Russian-born tech giant Yandex has responded to allegations surrounding the security of user data. In a blog post published on 1 April, the company clarified the functions of analytics tool AppMetrica, which has come under scrutiny in the past week. It also insisted that its use of data is transparent, and invited international auditors to conduct an appraisal of the company’s privacy policy and data collection practices, which it says are in line with normal practice for major technology companies in the US and around the world.

The aim of the blog post was to answer reports in international media accusing Yandex’s software of storing information about users in Russia, and suggesting that the company could pass that data on to the Kremlin.

Yandex’s riposte to the former claim is clear: yes, it does keep some data on Russian servers. Moreover, the company says, it is quite open about this fact.

“We make no secret of our Russian roots… We work in full compliance with international and local laws. Data received from app developers is stored in a distributed storage platform both in Finland and in Russia, as stated clearly in our Privacy Policy,” the blog post said. “The idea that we ‘secretly’ send this data to Russia is simply wrong. Our Privacy Policy has always been publicly available for anyone.”

Articles questioning Yandex’s handling of customer data have centred on a software called AppMetrica – a tool which enables app developers to analyse in-app user performance and improve the user experience accordingly. Yandex’s peers have similar tools, which are known as SDKs (software development kits).

Yandex says that AppMetrica works in the same way as comparable SDKs, including Google’s Firebase, Yahoo’s Flurry and analytics platform Adjust. Like them, the company only gathers data which both the app developer and the user expressly permit it to analyse.

The company was also at pains to stress that data collected by AppMetrica is generalised and grouped in one big analytics report. “We do not collect any sensitive user data concerning users’ names, addresses, phone numbers, payment details, personal ID data or any other sensitive personal details that the user shares with the application. We also do not and cannot collect data about what users do outside the app,” Yandex said in its blog post.

Instead, AppMetrica records data which is useful to the app developer, including the user’s operating system version, how long they spend on the app, and when the app crashes.

Addressing the question of whether the Russian government can access user data, Yandex was clear: “We have never given out any information on users of any apps with AppMetrica installed on them, nor have we ever been asked to.”

In theory, internet companies can field requests for access to information from governments. Google’s former chief legal officer David Drummond wrote about precisely this in Google’s blog, The Keyword, warning in 2013 that government requests for user information were on the rise.

In addition to Russian authorities, Yandex could be asked to provide data to international bodies like Interpol.

“We are fully transparent about all data requests we satisfy, and we publish a detailed report on a regular basis,” the company’s blog post said.

The global tightrope walk

Yandex, which was founded in Russia in 1997, has since expanded its presence in international markets. Listed on America’s NASDAQ, and with headquarters in the Netherlands, the company brings fresh meaning to the term “digital nomad”.

Yet this globalism has also created an unenviable predicament for Yandex. Caught between the often contradictory demands of Russian regulation and its international stakeholders, it seems that the company’s every move could cause umbrage.

This was reflected in the joint statement made by non-executive directors Esther Dyson and Ilya Strebulaev, who stepped down from the company’s board in March, citing the difficulty of reconciling these competing pressures.

“The company and all its employees are going through a terrible time. They find themselves under enormous pressure both inside and outside the country… It has become impossible for the team to continue to provide a free and open platform for information for the Russian public without breaking the law and putting the company and its employees at risk.”

A similar story undergirds the resignation of Deputy CEO Tigran Khudaverdyan just weeks after Ms Dyson and Mr Strebulaev, after he was sanctioned by the EU. This decision came as a shock to people who know the company and Tigran – an entirely self-made man who joined Yandex as an engineer more than 15 years ago, who is hardly someone who could be described as “close to the Kremlin”. Nevertheless, he was forced to step down.

Yandex has made it clear that the news stories it shows in Russia are simply in line with Russian law, which has cracked down on independent journalists, including compelling them to call the war in Ukraine a “special military operation”, or they can be found guilty of treason, which carries a 15-year jail sentence.

John Boynton, the American chair of Yandex’s board, said: “we were shocked and surprised to learn that Tigran was designated under EU sanctions, and we are extremely sorry to see him step down from his executive director and deputy CEO roles.”

A template for the tech world

In fact, Yandex has been navigating these fraught waters rather deftly for years. Big tech companies around the world are challenged by their simultaneous obligations to government and stakeholders, but nobody has yet found a perfect solution. Needless to say, this fine line is a good deal harder to tread for a company hailing from Russia.

But Yandex demonstrated a good deal of savvy in 2019 when it restructured its corporate governance. The share price had been taking a hit as shareholders became concerned that the company’s increasing customer base could make it a target for draconian regulations, nationalisation or a foreign ownership ban.

In response, Yandex set up a special body called the Public Interests Foundation (PIF), comprised mostly of representatives of Russian higher education institutions, and gave it two seats on the board of directors. The trade-off was that Yandex got to maintain control over its operations and management in return for giving the PIF a veto on a limited range of issues, including transferring Russian users’ personal data to third parties, selling intellectual property and striking deals with non-Russian companies.

This compromise allayed the concerns of shareholders, with the company’s share price jumping significantly on the news. Bloomberg columnist Leonid Bershidsky argued that Yandex’s move “could be seen as a template for Big Tech”, granting bodies comprised of NGO and university representatives a veto on socially sensitive issues in return for the ability to satisfy shareholder and customer demands unimpeded in all other spheres. “It could probably satisfy most Big Tech critics in democracies, too,” Bershidsky suggested.

Yandex is now looking to divest its media platforms Yandex.zen and Yandex.news, as reported by bne IntelliNews. This, too, appears consistent with the desire to reconcile the pressures coming from within Russia with those of the company’s stakeholders.

Both platforms had become problematic, with a raft of new legislation introduced after Russia’s invasion of Ukraine compelling news aggregators like Yandex.news to only feature publications officially listed on the national media watchdog’s register.

At the same time, pressure is growing on multinational companies to leave the Russian market. Yandex is now in negotiations to sell its news services, perhaps with a view to exit the double bind created by owning a Russian news platform.

A source close to the discussions confirmed to bne IntelliNews that Yandex has entered negotiations with VK for the sale of its news services.

Yandex has a range of verticals, from ride-hailing apps to delivery robots. It is now reportedly hoping to boost the monetisation of its existing technologies through consolidation and international expansion. The skill and resource it has already demonstrated in navigating the conflicting demands of international stakeholders will serve it well in that pursuit.