Recently, we have witnessed a very interesting dispute between Kaspersky and the US Department of the Interior. Let us recall that the Department of Homeland Security (DHS) banned the use of Kaspersky security software on federal computers.
This has naturally worried some who don't know if it's safe to use Kaspersky software on their computer.
We have gathered the facts, tried to understand the claims of each side, and we present to you what we found.
What the US Department of Homeland Security (DHS) says
According to the official DHS statement on the issuance of Binding Operational Directive 17-01, the Department has direct federal enforcement agencies to identify the use of Kaspersky software on Federal devices and remove it within 90 days. Why?
The Department is concerned about the ties between certain Kaspersky officials and Russian intelligence agencies and other government agencies. The Department is reportedly concerned that all of these Russian agencies, using Russian law, could request or compel assistance from Kaspersky and begin monitoring communications passing through Russian networks.
The statement also says that DHS is concerned that the Russian government could exploit Kaspersky products on U.S. federal computers, with or without Kaspersky's cooperation. The statement does not provide further information to support the Department's claims.
On the other hand, New Hampshire Senator Jeanne Shaheen has called on Congress to ban Kaspersky products from federal computers. In an interview with NPR, she said that there have been public concerns, and that some of those concerns “indicate that there was direct cooperation with certain Kaspersky and FSB officials.”.
Of course, we have not seen any evidence to prove this. Shaheen also stated that there is relevant classified information that could support what she claims. Because it is classified, we have no idea whether it still exists.
(Shaheen is known for her support of the Iraq War, which was based on false information. We all know this today, as it was later proven, and many commentators note the similarity of these two cases.
What Kaspersky says
The company, as you can imagine, is not too happy about this development. Kaspersky is a company that has been around for 20 years.
Kaspersky's response:
There is no credible evidence presented publicly by anyone or any organization, and the accusations are based on false allegations and inaccurate assumptions, including allegations about the impact of Russian regulations and policies on the company.
The company works with governments around the world to provide cybersecurity products. The majority of our business is outside of Russia.
“Kaspersky Lab has never assisted, nor will it assist, any government in the world with cyberespionage or aggressive cyber efforts, and it is very disturbing that a private company can be deemed guilty before it is proven innocent, due to geopolitical issues.”
Who is telling the truth?
What do we know so far?
As Kaspersky points out, no reliable data has been publicly presented. Some classified information has been hinted at, but there is no way to judge the veracity of this information. If it even exists.
Of course we know where relations between America and Russia stand today, and so the statement of “geopolitical issues” influencing decisions seems to make sense.
In a Foreign Policy article published in August 2017, an anonymous senior intelligence official said that intelligence agencies had been looking for evidence of government interference or vulnerabilities in Kaspersky software “for years,” but had found nothing.
Did US intelligence agencies find new information? It's possible. But there's no way to know.
Of course, nothing in the political world is as clear-cut as it first appears. In 2012, Wired wrote a lengthy profile of Kaspersky and his company. They noted several ways in which Kaspersky’s views aligned with the Russian government and how he appears to have connections with certain members of the FSB.
They also note that many of these relationships are similar to those that large American companies have with Washington. On the other hand, Kaspersky reportedly has a dedicated crew that seeks to neutralize any government espionage. The company's team discovered Stuxnet, a US-Israeli malware that operated in Iran.
The article paints a conflict. Especially when you consider its terribly misleading title, “Russia's Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals.”
Kaspersky: Complexity
But we also have a picture of a capable businessman. He understands the political climate and turns it to his advantage when he can. He agrees with the Russian party's line on protecting online privacy, but he also agrees with many others from around the world.
He is a complex man in a complex business. That certainly doesn't make him an easy tool for the FSB.
Yes, Kaspersky Labs has made software for the Russian government. But they have also made software for other governments around the world. They are probably closer to the FSB than to other government agencies. But that is perhaps to be expected, as they coexist in Russia, and the FSB handles much of the country's cyber concerns.
Should you be worried?
It depends on whether you are a politician, a military man, or a public figure. It also depends on many other things:
It seems unlikely that Kaspersky Labs, a highly successful international company, would be involved in Russian espionage. On the other hand, who is involved and doesn't cover their tracks as best they can?
If you believe in global conspiracies, you might be concerned that Russia is using Kaspersky software to infiltrate computers around the world.
On the other hand, in addition to Kaspersky's reputation, there is also a lot of money at stake: $644 million at the time of the Foreign Policy article. The company seems to have little incentive to risk its reputation to help the Russian government. You know how crucial the reputation of any company is.
Does this mean they are completely innocent?
No. As I mentioned before, the issue is quite complicated. For a cybersecurity company to cooperate with an intelligence agency is not something far-fetched. Based on the evidence that is publicly available – which is minimal – it seems that Kaspersky is telling the truth. But as we mentioned before, which spy is not credible?
After all, the US Department of the Interior does not mention Kaspersky as a spy, but that it was forced to give access to Russian spies due to the legal status of the state.
This also has a basis, and we cannot ignore it.
Do you feel safe?
The most important thing with any security software is that it makes you feel safe. If you no longer trust Kaspersky, switch to something else. It's simple. However, before jumping to conclusions, consider the company's long-standing reputation. Is this a political maneuver or something that actually happened? We'll be following the events and keeping you updated.
Do you still trust Kaspersky software or will you switch to something else?
