Web services provider Yandex has admitted that it stores user metadata in Russia-based servers, raising concerns that the government in Moscow could be able to track individual users via their smartphone.
Yandex has traditionally been positioned as a ‘Russian Google’, offering users a range of services like search, email, maps and an app store where users can download applications to their Android handset.
It also offers software development kits (SDKs) that allow other app developers to include certain functionality into their creations. One of these, AppMetrica, is widely used to help developers gather and analyze data for marketing purposes.
Yandex data
However, security researcher Zach Edwards discovered that AppMetrics sends metadata, such as device, network, and IP address to Russia. This has been confirmed by four researchers contacted by the Financial Times.
Yandex told the newspaper that it did send data to both Russia and Finland, but stressed the information was anonymous and that no one in practice would be able to identify the user in question.
However, this view has been challenged by other observers, and has led to many applications uninstalling the SDK to in order to protect user privacy. It is thought AppMetrica is on 52,000 different applications on both iOS and Android, and that there has been more than 100 million installations.
Conversely, the SDK has been added to several applications, including those claiming to offer virtual private network (VPN) services and free calls, seemingly only to capture data to send back to Russia.
Russia’s invasion of Ukraine appears to have at least temporarily halted Yandex’s international ambitions and highlights the difficulties that Russian technology firms will have in the near future. The company, which is listed on the New York Stock Exchange, recently laid off workers at its robot and self-driving car divisions in the US, while Estonian ministers have suggested the Yandex Go taxi app be banned in the country.
Earlier this month, Mozilla removed Russian search engine providers Yandex and Mail.ru from its list of providers amid concerns that they prioritized misinformation over other forms of content.
Via Financial Times