FBI pushes private sector to cut ties with Kaspersky | Hacker News Reader

FBI pushes private sector to cut ties with Kaspersky

cyberscoop.com

190 pointsdrewchainzz77 comments

I wonder how that is something the FBI should be doing. I always thought the US had it's somewhat-secret-security agencies divided between foreign and local, spying and acting, and public and government tasks. (which is why they have so many of them?)

If this was a problem for the country, wouldn't it be DHS's job? And if there was an issue to be looked in to, it's FBI's job. And if there is something about spying to figure out if someone is doing something, there is the CIA and the NSA depending on where they need to look?

On top of that: wouldn't this be something that should simply be looked at internally at agencies and if there is an actual problem, resolve it for the country by issuing a law or directive or bill or whatever name they put to rules the US-based companies have to follow?

My understanding is that the FBI handles intelligence within the country, while the CIA handles foreign intelligence.

The NSA's role being what, then?

Listening to everything

There are many agencies responsible for foreign intelligence collection in the US. The NSA does SIGINT, CIA is more operational and HUMINT, and there's also military intelligence and special purpose agencies like the National Geospatial Intelligence Agency.

I believe, officially, their role is foreign signals intelligence.

The NSA is under the defense department, they handle national security level information. As marco said, SIGINT and ELINT for example.

The NSA is our spy organization.

It's worth noting that the NSA is DoD while the CIA is State Dept.

They do have somewhat orthogonal missions (HUMINT vs SIGINT) as others have commented, but never underestimate each piece of the government wanting their own agents.

The CIA is an independent agency, not part of State or Defense or any other executive department.

In addition to being law enforcement, the FBI is also a domestic intelligence and counterintelligence agency. This would fall under their counterintelligence mission.

This is correct, FBI have aided in the securing of many private sector systems in the past. When a few critical flaws in the consumer credit network (eg visa,amex) were detected it was with the FBI's assistance and they oversaw the implementation of improvements.

Securing domestic computer networks and products from foreign attack surely fits within the FBI's jurisdiction. Obviously there's some overlap with the NSA in this mission (but not DHS -- they have very little in the way of computer crime experts), but this doesn't seem weird to me.

Basically: US law enforcement is telling US companies that Kaspersky products are likely compromised by Russian intelligence. Surely foreign law enforcement is issuing similar warnings about Symantec and McAfee products being compromised by the NSA.

NSA is DoD systems, DHS is other governmental systems and some critical private sector systems, FBI is counterintelligence investigations. They all overlap and help each other.

NSA is under Intelligence Community[0]. I think Defense Intelligence Agency is DOD's intelligence branch.[1] But my own wiki link is saying both NSA and DIA don't have parent agencies so idk..

------------------------------------

[0]http://www.dia.mil/

[1]https://en.wikipedia.org/wiki/United_States_Intelligence_Com...

This is all spelled out in EO 12333 : https://www.archives.gov/federal-register/codification/execu...

Both the NSA and the DIA are under the DoD. Both are intelligence agencies and are part of the IC. All of the IC members fall under the Director of National Intelligence (DNI). The NSA and DIA differ in their missions. The NSA is primarily focused on Signal Intelligence (SIGINT) whereas the DIA is focused on Human Intelligence (HUMINT), mostly pertaining to foreign militaries.

Those are euphemisms for spying and traitors.

more like "professional terminology"

DHS has a lot of computer crime experts– the United States Secret Service being the huge one.

President Obama issued a policy directive making the FBI the lead agency in cybersecurity response. This is a response.

> In view of the fact that significant cyber incidents will often involve at least the possibility of a nation-state actor or have some other national security nexus, the Department of Justice, acting through the Federal Bureau of Investigation and the National Cyber Investigative Joint Task Force, shall be the Federal lead agency for threat response activities.

https://obamawhitehouse.archives.gov/the-press-office/2016/0...

https://www.fbi.gov/news/stories/new-us-cyber-security-polic...

This kind of FBI involvement predates DHS, and has been continued in part because of the way the programs evolved.

Much of the US critical infrastructure is owned and operated by private industry. For that reason, a collaboration between the FBI and private industry was formed in 1996, called Infragard [0]. Today, there are chapters in each of various regions of the US, each with an FBI coordinator who facilitates the communication between feds and local industry.

[0] http://www.infragardmembers.org/critical-infrastructures.htm...

Thank you for the intel. Did not know about Infragard until now. Brushing up on my history, I am at about 1914 in the chronology :)

This isn’t really a comment about Kaspersky, because I don’t know if the implication that they are involved in Russian cyberespionage is true or not. However, in general, the FBI is very involved in tracking the different groups associated with nation state cyberespionage. One of the most common ways that a large company in the private sector finds out that it has been compromised is via FBI notification. Not even close to the same situation here, but it does illustrate that domestic network security falls within the scope of their operations.

