Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DHS Issues BOD Banning Kaspersky from Federal Government

dhs.gov

Post reply on HN
Print view View original

41–50 of 115 posts

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#41

Post by peterwwillis »

tptacek wrote: post #17

This is very bad for Kaspersky. Put aside how much revenue the entire GSA market represents for a security company (it'll be a double-digit percentage for a typical company). The bigger problem is that in the wake of this, every systemically important financial firm will also eject Kaspersky. In addition to being another significant chunk of revenue, major financial firms set the buying direction for IT security for…

If we don't speculate at all, we're left with the following bullet points from news articles this year:

  - Michael Flynn was paid by Kaspersky to speak at its seminar (probably nothing, but mildly interesting)
  - US Intel community considers Kaspersky to be an arm of the Russian government
  - Kaspersky employee arrested in sting by Russian government for treason
  - US Intel officials believe Kaspersky employees in US engaged in espionage
  - Kaspersky employees investigated/interviewed in US by FBI
  - Coincidence of a Russian military intelligence unit's ID in a certification for Kaspersky software
  - Kaspersky denies it will ever work with any government on cyberespionage
Take all of that, and ask yourself this. Would the US govt, which already had suspicion to remove them, and had been getting the ball rolling since at least May or before then, ask them to spy on behalf of the US in Russia, and if they balk, remove their funding and damage their reputation?

To me that's real reason: they wouldn't play ball.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#42

Post by shallot_router »

BoiledCabbage wrote: post #24
pvg wrote: post #20

Earlier quoted context omitted.

You're making a very big leap from 'Russia arrested someone and charged him with treason' to 'That person was actually a US spy' and even 'The arrest of this person who was actually a US spy is the driver behind a particular US policy'. We just don't have any reasonable insight into why Russia arrests people and what, if anything, they're guilty of.

> We just don't have any reasonable insight into why Russia arrests people In the actual article link it quotes Russian govt. officials saying they arrested them for treason, and for giving secrets to a US Intelligence Agency that wasn't the CIA. I do appreciate skepticism in response to claims, but please do read through the article first before contesting.

Of course that's what the Russian officials said, but who knows how accurate that is or what might be omitted from that statement?

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#43

Post by shallot_router »

todd8 wrote: post #35

Is Nginx next? I suppose that it's open source nature mitigates the risks of an important software infrastructure piece being developed in a country that might not always be friendly to us.

Nginx isn't a security company and doesn't make client-side software, so probably not. (Of course, theoretically nginx could be backdoored to give valuable information to intelligence agencies, but it's harder due to the fact it's open source, and even if it was closed source the escalation in response to banning nginx could start a new Cold War. Imagine the US and Russia mutually banning use of any of the other side's software and actually trying to implement it.)

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#44

Post by tptacek »

pera wrote: post #40
tptacek wrote: post #17

This is very bad for Kaspersky. Put aside how much revenue the entire GSA market represents for a security company (it'll be a double-digit percentage for a typical company). The bigger problem is that in the wake of this, every systemically important financial firm will also eject Kaspersky. In addition to being another significant chunk of revenue, major financial firms set the buying direction for IT security for…

If I have to guess I would say that some intelligence agency is monitoring software updates from Kaspersky and they found something unusual, but probably their evidence is circumstantial so they can't go public with it. I don't know how's their update model, but for instance they could skip or delay updates for ongoing operations for specific targets (and this could actually be done even without the consent of Kasper…

I think a lot of what we think we know about this stuff comes from people who preface comments with "if I have to guess" being read by people who skip the first 5 words in those comments.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#45

Post by tptacek »

peterwwillis wrote: post #41
tptacek wrote: post #17

This is very bad for Kaspersky. Put aside how much revenue the entire GSA market represents for a security company (it'll be a double-digit percentage for a typical company). The bigger problem is that in the wake of this, every systemically important financial firm will also eject Kaspersky. In addition to being another significant chunk of revenue, major financial firms set the buying direction for IT security for…

If we don't speculate at all, we're left with the following bullet points from news articles this year: - Michael Flynn was paid by Kaspersky to speak at its seminar (probably nothing, but mildly interesting) - US Intel community considers Kaspersky to be an arm of the Russian government - Kaspersky employee arrested in sting by Russian government for treason - US Intel officials believe Kaspersky employees in US eng…

Have you tried getting a reporter at Reuters on the phone to make sure they know this? It seems like big, if true.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#46

Post by ryaniscool »

joering2 wrote: post #33
tptacek wrote: post #30

Earlier quoted context omitted.

