Region on compliance with the requirements for official conduct of civil servants and the settlement of conflicts of interest," Andrey Borodin said. He also pointed out that no government contracts or contracts for the supply of goods and services were concluded between the ministry and Lintechno in 2015-2017.

Anton Gerasimov did not respond to requests from RBC.

closed market

Market participants refused to officially comment on how the retirement of the head of the CIB will affect the business of his children. RBC's interlocutor, close to law enforcement agencies, noted that the redistribution of the market after the departure of a major figure from law enforcement agencies is a common thing.

“For example, when Alexander Starovoitov headed the Federal Agency for Government Communications and Information (now liquidated, partly included in the FSB. - RBC), one of the main suppliers of cryptographic information protection systems was the Moscow “daughter” of the Penza Research Electrotechnical Institute, which was previously headed was Starovoitov. After his resignation, the company instantly lost its market position, and when we were going to buy its products, the curator said that now it is the “wrong” company, ”the RBC source concluded.

Representative of MSTU im. Bauman told RBC that Lintechno would continue to work, and the information contained on the company's website "partially lost its relevance, including the phone number, and is currently being specified as part of finalizing sections of the site, the site will start working after the end of the vacation period." The university emphasized that the enterprise was created to introduce the results of the intellectual activity of the university's author teams in the field of information technology, and refused to disclose its financial performance.

The supply of information security tools to law enforcement agencies is a specific segment of the information security market. “Works related to state secrets require the performers to have appropriate licenses, which limits the number of potential participants. The number of players operating in this market does not noticeably change. At the same time, regulators are now strengthening control over compliance with requirements for companies that work in the field of protecting state secrets. The most famous players in this market are FSUE NPP Gamma, FSUE NTC Atlas, Mask, CBI, Evraas, - says Sergey Sherstobitov.

“The size of the information security market for the public sector, that is, various government agencies, as well as special services, is up to 15 billion rubles. There are a lot of regulators in this area, and only after receiving a number of certificates and licenses, the company will be able to supply its products, for example, to the military-industrial complex, Vladimir Ulyanov, head of the Zecurion analytical center, told RBC. “So, the Ministry of Defense has its own certification system, a number of licenses are issued by the FSB, there is FSTEC certification, in addition, permits are issued by the Ministry of Communications, Roskomnadzor and the Central Bank.”

According to him, customers in this market "first of all look not at the functionality of the software product, but at whether there are necessary documents for it." “There is a lot of money in the market, and the mechanisms of competition there are not entirely market-based. Much depends on personal connections - even obtaining all the necessary certificates does not guarantee that the company will be able to sell its product. As a rule, the special services have a number of entrenched players who supply them with their products for years and develop specific solutions for them that are not in demand in the commercial sector,” Ulyanov notes.