Britain’s main cyber security agency has warned the UK government that security software company Kaspersky Lab could be linked to Russian spy agencies.
Despite the Moscow-based firm vehemently denying any connection to the Kremlin, the UK National Cyber Security Centre (NCSC) has penned a letter to government officials advising against the use of Kaspersky Lab’s anti-virus software.
NCSC chief Ciaran Martin said Russia is a “highly capable cyber threat actor”, which uses cyberspace for “espionage, disruption and influence operations”.
Mr Martin explained that the intrusive nature of anti-virus software means it is of particular concern.
For anti-virus (AV) software to be effective, it must “be highly intrusive within a network so it can find malware” and “be able to communicate back to the vendor,” he said.
“We need to be vigilant to the risk that an AV product under the control of a hostile actor could extract sensitive data from that network, or indeed cause damage to the network itself. That’s why the country of origin matters.”
We need to be vigilant to the risk that an AV product under the control of a hostile actor.
He went on to say that the NCSC would work with Kaspersky Lab to “develop a framework that we and others can independently verify”.
And while the company’s CEO Eugene Kaspersky insists he would never compromise the integrity of his business to engage in espionage, he also welcomed the opportunity to work with the cyber security agency.
Britain’s warning follows a similar move from the US in September, when Homeland Security ordered all government agencies to remove any products supplied by Kaspersky Lab because of security concerns.
It said it was “concerned about the ties between certain Kaspersky officials and Russian intelligence and other government agencies”.
And cited “requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks”.
However, Kaspersky Lab denied the Russian law applied to it, saying it was in place for telecommunication companies and internet service providers.
The firm has acknowledged that its software lifted highly sensitive hacking tools from a National Security Agency (NSA) staffer’s home computer in 2014, but said it was not part of an intentional effort to steal information from the NSA.
