American government agencies are now banned from using software created by the Russian cybersecurity firm Kaspersky Lab and will have to begin removing Kaspersky products from their systems within three months, the Department of Homeland Security announced today.
Acting Secretary of Homeland Security Elaine Duke ordered all government offices to remove and replace any of the company's popular anti-hacker software in use within 90 days.
The Department of Homeland Security says the risk is that the Russian government, acting on its own or in collaboration with Kaspersky, could use computer access to compromise USA government systems.
In July, Bloomberg Businessweek published internal emails from 2009 in which founder and CEO Eugene Kaspersky told executives that the company was embarking on a new project at the behest of the FSB, the Russia's primary state security agency. Speaking Wednesday on the sidelines of the Billington CyberSecurity Summit in Washington, he noted that Kaspersky, like other Russian companies, is "bound to comply with the directive of Russian state security services, by law, to share with them information from their servers".
"Kaspersky Lab has always acknowledged that it provides appropriate products and services to governments around the world to protect those organizations from cyberthreats, but it does not have unethical ties or affiliations with any government, including Russian Federation", the firm said.
"Kaspersky Lab doesn't have inappropriate ties with any government, which is why no credible evidence has been presented publicly by anyone or any organization to back up the false allegations made against the company", a spokesperson for Kaspersky Lab said in a statement to the Washington Post.
It will take some time to stop the government from using Kaspersky products.
The statement goes on to say that "North America remains a strategic market for Kaspersky Lab". In a New York Times column earlier this month, Shaheen warned that the company poses a danger to US security. Instead, the DHS said it's affording Kaspersky an opportunity to "mitigate" the allegations by submitting a written response. He denies all charges of Russian government influence in his computer security products. It has tried largely in vain to become a vendor to the US government, one of the world's biggest buyers of cyber tools. "Many of those companies will now feel compelled to go through their systems and remove this antivirus program, as well as conduct a risk assessment".
The giant tech and appliance retailer Best Buy removed Kaspersky products from its shelves last week. It also pointed out that government and business users have the option to opt-out of sending data to the Kaspersky Security Network (KSN).
A former senior official at the company told NBC News that the company's US federal government business is small, but the reputational damage from a federal ban would be huge.
Huawei, however, does sell phones in the US consumer market.