US Sales of Kaspersky Software to be Banned by Biden Administration

The Biden administration is preparing to announce a prohibition on the sale of antivirus software made by Russia’s Kaspersky Labs in the United States. This decision is based on concerns about the company’s close ties to the Russian government, which are perceived to pose significant security risks. Kaspersky's software has privileged access to computer systems, which could be exploited to steal sensitive information, install malware, or withhold critical updates. The ban will impact Kaspersky’s large U.S. customer base, including critical infrastructure providers and state and local governments.

The new rule is a part of a broader strategy that also includes adding Kaspersky Labs to a trade restriction list. This addition would prevent U.S. suppliers from selling to the company, potentially damaging Kaspersky’s reputation and affecting its sales overseas. The plan to place Kaspersky on the entity list and the specifics of the software sales prohibition have not been previously disclosed. The Commerce Department has declined to comment on the matter, and both Kaspersky Lab and the Russian Embassy have not responded to requests for comment. Kaspersky has previously claimed to be a privately managed company with no ties to the Russian government.

These moves reflect the administration’s efforts to mitigate risks of Russian cyberattacks via Kaspersky software, especially as tensions with Russia escalate due to the ongoing conflict in Ukraine. Additionally, this action illustrates the Biden administration’s use of a new authority that permits the restriction of transactions between U.S. firms and tech companies from "foreign adversary" nations, such as Russia and China. This authority, which was developed during the Trump administration, has seen limited application so far. Former President Trump attempted to use it to ban Chinese social media platforms TikTok and WeChat, but those efforts were blocked by federal courts.

The new restrictions on the sale of Kaspersky software will also prevent the download of software updates, resales, and licensing of the product starting on September 29, giving businesses 100 days from the announcement to find alternatives. New U.S. business deals for Kaspersky will be blocked 30 days after the restrictions are officially announced. Additionally, sales of white-labeled products that incorporate Kaspersky software under a different brand name will be prohibited. The Commerce Department will notify companies before taking enforcement action against them for violations of these restrictions.

The impact of adding Kaspersky to the entity list depends on whether the Commerce Department includes its foreign units that rely on significant U.S. inputs. If it only lists the Russian entity, the primary effect will be reputational rather than operational. Kaspersky’s Russian business is already heavily restricted by U.S. export controls related to the conflict in Ukraine, making it difficult for any U.S.-made items, except food and medical equipment, to be shipped to Russia.

Kaspersky has been under scrutiny by regulators for years. In 2017, the Department of Homeland Security banned its flagship antivirus product from federal networks, citing concerns about its alleged ties to Russian intelligence and the potential for Russian laws to compel Kaspersky’s cooperation with intelligence agencies. Media reports suggested that Kaspersky was involved in the theft of hacking tools from a National Security Agency employee, which allegedly ended up with the Russian government. Kaspersky admitted to discovering the code but denied any third-party access.

The U.S. government’s concerns about Kaspersky intensified following Russia’s invasion of Ukraine in February 2022. American companies were privately warned that Moscow could manipulate Kaspersky’s software to inflict damage. This heightened threat perception led the Commerce Department to intensify its national security investigation into the software, culminating in the current prohibition.

The delayed announcement of the ban is partly attributed to prolonged negotiations with Kaspersky, which had proposed mitigation measures to avoid a complete ban. However, the Commerce Department determined that no mitigating measures could adequately address the risks posed by Kaspersky’s ties to the Russian government.

Under the new rules, sellers and resellers who violate the restrictions will face fines from the Commerce Department, and the Justice Department may pursue criminal charges against willful violators. Software users themselves will not face legal penalties but will be strongly encouraged to discontinue using Kaspersky products.

Kaspersky, which operates a UK holding company and has offices in Massachusetts, reported revenue of $752 million in 2022, with over 220,000 corporate clients in about 200 countries. The impending restrictions and entity listing will likely have significant implications for the company’s operations and its presence in the U.S. market.