

“This is quite useless to find any real evidence, any real cases where Kaspersky Lab would violate their privacy policies and transfer some data from U.S. Indeed, many in Russia see the anti-Kaspersky campaign as politics with a dash of protectionism. The company’s website contains a large red notice that it’s not available in the U.S. Kaspersky now sells its DDoS protection service to large companies, installing sensors directly inside customers’ networks. “In the future the project may become one of the items on the list of services that we provide to corporate customers,” he wrote. In the emails, Kaspersky said the aim of the project for the FSB was to turn the anti-DDoS technology into a mass-market product for businesses. Stoyanov couldn’t be reached for comment. Kaspersky Lab has said the case involved allegations of wrongdoing before Stoyanov worked for the company. In December he and a senior FSB cyber investigator were arrested on treason charges, adding a bizarre twist to the company’s relationship to the government. Stoyanov previously worked in the Interior Ministry’s cybercrime unit.

One Kaspersky Lab employee who used to ride along with Russian agents on raids was Ruslan Stoyanov, whose technology underpinned the company’s anti-DDoS efforts, says the person familiar with the program. Chekunov is the point man for technical support to the FSB and other Russian agencies, say three people familiar with his role, and that includes gathering identifying data from customers’ computers. The project lead was Kaspersky Lab’s chief legal officer, Igor Chekunov, a former policeman and KGB officer. They weren’t just hacking the hackers they were banging down the doors. That’s what Kaspersky was referring to in the emails, says the person familiar with the system. The second part is more unusual: Kaspersky provides the FSB with real-time intelligence on the hackers’ location and sends experts to accompany the FSB and Russian police when they conduct raids. The first consists of traditional defensive techniques, including rerouting malicious traffic to servers that can harmlessly absorb it. A person familiar with the company’s anti-DDoS system says it’s made up of two parts.

In this case, Kaspersky may have been referring to something even more rare in the security world. “Active countermeasures” is a term of art among security professionals, often referring to hacking the hackers, or shutting down their computers with malware or other tricks.
