 |
| The Kazakh government intercepts HTTPS data |
The Kazakh government is using cybersecurity activities as an excuse to force citizens of the capital, Nur-Sultan, to install digital certificates on their devices when accessing Internet services abroad.
Digital certificates are designed to monitor citizens' internet usage and enable the government to intercept all HTTPS data from user devices using Man in the Middle (MitM) attack technology.
Kazakhstan ISPs (such as Beeline, Tele2, and Kcell) only redirect Sultan users to a website with instructions on how to install digital government certificates.
Nur-Sultan residents also received text messages informing them of the new regulations.
Users in Kazakhstan have been told that they will not be able to access websites such as Google, YouTube, Twitter, Facebook and Instagram if the government digital certificate is not installed.
This is the third attempt by the Kazakh government to force citizens to install digital certificates in their devices, after the first attempt in December 2015 and the second attempt in July 2019.
After the browser manufacturer blacklisted the government certificate, both attempts above failed.
In July 2019, Google and Mozilla blocked the digital certificate called (Qaznet) disclosed by the Kazakh government, which was used to monitor the encrypted internet activity of all users who installed the certificate.
Kazakh officials have said their efforts to intercept HTTPS data are cybersecurity training for government agencies, telecoms and private companies.
They indicated that during the current Corona epidemic, cyber attacks on the Internet industry in Kazakhstan increased 2.7 times, which is the main reason for this activity, and officials did not clarify how long this activity will continue.
The Kazakh government used a similarly vague statement last year, describing its measures as a security measure to protect citizens.
Browser manufacturers have played a major role in preventing the Kazakh government from making the first two attempts to intercept HTTPS data. They said they would investigate recent events and take appropriate action.