In a decisive effort to protect national security and maintain the integrity of its information and communication technology infrastructure, the United States government has taken significant action against AO Kaspersky Lab, a prominent Russian cybersecurity and anti-virus company. On June 21, 2024, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated twelve senior leaders of Kaspersky Lab, marking a substantial escalation in the U.S. government’s measures to counter cyber threats linked to foreign entities.
Treasury and Commerce Actions
Brian E. Nelson, Under Secretary of the Treasury for Terrorism and Financial Intelligence, emphasized the importance of this step: “The United States will take action where necessary to hold accountable those who would seek to facilitate or otherwise enable these activities.”
The Department of Commerce also prohibited Kaspersky Lab and its affiliates from providing anti-virus software and cybersecurity products or services in the U.S. This prohibition follows an investigation revealing that Kaspersky’s products pose a significant risk to U.S. national security. Kaspersky Lab, OOO Kaspersky Group (Russia), and Kaspersky Labs Limited (UK) have been added to the Entity List for their cooperation with Russian military and intelligence agencies.
The Risks of Kaspersky Products
Kaspersky’s cybersecurity solutions provide extensive access to files and elevated privileges on computers, raising concerns about potential misuse by the Russian government. This privileged access could be exploited to obtain sensitive data or bypass cybersecurity measures, posing unacceptable risks to U.S. national security.
The Individuals Sanctioned
The twelve individuals designated by OFAC hold critical positions within Kaspersky Lab and its affiliated entities, playing vital roles in the company’s operations and strategic direction:
- Andrei Gennadyevich Tikhonov: Chief Operating Officer and member of the board of directors.
- Daniil Sergeyevich Borshchev: Deputy CEO of Strategy and Economics and board member.
- Andrei Anatolyevich Efremov: Chief Business Development Officer and board member.
- Igor Gennadyevich Chekunov: Chief Legal Officer and board member.
- Andrey Petrovich Dukhvalov: Vice President and Director of Future Technologies.
- Andrei Anatolyevich Suvorov: Head of the Kaspersky Operating System Business Unit.
- Denis Vladimirovich Zenkin: Head of Corporate Communications.
- Marina Mikhaylovna Alekseeva: Chief Human Resources Officer.
- Mikhail Yuryevich Gerber: Executive Vice President of Consumer Business.
- Anton Mikhaylovich Ivanov: Chief Technology Officer.
- Kirill Aleksandrovich Astrakhan: Executive Vice President for Corporate Business.
- Anna Vladimirovna Kulashova: Managing Director for Russia and the Commonwealth of Independent States (CIS).
These individuals are designated pursuant to E.O. 14024 for their roles in the technology sector of the Russian Federation economy. This designation effectively freezes any property and interests in property of these individuals within the United States or controlled by U.S. persons, and prohibits U.S. persons from engaging in transactions with them.
Broader Implications of the Sanctions
These sanctions send a clear message about the U.S. government’s determination to protect its cyber infrastructure from foreign threats. The actions reflect a strategic effort to deter and disrupt potential malicious activities facilitated by Kaspersky’s extensive access to sensitive data. The sanctions also serve as a warning to other foreign entities about the serious consequences of compromising U.S. cybersecurity.
The OFAC sanctions extend beyond mere punitive measures. They reflect a strategic intent to induce positive behavioral changes among foreign actors by demonstrating the substantial risks and repercussions of engaging in activities that threaten U.S. national security. OFAC maintains a process for designated individuals and entities to seek removal from the sanctions list, provided they can demonstrate a change in behavior and compliance with U.S. regulations.
Kaspersky’s Response to U.S. Sanctions
Kaspersky acknowledges the U.S. ban on its software but notes it can still offer cyber threat intelligence and training. The company proposed independent verification of its products, which was ignored, and believes the decision is influenced by geopolitical tensions rather than an objective assessment.
Kaspersky asserts it does not threaten U.S. national security and has contributed to protecting U.S. interests. It plans to explore legal options to continue its operations and partnerships. Highlighting its 26-year history and independence from government influence, Kaspersky argues the sanctions disregard its proven integrity and transparency. The company warns that the sanctions will hinder cybersecurity efforts and limit consumer choice, causing disruption for its customers.
Despite these challenges, Kaspersky remains committed to combating cyber threats and reports strong business performance, with an 11% growth in sales bookings in 2023. The company is determined to defend its reputation and interests against what it views as unfair actions.
