Eugene Kaspersky

Kaspersky's interest in IT security began in 1989, when his PC was infected by the Cascade virus,[1][16] while working for the Ministry of Defense.[17] He studied how the virus worked[15] and developed a program to remove it.[1] Afterwards he continually found new viruses and developed software to remove them, as a hobby.[15][16] Early on Kaspersky's anti-virus software had just 40 virus definitions and was distributed mostly to friends.[2]

In 1991, Kaspersky was granted an early release from his military service[6] and left the defense ministry to take a job at the Information Technology Center of a private company KAMI, in order to work on his antivirus product full-time.[2][10] There, he and his colleagues improved the software[2] and released it as a product called Antiviral Toolkit Pro in 1992.[7][10] At first the software was purchased by about ten clients per month. It earned about $100 per month, mostly from companies in Ukraine and Russia.[1][8] Kaspersky's then-future wife Natalya Kaspersky became his coworker at KAMI.[10]

In 1994, Hamburg University in Germany gave Kaspersky's software first place in a competitive analysis of antivirus software.[7][8][10] This led to more business for Kaspersky from European and American companies.[8][18] Kaspersky Lab was founded three years later by Kaspersky, his wife and Kaspersky's friend Alexey De-Monderik.[6][lower-alpha 2] Natalya, who pushed Eugene to start the company, was the CEO, while Eugene was the head of research.[2] The following year, the CIH virus (AKA the Chernobyl virus) created a boon for Kaspersky's anti-virus products, which Kaspersky said was the only software at the time that could cleanse the virus.[2] According to Wired, "their software was advanced for the time." For example, it was the first software to monitor viruses in an isolated quarantine.[15]

Kaspersky's company grew quickly in the late 1990s. From 1998 to 2000, its annual revenue grew 280 percent and by 2000 almost sixty percent of revenues were international.[21] By 2000, it had a staff of 65 people, starting from 13 in 1997.[2] The antivirus product was renamed to Kaspersky Antivirus in 2000, after an American company started using the product's original name, which wasn't trademarked.[17][21]

As the head of research,[7] Kaspersky authored papers on viruses and went to conferences to promote the software.[22] He was often quoted in the technology press as an antivirus expert.[2] He helped establish the company's Global Research and Expert Analysis Team (GReAT), which helps corporations and governments investigate IT security threats.[15] Initially he told his team not to discuss cyber-terrorism publicly, to avoid giving governments ideas on how to sabotage their political opponents. After the American film Live Free or Die Hard (AKA Die Hard 4.0) (2007) was released, Kaspersky said the idea was now public.[23] He hired the researcher that identified the Stuxnet worm, which is believed to be the first instance of state-sponsored cyberweapon.[15][24] Afterwards, the company exposed the Flame virus at the request of the International Telecommunication Union. The virus was believed to have been used for cyber-espionage in Middle-Eastern countries.[15][16][24]

Kaspersky Lab developed a reputation for discovering cybersecurity threats.[25][26] In 2015 Kaspersky and Kaspersky Lab discovered a group of hackers known as Carbanak that were stealing money from banks. They also exposed Equation Group, which developed advanced spyware for monitoring computer use and was believed to be affiliated with the National Security Agency in the U.S.[26] According to The Economist, it was these discoveries, Kaspersky's "relentless salesmanship" and the company's anti-virus product that made Kaspersky Lab uncommon as an internationally recognized Russian company.[2][26]

Kaspersky became CEO of Kaspersky Lab in 2007.[7] According to a 2008 article in USA Today, he traveled to 20 to 30 countries per year promoting Kaspersky Lab products.[27] In early 2009, CRN said his personality contributed to the company's growth from "relative obscurity to now nipping at the heels of its larger, better-known rivals." At the time, Kaspersky Lab was the fourth largest endpoint security company. It introduced new products for the enterprise market and expanded its channel programs.[28]

In 2011, Kaspersky made a decision against taking the company public, saying it would make decision-making slow and prevent long-term R&D investments. This led to a series of high-level departures from the company, including his ex-wife and co-founder.[22][26][29] Another series of departures occurred in 2014 due to disagreements over how to run the company.[29]

Kaspersky Lab has defended itself against allegedly frivolous patent claims more aggressively than most IT companies. In 2012, it was the only one of 35 firms named in a suit by patent troll Information Protection and Authentication (IPAC) to take the case to court, rather than pay a fee. The case was ruled in Kaspersky's favor.[30] Also in 2012, another company, Lodsys, sued Kaspersky and 54 other companies for patent infringement, and that case also resulted in the claimant dropping the case against Kaspersky.[31] According to an article in TechWorld, the company's aversion to settling these claims is most likely because Eugene "just hates" patent trolls. In his blog he called them "parasites" and "IT racketeers."[32]

Kaspersky himself is the co-author of several patents, including one for a constraint-and-attribute-based security system for controlling software component interaction.[33]

