Speaker 1: Like call here in order like to welcome our witnesses today,
Speaker 1: Director of National Intelligence Dan Coates, Dan, it's good to
Speaker 1: see our former may. A group of U. S. Senators
Speaker 1: held the public hearing. It was about maybe the most
Speaker 1: divisive tech company that you've never heard of. Kaspersky Lab
Speaker 1: software is used by not hundreds of thousands, millions of Americans.
Speaker 1: Kaspersky Lab, that's Russia's top saber security company. This is
Speaker 1: Marco Rubio, a Republican senator from Florida. He's sitting behind
Speaker 1: a wooden dais with the rest of the Senate's Intelligence Committee,
Speaker 1: and he's questioning a panel of America's most senior intelligence officials.
Speaker 1: To each of our witnesses, I would just ask, would
Speaker 1: any of you be comfortable with Kaspersky Lab software on
Speaker 1: your computers? Resounding note for me, No Senator, no sir,
Speaker 1: No Senator, no sir. This software from Kaspersky Lab that
Speaker 1: none of these intelligence officials want on their computers. It's
Speaker 1: not just your run of the mill application. It's anti
Speaker 1: virus software that gets very deep access into our computers
Speaker 1: to protect us from hackers. Their software is installed all
Speaker 1: over the United States, in the computers of not just
Speaker 1: US ordinary consumers, but also in the computers of banks,
Speaker 1: power plants, internet routers, and even portions of the U. S. Government.
Speaker 1: The intelligence officials in this hearing didn't specify why they
Speaker 1: Seekspersky Lab as a security threat, but the senators, once
Speaker 1: again without mentioning details, seem to be very concerned about
Speaker 1: the ties that the company has with Russia's own government,
Speaker 1: the very government that tried to influence and hack the
Speaker 1: U S presidential elections last fall. Today, I'm going to
Speaker 1: give you a peek into Cospersky's connections with people inside
Speaker 1: Russia's intelligence services, relationships the company has tried to keep secret.
Speaker 1: It's an investigation and that we've been working on for
Speaker 1: about two years now. These are details that have never
Speaker 1: been reported on before. Hi am Aki Ito, and I'm
Speaker 1: Jordan Robertson. And this week on Decrypted, we're going to
Speaker 1: be introducing you to Kaspersky Lab and its founder and CEO,
Speaker 1: Eugene Kaspersky in Russia. Eugene is a celebrity entrepreneur, one
Speaker 1: of the few really big names in Moscow's tech industry.
Speaker 1: He's built a huge business across the U S and
Speaker 1: Western Europe, which together make up more than half the
Speaker 1: company sales. Kaspersky himself has publicly denied working with the
Speaker 1: Russian government, and he's offered to answer senators questions and
Speaker 1: to make the company's source code available to the US
Speaker 1: government to show that there's no cause for concern. But
Speaker 1: after listening to this episode, I think you'll understand why
Speaker 1: the US government thinks Kaspersky maybe vone are able to
Speaker 1: Russian government influence. Now, none of this is meant to
Speaker 1: suggest that Kaspersky has actually used its connections with the
Speaker 1: Russian government for malicious purposes. We do not have any
Speaker 1: basis for believing them. But the combination of having relationships
Speaker 1: with people in Russian intelligence, as well as the ability
Speaker 1: to closely monitor large swaths of our digital infrastructure, is
Speaker 1: making American officials nervous, and other unusual things are happening too.
Speaker 1: According to one recent report, FBI agents visited the homes
Speaker 1: of several Kaspersky employees here in the US. Kaspersky confirmed
Speaker 1: that FBI agents have had brief interactions with some of
Speaker 1: its US employees, but said the discussions were just due
Speaker 1: diligence chats. Plus, we'll please some tape that has never
Speaker 1: been aired before of using Kaspersky himself talking candidly on
Speaker 1: the record about his relationship with some Russian government officials.
