Is Kaspersky banned in the US? The 2024 order, date by date

What “banned” covers

The Commerce Department’s Bureau of Industry and Security (BIS) issued a Final Determination, announced on 20 June 2024, that prohibits Kaspersky Lab, Inc. and its affiliates, subsidiaries and parent companies from providing certain cybersecurity and antivirus products and services to US persons. BIS says it was the first Final Determination from its Office of Information and Communications Technology and Services, and the Secretary of Commerce is quoted in the same release calling it the department’s first use of those authorities. BIS gives an executive order on securing the information and communications technology and services supply chain, and 15 C.F.R. Part 791, as the legal basis.

The prohibition is written about what the company may do. BIS lists three kinds of transaction: any cybersecurity product or service supplied in whole or in part by Kaspersky, any antivirus software it supplies, and the integration of its software into other companies’ products, for example white-labelled ones. Resale, integration and licensing for either are prohibited in the United States or by US persons.

On the person who simply has the software installed, the BIS press release is direct. It says individuals and businesses that continue to use existing Kaspersky products will not face legal penalties under the Final Determination, and that anyone who does continue assumes all the cybersecurity and associated risks. It also strongly encourages a quick move to other vendors, to limit exposure of personal or sensitive data because of a potential lack of cybersecurity coverage. Kaspersky’s own FAQ goes further: it says the prohibition applies only to transactions by US persons and has no material legal effect on its operations in other regions, and it answers yes to the question of whether continuing to use its products is lawful. That is the company’s statement, and the pages we read do not show a Commerce Department reply to it.

The dates in the order

BIS gives the timetable in three steps. The announcement was on 20 June 2024. From 12:00 AM EDT on 20 July 2024, Kaspersky is prohibited from entering into any new agreement with US persons involving the transactions above. From 12:00 AM EDT on 29 September 2024, it is prohibited from providing antivirus signature updates and codebase updates for them, and from operating the Kaspersky Security Network (KSN) in the United States or on any US person’s computer system. The resale, integration and licensing prohibitions start on the same September date.

BIS explains the gap between the steps: many US individuals and businesses rely on the software, so the department allowed Kaspersky to keep running the KSN and sending updates to current US subscribers until 12:00 AM EDT on 29 September 2024, to give them time to look for alternatives. After that moment, BIS says, it may not provide those updates.

Some things are outside the determination. BIS says it does not apply to Kaspersky Threat Intelligence, Kaspersky Security Training, or consulting and advisory services, such as SOC Consulting, Security Consulting, Ask the Analyst and Incident Response, whose content is only informational or educational. Kaspersky’s FAQ names the same services (it calls the training one Kaspersky Cybersecurity Training) and says they continue to be available in the US market.

In addition to the determination, BIS added three Kaspersky entities to its Entity List: AO Kaspersky Lab and OOO Kaspersky Group in Russia, and Kaspersky Labs Limited in the United Kingdom. BIS gives their cooperation with Russian military and intelligence authorities as the reason. BIS presents it as an action separate from the Final Determination, while the CISA page describes the determination itself as adding Kaspersky Lab to the Entity List, so the two pages differ on this point. BIS’s page also links removal guides from CISA, one for individuals and one for enterprises. We could not read their contents, so this page does not describe any removal steps.

The reasons given, and Kaspersky’s reply

BIS gives its reasons in two places, and both are the department’s findings, not something we could check. The press release says Kaspersky falls under Russian Government jurisdiction and has to answer that government's requests for information; that it has broad access to, and administrative privileges over, customer information through its software; that it has the ability to install malicious software or selectively deny updates; and that integration into third-party products creates circumstances where the source code is unknown. The BIS page adds that Russia is a foreign adversary, and that manipulating the software in US critical infrastructure could risk data theft, espionage and system malfunction. The press release says a lengthy investigation found risks that could not be addressed by any mitigation short of a total prohibition.

Kaspersky’s statement of 21 June 2024 disagrees. It says the department decided on the present geopolitical climate and theoretical concerns, not a comprehensive evaluation of the integrity of its products; that it had proposed a system in which a trusted third party could verify the security of its products; that it does not engage in activities which threaten US national security; and that it intends to pursue all legally available options. It also says its sales bookings grew 11 percent in 2023.

Its FAQ adds that Kaspersky has stopped selling its cybersecurity products in the United States and begun winding down its operations there. On sanctions, the FAQ says the company is not under US financial sanctions, and that on 21 June the Treasury’s OFAC placed members of its senior leadership on the sanctions list, but not the company, its subsidiaries or its CEO. We did not read an OFAC page, so that is Kaspersky’s account. The FAQ also claims first place in 93 of 100 independent tests in 2023, an ISO information-security certification for its data services, a SOC 2 audit and a Global Transparency Initiative. We did not check those claims against the test labs, and the pages we read do not give the test results themselves.

