Persistent usage in US networks
Forty percent of US organizations still use Kaspersky software despite a ban enacted in the summer. Bitsight research shows 1,000 US organizations connected to Kaspersky servers after the ban. Only 58% of US organizations observed using Kaspersky products appear to have eliminated their usage. The US is the country with the largest number of organizations using the software. Bitsight based its research on observing connections and communications between global IP addresses associated with specific organizations and Kaspersky update servers. Nineteen US government agencies communicated with Kaspersky update servers as of November 2024. Between April and November 2024, global usage dropped from 22,000 firms and 7 million unique IP addresses to 8,000 firms and 2 million unique IP addresses. While usage in countries without formal bans fell, the US continues as a primary market. The firm acknowledged its research may also have captured traffic being used to perform security research or intelligence collection.
National security and software restrictions
The US Commerce Department maintains that Kaspersky poses an unacceptable risk to national security because of its ties to Russia. Officials claim the software can be used to identify sensitive data of US citizens or install malware. The department found that Kaspersky must follow Russian laws that allow the government to compel assistance in intelligence activities. The US government asserts that the risks addressed in the final determination stem from the potential for the software to be used strategically to cause harm to the United States instead of its effectiveness at identifying viruses. The ban prevents the sale and distribution of Kaspersky products. The restrictions take effect on September 29, 2024, and bar software downloads, resales, and licensing. New US business for Kaspersky was blocked 30 days after the restrictions were first announced on June 20. The US government also issued sanctions in June on senior leadership, including the chief business development officer, chief operating officer, legal officer and corporate communications chief. The US Treasury announced sanctions on a dozen Kaspersky executives, though the agency did not target CEO Eugene Kaspersky. The ban follows executive orders from 2019 and 2021 to protect Americans’ personal data from foreign adversaries. The ban extends to any product that uses Kaspersky services in the background.
| Restriction Type | Impacted Activity |
|---|---|
| Sales | Prohibits purchase of products |
| Updates | Bars software downloads |
| Licensing | Restricts product licensing |
| Resale | Prohibits reseller activity |
Operational wind down and data claims
Kaspersky denies that it can deliberately obtain sensitive data on Americans. The company says its employees in Russia can only access aggregate or statistical data not attributable to a specific person. This claim contradicts the US Commerce Department finding that software can be exploited to identify sensitive data of US citizens. You should recognize that these conflicting claims define the current standoff. Kaspersky began a gradual wind down of US operations on July 20, 2024, which will eliminate fewer than 50 US-based positions. The company states that the decision is based on the "geopolitical climate and theoretical concerns" rather than a full evaluation of its products. The firm has operated in the US for nearly two decades and has over 400 million users globally. In 2019, The Associated Press reported that an undercover operative targeted several cybersecurity experts to gather intelligence about critics of Kaspersky. The company argues that the decision benefits cybercriminals and diminishes the freedom of consumers to choose their cyber protection. The wind down process follows the prohibition of software sales, downloads, and licensing. The US government decision is the most significant move in this dispute. Will the US government eventually produce technical evidence to support these strategic risk claims?
