Major Russian cybersecurity firm Kaspersky is trying to push back against Western sanctions, threatening to sue Germany’s BSI for discouraging local users from using its products. The move may have been emboldened by the recent removal of a Kaspersky executive from a US sanctions list.

German information security agency vs. Kaspersky

In March 2022, just weeks after Russia's full-scale military invasion against Ukraine, Germany's BSI (Federal Office for Information Security), issued an official warning recommending against using Kaspersky anti-virus products. The main reason was that, with Germany standing behind Ukraine in the conflict, using software from a Russian company could mean major security risks. Plus, there had been reports about possible ties of the firm and its founder Yevgeny Kaspersky, to Russian security services.

Kaspersky, in addition to repeatedly denying any links to Russian security agencies, claimed that the company's Germany operations were overseen from its headquarters in London and the servers containing data of German customers were located in Switzerland. Still, BSI was apparently unimpressed by these reassurances, and it has continued to maintain its warning to date.

Previously, Kaspersky had a noticeable presence in Germany, with its office in the Bavarian city of Ingolstadt employing roughly 100 people in early 2022. Four years later, this number declined to about 60, while Kaspersky's business in Germany saw a slump of around 80% due to the large number of rapid cancellations, the German news magazine Spiegel reported.

In accordance with the Spiegel report, Kaspersky Lab's German office has recently been sending letters to various agencies and officials, lobbying for the BSI warning to be revoked. The argument is that the fears of the past have not materialised, and no concrete evidence that Kaspersky Lab products could present security risks for German customers has been shown.

The Spiegel report quoted a Kaspersky Lab spokesperson as saying that the company reserves the right to take legal action against the BSI if the agency does not withdraw the warning. In that case, Kaspersky Lab could demand "a high three-digit million euro amount" in damages.

Global ambitions fall pray to geopolitics

Almost from the outset, Kaspersky Lab, established in Moscow in 1997, had ambitions for global expansion. By 1999, it had opened its first overseas office in the United Kingdom, soon followed by a US office - part of an early push to compete in major global cybersecurity markets.

At the time, as Russia was seeking closer ties with Europe and the United States, an expansion into Western markets appeared logical for the young cybersecurity firm looking for international exposure.

By the early 2010s, Kaspersky had secured a substantial presence in the US market. Forbes reported that by early 2014 the company held roughly 9% of the US consumer security segment. For a short period, it was widely viewed as one of the top three internet security brands globally, alongside Norton and McAfee.

However, things changed after Russia's annexation of the Crimean peninsular from Ukraine in March 2014, which caused sweeping Western sanctions and heightened political tensions. Russian companies began to be viewed as "toxic," while reports about Kaspersky Lab's possible ties to Russian authorities – a claim that the company has vehemently denied – began to surface.

Still, those concerns escalated further following Russia’s full-scale invasion of Ukraine in February 2022. In addition to Germany’s BSI issuing its warning, several other countries announced or implemented restrictions on Kaspersky’s role in their markets. In the end, however, the most consequential measures came from the United States.

US ban

In June 2024, after more than two years of scrutiny, the United States significantly escalated its measures against Kaspersky. The US Treasury’s Office of Foreign Assets Control (OFAC) designated 12 individuals from Kaspersky’s executive and senior leadership, placing them on the Specially Designated Nationals (SDN) list.

The move blocked their property and interests in property within the United States and prohibits most dealings by US nationals with those individuals. Kaspersky Lab acknowledged the designations, noting at the time that the company itself and its CEO were not included in that specific action.

That same month, the US Commerce Department issued a Final Determination under its ICTS authorities prohibiting Kaspersky and its affiliates from directly or indirectly providing certain cybersecurity and anti-virus products and services in the United States or to US nationals, including sales and software updates within the defined scope and timelines.

Separately, the Commerce Department’s Bureau of Industry and Security (BIS) added several Kaspersky entities - including AO Kaspersky Lab (Russia), OOO Kaspersky Group (Russia), and Kaspersky Labs Limited (UK) - to the Entity List, imposing new licensing requirements and export restrictions on items subject to US export control regulations.

Kaspersky Lab stuck to its claims that all the accusations against it were groundless. "Neither Kaspersky Lab nor its management have any ties to any government, and we consider the allegations cited by OFAC to be speculation, as no credible evidence has been provided," Kaspersky Lab said in a statement issued in June 2024.

Earlier that year, Yevgeny Kaspersky said that the company "does not have a very large percentage of customers in the US, it is far from being the most important market," but it would like to maintain its presence there. The US decisions put a lid on those intentions.

Problems elsewhere

Meanwhile, the United States and Germany are not the only countries where Kaspersky Lab has faced problems in recent years. Several other countries have also taken formal steps to restrict Kaspersky’s presence in their public sectors.

In Australia, the Department of Home Affairs issued a whole-of-government direction in February 2025 ordering the removal of Kaspersky products and web services from Australian Government systems and devices, with a reported compliance deadline of April 1, 2025.

Canada made its move earlier: in October 2023, the federal government directed that Kaspersky be banned and removed from government-issued mobile devices. The measure focused specifically on federal government systems, particularly mobile infrastructure.

Italy and Romania adopted their own restrictions. In March 2022, Italy introduced measures requiring public-sector bodies to replace or restrict the use of Kaspersky - and in some cases other Russian-origin antivirus software - under broader security decrees. Discussions have since continued in Italy about tightening rules around Russian-developed software in public administration. Romania passed legislation in December 2022 prohibiting public authorities and institutions from purchasing antivirus products and services from entities originating in or controlled by Russia - a move widely understood to affect Kaspersky - with applicability reported through December 31, 2026.

Small victory

All these years, Kaspersky Lab has been trying to fight the Western sanctions, and it saw a small victory last December, when the OFAC removed Kirill Astrakhan, director of corporate business at Kaspersky Lab, from its sanctions list. The announcement was published on the agency's official website.

Astrakhan was added to the US sanctions list on June 21, 2024. As a result of the investigation, the US authorities concluded that the products promoted by Astrakhan posed a risk to US national security.

However, Russian law firm Pen & Paper apparently succeeded in convincing the US authorities that Astrakhan's activities, both before and after leaving office, did not pose a threat and that his inclusion on the list was not in line with the objectives of US sanctions policy.

This small victory could have emboldened Kaspersky Lab to more actively try to fight Western sanctions elsewhere, but it's not clear how successful it will be.