Speaker 1: Stay with us. So. Eugene Kaspersky was educated at a
Speaker 1: KGB sponsored cryptography institute, and he later worked for Russian
Speaker 1: military intelligence. But the reason he's famous is for his company,
Speaker 1: Kaspersky Lab. It was a company he started twenty years
Speaker 1: ago in the early days of anti virus security software,
Speaker 1: and it's made him a rich man. It's also made
Speaker 1: him the target of some of these congressional and intelligence
Speaker 1: community attacks. Right he's viewed at home in Russia kind
Speaker 1: of the way we think about Mark Zuckerberg right here
Speaker 1: in the US he is. Here's how he's viewed in Russia. Well,
Speaker 1: he's a big boss. He's a renowned industry and business leader.
Speaker 1: That's Oleg Demodov, a Russian cyber warfare expert with a
Speaker 1: p i R Center, an international security research organization based
Speaker 1: in Moscow. You cannot often see him in some regularly
Speaker 1: regular level conference or industry events. Ah. He appears in
Speaker 1: the public not so often, but he any any his speech,
Speaker 1: any his statement in his blog. AH. In many cases
Speaker 1: this is gonna be in the event Eugene is a boisterous,
Speaker 1: barrel chested guy in his fifties. I've met him a
Speaker 1: few times, and everyone who's met him will tell you
Speaker 1: the same thing. He's the life of the party. He's gregarious,
Speaker 1: quick with a joke, and you just get the sense
Speaker 1: that this guy knows stuff that others don't like. He's
Speaker 1: plugged into places not a lot of other people are.
Speaker 1: And his company, Kaspersky Lab, has a big reputation too.
Speaker 1: I can't tell you that in Moscow here, because Barresky
Speaker 1: Lab has been regarded is probably the most successful company
Speaker 1: in Russian information security cyber security sector, and that success
Speaker 1: all came from the anti virus software that the company sells,
Speaker 1: because Persky makes deals with retailers and PC makers to
Speaker 1: install it software on the devices, in some cases even
Speaker 1: before you buy it. And this part of Kaspersky's business
Speaker 1: is very large. It's what the company is most known for.
Speaker 1: I sense a butt, but Kaspersky's technology is also pervasive
Speaker 1: in less obvious places. The company boasts some four hundred
Speaker 1: million users worldwide, but according to one person familiar with
Speaker 1: how the company counts users, as many as two hundred
Speaker 1: million of those probably don't know it. That's because of
Speaker 1: undisclosed licensing agreements that put the Kaspersky Lab anti virus
Speaker 1: system in things like Internet routers that power large corporate
Speaker 1: networks and even critical US infrastructure. Kaspersky was founded in Moscow,
Speaker 1: but has quickly expanded its business to other markets. More
Speaker 1: than half of Kaspersky Labs revenue last year came from
Speaker 1: the U S and Europe, according to the research company
Speaker 1: I d C. And Eugene knows it's critically important that
Speaker 1: his clients in the West do not associate him too
Speaker 1: closely with his government, which of course has been actively
Speaker 1: hacking political operatives across the US and euro app. Yes,
Speaker 1: but I do need to emphasize it's not just Russian
Speaker 1: companies that have to work with the Russian government. I
Speaker 1: don't think there's a tech company in the world that
Speaker 1: can just refuse to cooperate with its home government. Right
Speaker 1: The Edwards Snowden revelations showed a pretty cozy relationship between
Speaker 1: the n s A and a lot of American tech companies,
Speaker 1: so it wouldn't be surprising at all two people in
Speaker 1: the industry if Kaspersky Lab had to keep some amount
Speaker 1: of contact with the Russian government complying with legal requests
Speaker 1: for information and that kind of thing. Those sorts of
Speaker 1: requests are very routine and happened here in the US too. Um.
