US Govermnent Bans Kaspersky Software Over Security Concerns

The Biden administration announced yesterday that it was banning sales of antivirus products from Russian company Kaspersky in the US, citing security concerns. The ban follows multiple actions from the US government against Kaspersky, the latest being the US Federal Communications Commission adding Kaspersky software to its “List of Communications Equipment and Services that Pose a Threat to National Security” back in March 2022.

In its final decision prohibiting the sale of Kaspersky software in the US, the Department of Commerce’s Bureau of Industry and Security (BIS) explained that the Russian government was able to exploit Russian companies like Kasperky to collect sensitive information through administrative privileges. The BIS also pointed out that Kaspersky has the ability to install malicious software and withhold critical updates. Lastly, the integration of Kaspersky software into third-party products was highlighted as another potential security risk.

“Today’s Final Determination and Entity Listing are the result of a lengthy and thorough investigation, which found that the company’s continued operations in the United States presented a national security risk—due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations—that could not be addressed through mitigation measures short of a total prohibition,” the press release reads.

In practice, Kaspersky is no longer authorized to sell its software in the US. However, the company will still be allowed to provide anti-virus codebase updates to its customers in the US until September 29, 2024. But the US government is strongly encouraging customers to look for another security vendor as soon as possible.

“Individuals and businesses that continue to use existing Kaspersky products and services will not face legal penalties under the Final Determination. However, any individual or business that continues to use Kaspersky products and services assumes all the cybersecurity and associated risks of doing so,” the BIS said today.