Today, the Bureau of Industry and Security (BIS) announced a Final Determination prohibiting Kaspersky Lab, Inc. from providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons.
Kapersky is the U.S. subsidiary of a Russian-based anti-virus software and cybersecurity company.
This is not a new concern. In 2018, the federal government banned the use of Kapersky software by government contractors. This was an interim final rule that was made permanent in 2019.
This current ban appears to be novel. It will prohibit Kaspersky from selling its software within the United States or providing updates to software already in use. The full ban goes into effect as of September 29, 2024. A full list of prohibited transactions and a more complete discussion of why this is being done can be found online at oicts.bis.gov/kaspersky.
The press release states:
Today’s Final Determination and Entity Listing are the result of a lengthy and thorough investigation, which found that the company’s continued operations in the United States presented a national security risk—due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations—that could not be addressed through mitigation measures short of a total prohibition.
Individuals and businesses that utilize Kaspersky software are strongly encouraged to expeditiously transition to new vendors to limit exposure of personal or other sensitive data to malign actors due to a potential lack of cybersecurity coverage. Individuals and businesses that continue to use existing Kaspersky products and services will not face legal penalties under the Final Determination. However, any individual or business that continues to use Kaspersky products and services assumes all the cybersecurity and associated risks of doing so.
In order to minimize disruption to U.S. consumers and businesses and to give them time to find suitable alternatives, the Department’s determination will allow Kaspersky to continue certain operations in the United States—including providing anti-virus signature updates and codebase updates—until 12:00AM Eastern Daylight Time (EDT) on September 29, 2024.
Discussion
No comments yet.