Speaker 1: But then there's the stuff that you've discovered in your
Speaker 1: reporting with our cybersecurity reporter Michael Reiley. Right. Our reporting
Speaker 1: shows that Kaspersky has maintained a much closer working relationship
Speaker 1: with Russia's main intelligence agency, the FSB, than Eugene Kaspersky
Speaker 1: has publicly admitted. We found evidence that Kaspersky Lab developed
Speaker 1: custom security technology that the FSB asked for. Plus we've
Speaker 1: uncovered some joint projects between the company and Russian intelligence.
Speaker 1: Coming up, we'll hear the details on Jordan's and Mike's investigation.
Speaker 1: That's right after the short break. Hi, I'm Pagat Carrie,
Speaker 1: a producer Here on Decrypted. We hear a lot about
Speaker 1: the possibility that robots and algorithms could take away our jobs.
Speaker 1: But how real is this threat? If you're seeing or
Speaker 1: experiencing automation at work, or suspect your job will be impacted,
Speaker 1: please get in touch with us. We want to hear
Speaker 1: your story, even use it for a future episode. Record
Speaker 1: a voice message on your smartphone and email it to
Speaker 1: decrypted at Bloomberg dot net. Before the break, we were
Speaker 1: just about have to hear the details of your investigation,
Speaker 1: Jordan with Mike. That highlighted some of the work that
Speaker 1: Kaspersky has done for the FSB, So let's hear these details. So,
Speaker 1: my colleague Mike Riley and I recently reviewed internal emails
Speaker 1: from October two thousand nine, suggesting that at least back then,
Speaker 1: Kaspersky Lab had a close working relationship with the FSB.
Speaker 1: Now remember that's the main intelligence agency in Russia, right,
Speaker 1: And what did that relationship look like? These emails actually
Speaker 1: come from Eugene Kaspersky himself discussing a project with his
Speaker 1: senior staff. The emails show that even back in two
Speaker 1: thousand nine, so again, eight years ago, Kaspersky was making
Speaker 1: custom software to protect the government's own network from any
Speaker 1: kind of external hack. And that doesn't sound that unusual, right, Well,
Speaker 1: it's one thing to make the software and sell it
Speaker 1: to the government, But the emails also discussed another type
Speaker 1: of operation. Kaspersky Lab's own employees appear to have been
Speaker 1: physically accompanying Russian agents on these raids to locate people
Speaker 1: thought to be launching hacks or cyber attacks against the government,
Speaker 1: so not just tracking these hackers down from their offices,
Speaker 1: but actually riding along on the cop cars. Correct. Have
Speaker 1: you heard of this kind of thing ever happening before? No. Never.
Speaker 1: We talked to lots of cybersecurity experts, and I've never
Speaker 1: spoken to one who's accompanied a federal law enforcement agent
Speaker 1: on an arrest. It's very common for private sector security
Speaker 1: companies here in the US to provide data on criminal
Speaker 1: hackers to the FBI, which then makes the arrest right
Speaker 1: And and what else did you find? Those emails, which
Speaker 1: I should remind everyone were written in two thousand nine,
Speaker 1: mentioned two Kaspersky Lab employees by name. One of them
Speaker 1: was the Kaspersky employee going out on those raids with
Speaker 1: the FSP agents. In December, the Russian government arrested that
Speaker 1: man on treas and charges for alleged connections to get
Speaker 1: this U S intelligence, which is quite the twist. It is.
