Speaker 1: Hi, everyone, it's a Key This Week group bringing you
Speaker 1: an update on an episode that we first broadcast last summer.
Speaker 1: It was the result of a detailed investigation into Kaspersky Lab,
Speaker 1: one of Russia's largest tech companies in the businesses relationship
Speaker 1: with the Russian government. We're going to play you an
Speaker 1: excerpt of that original episode to refresh your memory. But
Speaker 1: stick around because we'll be back after that with an update.
Speaker 1: Like call hearing to order, like to welcome our witnesses. Today,
Speaker 1: Director of National Intelligence Dan Coates and may a group
Speaker 1: of U. S senators held the public hearing. It was
Speaker 1: about maybe the most divisive tech company that you've never
Speaker 1: heard of. Kaspersky Lab software is used by not hundreds
Speaker 1: of thousands, millions of Americans. Kaspersky Lab, that's Russia's top
Speaker 1: cyber security company. This is Marco Rubio, a Republican Senator
Speaker 1: from Florida. He's sitting behind a wooden daist with the
Speaker 1: rest of the Senate's Intelligence Committee, and he's questioning a
Speaker 1: panel of America's most senior intelligence officials. To each of
Speaker 1: our witnesses, I would just ask, would any of you
Speaker 1: be comfortable with Cospersky Lab software on your computers have
Speaker 1: resounding no for me. No Senator, no sir, No Senator,
Speaker 1: no sir. This software from Kaspersky Lab that none of
Speaker 1: these intelligence officials want on their computers. It's not just
Speaker 1: your run of the mill application. It's anti virus software
Speaker 1: that gets very deep access into our computers to protect
Speaker 1: us from hackers. Their software is installed all over the
Speaker 1: United States in the computers of not just US ordinary consumers,
Speaker 1: but also in the computers of banks, power plants, internet routers,
Speaker 1: and even portions of the U. S. Government. But the Senators,
Speaker 1: once again without mentioning details, seemed to be very concerned
Speaker 1: about the ties that the company has with Russia's own government,
Speaker 1: the very government that tried to influence and hack the U. S.
Speaker 1: Presidential elections last fall. Today, I'm going to give you
Speaker 1: a peek into Kaspersky's connections with people inside Russia's intelligence services,
Speaker 1: relationships the company has tried to keep secret. It's an
Speaker 1: investigation that we've been working on for about two years now.
Speaker 1: These are details that have never been reported on before.
Speaker 1: Hi am Akio, and I'm Jordan Robertson, and this week Undecrypted,
Speaker 1: we're going to be introducing you to Kaspersky Lab and
Speaker 1: its founder and CEO, Eugene Kaspersky in Russia. Eugene is
Speaker 1: a celebrity entrepreneur, one of the few really big names
Speaker 1: in Moscow's tech industry. He's built a huge business across
Speaker 1: the U S and Western Europe, which together make up
Speaker 1: more than half the company sales. Kaspersky himself has publicly
Speaker 1: denied working with the Russian government, and he's offered to
Speaker 1: answer senators questions and to make the company's source code
Speaker 1: available to the US government to show that there's no
Speaker 1: cause for concern. But after listening to this episode, I
Speaker 1: think you'll understand why the US government thinks Kaspersky may
Speaker 1: be vulnerable to Russian government influence. Now, none of this
Speaker 1: is meant to suggest that Kaspersky has actually used its
Speaker 1: connections with the Russian government for malicious purposes. We do
Speaker 1: not have any basis for believing that. But the combination
Speaker 1: of having relationships with people in Russian intelligence, as well
Speaker 1: as the ability to closely monitor large swaths of our
Speaker 1: digital infrastructure, is making American officials nervous. Plus will please
Speaker 1: some tape that has never been aired before of using
Speaker 1: Kaspersky himself talking candidly on the record about his relationship
Speaker 1: with some Russian government officials. Stay with us. So. Eugene
Speaker 1: Kaspersky was educated at a KGB sponsored cryptography institute, and
Speaker 1: he later worked for Russian military intelligence. But the reason
Speaker 1: he's famous is for his company, Kaspersky Lab. It was
Speaker 1: a company he started twenty years ago in the early
Speaker 1: days of anti virus security software, and it's made him
Speaker 1: a rich man. It's also made him the target of
Speaker 1: some of these congressional and intelligence community attacks. Right he's
Speaker 1: viewed at home in Russia kind of the way we
Speaker 1: think about Mark Zuckerberg right here in the US. He is.
Speaker 1: Eugene is a boisterous, barrel chested guy in his fifties.
