U.S. allies refuse to say whether they will support Washington’s war on Kaspersky

U.S. allies do not appear to be following D.C.’s lead as the federal government continuously distances itself from Kaspersky Lab, a Russian cybersecurity company.

Based on public statements and actions, in addition to interviews conducted by CyberScoop, multiple foreign governments seem to be paying little heed to the U.S. government’s suspicions concerning the Moscow-based anti-virus maker.

Kaspersky has been repeatedly accused of enabling Russian hackers to spy on U.S. authorities through its software. Hackers reportedly stole sensitive National Security Agency tools from a private computer by leveraging their access to Kaspersky’s platform. The company denies the existence of an improper relationship with the Russian government.

The U.S. Department of Homeland Security ordered on Sept. 13 that all federal agencies begin removing Kaspersky software from their computers within 90 days.

Of nine U.S. allies CyberScoop contacted with repeated requests for comment, four responded and only one directly answered whether its government agencies have any Kaspersky products installed. CyberScoop asked these organizations if they themselves had Kaspersky installed, if there had been a new guidance about Kaspersky following recent events, and if the U.S.’ decisions has had any impact.

A spokesperson for Shared Services Canada, the Canadian department that manages software use in government agencies, said that SSC “does not have any Kaspersky software deployed on computers in its inventory.”

“Shared Services Canada currently uses a number of anti-virus products including those from major cyber security vendors in the industry,” the spokesperson said, withholding the names of the products, citing security reasons.

The U.K.’s cyberthreat monitoring agency, which cannot issue directive’s like the DHS’s ban, did not offer guidance about which anti-virus platforms were safe to install.

“The [National Cyber Security Centre] certification schemes do not currently cover anti-virus or anti-malware services,” a government spokesperson said by email, “but should they extend to this, Kaspersky would be assessed on its merits like any other supplier if they were to participate.”

The NCSC has in the past cited Kaspersky intelligence in cyberthreat reports.

A spokesperson for the Australian government said that it has not banned the use of Kaspersky products and did not say whether the government uses Kaspersky software on its networks.

“All Australian Government departments are required to continually assess the risks to their information and networks. Their selection of security products and services is based on that risk assessment,” the spokesperson said. “Our cyber security agencies continue to assess the national security risk presented by service providers and the Government will take any necessary action should the risk assessment change.”

New Zealand’s Government Communications Security Bureau (GCSB), which advises government agencies on data security, would not say if any agencies in the country use Kaspersky, citing national security reasons.

The GCSB publishes its guidance in the New Zealand Information Security Manual, the latest version of which references a website that compares anti-virus softwares, including Kaspersky. The manual itself, however, doesn’t mention any products by name.

Government agencies overseeing data security in France, Germany, Belgium, Qatar and Saudi Arabia did not respond to multiple requests for comment.

Earlier this month, Germany’s BSI, or Federal Office for Information Security, issued a press release saying it has not seen evidence that Russians used Kaspersky products to spy on U.S. authorities, challenging the generally accepted narrative in the U.S. BSI did not specify why it was commenting on the Kaspersky issue in the U.S.

On Oct. 12, Interpol, the international police organization, announced that it renewed a threat intelligence agreement with Kaspersky from 2014 to facilitate sharing information about cybercrime. Interpol has similar agreements with firms like Palo Alto Networks and British Telecom.

“The agreements ensure that any information exchange on data related to criminal trends in cyberspace, cyberthreats and cybercrime is in compliance with INTERPOL’s rules and regulations,” Interpol’s press office said in an email.

The organization also declined to say whether it uses Kasepersky software. However, a press release from its 2014 agreement with Kaspersky said that “Kaspersky Lab will provide threat intelligence as well as hardware and software” to Interpol’s cybersecurity research arm, known as the Global Complex for Innovation.