Speaker 1: A senior Russian intelligence official was also arrested, and while
Speaker 1: we don't know the exact nature of the treason charges,
Speaker 1: what is clear is that the Russian government is paying
Speaker 1: very close attention to Kaspersky Lab and its employees for
Speaker 1: a company that claims to have no connections to the
Speaker 1: Russian government, having employees ride along on these raids sounds
Speaker 1: very much like a connection. And as luck would have it,
Speaker 1: Mike and I actually broached some of these subjects with
Speaker 1: Eugene Kaspersky back in for a profile we did on
Speaker 1: the company for Bloomberg Business Week. Eugene Kaspersky agreed to
Speaker 1: let us record the interview, which was all on the record,
Speaker 1: and Jordan's this was the first time that you confronted
Speaker 1: Eugene Kaspersky with information you'd obtained back then about his
Speaker 1: ties to Russian officials. Correct, and his answers were surprisingly candid,
Speaker 1: even though he'd later deny, saying some of it okay,
Speaker 1: So let's place some of that tape. Well, I'll play
Speaker 1: you this bit first. This is where Eugene Kaspersky suggests
Speaker 1: that his company's interactions with law enforcement, both in Russia
Speaker 1: and in other countries around the world, happened routinely. Well, actually,
Speaker 1: we're in touch with the wet us everywhere on the world.
Speaker 1: We're in touch with the Center Police and cybersecuritiy UH.
Speaker 1: And in the Russia, the cyber police is for their
Speaker 1: low level cyber crime, and there was a serious attacks
Speaker 1: like carbon for example. This level it's ah FSB development,
Speaker 1: which is kind of DHS right side the side. So
Speaker 1: of course we've worked very close to them because there's
Speaker 1: so much crime in Russia. But after quite openly talking
Speaker 1: about the work that he does with the FSB, Eugene
Speaker 1: Kospersky reverts to this favorite punch line of his, which
Speaker 1: is that he's closer to the FBI in America than
Speaker 1: he is with Russian authorities. He repeated a version of
Speaker 1: this on May eleven, where he said, and I quote,
Speaker 1: we don't have ties to any government other than paying taxes.
Speaker 1: We paid tax is in many countries as we are
Speaker 1: a very international company. Here's the club. So there are
Speaker 1: rumors about our very special links in creaming we'll have.
Speaker 1: I'd like say that, of course we have in touch
Speaker 1: with these guys, but I think that in Israel, in
Speaker 1: in the United States, we have much better connections. This
Speaker 1: love enforcement And in this interview in Mike and I
Speaker 1: asked Eugene about this thing we heard about where he
Speaker 1: goes to the banya with members of the Russian military
Speaker 1: and Russian intelligence. Is a Russian sauna that's right, And
Speaker 1: we wanted to ask specifically about this because if it's true,
Speaker 1: that would suggest he has friendly relationships with people in
Speaker 1: Russian intelligence. When I go to Bunnet, it's like a
Speaker 1: difference not only from the company, but we don't talk
Speaker 1: about business. There are those friends FSB, military generals or
Speaker 1: some of those, or military personnel. And therefore, did we
Speaker 1: have one guy there it's a friend of us, uh,
Speaker 1: he's City diet As. He simply there because well, actually
Speaker 1: he was responsible for certification, so to get the military
Speaker 1: contract in the New States, in the Europe and the
Speaker 1: rest of the same, you have for positivetification. So we
Speaker 1: went to was that man for long years? Okay, so
Speaker 1: we've got through some of the details of your investigation,
Speaker 1: Jordan's with Mike that suggested Kaspersky Labs relationship with Russian
Speaker 1: intelligence is much closer than the company has publicly admitted.
Speaker 1: So let's take off the main points. Sure. First, there's
Speaker 1: the information from the company's internal emails suggesting that Kaspersky
Speaker 1: Lab employees participated in raids with Russian agents. Then there's
Speaker 1: the employee who apparently went on those raids getting arrested
Speaker 1: by the Russians on treason charges. And of course there's
Speaker 1: Eugene Kaspersky himself telling us on the record that he
Speaker 1: goes to these Banya knights with his friends, some of
Speaker 1: whom are Russian military and intelligence officials. So let's swim
Speaker 1: out to the geopolitical situation. Tensions are mounting, with Congress
Speaker 1: and the FBI looking separately into allegations that Russia was
Speaker 1: trying to influence the U S election. And it isn't
Speaker 1: just a US. Russia's cyber operations have been getting increasingly
Speaker 1: aggressive in France, the Netherlands and Germany too, So Kaspersky's
Speaker 1: wide business network in the US, combined with a working
Speaker 1: relationship with the Russian government, is what's making officials here
Speaker 1: in the US nervous. For them, even the possibility of
Speaker 1: Kaspersky's platform being used as a backdoor into computers, firewalls,
Speaker 1: and routers around the world is terrifying, although we don't
Speaker 1: have evidence that the company ever tried to do this.
