Germany’s Cyber Agency BSI Warns Against Kaspersky AV

Germany’s cyber protection agency has issued an official warning against using Kaspersky antivirus (AV) products, due to threats made by President Vladimir Putin against the EU, NATO, and Germany.

Germany’s Federal Office for Information Security (BSI) warned users and organisations that the anti-virus software developed by Moscow-based Kaspersky Lab poses a serious risk of a successful hacking attack.

This warning comes five years after the UK’s National Cyber Security Centre (NCSC) warned government departments not to use antivirus products with links to Russia for systems related to national security and those which are “critically important”.

German warning

The United States in 2017 banned government departments and the US military from using Kaspersky’s products, and the FBI has reportedly advised a wide range of private companies not to use the tools.

The company has continually denied involvement in any wrongdoing or that customers’ data could be used by the Russian state.

And for his part, Kaspersky Lab founder Eugene Kaspersky has repeatedly said that if he was ever asked to provide data to the Russian government he would move his company out of the country.

But this has not stopped Germany’s BSI warning that the Russia-based cyber-security company could be coerced by Russian government agents to hack IT systems abroad or agents could clandestinely use its technology to launch cyberattacks without its knowledge, Reuters reported.

The BSI warning comes amid Russia’s invasion of Ukraine, with the Russian army shelling of the capital of Ukraine, and being accused of war crimes by attacking and killing civilians.

The BSI said that German companies as well as government agencies that manage critical infrastructure were particularly at risk of a hacking attack.

Kaspersky response

Kaspersky responded to the BSI warning with its own statement on the matter, saying that its data processing infrastructure was relocated to Switzerland in 2018.

“We believe this decision is not based on a technical assessment of Kaspersky products – that we continuously advocated for with the BSI and across Europe – but instead is being made on political grounds,” said the firm.

“We will continue to assure our partners and customers in the quality and integrity of our products, and we will be working with the BSI for clarification on its decision and for the means to address its and other regulators’ concerns,” it said.

“At Kaspersky, we believe that transparency and the continued implementation of concrete measures to demonstrate our enduring commitment to integrity and trustworthiness to our customers is paramount,” the firm stated.

“Kaspersky is a private global cybersecurity company and, as a private company, does not have any ties to the Russian or any other government,” it insisted. “We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone.£

Kaspersky pointed out that its “data processing infrastructure was relocated to Switzerland in 2018: since then, malicious and suspicious files voluntarily shared by users of Kaspersky products in Germany are processed in two data centres in Zurich.”

“Beyond our cyberthreat-related data processing facilities in Switzerland, statistics provided by users to Kaspersky can be processed on the Kaspersky Security Network’s services located in various countries around the world, including Canada and Germany,” it said.

“The security and integrity of our data services and engineering practices have been confirmed by independent third-party assessments: through the SOC 2 Audit conducted by a ‘Big Four’ auditor, and through the ISO27001 certification and recent re-certification by TÜV Austria.”