Kaspersky Lab has faced controversy over allegations that it has engaged with the Russian Federal Security Service (FSB) to use its software to scan computers worldwide for material of interest—ties which the company has actively denied. The U.S. Department of Homeland Security banned Kaspersky products from all government departments on 13 September 2017, alleging that Kaspersky Lab had worked on secret projects with Russia's Federal Security Service (FSB). In October 2017, subsequent reports alleged that hackers working for the Russian government stole confidential data from the home computer of a National Security Agency (NSA) contractor in 2015 via Kaspersky antivirus software. Kaspersky denied the allegations, stating that the software had detected Equation Group malware samples which it uploaded to its servers for analysis in its normal course of operation.
The company has since announced commitments to increased accountability, such as soliciting independent reviews and verification of its software's source code, and announcing that it would migrate some of its core infrastructure for selected foreign customers from Russia to Switzerland. The allegations of ties to the Russian government were ignited again with the company's controversial response to the 2022 Russian invasion of Ukraine.
Alleged Russian intelligence collaboration According to the International New York Times, Kaspersky has "become one of Russia's most recognized high-tech exports, but its market-share in the United States has been hampered by its origins". According to Gartner, "There's no evidence that they have any back-doors in their software or any ties to the Russian mafia or state... but there is still a concern that you can't operate in Russia without being controlled by the ruling party". CEO Eugene Kaspersky's prior work for the Russian military and his education at a KGB-sponsored technical college has led to allegations of being employed by Russia to expose US cyberweapons, though he denies this. Analysts such as Gartner's Peter Firstbrook say suspicions about the firm's Russian roots have hindered its expansion in the US. The company has denied that it has direct ties with or has engaged with the Russian government.
In August 2015, Bloomberg News reported that Kaspersky Lab changed course in 2012, as "high-level managers have left or been fired, their jobs often filled by people with closer ties to Russia's military or intelligence services. Some of these people actively aid criminal investigations by the FSB, the KGB's successor, using data from some of the 400 million customers". Eugene Kaspersky criticized Bloomberg's coverage on his blog, calling the coverage sensationalist and guilty of exploiting paranoia to increase readership.
From July 2017 to December 2017, U.S. government agencies phased out their use of Kaspersky software. In July 2017, the United States' General Services Administration (GSA) removed Kaspersky Lab from its list of vendors authorized to do business with the U.S. government amid further reports by Bloomberg and McClatchy DC alleging that Kaspersky Lab had worked on secret projects with Russia's Federal Security Service (FSB). Anti-Russian sentiment had also grown in the country in the wake of an investigation of Russian interference in the 2016 presidential election. Kaspersky denied these reports, stating that it did not have "inappropriate ties" with any government, and "never received a request from the Russian government or any affiliated organization to create or participate in any secret projects, including one for anti-DDoS protection".
On 8 September 2017, U.S. electronics store chain Best Buy pulled Kaspersky products amid concerns over these ties, followed by U.S. retailers Office Max and Office Depot. On 13 September 2017, the Department of Homeland Security issued an order stating that in 90 days Kaspersky products will be banned from use within the U.S. civilian federal government, citing "[concerns] about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks."
NSA theft controversy On 6 October 2017, The Wall Street Journal - citing "multiple people with knowledge of the matter" - alleged that in 2015, hackers working for the Russian government used Kaspersky antivirus software to steal classified material from a home computer belonging to a National Security Agency (NSA) contractor. According to the report, the incident occurred in 2015 and remained undiscovered until early 2016. The stolen material reportedly included "details about how the NSA penetrates foreign computer networks, the computer code it uses for such spying and how it defends networks inside the U.S." The New York Times reported that the hacks had been discovered by Israeli intelligence agents who had themselves hacked into Kaspersky's network and recorded in real time how queries were being made for keywords on user machines.
On 10 June 2015, Eugene Kaspersky in a blog announced that Kaspersky Labs discovered an advanced attack on its own internal network claiming with confidence that there's a nation state behind it, calling the attack Duqu 2.0.
On 11 October 2017, The Wall Street Journal additionally alleged that Russian intelligence uses Kaspersky software to scan computers worldwide for material of interest. The company once again denied the reports, arguing that they were "baseless paranoia" and a "witch hunt", and considered it suspicious that major U.S. media outlets simultaneously "went for us almost in full force and they fantasized simultaneously, as if receiving an order, but they've got confused in details."
