Senator questions DHS's handling of Kaspersky software ban in federal agencies

A senior U.S. official pushed back against Sen. Claire McCaskill's criticism concerning the 90-day timeframe provided by the Department of Homeland Security for federal agencies to uninstall Kaspersky Lab products.

A senior U.S. official pushed back against a Democratic senator’s criticism Thursday concerning the 90-day timeframe provided by the Department of Homeland Security for federal agencies to uninstall Kaspersky Lab products after the technology was linked to Russian intelligence efforts.

In an open congressional hearing Thursday, Missouri Sen. Claire McCaskill questioned why the Homeland Security Department would offer such a grace period when the threat of foreign espionage is apparently evident. She implied that the Kremlin, if found in a similar situation, would be handling the situation much more rapidly.

“You’re giving them a long time,” said McCaskill. “Do you think if this happened in Russia, if they found a system of ours was looking at all their stuff, that they would give their government 90 days to remove it? Seriously? The point I am making I mean is that why don’t you just say you have to remove it immediately?”

On Sept. 13, the DHS announced a Binding Operational Directive — only the fourth of its kind — to push agencies to “take actions related to the use or presence of information security products, solutions, and services supplied directly or indirectly by AO Kaspersky Lab or related entities,” according to a government statement. The BOD followed months of speculation and media reports connecting the Russian anti-virus maker to the Kremlin’s national security apparatus. BODs exclude national security systems.

The directive was organized into three separate 30-day stages, which began with a review of existing software, followed by a planning period, and then finally the removal process. The first stage ended last week.

In an interview with CyberScoop, Jeanette Manfra, assistant secretary for DHS’s cybersecurity and communications office, said the government was on track to complete the BDO in 90 days — meaning that the first stage had been completed and DHS now had a comprehensive idea for where Kaspersky software was installed. 

https://twitter.com/Bing_Chris/status/920753156132364288

Christopher Krebs, a senior official performing the duties of the undersecretary for the National Protection and Programs Directorate (NPPD), responded to McCaskill’s criticism by explaining that the process of identifying, removing and replacing Kaspersky from government systems will require a budgetary and technical review in order to avoid unintended security issues.

“You can’t just rip out a system,” Krebs explained. “There are certain vulnerabilities that can be introduced by just turning a critical anti-virus product off. What we need to do is have a process in place that you can replace it with something that is effective. And in the meantime, we are able to put capabilities around anything we do to identify or monitor any sort of traffic.”

One of the challenges facing the government when it comes removing Kaspersky, broadly mentioned by Krebs in his brief response, is that replacing the software could result in a negative consequence if an alternative is not readily available.

Although U.S. intelligence officials unanimously agree that Kaspersky poses a threat, security experts maintain that the company’s anti-virus product is of high quality and can help prevent common computer viruses. As a result, there may be a scenario where the expulsion of Kaspersky would open up an organization to harm from everyday cybercriminals.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure