US Government Weighing Sanctions Against Kaspersky Lab (cyberscoop.com)

An anonymous reader quotes a report from CyberScoop: The U.S. government is considering sanctions against Russian cybersecurity company Kaspersky Lab as part of a wider round of action carried out against the Russian government, according to U.S. intelligence officials familiar with the matter. The sanctions would be a considerable expansion and escalation of the U.S. government's actions against the company. Kaspersky, which has two ongoing lawsuits against the U.S. government, has been called "an unacceptable threat to national security" by numerous U.S. officials and lawmakers.

Officials told CyberScoop any additional action against Kaspersky would occur at the lawsuits' conclusion, which Kaspersky filed in response to a stipulation in the 2018 National Defense Authorization Act that bans its products from federal government networks. If the sanctions came to fruition, the company would be barred from operating in the U.S. and potentially even in U.S. allied countries.

Comments

For working on

[AHuxley]

https://en.wikipedia.org/wiki/...
Stuxnet
Flame
Equation Group https://en.wikipedia.org/wiki/...
Android cyber-espionage used by 60 governments.

The internet needs all the security it can get. Why would the US not want quality global security research?

Re:For working on

[Anonymous Coward]

The answer is exceedingly self-evident: the US doesn't want research into its own malware.

Re:For working on

[Tom]

Why would the US not want quality global security research?

Because Kasperky could detect the next US-government-sponsored malware. The other malware companies can be "convinced" to play nice.

why would the sanctions have to wait?

[superwiz]

Sanctions, as such, are political acts. They don't have to comport with independent legal proceedings.

Re:why would the sanctions have to wait?

[Xest]

Because they have to judge the impacts.

When Trump threatened tariffs against steel/aluminium, Juncker in the EU being the absolute clueless corrupt prat he is made the same claim about waiting to see if it's worth applying sanctions against US brands like Harley Davidson and Levis.

Levis slipped off the list of possible companies a few days later, presumably because someone pointed out to him that sanctioning an American company that employs quite a few people in Europe (it has a factory in Italy, and stores Europe wide) and that shares European values, pays taxes without avoidance/evasions and disagrees with Trump's tarrifs as much as they do was probably going to be a massive own goal, when instead there are plenty of American companies that sell to Europe but don't have quite as high an employment footprint here which would've been way better targets - US agriculture, raw materials, and such would have made better targets for a counter response to steel/aluminium tariffs.

Still, Trump appears to have rowed back on applying the sanctions to Europe, so there's no need for a trade war between the US and Europe now anyway at least. That in itself is an example of a reason to wait though - the threat alone can sometimes be sufficient for action, what if Kaspersky offered to relocate key elements of it's business out of Russia to the US for example? Actually imposing sanctions would almost certainly never trigger that because it would be too late, threats might.

Re:EVIL RUSSIANS!!

[Anonymous Coward]

I'll continue to use Kaspersky's antivirus because it's the best around and because if the the US government don't like them, then that must mean their shit is secure from the US government.

and just for working...

[thesupraman]

Yes, it is also clear that Kaspersky is the only major threat protection software that has not agreed to whitelist US government malware.

Have the US government realise that this is just a form of Striesand effect recommending Kaspersky to anyone who doesnt that the US to know their affairs?

Re:and just for working...

[BlueStrat]

Makes a user wonder what a lot of the other EU and US AV brands are doing that the US gov totally approves of?

They do what they must for a piece of that valuable US/EU/Five-Eyes market.

No different than US tech companies vis a vis China. Just look at how Google is assisting the Chinese government with it's digital tyranny over the population. Just a different authoritarian regime's security service to have to make happy in order to compete with the competition.

Strat

The Agenda

[AlanObject]

It really seems to me that someone or someones high up in the U.S. govt really has it in for Kasperskey. Is that just my impression or does anyone else feel that way?

I would think that if the company actually had any malware in their security products it would have been detected by now. At the end of the day if they were doing Bad Guy Stuff then it would have to write Bad Guy Stuff either to local storage or onto the wire even if it is encrypted. There are a number of automated tools for detecting this both in a simulated environment (VM) and on real hardware.

