transparency
We announced the Global Transparency Initiative in October 2017. Its purpose: to show the world that we have nothing to hide, and that our customers can trust us. We aimed to prove it, too — not just ask for trust.
Over the past few years, we’ve been the subject of a lot of false allegations. Although not a single fact has been presented to support those allegations, we believe it is our responsibility to prove that Kaspersky Lab can, and should, be trusted. There are fundamental reasons to put trust in us, and that’s what our Global Transparency Initiative is all about.
We will update this post as the project matures.
Update: August 15, 2019
We’re pleased to announce that our third Transparency Center will open in early 2020 in Cyberjaya, Malaysia. Like the ones we opened earlier in Zurich and Madrid, this Transparency Center will serve as a trusted facility for our partners and government stakeholders, a place where they can check the source code of our products. CyberSecurity Malaysia, the country’s cybersecurity agency, will host it.
Our CEO Eugene Kaspersky notes that this Transparency Center, the company’s first in the APAC region, shows our pioneering Global Transparency Initiative, which aims to address the growing demand from partners and government stakeholders for more information on how our products and technologies work, remains on track.
Update: July 11, 2019
Our second Transparency Center opened in Madrid in June for Kaspersky’s customers and partners. We plan on having at least three Transparency Centers worldwide by 2020.
But that’s not all. An important part of our Global Transparency Initiative, the third-party Service Organization Controls (SOC2 Type 1) review of Kaspersky’s cybersecurity risk management controls has been completed. One of the Big Four auditors has reviewed our controls over regular automatic updates of antivirus databases for products for Windows and Unix Servers and concluded that development and release of these databases are protected from unauthorized changes. This serves as yet another confirmation that our products are secure and can be trusted. According to the terms of the contract, we can disclose the report to our clients and regulators upon request.
In addition to that we’re continuing to expand our Bug Bounty program and recently we have joined the Disclose.io movement, which means that we now provide a Safe Harbor for vulnerability researchers looking into our products and guarantee that there will be no legal actions against them. You can find more about Disclose.io in our blogpost.
Update: April 2, 2019
Our Global Transparency Initiative is making good progress: Today we announce the opening of a second Transparency Center. It will be located in Madrid, Spain, and will serve the purpose of providing more information regarding how Kaspersky Lab’s products and technologies work. In addition to that, the new Center will also serve as a briefing center where visitors can learn about our product portfolio, engineering, and data processing practices. We expect the Center’s first visitors this June. Plans to open Transparency Centers in Asia and North America in 2020 are ongoing.
Relocation of our data processing infrastructure is also on track. We have already relocated the receiving infrastructure to Switzerland and plan to finish relocating the storage part by the end of Q2. We expect to finalize full relocation of data processing for European customers by the end of this year.
In addition to that, we have published the results of a voluntary third-party legal assessment of Russian legislative acts and how they apply to Kaspersky Lab. The assessment was conducted by Dr. Kaj Hober, professor of International Investment and Trade Law at Uppsala University in Sweden and an expert on Russian law system. The key findings are the following:
- Kaspersky Lab may be asked by the federal security service (FSB) to cooperate with it, but the company is not obliged to do so.
- Laws that oblige vendors to assist the FSB with operational-investigative activities apply only to companies that provide electronic communication services, which Kaspersky Lab is not.
- Laws that force companies to store data in Russia and provide it and encryption keys (to decrypt it) to the FSB apply only to telecom providers, and Kaspersky Lab is not a telco.
Last but not least, we have improved our Bug Bounty program, adding Kaspersky Password Manager and Kaspersky Endpoint Security for Linux as well as some other products to the scope of the software available for review. So far more than 50 bugs were discovered and reported through the program, and researchers were paid more than $17,000 in bounties for pointing them out.
Update: November 13, 2018
Our first Transparency Center is now officially open, enabling authorized partners to access reviews of the company’s code, software updates, and threat detection rules.
Starting today, we will also process malicious and suspicious files shared with us by users of Kaspersky Lab products in Europe in our two world-class data facilities in Zurich.
As promised, Kaspersky Lab has also contracted with one of the Big Four professional services firms to conduct an audit, under the SSAE 18 standard, of the company’s engineering practices around the creation and distribution of threat detection rule databases, to independently confirm their accordance with the highest industry security practices.
Update: August 29, 2018
We are making good progress, having already implemented one major change by raising our bug bounty to $100,000. This helped make our products more secure and reliable. At this point, we have also initiated the next phase of the Global Transparency Initiative project, installing the equipment necessary for relocating our user data processing to Europe.
Kaspersky Lab has also signed contracts with two European providers — Interxion and NTS — to host the new infrastructure necessary to collect, process, and store customer data in Zurich, Switzerland, by the end of 2018, addressing concerns from public and private sector stakeholders regarding unauthorized access to customer data. Relocation of data processing and storage will begin with European customers, and other countries will follow. We plan to finalize full relocation for European countries in Q4 2019.
Why Switzerland?
We chose the location for several reasons. On the one hand, Switzerland is located in the heart of Europe. On the other hand, Switzerland is not part of the EU, which makes it an independent country that can make its own decisions. We also find the symbolism appealing: One of our Global Transparency Initiative’s main principles is to show that we are independent, so there’s just no better place than Switzerland to start.
Switzerland is also well known for its highly innovative and advanced IT landscape, and for its strict regulations on processing data requests received from authorities. So, our customer data will be stored and processed in one of the most secure locations in the world.
Global Transparency Initiative phases
Other elements of our Global Transparency Initiative are also being developed.
We’re planning on opening our first Transparency Center in Switzerland. This is currently being set up and will be opened once we’re ready to start processing data in the Zurich data centers (this is scheduled for later this year). [UPDATE: Our first center is now open.]
We’re determined to relocate the facilities that are tasked with customer data processing for other countries too. This is quite a complicated process, so in order to minimize any potential disruption in protecting our customers, we’ve decided to stick to an incremental approach. So we’ll get back to this after we’ve finished relocating the data processing facilities for European citizens to Switzerland. [UPDATE: The relocation process has started and will be completed for European citizens in 2019.]
The third-party code and processes review is also due to happen following the relocation; we are now looking for a suitable partner. [UPDATE: We have now contracted with a partner for this phase.]
Another part of our scope is moving the software and threat detection rules database assembly process to Switzerland. However, addressing concerns over unauthorized user data access was higher priority, so this move will happen after we have kicked off the data relocation process.
Implementing the Global Transparency Initiative is a very important process for us. We’re absolutely confident that investing time and effort into this lengthy project is necessary to prove that Kaspersky Lab is fully transparent, independent, and has every reason to be trusted. As we can share more news about the ongoing processes of our Global Transparency Initiative, we’ll continue to update this blog as well as our Transparency Center website, so that everyone can find information about our transparency-related activities in one place.
Tips