Whether the federal government should be lobbying against a private companies’ products is a more complicated issue. I think, if it could be demonstrated that there is sufficient evidence to link them to unethical behavior, it might be appropriate.

With the oligarchy in Russia being what it is, it's not a stretch to think that any large company based in Russia is a proxy for the government. At the very least, the executives of that company could be pressured by the state security apparatus.

Pretty much anyone with money in Russia crosses the Putin government at their own peril. There are numerous cases of Russian billionaires in opposition to Putin losing their companies to supposedly trumped-up charges of tax evasion and subsequently dying in jail under suspicious circumstances.

> Pretty much anyone with money in Russia crosses the Putin government at their own peril.

Having money is not a prerequisite, and in some cases even being in Russia is not a prerequisite.

My impression was that the charges are rarely trumped up; it's just that everyone remotely successful does it (so it's hard to be competitive without) and the law is enforced very selectively.

at this point, they should combine all agencies... and call it something like secret police

How about 'Homeland Security'?

That'd be fine

Responsibilities of various pieces of the federal government are usually well-delineated but without clean taxonomic hierarchy. The hierarchy only gets cleaned up years or decades after things get spun up and it takes a massive reorganization effort. Single entities with two (or more) responsibilities often aren't worth the effort needed to split up, and thus never fall anywhere cleanly. Even to this day the department that investigates counterfeit currency is also responsible for bodyguarding the president.

This is essentially the same reasoning why other governments and their constituents shouldn't trust American tech companies. That's pretty well established thanks to some notable leaks.

Well it depends what you are trying to secure against. Some companies just want to protect against hacktavists / script kiddies.

Huh? Because the FBI is warning about a Russian company being used by the Russian government for intelligence gathering?

As depressing as it sounds, assuming any government is keeping their nose out of their tech companies is honestly pretty naive.

Nowhere near to Kaspersky level though.

Indeed, significantly worse.

No actual technical mechanism has come out suggesting how Kaspersky is spying, only that it could. We've seen technical mechanisms which impact US firm's hardware such as Cisco and how they're embedding that malware into specific target's endpoints (postal intercepts). We've also seen firmware updates go out to US company's industrial hardware which MIGHT have needed the companies help to produce.

I'm yet to see anyone publish an article talking in technical terms about what Kaspersky is meant to be doing. All people keep repeating is that one of the top executives has Russian military experience. But technical facts are more key here than anecdotes or fear mongering. I'd stop using them tomorrow if someone can show me why, but even the FBI/DHS/NSA hasn't produced a paper on it or done a presentation at Blackhat.

Let's talk actual facts here. Software or even hardware isn't magic, if you can show that Kaspersky is evil show it already.

The true reason why the FBI wants to get rid of Kaspersky: since American agencies do not have access to data of Kaspersky but do have access to all data of American antivirus vendors, they want everybody to switch to American vendors.

Define data? Eugene Kaspersky volunteered their source code. It's true that won't be an on-going effort and that back-doors are hard to detect through the millions of lines of code, but it's one hell of a sign of confidence.

Edit: Not dismissing the Russian scenario, but this is McCarthyism 2.0 as far as I'm concerned.

Highly skeptical that this isn't new red scare BS. Eugene gets to be the subject of so many dumb conspiracy theories.

A recent rebuttal by himself: https://eugene.kaspersky.com/2015/03/20/a-practical-guide-to...

Edit: and a more recent one: https://eugene.kaspersky.com/2017/05/12/they-asked-me-everyt...

Edit 2: "FBI officials point to multiple specific accusations of wrongdoing by Kaspersky, such as a well-known instance of allegedly faking malware."

Ok, if they are bringing that incident up, this really does mean they have nothing and are grasping at straws. This is referring to a time when Kaspersky trolled competitors who were stealing their signatures, and they made some fake detections. It's the antivirus equivalent of "Trap Streets" used by mapmakers. It doesn't create any kind of back door or weakness.

The whole av industry is shady business - never know for sure whether some stuff is planted on purpose or is a result of a hack. (I used kaspersky stuff 20+ years ago - just don’t have much respect for this industry in the first place. Also using kaspersky av in us gov settings or any critical business ops is just plain clueless)

Interesting to look at these links, all 5+ years old:

1. Russia’s Top Cyber Sleuth Foils US Spies, Helps Kremlin Pals

2. What Wired Is Not Telling You – a Response to Noah Shachtman’s Article in Wired Magazine

3. HN Discussion on 2

_____________________________

[1]: http://www.wired.com/dangerroom/2012/07/ff_kaspersky/all/

[2]: https://eugene.kaspersky.com/2012/07/25/what-wired-is-not-te...

[3]: https://news.ycombinator.com/item?id=4340309

man that is one deep hole I've fallen into :D very good reads

NOW I know win7 also phone backs home T_T

Yeah, and you can't turn it off.

https://twitter.com/m8urnett/status/866353982217699328

https://news.ycombinator.com/item?id=14389441

If USA is fussing over an antivirus program, Russia should be absolutely panicking about Windows, Office and other critical software from the USA.

Well, if they stopped using it altogether, it wouldn't remain critical to them for very long. It would probably be good for free software, too!

They have.

http://www.digitaljournal.com/tech-and-science/technology/mo... (2016)

http://www.eetimes.com/document.asp?doc_id=1326694 (2015)

https://www.reactos.org/project-news/reactos-second-os-russi... (since 2014)

In the Lansing area all the municipalities using Kaspersky are being advised by the feds to drop it as quickly as possible. It was front page news a few days back.

http://www.lansingstatejournal.com/story/news/local/watchdog...

Presumably, the AV suite would send "telemetry" and related "data" to their servers for analysis...

"Microsoft Wins Appeal on Overseas Data Searches" https://www.nytimes.com/2016/07/15/technology/microsoft-wins...

[edit]https://www.mcafee.com/us/resources/solution-briefs/sb-quart...

How many are other security enterprises are out there who are as independent from US intelligence agencies?

Maybe nobody. But at least US intelligence agencies are operating in a jurisdiction where the rule of law is strongly enforced.

> Maybe nobody. But at least US intelligence agencies are operating in a jurisdiction where the rule of law is strongly enforced.

Except when it's not.

Is that what FISA is? After all that's gone down anyone making this kind of a statement is either guilty of propaganda or negligence.

US laws do not give much protections to citizens of other countries so the American rule of law is irrelevant for them; American and Russian government agencies have equal authority to spy on them etc., though of course geopolitics makes the two far from equivalent in real-life threat analysis terms for any particular place/org. (What US citizens can count on here is a separate and I guess muddier question.)

Independent from US intelligence agencies is no better if you simply trade one master for another.

It is, if the one master is less capable than the other.

What evidence do you have that Russian intelligence agencies are any less/more capable than the US ones?

If anything, it seems like the Russian intelligence agencies are more capable that the US ones right now ...

You can probably just compare the budgets...

FSecure at least - counter me if I'm wrong.

Only one I can think of is F-secure, from Finland. Some good posts by them have been voted up here previously.

It looks like FBI is making great advertisement of Karpersky for security conscious people that has more than 2 neurons.

Kaspersky is the only company that discloses NSA and CIA's evil malware. They are the good guys here.

That is not true. Other AV vendors, such as FireEye and Symantec, repeatedly write about TTPs of all state actors they encounter.

So Karpersky is just more competent to find the ones from the USA Gov.

That is not the case.

It is actually quite difficult to intentionally ignore nation state malware from certain regions, because attributing the origin is not something a private entity can accurately do with confidence.

I kind of like Kaspersky more than the NSA o CIA, but don't forget that they have their own interests too.

I am more concerned about the US government because I am an US citizen and I believe the US government does not align with me politically. So I would rather give my data to the Russians.

Don't use stuff that's pwned by other intelligence agencies, use stuff that's pwned by us.

From this reference in the article...

http://www.reuters.com/article/us-kaspersky-rivals-idUSKCN0Q...

"Microsoft's antimalware research director, Dennis Batchelder, told Reuters in April that he recalled a time in March 2013 when many customers called to complain that a printer code had been deemed dangerous by its antivirus program and placed in "quarantine."

"Over the next few months, Batchelder's team found hundreds, and eventually thousands, of good files that had been altered to look bad."

"Batchelder told his staff not to try to identify the culprit"

This last part seems incredibly suspicious.. perhaps it was Microsoft trying to discredit Kaspersky

Aside from all the innuendos and made-up proof, the one true statement you can make here is that Kaspersky is not, nor ever will be, providing backdoor services for the FBI.

What happens if you use both Russian Anti Virus Software and an American Anti Virus Software?

Would this catch everything?

They'd probably catch each other.

I was surprised to hear an ad for Kaspersky on NPR this morning. I know there's a disproportionate number of ads for Barracuda and other security services, but I was curious about an entity in the news running ads. The hosts didn't mention any connections to current events.

Seems to me like all the Chinese-made equipment everyone (including FBI) is using is a much more credible threat. This looks like they're just piggybacking on a witch hunt.

Disclosure: I am Russian-American, but always voted against Putin. Not that it mattered, of course.

Is Jetbrains also a risk?

What if they build something bad into the Kotlin language?

You mean like easily allowing null pointer exceptions again?

Kaspersky can go fuck itself

super surprised this thread isn't filled full of hate for our fed Intel teams. The IC works incredibly hard to keep us safe. Maybe this Presi and his hate for the IC is changing minds about our IC.

Reply on news.ycombinator.com