UPDATE: The White House has made the ban official by banning the sale, resale, and licensing of any Kaspersky security products or services within the US or by US persons.
The Commerce Department called the sales ban the "first of its kind" following a lengthy investigation into the antivirus provider. It found "that the company’s continued operations in the United States presented a national security risk—due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations— that could not be addressed through mitigation measures short of a total prohibition."
That said, if you still use Kaspersky products on your PC, don't worry about being punished. "Individuals and businesses that continue to use existing Kaspersky products and services will not face legal penalties under the Final Determination," the Commerce Department said. "However, any individual or business that continues to use Kaspersky products and services assumes all the cybersecurity and associated risks of doing so."
Starting today, Kaspersky is banned from entering new agreements with US persons relating to its security products. However, the White House won't impose a complete crackdown for three months to give consumers and businesses time to switch to alternatives. Once Sept. 29 arrives, Kaspersky will then be formally barred from "providing any anti-virus signature updates and codebase updates," although it remains unclear if the company will observe the ban.
The Commerce Department created a website dedicated to answering questions about the action. Users and companies that continue to assist Kaspersky in the prohibited transactions risk facing civil and criminal penalties.
Kaspersky says the White House's "decision does not affect the company's ability to sell and promote cyber threat intelligence offerings and or trainings in the US."
"Kaspersky believes that the Department of Commerce made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky's products and services," the company added. "Kaspersky does not engage in activities which threaten US national security and, in fact, has made significant contributions with its reporting and protection from a variety of threat actors that targeted US interests and allies."
The company's statement goes on to say the ban threatens to undermine cybersecurity across the industry. "The primary impact of these measures will be the benefit they provide to cybercrime. International cooperation between cybersecurity experts is crucial in the fight against malware, and yet this will restrict those efforts," Kaspersky said. "Furthermore, it takes away the freedom that consumers and organizations, large and small, should have to use the protection they want."
Kaspersky is also signaling it'll challenge the ban in court. “The company intends to pursue all legally available options to preserve its current operations and relationships," the statement says.
Original Story:
President Biden's administration is expected to announce a ban on the sale of Kaspersky software in the US due to concerns around the company's perceived ties to the Russian government, Reuters reports Thursday, citing a source familiar with the matter. The US will also establish trade restrictions around Kaspersky Lab, according to two other sources who spoke with the outlet.
Any products that use Kaspersky software under a third-party white label will also be restricted, per the report. The third-party companies will be notified in advance.
US critical infrastructure providers as well as some state and local governments use Kaspersky's software, the sources note, arguing that it could pose security concerns because they believe Kaspersky is closely connected to the Russian government.
Kaspersky Lab, however, has repeatedly denied any collaboration with the Russian government, WSJ has reported. “Kaspersky has no political ties to any government,” PCMag's Kaspersky contact said in 2022.
Regardless, US officials have had concerns with Kaspersky for years. Nine years ago, Russian hackers used Kaspersky software to access an NSA contractor's computer, The Wall Street Journal previously reported. In 2017, a US official told the outlet that they were certain Kaspersky Lab was aware of the software's ability to help the attackers gain access to sensitive information about US federal operations.
After Russia invaded Ukraine in early 2022, US officials deliberated sanctioning Kaspersky while the FCC said it posed a national security risk. The action was put on hold. Over a year later, Biden's administration once again considered banning or otherwise restricting US use of the software. Last year, Canada banned Kaspersky apps on government devices, citing "an unacceptable level of risk."
PCMag has reached out to Kaspersky and the Department of Commerce for comment.