Speaker 1: And in a statement, Democratic Senator Jean Chaheen called the
Speaker 1: ties between Kaspersky and the Kremlin quote alarming, and she
Speaker 1: said it's because of that that the Congress and the
Speaker 1: administration thinks quote Kaspersky Lab cannot be trusted to protect
Speaker 1: critical infrastructure, particularly computer systems vital to our nations security,
Speaker 1: and that fear comes from the very nature of the
Speaker 1: software that Kaspersky has installed on our computers. They would
Speaker 1: know the security posture and the security risk of their customers,
Speaker 1: so they would know if a certain customer is not
Speaker 1: very security oriented and has a lot of threats detected
Speaker 1: on its end points, they would get a snapshot of
Speaker 1: what the architecture is somewhat like. That's Rob Westerfeld, who's
Speaker 1: an analyst with market research firm I d C. What
Speaker 1: Rob saying here is that Kaspersky Lab could easily find
Speaker 1: out which of its clients would be most vulnerable to
Speaker 1: an attack. That's enormously valuable in securing those systems or
Speaker 1: planning an attack. And let's be super clear here, this
Speaker 1: is all very hypothetical. There's absolutely no evidence that Kaspersky
Speaker 1: is misusing its access. That's right, it's just as potential
Speaker 1: that's getting officials worried. There's always a risk there, and
Speaker 1: there could be a risk. That risk could be repeated
Speaker 1: by any security vendor. They could have a rogue employee
Speaker 1: that is doing that, and so you know, it's a
Speaker 1: virtually impossible for a security vendor to be probed extremely
Speaker 1: heavily in order to tell whether the level of that
Speaker 1: risk exists. Although in Russia many people blame the scrutiny
Speaker 1: Kaspersky Lab is under on politics, here's the security analyst.
Speaker 1: Oh leg Again, people in Russia understand well why this
Speaker 1: is happening now, this is a kind of alarm is
Speaker 1: wideless bread in the American military communities, special services community,
Speaker 1: and tolist extent less extent law enforcement community with regard
Speaker 1: to Russia and the so called the Russian threat in cyberspace.
Speaker 1: So at the top of the show, we mentioned that
Speaker 1: FBI asians visited the homes of some of Kaspersky's US employees. Jordan,
Speaker 1: would we know about this so far? Well, we don't
Speaker 1: know exactly why the FBI agents decided to make those visits.
Speaker 1: Reports say it has to do with a counterintelligence inquiry.
Speaker 1: And what does that mean? So counterintelligence means they're looking
Speaker 1: for foreign spies right here in the US. That's pretty interesting. Now,
Speaker 1: that doesn't necessarily mean the FBI thinks that Caspersky employees
Speaker 1: themselves are involved in espionage, or even that they know
Speaker 1: anything about it, but for whatever reason, the FBI apparently
Speaker 1: thought it was worth the effort to pay them a visit.
Speaker 1: We also saw news of a Senate bill that will
Speaker 1: ban the Department of Defense from using Kaspersky software. The
Speaker 1: legislation said that Kaspersky Lab quote might be vulnerable to
Speaker 1: Russian government influence. Now let's make this clear. It's not
Speaker 1: like the Pentagon us as much Kaspersky Lab software anyway,
Speaker 1: so the idea may not actually do all that much.