If that's true now, it was true 4 years ago too. The McCain/Rubio claims are what's new.

So its even more important for public to see the evidence. Otherwise it feels like private vendetta most likely because Kaspersky is Russian (you know, our current Administration doesn't like Russians much) who actually build his empire on fighting Russian Government-funded cyberspying (claims Wikipedia). I'm sure if Kaspersky sells tons of software on US soil, and most likely pay taxes on US soil, then they will sue…

It's possible they're trying to tank Kapersky but considering all the backdoors the NSA injected in American software (RSA[0], PRISM[1]), it seems very plausible the Russian government does exactly the same thing to Russian software.

[0] https://en.wikipedia.org/wiki/RSA_BSAFE [1] https://www.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-...

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#47

Post by pera »

tptacek wrote: post #44
pera wrote: post #40

Earlier quoted context omitted.

If I have to guess I would say that some intelligence agency is monitoring software updates from Kaspersky and they found something unusual, but probably their evidence is circumstantial so they can't go public with it. I don't know how's their update model, but for instance they could skip or delay updates for ongoing operations for specific targets (and this could actually be done even without the consent of Kasper…

I think a lot of what we think we know about this stuff comes from people who preface comments with "if I have to guess" being read by people who skip the first 5 words in those comments.

Maybe, but I think that all this speculation is understandable, specially for commercial reasons: what other software companies can do to not be banned.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#48

Post by tptacek »

pera wrote: post #47
tptacek wrote: post #44

Earlier quoted context omitted.

I think a lot of what we think we know about this stuff comes from people who preface comments with "if I have to guess" being read by people who skip the first 5 words in those comments.

Maybe, but I think that all this speculation is understandable, specially for commercial reasons: what other software companies can do to not be banned.

It's totally understandable that people speculate. We're humans, and we're very uncomfortable with incomplete information. Our brains are wired to fill in gaps like this.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#49

Post by tptacek »

ryaniscool wrote: post #46
joering2 wrote: post #33

Earlier quoted context omitted.

So its even more important for public to see the evidence. Otherwise it feels like private vendetta most likely because Kaspersky is Russian (you know, our current Administration doesn't like Russians much) who actually build his empire on fighting Russian Government-funded cyberspying (claims Wikipedia). I'm sure if Kaspersky sells tons of software on US soil, and most likely pay taxes on US soil, then they will sue…

It's possible they're trying to tank Kapersky but considering all the backdoors the NSA injected in American software (RSA[0], PRISM[1]), it seems very plausible the Russian government does exactly the same thing to Russian software. [0] https://en.wikipedia.org/wiki/RSA_BSAFE [1] https://www.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-...

PRISM isn't a software backdoor. It's a system for sending selectors (metadata query terms) to providers under FISA 702 Directives. PRISM : FISA warrants :: Stripe : credit card authorizations.

Re: DHS Issues BOD Banning Kaspersky from Federal Government

#50

Post by joering2 »

tptacek wrote: post #37
joering2 wrote: post #33

Earlier quoted context omitted.

So its even more important for public to see the evidence. Otherwise it feels like private vendetta most likely because Kaspersky is Russian (you know, our current Administration doesn't like Russians much) who actually build his empire on fighting Russian Government-funded cyberspying (claims Wikipedia). I'm sure if Kaspersky sells tons of software on US soil, and most likely pay taxes on US soil, then they will sue…

You're unlikely to see the evidence in this case. Could you be clearer about exactly which "discrimination" code or statute the USG would be violating, even if they were doing this capriciously?

Not a lawyer to know one, just common sense they got banned based on being Russians, unless of course we can be proven otherwise (with evidence)
Post reply on HN