Kaspersky pledges independent code review to cast off spying suspicions

reader comments
0

After reports that data collected by the company’s anti-malware client was used to target an NSA contractor and various accusations of connections to Russian intelligence, today Kaspersky Lab announced the launch of what company executives call a “Global Transparency Initiative.” As part of the effort aimed at regaining the trust of corporate and government customers among others, a Kaspersky spokesperson said that the company would open product code and the company’s secure coding practices to independent review by the first quarter of 2018.

Don’t just take our word for it – Kaspersky Lab announces comprehensive transparency initiative https://t.co/WctdVi0lXG http://pic.twitter.com/7YaedHLH9D

— Kaspersky Lab (@kaspersky) October 23, 2017

In a statement released by the company, founder Eugene Kaspersky said, “We want to show how we’re completely open and transparent. We’ve nothing to hide. And I believe that with these actions we’ll be able to overcome mistrust and support our commitment to protecting people in any country on our planet.”

As part of the initiative, Kaspersky Lab will open three “Transparency Centers” for code review—one in the US, one in Asia, and one in Europe. This is similar to the practices of Microsoft and other large major software companies that allow code reviews by major government customers in a controlled environment. Kaspersky isn’t the first vendor accused of providing espionage backdoors to follow this route—a similar practice was launched by Chinese networking hardware vendor Huawei in 2012 in the United Kingdom. At the time, Huawei offered to do the same for Australia and the US, but the offer was rejected and the company was banned from sensitive network work in the US by Congress.

Kaspersky Lab also announced a boost to the company’s bug bounty program, promising to raise payments for the “most severe vulnerabilities” submitted by researchers to the company’s Coordinated Vulnerability Disclosure program to $100,000 “to further incentivize independent security researchers to supplement our vulnerability detection and mitigation efforts.”

In a blog post, Eugene Kaspersky accused the press of making false allegations about his company. “The media attacks have been intense, fierce, and persistent,” he wrote. “So much so that we’ve had to lay low for a while to catch our breath and work out what on earth this is all about.” He acknowledged that some “think ‘Russian cybersecurity company’ are three words that shouldn’t be in the same sentence, especially these days,” but Kaspersky suggested there were ulterior motivations behind the recent accusations.

“The steady stream of media leaks seem intentionally designed to damage our reputation without providing us with any real opportunity to address any concerns,” Kaspersky wrote. “Action is being taken before we can engage. Some will say that the government has provided us with an administrative remedy that we can pursue, and if so we will do so. But genuine due process provides you with the opportunity to defend yourself and see the evidence against you before action is taken; it doesn’t ask you to respond once action is already underway.”

Last month, the US Department of Homeland security ordered government agencies to stop using any software products made by Kaspersky Lab due to concerns about possible ties between Kaspersky officials and Russian intelligence.