Speaker 1: I've met him a few times, and everyone who's met
Speaker 1: him will tell you the same thing. He's the life
Speaker 1: of the party. He's gregarious, quick with a joke, and
Speaker 1: you just get the sense that this guy knows stuff
Speaker 1: that others don't like. He's plugged into places not a
Speaker 1: lot of other people are, and his company a Spersky Lab,
Speaker 1: has a big reputation too. I can tell you that
Speaker 1: in Moscow here that's Oleg Demodov, a Russian cyber warfare
Speaker 1: expert with the p i R Center, an international security
Speaker 1: research organization based in Moscow. Kaspersky Lab has been regarded
Speaker 1: is probably the most successful company in Russian information security
Speaker 1: cyber security sector, and that success all came from the
Speaker 1: anti virus software that the company sells. Kaspersky makes deals
Speaker 1: with retailers and PC makers to install it software on
Speaker 1: the devices, in some cases even before you buy it,
Speaker 1: and this part of Kaspersky's business is very large. It's
Speaker 1: what the company is most known for. I sense a butt,
Speaker 1: but Kaspersky's technology is also pervasive in less obvious places.
Speaker 1: The company boasts some four million users worldwide, but according
Speaker 1: to one person familiar with how the company counts users,
Speaker 1: as many as two hundred million of those probably don't
Speaker 1: know it. That's because of undisclosed licensing agreements that put
Speaker 1: the Kaspersky Lab anti virus system in things like Internet
Speaker 1: routers that power large corporate networks and even critical US infrastructure.
Speaker 1: Kaspersky was founded in Moscow, but has quickly expanded its
Speaker 1: business to other markets. More than half of Kaspersky Labs
Speaker 1: revenue last year came from the U S and Europe,
Speaker 1: according to the research company I d C. And Eugene
Speaker 1: knows it's critically important that his clients in the West
Speaker 1: do not associate him too closely with his government, which
Speaker 1: of course has been actively hacking political operatives across the
Speaker 1: US and Europe. Yes, but I do need to emphasize
Speaker 1: it's not just Russian companies that have to work with
Speaker 1: the Russian government. I don't think there's a tech company
Speaker 1: in the world that can just refuse to cooperate with
Speaker 1: its home government. Right. The Edwards Snowden revelations showed a
Speaker 1: pretty cozy relationship between the n s A and a
Speaker 1: lot of American tech companies, So it wouldn't be super
Speaker 1: rising at all to people in the industry if Kaspersky
Speaker 1: Lab had to keep some amount of contact with the
Speaker 1: Russian government, complying with legal requests for information and that
Speaker 1: kind of thing. Those sorts of requests are very routine
Speaker 1: and happened here in the US. Two. But then there's
Speaker 1: the stuff that you've discovered in your reporting with our
Speaker 1: cybersecurity reporter Michael Riley. Right, our reporting shows that Kaspersky
Speaker 1: has maintained a much closer working relationship with Russia's main
Speaker 1: intelligence agency, the FSB, than Eugene Kaspersky has publicly admitted.
Speaker 1: We found evidence that Kaspersky Lab developed custom security technology
Speaker 1: that the FSB asked for. Plus we've uncovered some joint
Speaker 1: projects between the company and Russian intelligence. Coming up, we'll
Speaker 1: hear the details on Jordan's and Mike's investigation. That's right
Speaker 1: after the short break. Before the break, we were just
Speaker 1: about to hear the details of your stigation, Jordan with
Speaker 1: Mike that highlighted some of the work that Kaspersky has
Speaker 1: done for the FSP. So let's hear these details. So,
Speaker 1: my colleague Mike Riley and I recently reviewed internal emails
Speaker 1: from October two thousand nine, suggesting that at least back then,
Speaker 1: Kaspersky Lab had a close working relationship with the FSB.
Speaker 1: Now remember that's the main intelligence agency in Russia, right,
Speaker 1: And what did that relationship look like? These emails actually
Speaker 1: come from Eugene Kaspersky himself discussing a project with his
Speaker 1: senior staff. The emails show that even back in two
Speaker 1: thousand nine, so again eight years ago, Kaspersky was making
Speaker 1: custom software to protect the government's own network from any
Speaker 1: kind of external hack. And that doesn't sound that unusual, right, Well,
Speaker 1: It's one thing to make the software and sell it
Speaker 1: to the government, but the emails also discussed another type
Speaker 1: of operation. Kaspersky Lab's own employees appear to have been
Speaker 1: physically accompanying Russian agents on these raids to locate people
Speaker 1: thought to be launching hacks or cyber attacks against the government.
