The US government has banned federal agencies from using cybersecurity software made by Russian company Kaspersky Lab over fears that the firm has ties to state-sponsored spying programs.
On Wednesday, the Department of Homeland Security (DHS) issued a directive, first reported by the Washington Post, calling on departments and agencies to identify any use of Kaspersky antivirus software and develop plans to remove them and replace them with alternatives within the next three months.
“The department is concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks,” the DHS said in a statement.
“The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates US national security.”
Kaspersky Lab is one of the world’s largest and oldest antivirus software companies and claims to have 400 million users worldwide.
Their products usually have access to every file on the computers they protect and regularly communicate with Kaspersky to receive updates, which is typical of antivirus software. This means that they could theoretically provide backdoor access to sensitive information on government networks.
The Russian company denied the allegations and said in a statement: “Kaspersky Lab doesn’t have inappropriate ties with any government, which is why no credible evidence has been presented publicly by anyone or any organization to back up the false allegations made against the company.”
The company concluded that it was “caught in the middle of a geopolitical fight” and is being “treated unfairly even though the company has never helped, nor will help, any government in the world with its cyberespionage or offensive cyber efforts.”
Kaspersky highlighted that more than 85% of its revenue comes from outside Russia, so it would be detrimental to its bottom line to work inappropriately with any government.
The DHS is inviting Kaspersky to submit a written response to address or mitigate its concerns.
“The department wants to ensure that the company has a full opportunity to inform the Acting Secretary of any evidence, materials, or data that may be relevant,” it said in a statement.
The decision comes at a time when the US government has jitters about Russian efforts to interfere with the US presidential election. An ongoing investigation has discovered that Russian spy services hacked political organizations including the computer networks of the Democratic National Committee and leaked damaging information.
Kaspersky has long been suspected by US officials of having ties to Russian intelligence agencies.
In May, six US intelligence and law enforcement chiefs were asked in a Senate hearing if they’d let their networks use Kaspersky software and they all said no.
At the time, the company’s CEO, Eugene Kaspersky, who attended a KGB-sponsored school, described the fears about the company’s ties to the Kremlin as “total BS” and “unfounded conspiracy theories” .
However, Bloomberg Businessweek obtained emails indicating that the relationship between the security software company and the FSB, Russia’s main intelligence agency, are much cozier than public statements suggest.
The company, according to the emails from 2009, had developed security technology for the FSB and advised staff to keep the collaboration secret. The project was led by Igor Chekunov, Kaspersky Lab’s chief legal officer and a former member of the KGB.
Kaspersky Lab said that the facts of the emails have been “misconstrued to fit in with the hypothetical, false theory”.
“[Kaspersky Lab] does regularly work with governments and law enforcement agencies around the world with the sole purpose of fighting cybercrime.”