On 25 October 2017, Kaspersky confirmed that the incident described by The Wall Street Journal had occurred in 2014, and was the result of the software having detected a ZIP file containing samples and source code from the Equation Group. The user had enabled the Kaspersky Security Network (KSN) features of the software, so the files were automatically uploaded to Kaspersky as a malware sample to KSN for analysis, under the assumption that it was a new malware variant. Eugene Kaspersky stated that he ordered that the sample be destroyed. Kaspersky claimed that the antivirus software had been temporarily disabled by the PC's user in order to install a pirated copy of Microsoft Office. When the software was re-enabled, it detected both the Equation Group code, as well as unrelated backdoor infections created by a keygen program for Office, which may have facilitated third-party access to the computer.
Concerns raised by other governments On 13 November 2017, the British intelligence agency MI6 raised suspicions over Kaspersky Lab software after it was distributed free to more than 2 million UK Barclays customers. On 2 December 2017, Barclay's announced that they would no longer provide their new customers with the company's software. Also around 2 December 2017, Britain's National Cyber Security Center advised, as a national security precaution, that UK government departments avoid Russia-based antivirus software such as Kaspersky, but stated there was "no compelling case at present to extend that advice" to the wider public. On 9 December 2017, the U.S. government banned Kaspersky from federal civilian and military computers as part of a broader defense bill.
On 21 December 2017, Lithuanian Government bans Kaspersky Lab software on sensitive computers claiming it to be a threat to Lithuanian national security.
On 14 May 2018, the Dutch government announced it decided to phase out the use of antivirus software made by Kaspersky Labs “as a precautionary measure” and was advising companies involved in safeguarding vital services to do the same.
On 13 June 2018, European Union passed a motion that labeled Kaspersky as "confirmed as malicious" as part of a report on cyber defense written by Estonian MEP Urmas Paet of the Committee on Foreign Affairs. The report "Calls on the EU to perform a comprehensive review of software, IT and communications equipment and infrastructure used in the institutions in order to exclude potentially dangerous programmes and devices, and to ban the ones that have been confirmed as malicious, such as Kaspersky Lab." The resolution was approved with 476 votes in favor and 151 against. Kaspersky Lab responded by claiming the amendment to the report was based on untrue statements and by temporarily halting their numerous collaborative European cybercrime-fighting initiatives. In March 2019, Belgian MEP Gerolf Annemans submitted a question to the European Commission (EC), requesting in writing any evidence the Commission had justifying Parliament's labelling of Kaspersky as "malicious", citing reports from Germany, France, and Belgium which found no evidence of this. On 12 April 2019 the Commission responded by stating, "The Commission is not in possession of any evidence regarding potential issues related to the use of Kaspersky Lab products." and that, "[...] the Commission did not commission any reports."
On 15 March 2022, The German Federal Office for Information Security known as "BSI" urged consumers not to use antivirus software made by Russia's Kaspersky, warning the firm could be implicated in hacking assaults amid Russia's war in Ukraine. According to the agency, antivirus software has extensive system authorizations and must maintain a permanent connection to the manufacturer's servers. The BSI claims a Russian IT manufacturer can be forced to partake in an attack against targets in the EU, NATO, and Germany. Kaspersky published a statement to its Twitter feed concerning the BSI recommendation to stop using Kaspersky.
On 17 March 2022, The Italian government announced that it would curb the use of Russian antivirus software in the public sector in the wake of Russia's invasion of Ukraine, fearing Moscow could hijack the programs to hack key websites.
Twitter advertising ban In January 2018, Twitter banned Kaspersky from advertising on Twitter, stating that "Kaspersky Lab operates using a business model that inherently conflicts with acceptable Twitter Ads business practices", and citing the Department of Homeland Security's warning about Kaspersky.
Transparency Initiative and data-centers moves On 23 October 2017, Kaspersky announced a "Global Transparency Initiative", under which it would be more accountable for security issues surrounding its products to select countries, and would allow third-party analysts to validate its products and other business practices in order to validate their integrity. The company stated that trust "must be repeatedly earned through an ongoing commitment to transparency and accountability", and that this program was a "reaffirmation of the company's commitment to earning and maintaining the trust of their customers and partners every day."
On 15 May 2018, Kaspersky Lab announced that it would be migrating some "core infrastructure" from Russia to new data centers in Switzerland. Kaspersky software and antivirus definitions for foreign markets will be compiled and digitally signed in Switzerland by the end of 2018 (products targeting Russia will still be compiled on existing domestic infrastructure). User data for Europe, the United States, Canada, Australia, New Zealand, Japan, Bangladesh, Brunei, Cambodia, India, Indonesia, South Korea, Laos, Malaysia, Nepal, Pakistan, Philippines, Singapore, Sri Lanka, Thailand and Vietnam markets is to be stored and processed on Swiss servers as of 2022. All other countries will continue to be processed in Moscow, Russia. In November 2020 Kaspersky finished relocating the data of its foreign customers from Russia to Switzerland.