Officials: U.S. should share threat info on — but not blacklist — Kaspersky products

Both current and former officials say the government needs to take a different approach with Kaspersky's products.

The U.S. government should brief companies about supply chain security threats, like the ones allegedly posed by Russian cybersecurity firm Kaspersky, yet the government shouldn’t be in the business of blacklisting, officials and executives said Thursday.

Companies have to manage the risks suppliers might present, be it from an inadequate security posture, or — as is alleged against Kaspersky — links to Russian intelligence agencies, panelists told a session at the Intelligence and National Security Summit.

“We’re in a position to help you make those [risk management] decisions [about suppliers], we’re not in a position to make them for you,” said John Felker, director of the National Cybersecurity and Communications Integration Center at the Department of Homeland Security.

“The government has always been reluctant to create blacklists,” observed former DHS Undersecretary Suzanne Spaulding.

Representatives of vital industries agreed with Felker and Spaulding during a discussion on critical infrastructure cybersecurity.

The companies that provide the so-called tier one telecommunications backbone, like AT&T, have quarterly meetings with national security officials where “we talk about suppliers, about the security threats that are there,” said AT&T’s Vice President for Global Public Policy Chris Boyer.

He said there had been briefings on particular suppliers, including some requested by the companies. However, Boyer said government officials he has dealt with has stopped short of asking for a ban on Kaspersky products.

“My experience of it hasn’t been anything like a blacklist per se.” Boyer said. Conversations about suppliers concern “risk factors and we then take that into account in the business decisions we make. It’s more collaborative than ‘You shalt not.'”

There has been a tremendous amount of heat placed on Kaspersky in the past few months, from various government agencies moving to ban use of the company’s products to the FBI advising private companies to stay away from using the products on their own systems.

“The focus has all been on [Kaspersky’s alleged] links to Russian intelligence,” Spaulding said. “The focus should be on Russian law, and the requirements that places on companies that are based there. Kaspersky’s servers are there, the data [they collect from customers] is there … Russian law requires that the government can get access to it,” Spaulding told CyberScoop after the session.

She said if U.S. companies stopped buying Kaspersky’s products because of concern about the legal regime in Russia that would send a powerful message.

“Governments need to start to think about their laws, their legal frameworks and the impact that has on the competitiveness of their companies,” she said.

Letting the market secure its supply chain was an approach other panelists mentioned, and not just in the context of Kaspersky.

The private sector needs to look at supply chain security as an opportunity as well as a threat, said Fred Hintermister, who runs the Electricity Information Sharing and Analysis Center.

Supply chain security is a risk, but it’s also “a strategic competitive advantage,” he said, “The marketplace can be very, very powerful in taking care of a lot of these issues.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems