Kaspersky: Yes, we obtained NSA secrets. No, we didn’t help steal them

"...found they contained malicious code from Equation Group..."

"Equation Group" is Kaspersky's label for a malware group believed to be NSA.

Kaspersky's software possibly then detected as malware the very confidential code the NSA contractor/employee illegally took home, ha!

Those files were destined to be leaked somehow the moment they were created.

> Seems like massive incompetence from this user

So when we delete production data, it is a process failure[Gitlab postmortem] but when employees at a three letter agency cause spillage, it is a felony? It is wrong on several counts. One: this is data that we should not be hoarding in the first place. We should be helping vendors fix their stuff so the cachet of information automatically loses its value to people who want to get it. Two: Even if we are an axis of evil and don't want to do the right thing, punishing this individual seems like the thing the higher ups at an oppressive regime would do to prevent the wrath of the dictator on themselves for failing to prevent what is really a system failure.

[Gitlab postmortem] https://about.gitlab.com/2017/02/10/postmortem-of-database-o...

Edit while I have your attention I would like your support in ending the CFAA https://cfaa.eff.org/

I'm sorry but Kaspersky gets NSA files and deletes them, instead of handing them to FSB? Nope, I don't believe it. You can get away with xx murders in exchange for that

And that's the most generous assumption--that Kaspersky wasn't looking for them

Why not both?

I don't know about this particular story, but Kaspersky is certainly has strong ties with FSB, FSO and other official structures. I don't mean that it's their main business model — developing anti-virus software pays well enough not to be some cover story — but they're definitely _friendly_ on a deep personal level. Kaspersky himself was educated in KGB school, worked in government structures and has a lot of connections (which he used, for example, with that shady story when his son was kidnapped).

Usually, in Moscow, there is a strong correlation between being a highly educated, well-paid IT professional and having a negative opinion about current Russian regime; but judging from my second-hand stories from friends and colleagues, guys at Kaspersky tend to be very patriotic and pro-government. So, while I don't think that Kaspersky lab was founded deliberately like some sort of cover. But they're the kind of people who would definitely help FSB with whatever they ask — not because of some secret court order, but happily, thinking that they are serving their country and doing a good thing.

I don't think it even needs a narrative about Kaspersky. You could expect that they're infiltrated in some way (worker, infrastructure, hosting, ...) and leak information to FSB. I'm exactly the same way Symantec could leak information to NSA. Without the evil qualifier and narrative for the reasons, both are likely to happen to some extent.

In this case, _if_ you buy into the arc of the story then I would say it was it was likely another family member who tried to do the pirated software. But that would be a massive faux pas. So there's likely other nips and tucks, etc.

"For many months, U.S. intelligence agencies studied the software and even set up controlled experiments to see if they could trigger Kaspersky’s software into believing it had found classified materials on a computer being monitored by U.S. spies, these people said. Those experiments persuaded officials that Kaspersky was being used to detect classified information."

https://www.wsj.com/articles/russian-hackers-scanned-network...

is just a highly misleading way of saying

"Kaspersky added strings/.text/.rodata from the analysed malware sample to their virus database"

And no shit, a antivirus will then search computers "around the world" (this qualifier is here.. why?) for that data. That is why you paid for it.

The objectionable part here is "Iraelis were watching" but nobody seems all too concerned any more with economic espionage.

Either way the flavor of the comments on this thread are really, really unusual for Hacker News and YCombinator in general.

So yes, it is possible, maybe even likely, that Kasperky is doing nothing shady and has only the best intentions. It's also somewhat irresponsible to entrust them with any data of value. Those two things are not mutually exclusive.

It's like incident #100, maybe Kaspersky is the KGB, good on them since they are clearly more competent than the NSA. Maybe we can poach them?

I'm merely speculating, of course. Personally, I never take ordinary public announcements or claims from intelligence agencies at face value, since they have plenty of reasons to lie and disinform. That doesn't entail that their secret reports are bogus, of course, and senate hearings are also reliable. I've followed the senate hearings close enough to be reasonably certain that the US intelligence community is right about the accusations concerning Russian meddling in politics in the US and the EU. But that's a different case, people were testifying under oath in front of senate committees and senators from both parties who went to meetings behind closed doors were also convinced of the (classified) evidence.

As for Kaspersky, the information is unreliable and my personal guess is that whatever happened wasn't their fault. If someone has malware on his machine, it's the job of the antivirus software to detect and analyze it. If at all, the story has increased my overall trust in the technical quality of Kaspersky software.

Another speculation that I find overall credible is that since Snowden's revelations there is some concerted effort to further discredit the NSA in order to weaken their ability to operate. If that's so, then this campaign seems to be quite successful.

Kaspersky is just easy target and apparently three-letter-agencies have means to steer the media to pursue this direction.

Given what we know about the feds installing black boxes in ISPs' networks here in the US- a country nominally committed to the rule of law- it seems somewhat naive to think that the Russian government doesn't have access to Kaspersky servers.

Does that make Kaspersky uniquely evil? Probably not. Do the feds have an agreement with Microsoft to take a peek at anything they turn up from a foreign intelligence service? I don't know. It wouldn't be too surprising.

The Hacker News community largely gets its non-hacker news from CNN, the NYT, HuffPo, etc. As mainstream US media parrots whatever the FVEY IC tells them to, it's not surprising that most HN voters end up uncritically believing the Russia-Is-Evil narrative from the same IC that conducted MKULTRA and sold us a war predicated on the lie that Saddam was loaded up with WMDs.

Downvoting any and all dissent from CIA psyops is the natural consequence of this. Because, patriotism, or something.

no offense, it is just very entertaining(and educational) to observe how people from one culture try to apply their mental frameworks to completely different mentality. There is no "whether", "or not", "gag order" (in the sense as if explicit one was necessary) in the Russian reality in the context of private company cooperating with FSB. Hell, there is no even much of "cooperating". An FSB guy just says what he wants to get, and he gets it pronto. And in cases like Kaspersky it is even more straightforward as Kaspersky and the others there are FSB guys.

I mean it is like a joke among Russians here:

"Did you hear? The NSA thinks about stopping to use Kaspersky on their computers!"

"Wow! How did they discovered (the ploy)? Was it the parachute?"

(the parachute is a reference to a very well known joke about a USSR spy in Nazi Germany from very popular TV movie - the spy was so good and invincible that only the deployed parachute he was dragging behind him in the open daylight on the streets of Berlin was the only possible clue for the Nazis)

Again, it is different reality. In US law protects from and punishes for illegal cooperation, whereis in Russia the system protects for cooperation and punishes for refusal to do so.

But somehow these warnings only became necessary in the past year or so, when the US has had ongoing conflict with Russia over the past 20 years?

Essentially, that the government is publicly running a campaign to openly access user data does not in any way change the fact that they already have covert access to that data in private. Why are they doing this? One can only speculate, but I'd imagine one reason is that unlawfully obtained information and evidence is not admissible in court leading to all sorts of fun things like parallel construction. [2]

[1] - https://www.theguardian.com/world/2013/jun/06/us-tech-giants...

[2] - https://en.wikipedia.org/wiki/Parallel_construction

Yet allowing anything seems fairly common practice, even more so outside the US. I wonder how many government employees of countries other than the US have Gmail accounts and put all their documents on Google docs, etc. Not to mention online backups which tend to be more expensive for servers located outside the US...

I am also inclined to believe Kaspersky is in the wrong here, especially given the publicizing of personal data from a customer's computer for PR purposes, but I am having trouble understanding how the Espionage Act applies?