During a Thursday meeting of the Senate Appropriations Committee, DHS Secretary John Kelly was asked if any Kaspersky software was being used on DHS systems. He replied in the affirmative but was not sure about the extent of the usage. Senator Joe Manchin (D-WV) asked for a comprehensive report, and Kelley promised to deliver one.
"We are very much concerned about this, very much concerned about the security of our country," said Manchin during the hearing.
Earlier in May, Buzzfeed News reported that several anonymous sources within US intelligence were "concerned" by the relationship between Kaspersky Lab and the Russian government.
They admitted that they had no evidence connecting Kaspersky to alleged Russian interference in the 2016 presidential election or any incidence of Russian hacking. The suspicion originates from two places: firstly, Kaspersky is widely used in many American federal agencies, including the National Institutes of Health, the Justice Department, the Treasury Department and several offices and embassies within the State Department.
Secondly, Kaspersky is Russian. Founder Yevgeny Kaspersky attended a KGB technical institute and served in Soviet military intelligence as a young man, and Western critics have argued that he has never truly severed those ties. Others affiliated with Kaspersky are former employees of the Russian government or military, such as COO Andrey Tikhonov who used to work for the Russian Ministry of Defense.
In 2015, not long after the launch of Kaspersky's US subsidiary, Bloomberg reported that Kaspersky Lab radically changed its upper echelon of leadership: "high-level managers have left or been fired, their jobs often filled by people with closer ties to Russia's military or intelligence services. Some of these people actively aid criminal investigations by the FSB, the KGB's successor, using data from some of the 400 million customers".
During an interview with The Australian on May 24, Yevgeny Kaspersky dismissed Bloomberg's allegations. "We do have former employees from the Russian defense, from the European defense, from the Israeli defense, and from different countries. The people are coming to get a job and they are good guys; they're not working on defense anymore."
When Buzzfeed reached out for a comment, a spokesperson told them that Kaspersky "has no ties to any government, and the company has never helped, nor will help, any government in the world with its cyberespionage efforts… just as a US-based cybersecurity company doesn't send or allow access to any sensitive data from its products to the US government, Kaspersky Lab products also do not allow any access or provide any secret data to any country's government."
On May 24, Kaspersky offered to turn over the source code of his company's software to US intelligence so as to dispel fears that it contained backdoors that could be exploited by hackers. "[I] would give them the source code for checking," he told The Australian. "When we have government contracts, in some cases we're asked to disclose our technologies – and we do it."
He dismissed the possibility of a purposeful vulnerability in his software entirely. "It's suicide," he said. "It would not only kill the business, but you'd have to save your life somewhere in a jungle, in the Amazon River or in Siberia."
The Senate has frequently grappled with the use of Kaspersky products. In late March, Senator Marco Rubio (R-FL) asked cybersecurity and national security experts if they would be willing to use a device protected by Kaspersky software. The reaction was split. Former NSA Director General Keith B. Alexander said that he "wouldn't, [and] you shouldn't either. There are other US firms that answer and solve problems that will face you."
But Thomas Rid, a professor of War Studies at King's College London denied any ties between Kaspersky and Moscow. "Kaspersky is not an arm of the Russian government," he testified.
Nearly every leading voice in US intelligence, from CIA Director Mike Pompeo to NSA head Admiral Mike Rogers, chimed in of their "awareness" of Kaspersky, although no formal allegations were levied.
Kaspersky Lab has had a run-in with the government recently – the Russian government. Chief Investigator Ruslan Stoyanov was arrested in December 2016 by Russian police under allegations of having provided "financial, technical, advisory, or other assistance to a foreign state" before he came to work for Kaspersky.
Kaspersky has repeatedly identified and dismantled malware and spyware that originated in Russia, such as Red October (a spy program that targeted embassies) in 2013 and Poseidon Group (a Russian phishing group) in 2016.
