Encryption & Data Storage Legislation in Russia
In mid-2016, Russia passed a bill known as the “Yarovaya law”. This legislation includes a vast data-eavesdropping and retention program, requiring companies doing business in Russia to record and store all customer communications for at least six months.
While telecommunications and internet companies are affected most by these new laws, all companies looking to move IT equipment into Russia have been affected by this legislation. Companies are racing to become compliant with the new laws and avoid fines as high as 1 million rubles for non-compliance.
Due to the vast storage requirements, new equipment must be purchased either in Russia or imported from another country. Purchasing this equipment in Russia can be expensive and slow as local VARs need 4-6 months or more to source infrastructure hardware.
Importing the equipment can be done, but is complex and requires significant import documentation as well as licenses, permits, and permission from each manufacturer. The right logistics partner can guide you through the import process, enabling you to quickly procure the needed equipment in the US or EU, then ship it to Russia in under 4 weeks.
FGX is uniquely positioned to help our clients navigate the complex customs & import compliance landscape in Russia. This case study outlines the benefits of our “Buy Local – Ship Global” methodology and how it provides more control, monetary savings and shorter timelines for our clients.
The Case Study
A leading international data center & cloud services provider with 22 global locations; the client is rapidly growing their presence in APAC and EMEA through both organic expansion and acquisitions. Presented with an opportunity to provide managed hosting services to a Fortune 100 company in Moscow, our client needed a way to rapidly deploy several million dollars of IT infrastructure equipment to Russia.
The timeline was tight as new data protection legislation demanded full compliance in a matter of months. Without a business entity setup in Russia, the client needed an efficient solution to import this equipment for installation in a colo facility.
FGX built a solution to enable the client to purchase all of the equipment from their preferred VAR in the US, and take advantage of their competitive volume pricing and quick delivery SLAs. Once purchased, the gear from 8 different manufacturers would be drop-shipped to FGX’s export facility in New York City. FGX would manifest each item by part and serial number, then custom crate the equipment for safe transit.
Utilizing FGX’s IATA membership, cargo space would be booked on a direct flight from NYC to Moscow, ensuring the most logistical control and fastest possible transit time. To facilitate import clearance, FGX would utilize their importer of record (IOR) service and work directly with each manufacturer to obtain compliance documents like EAC Certificates, FSB Notifications, and Letters of No Encryption. After clearing customs, a dedicated and secure vehicle would be arranged to deliver the equipment to the destination data center facility.
As soon as the bill of materials was finalized, FGX’s compliance team began compiling all of the import documentation by liaising with individual manufacturer contacts. The entire shipment was simulated with customs prior to departure to ensure the documentation was valid and that all compliance requirements had been met.
Utilizing a direct commercial flight, the equipment arrived in Moscow overnight and began customs processing the day of arrival. FGX managed the entire customs process on behalf of the client, provided the importer of record service and completed clearance within 14 business days. Once cleared, the crates were delivered the following business day, well within the client’s aggressive timeline.
Importer of record is a term used in customs law. It refers to an importer, whether an entity or individual, who is responsible for ensuring that legal goods are imported in accordance with the law of the place. Importer is responsible for filing legally required documents.
The Ideal Logistics Partner
When conducting a large scale deployment of IT equipment into Russia, you need to have a partner capable of managing the entire shipment end-to-end. You should involve your logistics partner as soon as the initial BOM is put together as they will assist you in validating that each part satisfies encryption regulations and will be cleared for import.
- Pre-screen the bill of materials (BOM) to ensure all components are cleared for use in Russia
- Work with OEMs to recommend russia-compliant encryption configurations to the VAR
- Manage the classification of all part numbers, HTS Codes and ECCN numbers for the equipment in the bill of materials
- Coordinate the collection of all required compliance documents for a range of manufacturers, component types and encryption levels
- Understand the duty & tax implications and ensure the required taxes are paid on time to ensure no delay to the project timeline
Logistics & Customs Clearance
- Coordinate custom crating for safe international air transit
- Arrange for direct, expedited air transit from the United States to Moscow
- Provide an importer of record service to allow the client to import IT equipment into the country
World Class Project Management
Most importantly, your partner should provide comprehensive project management and timely communication throughout the process by interfacing with the client, the VAR, the destination data center, customs, as well as the manufacturers and their compliance departments to ensure strict adherence to the required client deadline.
The Shipment in Numbers
The complexity of shipments into Russia varies based on a number of factors including the value of the actual shipment, the physicality of the parts being sent over, the manufacturers of the equipment, as well as the level of encryption each device utilizes.
Each one of those factors affects the type of documentation required and the amount of time taken to source all necessary permits prior to the shipment departing the United States.