As of 2015, Kaspersky Lab employed more than 2,800 people.[1] As of 2012, Kaspersky was working on developing software to protect critical infrastructure, like power plants, from cyberwarfare.[22]

Kaspersky's prior work for the Russian military and his education at a KGB-sponsored technical college has led to controversy about whether he uses his position to advance Russian government interests and intelligence efforts.[24][35] According to Kaspersky, allegations of dubious connections with Russian agencies began after he got his first clients in America.[22] He spends much of his working life trying to get governments and organizations to trust him and his software in spite of the allegations.[25]

Wired said Kaspersky's critics accuse him of using the company to spy on users for Russian intelligence. Russian telecommunications companies for example are required by federal law in Russia to cooperate with the government's military and spy operations if asked. Kaspersky said his company has never been asked to tamper with its software for espionage[15] and called the accusations "cold war paranoia."[36] According to Wired, Kaspersky staffers argue "not unconvincingly" that spying on users would hurt its business and its relationship with the Russian FSB, the KGB's successor, is limited.[15] According to Gartner, "There's no evidence that they have any back doors in their software or any ties to the Russian mafia or state... but there is still a concern that you can’t operate in Russia without being controlled by the ruling party.”[16] Computing mocked some of the more extreme accusations of espionage, but said it would be unlikely for a Russian business to grow to the size of Kaspersky Lab without relationships within the Russian government.[37] NPR journalists also said it was unlikely Kaspersky was using its software for espionage, because it would be risky for the company's business, but said Kaspersky showed an unusual disinterest in Russia-based cybercrime.[38]

In August 2015, Bloomberg reported that Kaspersky Lab changed course in 2012. According to the publication, "high-level managers have left or been fired, their jobs often filled by people with closer ties to Russia’s military or intelligence services. Some of these people actively aid criminal investigations by the FSB using data from some of the 400 million customers".[39] Bloomberg[40] and The New York Times[16] also said Kaspersky was less aggressive about identifying cyberattacks originating from Russia than from other countries, allegations Kaspersky refutes. For example, he allegedly ignored or downplayed a series of denial-of-service attacks in December 2011 that were made to disrupt online discussion criticizing Russian politicians.[15][5] Kaspersky also allegedly ignored a Russian-based spyware called Sofacy, which is believed to have been used by Russia against NATO and Eastern Europe.[38] On the other hand, Kaspersky also published information on the Russia-based Crouching Yeti cyberattacks two days before Bloomberg accused him of ignoring Russia-based cyberattacks.[41] At the time, the company had published eleven reports on malicious Russian programs.[42][43] Competitor FireEye said it is awkward even in the U.S. to investigate cybercrimes performed by one's own government.[41]

A March 2015 article in Bloomberg said an increasing number of executive staff at Kaspersky Lab previously worked for Russian military and intelligence agencies.[44] According to News & Observer, Kaspersky "published a mammoth response, tearing down Bloomberg's accusations and accusing them of throwing facts out the window for the sake of a juicy anti-Russian narrative."[43] Competitor FireEye said many U.S. IT companies also have executives that formerly worked for government military and intelligence agencies.[41] NPR reported that Kaspersky has been doing an increasing amount of business with Russian cybersecurity agencies to catch cybercriminals.[42] Kaspersky confirmed that Russian agencies are among its government customers.[26][36]

In May 2017, the allegations resurfaced when US National Security Agency (NSA) director Mike Rogers told a US Senate Intelligence committee that the NSA was reviewing the US government's use of Kaspersky software for fear it would allow Russian intelligence services to conduct spy operations or launch cyber attacks against American digital infrastructure.[45] ABC reported that the Department of Homeland Security had issued a secret report in February on possible connections between Kaspersky Lab and Russian intelligence, and that the FBI was currently investigating the matter.[46] According to Defense Intelligence Agency (DIA) director Vincent Stewart, his agency is "tracking Kaspersky and their software."[47] In a press release, Eugene Kaspersky denied that his software is currently, or could be, used for such purposes, stating that "As a private company, Kaspersky Lab has no ties to any government, and the company has never helped, nor will help, any government in the world with its cyber-espionage efforts."[48] He also stated that the US does not want to use his company's software for political reasons,[47] and called the allegations "unfounded conspiracy theories."[49]

Kaspersky is one of many Russian "oligarchs" named in the Countering America's Adversaries Through Sanctions Act, CAATSA, signed into law by President Donald Trump in 2017.[50]

In August 2015, two former Kaspersky employees alleged that the company introduced modified files into the VirusTotal community anti-virus database to trick its rivals' programs into triggering false positives. The result of the false positives was that important uninfected files would be disabled or deleted. The allegations also claimed that Kaspersky himself had ordered some of the actions, specifically targeting competitors, including Chinese companies he felt were copying his software. Emails dated 2009, two years after Kaspersky became CEO, were allegedly leaked to Reuters, one of which allegedly had Kaspersky threatening to go after competitors by "rubbing them out in the outhouse," using a phrase popularized by Vladimir Putin.[51][52] The company denied the allegations.[51]