Speaker 1: So not just tracking these hackers down from their offices,
Speaker 1: but actually riding along on the cop cars. Correct. Have
Speaker 1: you heard of this kind of thing ever happening before? No? Never.
Speaker 1: We talked to lots of cybersecurity experts, and I've never
Speaker 1: spoken to one who's accompanied a federal law enforcement agent
Speaker 1: on an arrest. It's very common for private sector security
Speaker 1: companies here in the US to provide data on criminal
Speaker 1: hackers to the FBI, which then makes the arrest right
Speaker 1: And and what else did you find? Those emails, which
Speaker 1: I should remind everyone were written in two thousand nine,
Speaker 1: mentioned two Kaspersky Lab employees by name. One of them
Speaker 1: was the Caspersky employee going out on those raids with
Speaker 1: the FSP agents. In December, the Russian government arrested that
Speaker 1: man on treas and charges for alleged connections to get
Speaker 1: this U S intelligence for a company that claims to
Speaker 1: have no connections to the Russian government, having employees ride
Speaker 1: along on these raids sounds very much like a connection.
Speaker 1: And as luck would have it, Mike and I actually
Speaker 1: broached some of these subjects with Eugene Kaspersky back in
Speaker 1: for a profile we did on the company for Bloomberg
Speaker 1: Business Week. Eugene Kaspersky agreed to let us record the interview,
Speaker 1: which was all on the record, and Jordan's this was
Speaker 1: the first time that you confronted Eugene Kaspersky with information
Speaker 1: you'd obtained back then about his ties to Russian officials. Well,
Speaker 1: I'll play you this bit first. This is where Eugene
Speaker 1: Kaspersky suggests that his company's interactions with law enforcement, both
Speaker 1: in Russia and in other countries around the world, happened routinely. Well, actually,
Speaker 1: we're in Dutch, was both us everywhere on the world.
Speaker 1: We're in Dutch with the cyber police and cybersecurities. Uh
Speaker 1: and in the Russia the cyber police is for their
Speaker 1: low levels other crime and there were serious effects like
Speaker 1: kind of not yet. For example, this level is a
Speaker 1: FSB department which is kind of deches right side side,
Speaker 1: So of course we worked very close to them because
Speaker 1: there's so much crime in Russia. But after quite openly
Speaker 1: talking about the work that he does with the FSB,
Speaker 1: Eugene Kaspersky reverts to this favorite punch line of his,
Speaker 1: which is at he's closer to the FBI in America
Speaker 1: than he is with Russian authorities. So there are rumors
Speaker 1: about our various special links. And in creaming we'll have
Speaker 1: I let's say that, of course we have in touch
Speaker 1: with these guys, but I think that in Israel, in
Speaker 1: in the United States, we have much better connection this
Speaker 1: love of enforcement. And in this interview in Mike and
Speaker 1: I asked Eugene about this thing we heard about where
Speaker 1: he goes to the banya with members of the Russian
Speaker 1: military and Russian intelligence is a Russian sauna, that's right,
Speaker 1: And we wanted to ask specifically about this because if
Speaker 1: it's true, that would suggest he has friendly relations and
Speaker 1: ships with people in Russian intelligence. When I go to Banna,
Speaker 1: it's like a difference not only from the company, but
Speaker 1: we don't talk about business. There are some most friends.
Speaker 1: FSB military generals are some of these training or military personnel,
Speaker 1: and therefore they we have a one guy there. It's
Speaker 1: a friend of us. Uh, he's a retired as he's
Speaker 1: simply there because well, actually he was responsible for certification.
Speaker 1: So to get a military contract like the New States
Speaker 1: and the Europe and the rest of the same, you
Speaker 1: have to positiveification. So we went touch with that man
Speaker 1: for long years. So Kaspersky is wide business network in
Speaker 1: the US, combined with a working relationship with the Russian
Speaker 1: government is what's making officials here in the US nervous.
