Anti-virus and cybersecurity company Kaspersky Labs [corporate website] filed suit [complaint, PDF] against the Department of Homeland Security (DHS) [official website] on Monday seeking to set aside an order directing all civilian agencies to stop using Kaspersky products.
Kaspersky alleges that the review process contained in Binding Operational Directive BOD-17-01 [text] violated the Administrative Procedures Act (APA) [text] in two respects. First, they contend that their liberty interests under the Fifth Amendment [text] were curtailed without adequate due process, notice or opportunity to be heard prior to the directive becoming effective. Second, Kaspersky asserts that the DHS directive was supported only by “a series of uncorroborated news articles, most of which rely upon the same anonymous sources, none of which have been tested in a fair and public forum,” and thus that the decision was arbitrary and capricious within the meaning of the APA.
DHS issued the directive in September, requiring all federal agencies to “identify the use or presence of Kaspersky-branded products on all Federal information system,” remove all such products from their computers, and discontinue any plans to use Kaspersky products in the future. DHS says that it based its determination [press release] on its concern
about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks. The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security.
The directive gave Kaspersky an opportunity to respond in writing to the decision by November 3, although Kaspersky notes in its complaint that this deadline came after DHS had “already committed themselves, and their subject agencies, to detrimental action against” the firm.
Kaspsersky is an international firm headquartered in Moscow and claims to operate in 200 countries around the world, with offices in 31. Its privately-held US subsidiary, Kaspersky Labs, Inc., is based in Massachusetts.