Speaker 1: But we recently reported at Bloomberg that Russia is threatening
Speaker 1: some kind of retaliation if this bill goes through. We
Speaker 1: don't have details on what kind of measures that could entail,
Speaker 1: but the threat from Russia shows just how important this
Speaker 1: one company could become. In response to this escalated concern
Speaker 1: over Cospersky Lab, Eugene Coosperski himself went on Reddit. During
Speaker 1: the Senate hearing we've mentioned at the top of the show,
Speaker 1: he repeated the same message he's maintained for years, that
Speaker 1: the allegations are unfounded conspiracy theories and amount to simple
Speaker 1: Russia baiting. Eugene Kaspersky said his only ties to the
Speaker 1: Russian government are the taxes his company pays and even
Speaker 1: went so far as to say that Caspersky Lab doesn't
Speaker 1: share any user data with any government, including Russian And
Speaker 1: by the way, we ask Spersky Lab for comment on
Speaker 1: our story today, they said, quote, Kaspersky Lap has always
Speaker 1: acknowledged that it provides appropriate products and services to governments
Speaker 1: around the world to protect those organizations from cyber threats.
Speaker 1: But it does not have any unethical ties or affiliations
Speaker 1: with any government, including Russia. And where do you think
Speaker 1: this is gonna go? What do you think it's going
Speaker 1: to happen next? Well, the latest development is Eugene Kaspersky
Speaker 1: has offered to give the US government his company source
Speaker 1: code for review. This is not an uncommon thing for
Speaker 1: companies doing business with the federal government, but many security
Speaker 1: experts say it's not the point. Uh. The point, they
Speaker 1: say is that this software could be used for potentially
Speaker 1: malicious purposes independent of what's in the source code. And
Speaker 1: the reason is security software receives continuous updates, and if
Speaker 1: any of those updates are malicious, uh, the theory goes,
Speaker 1: the software could be used for for bad intentions. So
Speaker 1: Jordan's with the US relationship with Russia, where it is now,
Speaker 1: just tensions being higher than they have in a really
Speaker 1: long time. Do you think a company like Kaspersky Lab
Speaker 1: even stands a chance in the federal government market. I
Speaker 1: think Caspersky Lab is going to find it very very
Speaker 1: hard to penetrate the US federal market, and they've all
Speaker 1: but acknowledged that this really isn't a market they're pursuing. However,
Speaker 1: on the consumer side, their software is actually really good
Speaker 1: at what it does, and it has the endorsement of
Speaker 1: a lot of cybersecurity professionals, so on that side they
Speaker 1: still see potential for very very big growth. But really,
Speaker 1: what's happening here is just as the US doesn't buy
Speaker 1: missiles and other weapons systems from foreign countries, we're starting
Speaker 1: to see the same thing play out in the cybersecurity market,
Speaker 1: where if your security software is made by made in
Speaker 1: a country that is considered an adversary, you may not
Speaker 1: have great success here in the US. And that's it
Speaker 1: for this week's episode of Decrypted. Thanks for listening. Let
Speaker 1: us know what you thought of the show. Please record
Speaker 1: a voice message and send it to Decrypted at Bloomberg
Speaker 1: dot net. Also, I'm on Twitter at Jordan's are one
Speaker 1: thousand and I'm at Akio seven. If you haven't already,
Speaker 1: please subscribe to our show wherever you get your podcasts,
Speaker 1: and while you're there, leave us a rating and a review.
Speaker 1: This really helps us find more listeners for a show.
Speaker 1: This episode was produced by Pia Gadkari Liz Smith at
Speaker 1: Magnus Hendrickson. Thanks to Nico Grant for his help on
Speaker 1: this show. My business Week story was co written by
Speaker 1: Michael Reilly and edited by Jeff Muscus. You can read
Speaker 1: it at Bloomberg dot com, slash business Week, or in
Speaker 1: the New Business Week app. Alec McCabe is head of
Speaker 1: Bloomberg podcast. We'll see you next week.