Speaker 1: For them, even the possibility of Kaspersky's platform being used
Speaker 1: as a backdoor into computers, fire walls, and routers around
Speaker 1: the world is terrifying, although we don't have evidence that
Speaker 1: the company ever tried to do this. And in a statement,
Speaker 1: Democratic Senator Jeane Schaheen called the ties between Kaspersky and
Speaker 1: the Kremlin quote alarming, and she said it's because of
Speaker 1: that that the Congress and the administration thinks quote Kaspersky
Speaker 1: lap cannot be trusted to protect critical infrastructure, particularly computer systems,
Speaker 1: vital to our nation's security. We also saw news of
Speaker 1: a Senate bill that will ban the Department of Defense
Speaker 1: from using Kaspersky software. We recently reported at Bloomberg that
Speaker 1: Russia is threatening some kind of retaliation if this bill
Speaker 1: goes through. We don't have details on what kind of
Speaker 1: measures that could entail, but the threat from Russia shows
Speaker 1: just how important this one company could become. And by
Speaker 1: the way, we ask Kaspersky Lab for comment on our
Speaker 1: story today, they said, quote, Kaspersky Lab has always acknowledged
Speaker 1: that it provides appropriate products and services to governments around
Speaker 1: the world to protect those organizations from cyber threats, but
Speaker 1: it does not have any unethical ties or affiliations with
Speaker 1: any government, including Russia. With the U S relationship with
Speaker 1: Russia where it is now just tensions being higher than
Speaker 1: they have in a really long time. Do you think
Speaker 1: a company like Kaspersky Lab even stands a chance in
Speaker 1: the federal government market. I think Kaspersky Lab is going
Speaker 1: to find it very, very hard to penetrate the US
Speaker 1: federal market, and they've all but acknowledged that this really
Speaker 1: isn't a market they're pursuing. However, on the consumer side,
Speaker 1: their software is actually really good at what it does,
Speaker 1: and it has the endorsement of a lot of cybersecurity professionals,
Speaker 1: so on that side, they still see potential for very
Speaker 1: very big growth, but really what's happening here is just
Speaker 1: as the US doesn't buy missiles and other weapons systems
Speaker 1: from foreign countries, we're starting to see the same thing
Speaker 1: play out in the cybersecurity market, where if your security
Speaker 1: software is made by made in a country that is
Speaker 1: considered an adversary, you may not have great success here
Speaker 1: in the U. S Okay, so Jordan's it is now mayen.
Speaker 1: Since we first ran that episode last year, the Trump
Speaker 1: administration has banned the federal government from using Kaspersky software.
Speaker 1: A lot's happened. Walk us through some of the highlights.
Speaker 1: As no federal agency is allowed to use Kaspersky Lab
Speaker 1: software anywhere on its networks. Now, that doesn't mean there's
Speaker 1: no Kaspersky Lab software anywhere on those networks Already, It's
Speaker 1: used in some very small parts of those organizations. So
Speaker 1: as though the government is supposed to be getting rid
Speaker 1: of all of that software. Uh, it's been several years
Speaker 1: now since we've been hearing this drumbeat of concerns from
Speaker 1: national security officials here in the US that Caspersky Lab
Speaker 1: could be a backdoor mechanism for the Russian government to
Speaker 1: spy on American citizens, American businesses, American government organizations and uh,
Speaker 1: and last year a pretty bombshell type of storyline emerged,
Speaker 1: you know, that involved Kaspersky Labs software apparently being used,
Speaker 1: according to National security officials, at the hands of Russian
Speaker 1: intelligence services, to spy on American citizens computers and look
Speaker 1: for classified material on those computers. And in one case,
Speaker 1: apparently they found an n S A contractor who had
Speaker 1: taken classified materials home to his home computer. The Caspersky
Speaker 1: Lab software, according to the reporting, flagged on that software,
Speaker 1: and UH, the Cospersky Lab software was able to retrieve
Speaker 1: that classified material from that analyst computer who wasn't supposed
Speaker 1: to have it on his computer in the first place.
Speaker 1: And then there's the report we saw just the other
Speaker 1: week that U S Intelligence officials are considering officially sanctioning Kaspersky.
Speaker 1: Tell us what that means, tell us why that is
Speaker 1: different from what's already happened. Sure, so what we're seeing now.
