The developer of a compliance scanner designed to check websites against Russian Federal Law 152-FZ on personal data identified eight critical flaws in the tool's logic. These errors previously led to false violation reports for major entities, including Gosuslugi, Russian Railways (RZD), and T-Bank.
The scanner incorrectly flagged sites due to issues like incomplete page rendering, misinterpretation of SSL certificates from Russian certificate authorities, and confusion between privacy policies and news sections. For instance, the tool failed to parse JavaScript-heavy pages, leading to false 'missing policy' reports.
To improve accuracy, the developer implemented three verification tools. These tools cross-check results for internal contradictions, verify if rules are too broad or narrow, and perform secondary checks by re-opening sites with different code. The developer also updated the logic to handle server-side errors and anti-bot protections more gracefully.
The scanner now distinguishes between actual site failures and external factors like anti-bot protection. Furthermore, the developer replaced static registry lookups for data operators with live queries to the Roskomnadzor portal, ensuring that the tool remains functional even when official bulk data files are unavailable.
The updated system now includes pre-flight checks and automated notifications if external data sources are unreachable. These measures prevent the scanner from silently failing or reporting false positives, ensuring that users receive clear, actionable information rather than ambiguous error codes.
