Kaspersky Lab is suing the US Department of Homeland Security for banning federal government agencies from using its products.
The ban, issued in September, was the culmination of months of speculation from officials in the US government that using Kaspersky was a security risk after national security officials said the Russian government had stolen hacking tools from the National Security Agency through Kaspersky software on a NSA employee's home computer. The ban gave US agencies until Dec. 12 to stop using the software.
Kaspersky is one of the world’s foremost cybersecurity companies and has long denied that it conspires with any nation except when a court orders it to do so in a criminal prosecution. But its ties to Russian intelligence – its founder, Eugene Kaspersky, was trained at a school run by the KGB spy agency during the Soviet era – have long been a concern for some US officials.
The lawsuit, announced Monday, charged that DHS never afforded the company the chance to rebut the claims against it. In July, the company claims in its lawsuit, Kaspersky offered to discuss how its products are used. DHS responded in August that it would “be in touch again shortly,” but didn’t respond before issuing the ban.
DHS didn't immediately respond to a request for comment.
Kaspersky's suit cites the Administrative Procedure Act, which allows individuals to sue the federal government if it decides a contract award without adequate evidence. “The APA provides a framework by which those theories can be pursued, but the company will have to substantiate them,” Ronald Levin, a professor at Washington University Law. told BuzzFeed News.
Complicating the issue is the difficulty in learning exactly what role Kaspersky software might have played in the pirating of NSA hacking tools. In November, an employee of NSA’s elite Tailored Operations Unit, Nghia Hoang Pho, pleaded guilty to taking such tools home and loading them onto his personal computer, which was running Kaspersky antivirus software. The software detected the tools as a virus and transmitted them back to Kaspersky's servers in Moscow for analysis, Kaspersky has said.
The Kaspersky suit cites DHS official Jeanette Manfra's testimony in a Nov. 14 congressional hearing that she doesn’t have conclusive evidence that Kaspersky facilitated a breach of US government computers. But in May, the chiefs of the US's top intelligence agencies, including the NSA, the CIA, the FBI, and the Defense Intelligence Agency, all said they would not personally use Kaspersky.
It’s unclear exactly how badly DHS’s decision has affected Kaspersky’s business. Eugene Kaspersky has described the company's sales to the US government as “very few.” But competitors have seized on the ban as a selling point since September, and Kaspersky recently closed its suburban Washington, DC, office because, according to a company spokeswoman, "the opportunity for which the office was opened and staffed is no longer viable.”
It's also unclear whether Kaspersky still has plans to open offices in Toronto, Chicago, and Los Angeles.
Kevin Collier is a cybersecurity correspondent for BuzzFeed News and is based in New York.
Contact Kevin Collier at email@example.com.
Got a confidential tip? Submit it here.