Bolstering the Government's Cybersecurity: Assessing the Risk of Kaspersky Lab Products to the Federal Government

Kaspersky Lab is based in Moscow, Russia, and was founded in 1997 by Eugene Kaspersky. The company is one of the world's largest providers of cybersecurity software and services, including both consumer and enterprise solutions. As early as 2015, reports began to surface alleging that Mr. Kaspersky maintained close ties to Russian spies. Mr. Kaspersky was] educated at a KGB-sponsored university and] also wrote code for the Soviet military. While once considered reputable, Kaspersky Lab, its founder and their Russian ties have created a significant risk to U.S. security. According to several media investigations, these connections have allowed Kaspersky Lab to be exploited not only by the Russian government but also by criminal hackers around the world. Mr. Kaspersky's history and recent remarks have done little to alleviate these concerns. The matter reached a tipping point in July 2017], when the General Services Administration, the GSA, announced the removal of Kaspersky Lab products from its preapproved government contracts schedules. The purpose of this hearing is to examine the concerns raised regarding the risks associated with utilizing Kaspersky Lab products on federal government information technology systems and the federal government's response to the concerns. Witnesses will discuss the government's cybersecurity posture, potential cybersecurity risks Kaspersky Lab's products pose to agency IT systems, and ways to improve agency practices related to design, acquisition, development, modernization, use and performance of federal IT resources.