Vulnerabilities / Threats

1/19/2018
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Kaspersky Lab Seeks Injunction Against US Government Ban

Revenues and reputation have taken a hit in the wake of the US Department of Homeland Security's decision to prohibit use of its products and services by the feds, the company says.

Security vendor Kaspersky Lab has filed a motion for a preliminary injunction in its lawsuit challenging the US government's recent ban on the use of the company's anti-malware products by federal agencies.

The ban has seriously hurt Kaspersky Lab's reputation and revenues and should be overturned expeditiously, the company argued in the motion filed Wednesday in US District Court for the District of Columbia.

The US Department of Homeland Security (DHS) last September ordered the removal of Kaspersky Lab software and services from all federal information systems covered under the Federal Information Systems Management Act, and banned further use of all products from the company.

The ban, issued under DHS Binding Operational Directive (BOD) 17-01, stemmed from concerns about the firm's ties to the Russian government and the belief that Russian agents had used the company's software to steal sensitive data from US government systems.

In its motion, Kaspersky Lab claimed the ban has caused considerable reputational damage and loss of sales to the company in North America. The debarment has precluded Kaspersky Lab from doing business with the US federal government, while hurting its consumer and commercial business as well, the motion said. US retailers that used to carry its products have now removed it from their shelves and are encouraging customers to switch to rival products, resulting in an overall decline in North American sales of over 50% during the second half of 2017.

According to Kaspersky Lab, the government issued the BOD without giving the company enough notice or enough of an opportunity to contest the evidence for the ban, thereby violating Fifth Amendment rights to due process. The BOD is also not supported by any substantial evidence and is therefore both "arbitrary and capricious," Kaspersky Lab said in seeking an injunction overturning the ban.

"DHS used the BOD to achieve a preordained result—the immediate debarment of Kaspersky Lab, and the consequential and foreseeable adverse effect on its U.S. commercial sales," the security vendor said in its motion.

"The BOD achieved this result while depriving Kaspersky Lab of any meaningful or constitutionally sound process to challenge the tenuous, often anonymous, and uncorroborated media stories and other self-serving public statements which DHS relied upon to justify its action."

Ed McAndrew, a trial lawyer at Ballard Spahr, says Kaspersky Lab's injunction is curious in what it does not seek.

After the ban went into effect, it was codified into law under the 2018 National Defense Authorization Act, he says, and as a result, the government will likely argue that Kaspersky’s challenge to the agency actions is moot.

Kaspersky Lab is attempting to use the Administrative Procedures Act (APA) to challenge DHS's administrative actions.  But "there's no need to focus on the administrative action because we now have the ban codified as a law," McAndrew says. 

In addition, the DC federal court has previously already ruled in another case that the APA does not provide a basis for judicial review under FISMA, he adds.

The security vendor's bid to get a temporary injunction — and eventually a permanent injunction— against the ban faces other legal challenges as well, McAndrew notes. To obtain injunctive relief the company will have to prove a variety of things, including the fact that it will suffer irreparable harm, and that issuing an injunction would be in the public interest. It is unlikely that the company will be able to satisfy any, let alone all, of the requirements, he says.

"Winning the case may not be Kaspersky's only objective," however, McAndrew notes. "Seeking injunctive relief will provide Kaspersky with a public judicial forum in which to air its dispute with the government's action – and perhaps to attempt to repair its reputation."

If a hearing is held, Kasperksy Lab will have an opportunity to publicly present evidence disputing the disbarment while requiring the government to present public proof of the basis for its decision to ban Kaspersky Lab products, he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
100%
0%
BrianN060,
User Rank: Ninja
1/21/2018 | 3:50:37 PM
...while hurting its consumer and commercial business as wel
"...while hurting its consumer and commercial business as well..."  The phrasing infers that the main loss to KL was its US government contract - which were actually a negligible part of their US revenue. 

Immediately following the public announcement of the ban on federal use, they encouraged the private sector to move away from KL products. 

Every sovereign government has the right, even the obligation, to regulate the tools its officials can or should use, as much as they should regulate who and what crosses their borders.  If the US has concerns about private sector data governance (data which is transmitted through or stored in foreign territories - as they should), it is that fact, not the location of a company's headquarters, which ought to guide their policies. 
RIP, 'IT Security'
Kevin Kurzawa, Senior Information Security Auditor,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19367
PUBLISHED: 2018-11-20
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
CVE-2018-19335
PUBLISHED: 2018-11-20
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-19334
PUBLISHED: 2018-11-20
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-10099
PUBLISHED: 2018-11-20
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
CVE-2018-17906
PUBLISHED: 2018-11-19
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.