US House committee asks 22 US agencies for documents about Kaspersky Lab dating from 2013, including risk assessments, names of contractors, subcontractors
Dustin Volz / Reuters :
Context & Ripple Effects
This request escalates a months-long congressional squeeze on Kaspersky Lab. In May, sources reported the Senate Intelligence Committee had sent a secret notice to the Attorney General and Director of National Intelligence warning about the Russian firm's software given its large US market share, prompting Eugene Kaspersky to publicly offer to testify and hand over source code in an attempt to defuse the concerns.
The House committee's move is different in kind: rather than warning agencies, it is compelling them to disclose what they know — risk assessments dating back to 2013 and, notably, the names of contractors and subcontractors using Kaspersky products. That paper trail sets up the October hearing the Science Committee later schedules and frames the due-process fight that follows the eventual government ban.
First-order effects
- Twenty-two US agencies must now locate and turn over four years of internal Kaspersky risk assessments, exposing how widely the software penetrated federal systems and through which contractors.
- Contractors and subcontractors named in the documents face sudden scrutiny of their own procurement choices, since their use of Kaspersky products becomes part of the public record.
Second-order effects
- Eugene Kaspersky's earlier offer to testify and provide source code becomes the company's main defensive lever as Congress moves from private warnings to public hearings.
- The documented risk picture gives executive-branch agencies grounds for an outright ban, which triggers Kaspersky's December lawsuit against the Trump administration claiming it was denied due process.
Third-order effects
- If the pattern holds, foreign security software gets policed by procurement exclusion first and litigation second — vendors contest bans in court after the market access is already lost, shifting the burden of proof onto the supplier.
- The contractor-name disclosures push federal supply-chain auditing inward: agencies can no longer evaluate only the vendor but must map every intermediary reselling or embedding its software.
The trend: US oversight of Russian cybersecurity firms is moving from intelligence-community warnings to compulsory disclosure, hearings, procurement bans, and courtroom challenges — with each step hardening into precedent for how governments treat foreign software vendors.