Possible Kaspersky sanctions meet resistance inside U.S. government

Officials are worried that sanctions could set a dangerous precedent for global behavior on the internet.

A White House plan to sanction Kaspersky Lab has met resistance from senior U.S. government officials who are worried that it could set a dangerous precedent for global behavior on the internet, according to two officials familiar with the matter.

The plan to sanction the Moscow-based anti-virus maker has largely been pioneered by the National Security Council, CyberScoop previously reported. A source with knowledge of the effort recently said that Treasury Department head Steve Mnuchin has “OK’d” sanctions against Kaspersky, although several of his advisers are against it.

A plan to make the sanctions official has no immediate timetable. The final decision rests with the executive branch; which is home to the NSC.

When reached for comment, a spokesperson for the Treasury Department said the agency “does not telegraph sanctions or comment on prospective actions.”

The NSC previously declined to comment on possible Kaspersky sanctions.

Some in government worry about the impact such sanctions would have on the development of global cyber norms — a still evolving policy area that sets behavior boundaries on international internet activity. The concern is that other countries may one day use the same line of reasoning against U.S. companies operating abroad.

“After all, what’s stopping China from punishing Apple if they found out they were conforming to a National Security Letter or something,” one person familiar with the Kaspersky sanctions plan told CyberScoop, referring to the use of secret administrative subpoenas to compel evidence from private companies. “You know, that’s the sort of question that needs to be asked. How would this affect that calculus for others in the future, right? I don’t know.”

Kaspersky Lab faces accusations of assisting the Russian government with spying on its customers. Last year, the U.S. government mandated the removal of Kaspersky software throughout federal agencies. The underlying reason for this removal remains largely classified, but the government has supplemented their case by pointing to publicly available sources — including media reports and the existence of a draconian Russian surveillance law that forces Kaspersky’s to cooperate with Russian intelligence services.

Sanction critics contend that carrying out these actions strictly due to national security risks — the basis of which has not been made public — would be reckless.

“What’s motivating this is revenge. It’s entirely punitive,” another source said. “The policy of the U.S. can not be that declaring war on a company is a legitimate national security tool.”

All of the sources who spoke to CyberScoop said they supported the decision to ban Kaspersky from federal IT systems, but they argued sanctions would be a step too far. The sources spoke on condition of anonymity to speak freely about internal government discussions.

“Sanctions would be a bullet in the head for Kaspersky,” a source told CyberScoop. “It would kill their business not just here but pretty much anywhere that enjoys the benefits of using the U.S. banking system. This could have a reverberating impact that comes back to hurt us … sometimes these things have unintended consequences.”

The Russian technology giant maintains that it has done nothing wrong. Its founder, Eugene Kaspersky, previously declared that the damage caused by the U.S. government’s federal ban was negligible.

While the U.S. has long held concerns about the Chinese government using their domestic technology companies for spying purposes, the Treasury Department did not sanction ZTE until it finally broke a visible agreement barring the sale of equipment to Iran and North Korea. That decision sent ZTE’s stock tumbling.

However, the sanctions against ZTE may be short lived. President Donald Trump recently announced that he would be helping ZTE around sanctions as part of trade negotiations with China.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure