US prohibits Kaspersky software sales over Russian security threat concerns

On Thursday, the U.S. government declared a prohibition on the sale of Kaspersky antivirus software within the nation, urging American users to transition to alternative security providers.The Bureau of Industry and Security, part of the Commerce Department, has enacted what it describes as an unprecedented ban, citing the Russian origins of Kaspersky as a threat to the national security and privacy of U.S. citizens.

“Given Russia’s demonstrated capabilities and intent to leverage companies like Kaspersky for gathering and weaponizing American citizens’ personal data, we find ourselves obligated to implement the measures announced today,” stated U.S. Commerce Secretary Gina Raimondo during a press briefing.

Reuters was the first to break the news of the impending ban before the official statement. Starting July 20, Kaspersky will be prohibited from distributing its software to consumers and enterprises in the United States. However, the company is allowed to continue providing software and security updates to its existing clientele until September 29. Post this date, Kaspersky will be barred from delivering updates to its software for customers in the U.S., as per Raimondo.

Raimondo emphasized the urgency of finding a Kaspersky alternative, stating, “Your software and services will deteriorate over time. Hence, I strongly advise that you immediately seek a replacement for Kaspersky.” She also clarified that current U.S. users of Kaspersky antivirus are not in breach of the law.

Commerce Secretary Gina Raimondo reassured U.S. individuals and businesses that they are not breaking the law by continuing to use Kaspersky products and services. “You have done nothing wrong and are not subject to any criminal or civil penalties,” Raimondo stated. Nevertheless, she strongly urged users to discontinue using Kaspersky software and switch to alternatives for their own protection and the security of their data and families.

To facilitate consumer awareness, Raimondo mentioned that the Department of Homeland Security and the Justice Department will be tasked with notifying U.S. consumers. Additionally, the U.S. government plans to launch a website to provide affected individuals with necessary information about the ban and guidance on subsequent steps.

During the press briefing, a senior official from the U.S. Commerce Department, whose identity was not disclosed at the department’s request, indicated that the federal cybersecurity agency CISA will engage with critical infrastructure entities that utilize Kaspersky software to assist them in transitioning to other options. The official noted that no specific incidents involving Kaspersky prompted the ban.

This latest prohibition is a continuation of the U.S. government’s ongoing scrutiny of the Moscow-based Kaspersky. In 2017, the Trump administration prohibited federal agencies from using Kaspersky software due to concerns that the company could be coerced into aiding Russian intelligence. That year, reports surfaced of Russian hackers allegedly exploiting Kaspersky’s antivirus to steal classified U.S. documents from a contractor’s home computer, marking the first known espionage case linked to the company’s software.

The move to ban Kaspersky has been under consideration since the previous year, as reported by The Wall Street Journal in April 2023.

Kaspersky claims a global customer base of over 400 million individuals and more than 240,000 corporate clients. The senior Commerce Department official did not disclose the number of U.S. customers but acknowledged that it includes a substantial count, with critical infrastructure organizations and state and local government entities among them.