The earlier steps, from 2017

The 2024 order is not the first US action. CISA’s page for BOD 17-01, dated 13 September 2017, carries the Department of Homeland Security directive, a compulsory direction to federal agencies to remove Kaspersky-branded products from federal information systems. It lists the products it covered, such as Kaspersky Anti-Virus, Internet Security and Total Security, and says it did not address Kaspersky code embedded in other companies’ products, nor Kaspersky Threat Intelligence and Security Training. IBM Think adds that agencies were told they had 90 days, and that some large private companies, Best Buy among them, also followed. IBM also says the company firmly denied any foreign influence at the time.

The BIS release lists two further steps: the National Defense Authorization Act for fiscal year 2018, which prohibited use of Kaspersky by the federal government, and the Federal Communications Commission’s addition, in March 2022, of Kaspersky information security products and services to its list of equipment and services that pose a threat to national security.

The note CISA adds to the 2017 page states the difference in width. In its words, the 2024 prohibition applies more broadly than BOD 17-01, which contained exceptions: Kaspersky is now prohibited from selling all antivirus software and cybersecurity products or services without exception. BIS, as shown above, still excludes Threat Intelligence, Security Training and informational consulting, so the two pages do not describe the exceptions in the same way.

What happened to the customers

BankInfoSecurity reported on 5 September 2024, citing Axios, that Kaspersky’s remaining US antivirus customers, about 1 million, would be moved to UltraAV, the product of Boston-based Pango Group. A Pango spokesperson told the site that Windows users would move automatically by mid-September, while Mac and Android users would get an email with a setup link. The article says there was no change in price for existing customers, who keep their existing pricing plans, and that billing with UltraAV would resume in October 2024. It also compares the two products: UltraAV adds real-time authentication alerts, high-risk transaction monitoring and $1 million identity theft insurance, but lacks Kaspersky’s webcam and online payment protection, and a customer who repurchases UltraAV with all the features of their Kaspersky account would pay $47.88 for the first year and then $149.99 on renewal, according to an FAQ on the UltraAV site as cited by the article (the feature comparison is the article’s own); it adds that Kaspersky stopped billing US customers in June 2024. Kaspersky said in a statement to the site that it had arranged a solution so that US customers continue to be served.

TechCrunch, on 23 September 2024, described how it landed. Customers wrote on social media that their Kaspersky software had been replaced automatically by UltraAV, and some said they had no idea it would happen, while others reported getting an email about the transition. Kaspersky confirmed that on 19 September a software update facilitated the transition, and said, through a company forum post, that it ensured there would be no gap in protection. Pango told TechCrunch that all customers were notified in early September; asked repeatedly, TechCrunch says, Pango could not point to where customers were told explicitly that their software would be replaced. A former senior US cybersecurity official, TechCrunch reports, called it an example of the risk posed by the access the software has. Bitsight, covered below, also notes that some in the national security community raised questions about the installation.

These are accounts from the press and the companies. This page does not rank or recommend replacement products.

Who is still using it, and what the pages leave open

Bitsight, a security ratings company, published an analysis on 18 December 2024. Its method is to watch connections between IP addresses it attributes to organisations and Kaspersky update servers, and it warns that this can also capture traffic from research, testing or reconnaissance. On that basis it says more than 40 percent of US organisations observed using Kaspersky before the June announcement still appeared to be using it, and that only about 58 percent appeared to have stopped. As of 30 November 2024 it saw more than 1,000 US organisations and 19 US government agencies still communicating with the update servers. Bitsight also compares countries: it reports a 69 percent decline in Germany from April to November, against 58 percent in the US.

Bitsight adds that the United States is one of the few countries to ban Kaspersky in both the public and private sectors; it names Canada, Italy and the United Kingdom as having limited use on government devices, and Germany as having issued a warning. These are counts of connections, not of people, and Bitsight’s figures cannot be set beside the 1 million customers in the earlier report, which comes from a different source and method.

The pages we read do not mention any change to the order after 2024. They also do not say how to remove the software, because BIS passes that to the CISA guides we could not read. They do not say whether a Kaspersky program on a computer in the US keeps getting signature updates from servers outside the US after 29 September 2024; BIS says only that Kaspersky may not provide those updates to US persons. On the dates, BIS and TechCrunch say 29 September 2024, IBM Think says 30 September, and Bitsight gives both; this page follows BIS.