- Total Shipment Value: $3.6 Million USD
- 320 Components: Routers, Switches, Firewalls, and Accessories
- 15 Custom-Built Crates: Over 5,000 lbs of equipment
- 7 Manufacturers: CISCO, EMC, Brocade, Gigamon, F5, Arbor, WTI
- 94 Compliance Documents: EAC Certificates, Letters of No-Encryption, FSB Notifications
The Plan & Execution
FGX devised a 3-month project execution road-map based on the client’s required deadline for go-live in Russia. This detailed outline provided our client, the VAR, and FGX with structured guidance and transparency on all deadlines. The dedicated project manager assigned to this project also ensured that all parties stayed on task and were aware of the dependencies related to their assigned tasks.
- June 1st, 2016 – BOM finalized & Orders placed
- June 1st – June 14th, 2016 – Compliance Documentation Procured
- June 16th, 2016 – Duties, Taxes & IOR fee Collected
- July 5th – August 5th, 2016 – All Equipment is Custom Crated
- July 20th, 2016 – First Shipment Departs for Moscow
- July 25th – September 6th, 2016 – Customs Processes Each Shipment
- August 7th, 2016 – Final Shipment Departs for Moscow
- August 18th, 2016 – First Shipment Delivered to Data Center
- September 8th, 2016 – Final Shipment Delivered to Data Center
Once final bill of materials was confirmed, FGX coordinated with Russian customs to understand the compliance requirements for each of the 320 components and sub-components in the shipment. Customs requires documentation for each and every part number declared on the commercial invoice.
Electro-mechanical devices, specifically power supplies, must have a corresponding EAC Certificate which is similar to an FCC approval stamp in the US. For devices that utilize encryption technology, different documentation is required, depending on the level of encryption.
Devices that utilize mid-level encryption require an FSB Notification, while devices that utilize a high level encryption may require an additional import license or activity permit. Devices that do not use encryption typically need a letter from the manufacturer certifying that the specific device part number doesn’t use encryption.
FGX’s customs compliance team proceeded to liaise with the 7 different manufacturers involved to procure the following set of documents for each component:
FGX provided the client with an online project tracker that allowed both our client and their preferred VAR to regularly monitor which items had been received at the FGX warehouse as well as what compliance documentation had been sourced and what was outstanding. FGX published photos of every single component and scanned packing lists as each shipment arrived at the export facility.
In addition to the online tracker, FGX continuously provided updates on the anticipated timeline and ensured that required documentation, quote approvals, and duty & tax payments occurred on time to ensure no delays to the final deployment.
Crating & Transit
The entire shipment was crated with anti-static foam and IPCC treated wood. FGX also custom-built a crate to house the 42U cabinet, complete with a built-in ramp and shock-absorbers for safe transit. The equipment was crated with items of the same manufacturer grouped together to ensure that Russian customs officers could easily locate any devices of interest should a physical inspection be required.
Once crating was completed and all documentation had been pre-approved by the local customs team, the shipment was tendered on a direct flight to Moscow. FGX’s IATA membership enabled us to utilize any commercial or cargo airline with available space to transport the equipment as quickly as possible. The shipments safely arrived in Moscow less than 24 hours after departing from New York.
Breaking Up the Shipment
Since the shipment consisted of equipment from multiple manufacturers, with varying shipping SLAs, some equipment arrived at FGX’s facility later than planned.
To reduce the impact on the overall timeline, FGX advised the client to split the shipment into three-phases. Each phase was grouped by manufacturer, and resulted in a staggered clearance which was easier for Russian customs to process. Since the majority of the equipment had already been cleared and delivered, when the final phase arrived at customs, the processing time was reduced, resulting in an on-time delivery for the third phase.
Customs Clearance & Final Delivery
In order to expedite the clearance process as much as possible, duties & taxes were pre-paid to Russian Customs in advance of each shipment arriving at the border. Simultaneously, FGX arranged for pre-clearance for each shipment, so that customs received the necessary documentation prior to the shipment physically arriving at the border.
Once each shipment arrived at customs, they were cleared against the entries already created during pre-clearance. Following customs clearance procedures using our importer of record (IOR) service, and physical equipment inspections, the shipments were released for final delivery to the datacenter.
FGX coordinated directly with the receiving data center to understand their delivery requirements well in advance of the first shipment. This ensured there would be no surprises when the crated equipment arrived at the final destination.
Delivery was completed with dedicated air-ride trucks and additional man power to assist in off-loading the large crates. The project was completed on schedule, allowing the client to meet their internal deadlines and dispatch a team of engineers to setup the newly imported equipment. The stakes were high, but FGX delivered a rock solid service offering that gave the client confidence for future shipments.