Kaspersky Lab

Kaspersky Lab is a Russian cybersecurity firm whose products and services have been restricted by the United States because of their privileged system access and the risks authorities attributed to Russian jurisdiction and state capabilities. The published measures are administrative and regulatory actions, not a criminal judgment that Kaspersky conducted espionage. Kaspersky disputed Commerce's risk findings. This entry distinguishes those findings from a judicial determination of operational cooperation with Russian intelligence.

Exclusion history

In September 2017 the Department of Homeland Security directed covered federal civilian agencies to identify and remove Kaspersky products. Section 1634 of the FY2018 National Defense Authorization Act extended a prohibition on government use of specified Kaspersky products and services across the Federal Government, effective 1 October 2018.

Commerce's June 2024 ICTS Final Determination restricted covered cybersecurity and anti-virus transactions in the United States or with United States persons. New agreements were prohibited from 20 July 2024, while specified updates and operation of the Kaspersky Security Network could continue only until midnight EDT at the start of 29 September 2024. The determination expressly excludes specified threat-intelligence, security-training and purely informational or educational consulting services. These exclusions make the operative text more precise than a blanket description of all Kaspersky services as prohibited.

OFAC separately designated twelve executives on 21 June 2024 under Executive Order 14024. Commerce also added three Kaspersky entities to the Entity List. The ICTS transaction prohibition, export-control listings and sanctions on individuals are distinct measures. BIS continued to publish the ICTS prohibition and its exclusions when checked on 17 October 2026; their United States jurisdictional scope should not be applied automatically elsewhere.

Significance

Kaspersky illustrates software-supply-chain exclusion based on privileged access and continuing vendor updates. That logic has points of contact with later restrictions involving Huawei, ZTE and Hikvision, but each case rests on distinct technology, evidence and legal authority. Commerce considered Kaspersky's technical and operational mitigation proposals, including the location and control of data processing, and found them insufficient to resolve its identified risks. The determination acknowledged processing of North American threat-related data on Swiss servers. Its conclusion shows the limits of those assurances in this case; it does not establish that audit or compliance can never restore trust elsewhere.

See also

Panopticon effect · Technology-embargo bundle · Huawei · ZTE · Hikvision · Russia · Weaponised interdependence · Grey-zone competition

Sources

1. United States Department of Commerce, Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc., 89 FR 52434 (24 June 2024), pp. 52434-52437.
2. United States Department of Homeland Security, Binding Operational Directive 17-01: Removal of Kaspersky-branded Products (13 September 2017), operative directive text.
3. United States Congress, National Defense Authorization Act for Fiscal Year 2018, Public Law 115-91, section 1634 (12 December 2017).
4. United States Department of the Treasury, "Treasury Sanctions Kaspersky Lab Leadership in Response to Continued Cybersecurity Risks" (21 June 2024).
5. United States Department of Commerce, Bureau of Industry and Security, "Kaspersky Lab, Inc. Prohibition", checked 17 October 2026.
6. Kaspersky, "Company overview", company history, checked 17 October 2026.