Kaspersky bans and allegations of Russian government ties

According to the International New York Times, Kaspersky has "become one of Russia's most recognized high-tech exports, but its market share in the United States has been hampered by its origins."[1] According to Gartner, "There's no evidence that they have any back doors in their software or any ties to the Russian mafia or state... but there is still a concern that you can’t operate in Russia without being controlled by the ruling party."[2] CEO Eugene Kaspersky's prior work for the Russian military and his education at a KGB-sponsored technical college has led to allegations of being employed by Russia to expose US cyberweapons, though he denies this.[3][4] Analysts such as Gartner's Peter Firstbrook say suspicions about the firm’s Russian roots have hindered its expansion in the US.[2] The company has denied that it has direct ties with or has engaged with the Russian government.[5]

In August 2015, Bloomberg News reported that Kaspersky Lab changed course in 2012, as "high-level managers have left or been fired, their jobs often filled by people with closer ties to Russia's military or intelligence services. Some of these people actively aid criminal investigations by the FSB, the KGB’s successor, using data from some of the 400 million customers".[6] Kaspersky slammed Bloomberg's coverage on his blog, calling the coverage sensationalist and guilty of exploiting paranoia to increase readership.[7]

From July 2017 to December 2017, U.S. government agencies phased out their use of Kaspersky software. In July 2017, the United States' General Services Administration (GSA) removed Kaspersky Lab from its list of vendors authorized to do business with the U.S. government amid further reports by Bloomberg and McClatchy DC alleging that Kaspersky Lab had worked on secret projects with Russia's Federal Security Service (FSB). Anti-Russian sentiment had also grown in the country in the wake of an investigation of Russian interference in the 2016 presidential election. Kaspersky denied these reports, stating that it did not have "inappropriate ties" with any government, and "never received a request from the Russian government or any affiliated organization to create or participate in any secret projects, including one for anti-DDoS protection."[8][9][10][11]

On 8 September 2017, U.S. electronics store chain Best Buy pulled Kaspersky products amid concerns over these ties.[12] On 13 September 2017, the Department of Homeland Security issued an order stating that in 90 days Kaspersky products will be banned from use within the U.S. civilian federal government, citing "[concerns] about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks."[13]

On 6 October 2017, The Wall Street Journal—citing "multiple people with knowledge of the matter"—alleged that in 2015, hackers working for the Russian government used Kaspersky antivirus software to steal classified material from a home computer belonging to a National Security Agency (NSA) contractor. According to the report, the incident occurred in 2015 and remained undiscovered until early 2016. The stolen material reportedly included "details about how the NSA penetrates foreign computer networks, the computer code it uses for such spying and how it defends networks inside the U.S."[14] The New York Times reported that the hacks had been discovered by Israeli intelligence agents who had themselves hacked into Kaspersky's network.[15] On 11 October 2017, The Wall Street Journal additionally alleged that Russian intelligence uses Kaspersky software to scan computers worldwide for material of interest.[16] The company once again denied the reports, arguing that they were "baseless paranoia" and a "witch hunt", and considered it suspicious that major U.S. media outlets simultaneously "went for us almost in full force and they fantasized simultaneously, as if receiving an order, but they've got confused in details."[17][18]

On 23 October 2017, Kaspersky announced a "Global Transparency Initiative", under which it would be more accountable for security issues surrounding its products, and would allow third-party analysts to validate its products and other business practices in order to validate their integrity. The company stated that trust "must be repeatedly earned through an ongoing commitment to transparency and accountability", and that this program was a "reaffirmation of the company's commitment to earning and maintaining the trust of their customers and partners every day."[19]

On 25 October 2017, Kaspersky confirmed that the incident described by The Wall Street Journal had occurred in 2014, and was the result of the software having detected a ZIP file containing samples and source code from the Equation Group. The user had enabled the Kaspersky Security Network (KSN) features of the software, so the files were automatically uploaded to Kaspersky as a malware sample to KSN for analysis, under the assumption that it was a new malware variant. Eugene Kaspersky stated that he ordered that the sample be destroyed. Kaspersky claimed that the antivirus software had been temporarily disabled by the PC's user in order to install a pirated copy of Microsoft Office. When the software was re-enabled, it detected both the Equation Group code, as well as unrelated backdoor infections created by a keygen program for Office, which may have facilitated third-party access to the computer.[20][21][22][23]

On 13 November 2017, the British intelligence agency MI6 raised suspicions over Kaspersky Lab software after it was distributed for free to more than 2 million UK Barclays customers.[24] On 2 December 2017, Barclay's announced that they would no longer provide their new customers with the company's software.[25] Also around 2 December 2017, Britain's National Cyber Security Centre advised, as a national security precaution, that UK government departments avoid Russia-based anti-virus software such as Kaspersky, but stated there was "no compelling case at present to extend that advice" to the wider public.[26] On 9 December 2017, the U.S. government banned Kaspersky from federal civilian and military computers as part of a broader defense bill.[27]

In January 2018, Twitter banned Kaspersky from advertising on Twitter, stating that "Kaspersky Lab operates using a business model that inherently conflicts with acceptable Twitter Ads business practices", and citing the Department of Homeland Security's warning about Kaspersky.[28]

On 15 May 2018, Kaspersky Lab announced that it would be migrating some "core infrastructure" from Russia to new data centres in Switzerland. Kaspersky software and antivirus definitions for foreign markets will be compiled and digitally signed in Switzerland by the end of 2018 (products targeting Russia will still be compiled on existing domestic infrastructure), and user data for most foreign markets will be stored and processed on Swiss servers by the end of 2019. The Swiss operations will be overseen by a third-party organization holding "all access necessary to verify the trustworthiness of our products and business processes", and will be accompanied by one of the three planned "Transparency Centre" facilities, at which "responsible stakeholders" will be allowed to inspect Kaspersky's source code and business practices to verify their integrity. Kaspersky stated that this move was "first and foremost in response to the evolving, ultra-connected global landscape and the challenges the cyber-world is currently facing", and was a further step in its goal to be more accountable and trustworthy in its business practices.[29]

In December 2017 and February 2018 the company sued the Trump administration, arguing the ban to be a bill of attainder and a violation of due process, and arguing that the government unfairly tarnished Kaspersky's reputation.[30][31] Both cases were dismissed on May 30, 2018 by Judge Colleen Kollar-Kotelly, a former presiding judge of the Foreign Intelligence Surveillance Court, declaring both as unsubstantial.[32][33][34]

• Duqu 2.0