Kaspersky Software Found at 15% of Federal Agencies

About 15 percent of federal agencies had Kaspersky Lab software running on some of their computer systems before the Homeland Security Department banned the Russian anti-virus in September, a top department official told lawmakers Tuesday.

In most cases, those agencies didn’t purchase Kaspersky directly but obtained it as part of a larger package of digital protection services, Assistant Homeland Security Secretary Jeanette Manfra told members of the House Science Committee.

The government is two months into a three-month sprint to scrub Kaspersky from all of its systems following Homeland Security’s conclusion that the anti-virus is too closely tied to the Russian government and may be a jumping off point for data breaches by Kremlin hackers.  

About 94 percent of agencies met an October deadline to scan their systems for Kaspersky software and begin planning to remove the anti-virus, Manfra said. Those that have not complied with the October deadline are very small agencies that require Homeland Security’s help to do that scanning, she said.

Homeland Security’s Sept. 13 binding operational directive ordering Kaspersky off all government computers also applied to contractors, though the department left it up to agencies to determine who should be included in their universe of contractors. It’s not entirely clear if subcontractors, for example, are always included in the list.

Manfra’s confident large departments and agencies fully vetted their contractor ecosystems, she said, but is less confident that all smaller agencies were able to do that.

Homeland Security is also using its governmentwide system of cybersecurity sensors to search for any instances of computers pinging back to Kaspersky IP addresses, she said.

Tuesday’s hearing marked the second major interrogation by the House Science Committee into what prompted the Kaspersky ban, why it didn’t come earlier and how agencies are complying with it.

Manfra first became deeply concerned that Kaspersky might create a government security vulnerability after an intelligence assessment that circulated through government in 2014, she said. During that time Manfra held less senior positions at Homeland Security and the White House.

Homeland Security and other large departments and agencies largely opted to steer away from Kaspersky around that time, she said. Smaller agencies that were not focused on cybersecurity and could not access classified information as they made technology acquisition decisions, however, continued to purchase security packages that included the Russian anti-virus.

“Where there was a gap was in civilian agencies that did not have that infrastructure necessarily in place where they could rely on classified information to make procurement decisions,” she said.

The Defense Department, which has determined that Kaspersky is not running on any of its systems, may have begun an effort to ensure it was free of the anti-virus as early as 2012, Pentagon Deputy Chief Information Officer Essye Miller testified. She could not confirm the precise year Defense began that process.

Thus far, Homeland Security does not have conclusive evidence that flaws in Kaspersky were used to steal information from any civilian government systems, Manfra said, but the investigation is far from complete.

“I want to do a thorough review to ensure that we have the full picture,” she said under questioning by Committee Chairman Lamar Smith, R-Texas.

Manfra declined to respond when Smith asked about a Wall Street Journal report that Kremlin hackers may have used Kaspersky to swipe National Security Agency malware off of the home computer of an agency contractor. She referred questions about the story to NSA.

DHS does not have any authority over NSA operations or security procedures, so Manfra would not necessarily have access to information about that breach if it occurred.

Anti-virus is one of the most powerful computer security tools because it’s allowed to probe nearly every part of a computer to scan for vulnerabilities. Anti-virus systems also routinely quarantine and remove documents and data that might be infected with malware, making them highly useful if intelligence services can exploit them.

Also during Tuesday’s hearing

• Kaspersky Lab sent a lengthy response to Homeland Security’s concerns, which the agency received Nov. 10, Manfra said. Department lawyers are currently reviewing the document, she said, declining to discuss it further.
• Manfra responded to a Kaspersky offer to let the U.S. government review its source code for vulnerabilities and exploits. “That’s not sufficient” to alleviate Homeland Security’s concerns, she said.
• Manfra raised the possibility Kaspersky could sue the U.S. government over the ban. Department lawyers have assured her the ban was legally proper, she said.
• NASA formerly ran Kaspersky on some of its systems but is totally free of the anti-virus as of Oct. 13, Chief Information Officer Renee Wynn testified.