Speaker 1: Anytime you see these stories about, you know, federal officials
Speaker 1: mulling a ban on something, whether it's Kaspersky Lab software
Speaker 1: out of Russia or Huawei and Zte hardware and mobile
Speaker 1: phones out of China, you know what the government is
Speaker 1: typically doing is restricting the use of those technologies on
Speaker 1: federal networks. I mean, that's what the federal government can
Speaker 1: most directly control in the case of Kaspersky Lab. Again,
Speaker 1: as of Kaspersky is banned from all federal networks, that's
Speaker 1: kind of the logical step for a federal government that's
Speaker 1: concerned about a technology. Sanctioning Kaspersky Lab would be a
Speaker 1: whole other level. What's sanctioning Kaspersky Lab would mean is
Speaker 1: that no US business would be legally allowed to do
Speaker 1: business with Kaspersky Lab. That would be a fine, herble
Speaker 1: punishable offense. So if Kaspersky were to be sanctioned by
Speaker 1: the US, that would effectively wipe out all of Kaspersky's
Speaker 1: US sales. That would be devastating for the company instantly. Yeah,
Speaker 1: I mean, as all of this has gone on, you know,
Speaker 1: Kaspersky has lost over the past year, especially significant clients
Speaker 1: in the US. Best Buy has stopped selling them at
Speaker 1: their retail stores. Uh, you know, and other large big
Speaker 1: box retailers have done the same. But still it's it
Speaker 1: hasn't been illegal to buy the software, and many, many people,
Speaker 1: millions of people have Kaspersky software in the US. I
Speaker 1: mean Let's not forget it was only you know a
Speaker 1: little over a year ago that you walk into any
Speaker 1: best buy in the country and you would see Kaspersky
Speaker 1: Labs software all over the shelves. And anytime you bought
Speaker 1: a new computer and went to the geek squad to
Speaker 1: have it set up. So you know, Kaspersky paid a
Speaker 1: pretty penny on for their marketing in the US. And
Speaker 1: the reason is the U s was is there. Big
Speaker 1: was their biggest market. But if they were to be
Speaker 1: formally sanctioned and all of that business were to dry up,
Speaker 1: you know, the big box retailers are gone, but any
Speaker 1: consumer business they had left in the US at any
Speaker 1: small business, uh, you know, sales they had left in
Speaker 1: the US, those are evaporate instantly, and you're talking about
Speaker 1: wiping out potentially, I don't know fift of the company.
Speaker 1: And you know recently the Chinese tech companies Huawei and
Speaker 1: Zte you just mentioned them earlier, have come under similar scrutiny.
Speaker 1: The Pentagon just announced that it's banning the sale of
Speaker 1: z t E and Wawi phones a military bases. And uh,
Speaker 1: presumably this is because US officials are worried that the
Speaker 1: Chinese government could order these companies to create backdoors to
Speaker 1: spy in Americans. What do you make of all this
Speaker 1: of these growing bands on foreign devices and services. Is
Speaker 1: the US soon only going to be using US design,
Speaker 1: US manufactured devices. You know, it's a double edged sword.
Speaker 1: It's like the trade wars we're seeing with steel and
Speaker 1: you know and other goods. Uh. You know, the federal
Speaker 1: government is absolutely within its authority to say, you know,
Speaker 1: technologies like Kaspersky Lab, if they have concerns about that company,
Speaker 1: have no place on a federal government network. Totally appropriate
Speaker 1: and totally understandable that the federal government would take steps
Speaker 1: to secure federal networks. When you move into the private sector, however,
Speaker 1: it gets a little trickier because you know, companies like
Speaker 1: Kaspersky in Whahwei and zte, you know, to the extent
Speaker 1: that they exist in the US marketplace at all, you know,
Speaker 1: they tend to live at the lower end. They live
Speaker 1: at the end of you know, small businesses that may
Speaker 1: not have a lot of money to pay for the
Speaker 1: high end security software or in the case of Whahwei
Speaker 1: and zte, you know, they would exist in the realm
Speaker 1: of kind of maybe regional internet carriers, small internet companies
Speaker 1: that may not have the money to buy cutting edge
Speaker 1: Cisco networking equipment or whatever. So to the extent those
Speaker 1: companies had a market presence at all in the US,
Speaker 1: you know, it wasn't at the big federal agencies. It
Speaker 1: wasn't at you know, large internet providers. It wasn't at
Speaker 1: big companies in the first place. And any time you
Speaker 1: get into the realm of regulating what the private sector
Speaker 1: can and can't buy, you get into really tricky territory
Speaker 1: because the other countries, the target countries, can do exactly
Speaker 1: the same to your companies. It's got to make American
Speaker 1: companies like Apple and Microsoft really nervous. Absolutely. I mean,
Speaker 1: you know, it's like if you split apart parts of
Speaker 1: the tech business that would be most affected by things
Speaker 1: like this, You're exactly right, it would be a company
Speaker 1: like Apple, say, you know, that does a ton of
Speaker 1: business in China and needs to do more business in
Speaker 1: China to to continue to further its growth. Uh. You know,
Speaker 1: the US government should tread very carefully in regulating what
Speaker 1: the private sector does and doesn't buy. And that's it
Speaker 1: for this week's episode of Decrypted. Thanks for listening. We
Speaker 1: always like to know what you think of the show,
Speaker 1: and which topics you want us to cover in future episodes.
Speaker 1: Right to us at decrypted at Bloomberg dot net. This
Speaker 1: episode was produced by Pogut, Cary, Liz Smith, Magnus Hendrickson,
Speaker 1: and Tofur Foreheads. Francesca Levy is head of Bloomberg Podcast.
Speaker 1: We'll see you next week.