Has there been any revealing of this kind of behavior that I missed? If not this seems like an awful lot of punishment in the absence of any crime.

So what's the motive here?

Re:The Agenda

[AHuxley]

Re "So what's the motive here?"

The problem for the USA and UK is that their gov/mil malware is regional and has to stay hidden.
When discovered the malware also has to look very average.
The UK wants to collect on every computer network in Ireland and all Irish supporters in the USA.

So subtle differences in gov malware only found in the wild in Ireland/USA would get detected by the more advanced AV brands.

The US wants collect it all but different cyber projects do not want to collect within the USA, 5 eye nations.

FBI projects might only collect in the USA and regions of the USA. Under the cover of state and federal task forces.

Globally that adds up to very distinct regional changes in advanced nation state funded malware finding its way into lots of low end consumer computers and networks.

The CIA and MI6 can have very advanced but parallel collection projects than a NSA, GCHQ.
MI5 within Ireland and the UK.

The governments are using contractors to create new malware that looks like average malware so it cant be seen as advanced security service products.
Why use bespoke code once that can be tracked back to the security services when contractors can just use average new malware again and again?
Very average gov malware gets detected globally and regionally by AV brands with skills. Thats the risk.
How to keep gov malware safe? Stop the better AV brands from collecting globally and seeing regional security services malware differences.

Re: The Agenda

[rtb61]

Always look at stuff from the professionally paranoid point of view (not an insult, gees they get cranky, just the nature of the job, you have to be professionally paranoid). The US governments wants to use entirely corrupt security letters to put back doors in security software sold to foreigners. Immediately they will suspect foreign governments of doing the same thing, the US does it, why wouldn't Russia or China do it. It has to be careful how it tackles this though, a blanket ban on foreign security software would generate a blanket ban on US security software and wipe out the security letters and back doors, mind you this includes stuff like M$ windows updates, which are now individually packaged, a specific user's computer get a specifically targeted update (only for high level hacks but will get caught if that computer is already being monitored by local intelligence agencies, change in traffic). It would be much cleaner to simply blanket ban all foreign security software and entirely reasonable to do so but the messy bit about US software being banned by foreign countries for exactly the same reason, forces this messy rubbish with Kaspersky. They will be banned one way or another, they will just have to accept that and the Russian government will ban US/EU security software for the same reason.

The only way out, open source the code and any updates and the updates must be served locally, only after the code for the update has been supplied and verified (so you can image open source security software becoming part of FOSS distributions to simplify the issue for everyone). Should the Russian government decide to be really mean, they can simply review copyright law and shorten copyright protection to 25 years from date of first publication and that will hurt the US by far the worst and many other NATO countries will also feel the brunt of that (UK/France). People would just source 60s, 70s and 80s content out of Russia (keep in mind, current movies demonstrate that music from those eras are much more popular than the autotune crap of the last couple decades and movie and TV series have similarly crapped out apart from the odd few exceptions). Of course China would join in, they are not really pleased with the US either and other partner countries would follow suit. So 2018 - 25 = 1993, so youch, makes the Kaspersky ban a joke in comparison and does not hurt Russia and China any where near as much as the US, a tiny fraction in comparison. US want's a trade war, it shouldn't be surprised 'when' it gets kicked in the copyright licence fee crown jewels, software as well. This US would lose far more in copyright licence fees than the entire rest of the world combined.

They can fend that off with a blanket ban on all foreign security software and simply not mention Russia or Kaspersky. Of course Russia and China could still simply extort 'er' bargain the 'Trump' way, to get greater cooperation from the US with the threat of the downward revision of copyright laws (originally 14 years, so very hard to diplomatically argue about 25 years but the money gone, wow, not just revenue but the valuation of assets, from billions to ZERO and that would also hurt the US dollar, a lot).

Re: The Agenda

[Darkling-MHCN]

The issue is that it's security software with low level access to your system which is controlled by a company which is controlled by Putin. It may not have malware in it now, but of course it has mechanisms in place to enable the distribution of malware very quickly.

Re: Drone to death.

[Reverend Green]

Moscow probably has a lot better air defences than our usual targets for military aggression.