Commerce Department Prohibits Russian Kaspersky Software for U.S. Customers
On June 20, 2024, the Bureau of Industry and Security (BIS) announced a Final Determination prohibiting Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from directly or indirectly providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons.
This action is the first Final Determination issued by BIS’s Office of Information and Communications Technology and Services (OICTS), whose mission is to investigate whether certain information and communications technology or services transactions in the United States pose an undue or unacceptable national security risk.
In order to minimize disruption to U.S. consumers and businesses and to give them time to find suitable alternatives, the Department’s determination will allow Kaspersky to continue certain operations in the United States—including providing anti-virus signature updates and codebase updates—until 12:00AM Eastern Daylight Time (EDT) on September 29, 2024.
Individuals and businesses that utilize Kaspersky software are strongly encouraged to expeditiously transition to new vendors to limit exposure of personal or other sensitive data to malign actors due to a potential lack of cybersecurity coverage.
Additional information about this action and publicly available resources can be found on our website and Frequently Asked Questions page.
Office overview and responsibilities
The ICTS program implements four Executive Orders (EOs) and its related regulations under the International Emergency Economic Powers Act (IEEPA):”
- EO 13873, “Securing the Information and Communications Technology and Services Supply Chain,” (May 15, 2019) delegated to the Secretary of Commerce broad authority to prohibit or impose mitigation measures on any ICTS Transaction subject to United States jurisdiction that poses undue or unacceptable risks to the United States.
- 15 C.F.R. Part 791, “Securing the Information and Communications Technology and Services Supply Chain“ is the implementing regulation for EO 13873 and establishes the scope of an ICTS Transaction and creates a process for reviewing ICTS Transactions the Department or other agencies (through referrals) believe may pose an undue or unacceptable risk. The Department can, on its own accord or upon referral, investigate ICTS Transactions. Ultimately, the Secretary can prohibit or mitigate ICTS Transactions if those transactions pose one of the three risks outlined in EO 13873.
- EO 13984, “Taking Additional Steps to Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities” directs the Secretary of Commerce to propose rules to address malicious cyber actors’ use of Infrastructure as a Service (IaaS), by proposing “know your customer” (KYC) requirements.
- EO 14034, “Protecting Americans’ Sensitive Data from Foreign Adversaries” (June 11, 2021) builds upon EO 13873 to address threats posed by connected software applications linked to foreign adversaries.
- EO 14110, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence” (October 30, 2023), builds on E.O. 13984, directing the Secretary of Commerce to impose record keeping requirements on IaaS providers when transacting with a foreign person to train certain large AI models.
2024 Technology Prioritization
The Office of Information and Communications Technology and Services (OICTS) has come up with 2024 Technology Prioritization Table based on supply chain transactions posed risks to the security and safety of United States persons. The prioritization table shows ICTS supply chain tracks and its priorities.
2024 Technology Prioritization Table
Office leadership
Elizabeth Cannon
Learn more
Elizabeth Cannon
Elizabeth “Liz” Cannon previously served as Senior Corporate Counsel for Global Trade with Microsoft. In that capacity, she was responsible for monitoring export controls, sanctions, and other international trade and security policy issues. She also oversaw Microsoft’s Risk Intelligence Group, which conducts due diligence and trade-related investigations. Liz also brings more than a decade of public service and national security experience from the Department of Justice, including five years as Deputy Chief for Export Controls and Sanctions in the National Security Division. In this role, she supervised all criminal cases involving export control and sanctions violations around the country.
During her service at DOJ, she prosecuted national security cases, including matters involving espionage, economic espionage, mishandling of classified information, cyber offenses, and sanctions and export control violations. She has also spent time in private practice at an international law firm. She holds a BS in Commerce from the University of Virginia and a JD from New York University School of Law.
Contact us
For general inquiries to OICTS, please email: [email protected]
To report a tip on potential violations of OICTS regulations, please email: [email protected]