The US Department of Homeland Security (DHS) has ordered all government agencies to “develop plans to remove” all “information security products, solutions, and services” produced by Kaspersky Lab, the Russian multinational cybersecurity and anti-virus provider.
The DHS issued a Binding Operational Directive (BOD) that calls “on departments and agencies to identify any use or presence of Kaspersky products on their information systems” and “to develop detailed plans to remove and discontinue present and future use of the products,” giving them 90 days to comply with the order.
READ MORE: ‘We stay on bright side’: Kaspersky ready to give source code to US govt
The DHS further explained that its decision is based on assessments of the “information security risks presented by the use of Kaspersky products on federal information systems.” It added that these products could be “exploited by malicious cyber actors to compromise those information systems.”
US authorities also believe that “certain Kaspersky officials” could have ties with Russian intelligence and other government agencies, providing an opportunity for US security to be "compromised."
“The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates US national security,” a DHS statement issued Wednesday reads.
The DHS provided no specific evidence supporting its claims, however.
It also afforded “an opportunity for Kaspersky to submit a written response addressing the department’s concerns or to mitigate those concerns.”
In recent months, Kaspersky Lab been subjected to increased scrutiny by US law enforcement agencies and Congress. In June, the FBI questioned its employees across the US while US senators approved a draft defense policy spending bill aimed at barring the Pentagon from using its software.
In mid-July, the US General Services Administration (GSA) removed the firm from two lists of government contractors, citing security reasons.
The move comes less than a day after Bloomberg magazine published an article, accusing the Moscow-based world cybersecurity leader of having close ties to Russia’s security service, the FSB.
Kaspersky has repeatedly denied all claims of collusion with the Kremlin and denounced the report as “numerous allegations, misinterpretations & fakes.”
The firm then issued a statement in which it said it had never launched DDoS attacks on behalf of the Russian government or any other entity. It further denied that it ever assisted government agencies in tracing and hunting down people.
Kaspersky Lab reiterated that it “has no ties to any government” and is a victim of a political battle.
Facing intense pressure from US authorities, company CEO, Eugene Kaspersky even expressed his readiness to reveal the source code for its software to the US government in order to dispel all allegations of its perceived links to Russian intelligence.
"If the United States needs, we can disclose the source code,” he told AP in early July, adding that he would do “anything he can” to “prove that we [the Kaspersky Lab] don’t behave maliciously.”
Remarkably, the head of Kaspersky Lab's computer incidents investigations unit, Ruslan Stoyanov, was charged in Russia in February 2017 over "treason in favor of the US” together with two FSB officers.