Back
Automatically translated version. May contain inaccuracies compared to the original.
The state enterprise “Ukrainian Special Systems,” which likely issued a real electronic key to an unknown person in the name of Ruslan Ryaboshapka, did not conduct an examination of the enhanced certificate for that key either in response to a parliamentary inquiry or after journalists’ requests.
The state enterprise “Ukrainian Special Systems,” which likely issued a real electronic key to an unknown person in the name of Ruslan Ryaboshapka, did not conduct an examination of the enhanced certificate for that key either in response to a parliamentary inquiry or after journalists’ requests. This is reported in Alisa Yurchenko’s segment for the program Our Money with Denys Bihus.
The following facts point to the involvement of the SE Ukrainian Special Systems (USS) in the unlawful issuance of an official electronic key used to publish a fake declaration of a member of the National Agency on Corruption Prevention (NACP), Ruslan Ryaboshapka.
An internal inspection by the NACP established that there was no hack of the e-declaration system; they accessed it using a valid electronic key, and the electronic digital signature file on the declaration “contains a hyperlink to the address of the accredited key certification center of the SE ‘USS’.”
After the press conference, programmers downloaded from the SE ‘USS’ website an enhanced public key certificate that contains the same personal data entered into Ryaboshapka’s fake declaration (his initials and tax ID 1234567892).
The SE carried out several manipulations, apparently trying to hide traces of this certificate’s existence. First, the key certificate disappeared from the SE ‘USS’ website, and its number appeared on the official list of revoked keys. Shortly thereafter, that number, along with a number of other keys with similar numbers, also disappeared from the list of revoked keys on the USS website. But programmers had already downloaded that list as well.
Both the certificate itself and the lists of revoked keys are documents that contain an electronic digital signature, so they can be verified at any time. The SE ‘USS’ even provides an official service “Verification of the validity of an electronic digital signature on documents submitted electronically to the CSC at the request of persons who are not CSC clients.”
Journalists from Our Money contacted the USS CSC to verify the certificate and the list of revoked keys published by the programmers. However, the SE ‘USS’ informed them that it could not accept the documents for verification for two reasons: 1) at that very moment, tariffs for the service were under review. 2) the SE doubted that providing such a service complied with the current regulatory framework.
In addition, the journalists personally handed the file with the certificate and a public information request to USS director Taras Oliynyk. After the segment aired, a response was received from the SE ‘USS’.
The journalists asked Taras Oliynyk to state whether the USS CSC had issued or recognized as invalid the specific public key certificate of the electronic digital signature (registration number: 425D4BC6E44FFB1004000000E20E000026190000), attaching it electronically to the information request.
In response, the state enterprise said it had checked only the full name of the owner listed in the certificate and found that Ryaboshapka R. H. had not been issued electronic digital signature services. This is a manipulation, because the key itself was not examined. The likely crime is precisely that a key in the name of Ryaboshapka R. H. was issued to another person so that deputies Anton Herashchenko and Ivan Vynnyk could hold a press conference about a “hack” of the e-declaration system.
The SE gave a similar response to a parliamentary inquiry from People’s Deputy Pavlo Kostenko. Instead of conducting an examination of the key (which would have confirmed the very fact of generating a key certificate in the name of Ryaboshapka R. H.), as the deputy requested to be done in his presence, the SE ‘USS’ sent a letter stating that the key had not been issued to Ryaboshapka R. H.
Document: PDF proof of the original version of the news item "Донька Держспецзв’язку відмовляється провести експертизу сертифіката на ключ, який містить ім’я Рябошапки та фейковий ІПН". It records the publication content at the moment of the first scan, the preservation date and the source: Bihus.Info.
