Kaspersky Lab, Inc. Prohibition

Why were Kaspersky products prohibited?

The Bureau of Industry and Security (BIS) conducted a review of Kaspersky's cybersecurity and anti-virus transactions under its legal authorities pursuant to Executive Order 13873 and 15 C.F.R. Part 791. The Office of Information and Communications Technology and Services (OICTS) within BIS determined that the transactions pose a number of risks to the United States, and therefore prohibited these transactions.

Why are Kaspersky products considered a security risk?

BIS found that the dangers of Kaspersky's cybersecurity and anti-virus products and services (“ICTS offerings”) pose unacceptable risks to the United States' national security and the security and safety of its people. The risk factors considered were:

• The threats posed by the Russian Federation (Russia).
• The vulnerabilities that Kaspersky's ICTS products create for U.S. national security.
• Safety and the consequences of Russia exploiting the vulnerabilities presented.

BIS found that Kaspersky's ICTS offerings pose the following risks to the national security of the United States and the security and safety of U.S. persons:

• Russia is a foreign adversary that continues to threaten the United States.
• Kaspersky is subject to the jurisdiction, control, or direction of the Russian Government.
• Kaspersky software provides the Russian Government access to sensitive U.S. customer information.
• Kaspersky software allows for the capability and opportunity to install malicious software and withhold critical updates.
• The manipulation of Kaspersky software, including in U.S. critical infrastructure, can cause significant risks of data theft, espionage, and system malfunction. It can also risk the country's economic security and public health, resulting in injuries or loss of life.

For more information refer to the DNI Public Threat Assessment.

What does the Final Determination prohibit?

BIS has issued a Final Determination that prohibits Kaspersky from engaging in the following ICTS transactions in the United States or with U.S. persons:

• ICTS transactions involving any cybersecurity product or service designed, developed, manufactured, or supplied, in whole or in part, by Kaspersky, including those products and services listed in Appendix B of the Final Determination;
• ICTS transactions involving any anti-virus software designed, developed, manufactured, or supplied, in whole or in part, by Kaspersky including those products and services listed in Appendix B of the Final Determination; and
• ICTS transactions involving the integration of software designed, developed, manufactured, or supplied, in whole or in part, by Kaspersky into third-party products or services (e.g., “white-labeled” products or services).

A non-exhaustive list of products and services covered by the Final Determination is available in the linked Appendix B.

The Final Determination takes effect as follows:

At 12:00 AM EDT on July 20, 2024, Kaspersky is prohibited from entering into any new agreement with U.S. persons involving one or more ICTS transactions identified above.

At 12:00 AM EDT on September 29, 2024, Kaspersky, and any of its successors or assignees, shall be prohibited from:

• Providing any anti-virus signature updates and codebase updates associated with the ICTS transactions identified above; and
• Operating the Kaspersky Security Network (KSN) in the United States or on any U.S. person's information technology system.

At 12:00 AM EDT on September 29, 2024, the following is prohibited:

• Reselling Kaspersky cybersecurity or anti-virus software;
• Integrating Kaspersky cybersecurity or anti-virus software into other products and services; and
• Licensing Kaspersky cybersecurity or anti-virus software for purposes of resale or integration into other products or services.

The Department recognizes that many U.S. individuals and businesses rely on Kaspersky software for protection against viruses and other cyber threats. To provide users of Kaspersky software with time to seek alternative products and services, the Department has calibrated its prohibition to allow Kaspersky to continue to operate the KSN for U.S. persons, as well as provide anti-virus signature updates and codebase updates to current U.S. subscribers and users of cybersecurity and anti-virus products and services as identified in Appendix B, until 12:00 AM EDT on September 29, 2024.

After 12:00 AM EDT on September 29, 2024, Kaspersky will be prohibited from providing any anti-virus signature updates and codebase updates associated with the ICTS transactions identified above; and operating the KSN in the United States or on any U.S. person's information technology system.

This Final Determination does not apply to transactions involving Kaspersky Threat Intelligence products and services, Kaspersky Security Training products and services, or Kaspersky consulting or advisory services (including SOC Consulting, Security Consulting, Ask the Analyst, and Incident Response) that are purely informational or educational in nature.