U.S. Bans Kaspersky Antivirus Software Over Potential Russian Security Threat

The order was issued by the Department of Commerce's Bureau of Industry and Security (BIS), on the grounds that the Russian company providing this software, one of the most popular antivirus program suites in the world, could pose a national security threat to the United States at large.

The announcement came in a “Final Determination” that blocks “Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from directly or indirectly providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons.” As noted in the order, the prohibition also applies to the same category of products provided by the Russian parent company of Kaspersky Lab, Inc., as well as its subsidiaries and affiliated companies.

As further evidence of why the company received such a blanket prohibition for use or sale in the U.S. and to U.S. citizens, wherever they may be, the Commerce Department has also added three of Kaspersky’s business subsidiaries to its official “Entity List”. That is what the U.S. government deems a comprehensive “compilation of foreign individuals, companies, and organizations deemed a national security concern, subjecting them to export restrictions and licensing requirements for certain technologies and goods.”

The entities which form part of Kaspersky Software’s global network which the BIS added to the Entity List were AO Kaspersky Lab and OOO Kaspersky Group, both Russian-based companies; and Kaspersky Labs Limited, based in the United Kingdom. The announcement covering adding these enterprises to the list called out these three companies’ direct support of the Russian military’s own cybersecurity, cyberintelligence, and offensive cyber capabilities.

In banning the antivirus products of Kaspersky Lab, Inc. and its array of linked international companies, and making the decision to add the three Kaspersky’s subsidiaries to its Entity List, the BIS found that “the company’s continued operations in the United States presented a national security risk…that could not be addressed through mitigation measures short of a total prohibition.”

Besides the risk to American companies, the Commerce Department also identified the high risks that using Kaspersky Lab, Inc.’s antivirus software could pose to penetrating infrastructure enterprises across the country. Though not specifically called out, the risks posed to infrastructure would also apply to commercial technology suppliers to the U.S. military which may also be using the software.

The Commerce Department declaration did not refer to any specific examples of where Kaspersky’s software may have been used to cause harm to U.S. companies, or to extract sensitive or confidential from them. Instead, it referred to the high potential for risk for all U.S. enterprises, government institution, and individuals using the product.

 “Russia has shown time and again they have the capability and intent to exploit Russian companies, like Kaspersky Lab, to collect and weaponize sensitive U.S. information, and we will continue to use every tool at our disposal to safeguard U.S. national security and the American people,” said Secretary of Commerce Gina Raimondo in a statement released connected with the ban on Kaspersky’s products. “Today’s action, our first use of the Commerce Department’s ICTS authorities, demonstrates Commerce’s role in support of our national defense and shows our adversaries we will not hesitate to act when they use their technology poses a risk to United States and its citizens.”

The ban is being implemented under executive powers put in place during the Trump era which allow the U.S. Executive Branch of the government broad authority to restrict or outright ban trade between U.S. and foreign adversaries, or companies which are capable of manipulation or direction by those adversaries.

Kaspersky Lab's Russian parent company was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky, and Alexey De-Monderik. The concept for the product emerged after Eugene Kaspersky’s own computer systems were infected with the “Cascade” virus, one of the earliest global cybersecurity threats, in 1989. The Moscow-based company develops, distributes, and maintains an array of products designed to protect against such threats, including internet security, endpoint security, antivirus, and password management systems.

With such tight integration of those products at root levels of security in computers and servers, the product has access to – and the ability to infiltrate, if it truly does represent a threat to a company or individual – all data and programs on the networks and individual computer systems it is installed within.

Since its founding, Kaspersky has grown to a sizeable enterprise, with estimated 2023 global revenues of U.S. $753 million. Though only a minor player in this business in the United States, the company is the number one provider of cybersecurity products across all of Europe. It has also of late logged substantial growth in market share in Asia-Pacific countries, the region known as META (Middle East, Turkey, and Africa), and the Commonwealth of Independent States (CIS), a consortium of former states of the Soviet Union.

In a statement released yesterday about the ban by Chief Executive Officer Eugene Kaspersky from Kaspersky Labs’ Moscow headquarters, the CEO denied its software constitutes a security threat to any of its customers. He asserts the U.S. Bureau of Industry and Security’s accusations were based on “geopolitical climate and theoretical concerns” rather than from any real evidence of a cybersecurity threat.

Kaspersky says his company will be considering “all legally available options” to have the Commerce Department’s ban lifted.

The ban on the selling, distribution, purchase, or installation of all of Kaspersky Labs, Inc.’s antivirus software in the U.S., its territories, and to any U.S. citizens based out of the country, is effective 30 days from the June 20 BIS announcement.

Those who already have the software installed will be allowed to receive software updates to Kaspersky’s products for the next several months, to give them time to transition to other means of protecting their computers and servers. The Commerce Department begins prohibiting allowing downloads of updates to the software or antivirus definitions, as well as resales of the base product, as of September 29, 2024.