US House committee asks 22 US agencies for documents about Kaspersky Lab dating from 2013, including risk assessments, names of contractors, subcontractors
Dustin Volz / Reuters :
Context & Ripple Effects
The House committee's document sweep is the public escalation of a warning that had circulated quietly for months: the Senate Intelligence Committee sent a secret notice to the Attorney General and Director of National Intelligence flagging the potential risks of Kaspersky software given the Russian firm's large US market share.
Eugene Kaspersky responded by offering to testify and hand over source code, but the House request for agency risk assessments and contractor names signals Congress is no longer relying on voluntary cooperation — it is building its own evidentiary record ahead of an October hearing.
First-order effects
- Twenty-two US agencies must now locate and turn over internal Kaspersky risk assessments dating back to 2013, exposing how widely the software was tolerated inside government.
- Federal contractors and subcontractors named in the documents face scrutiny over their own use of Kaspersky products, since the committee explicitly asked for their identities.
Second-order effects
- Agencies and their suppliers face pressure to purge Kaspersky software preemptively rather than wait for a congressional finding, shrinking the vendor's US government-adjacent business.
- Kaspersky's earlier offer of testimony and source code becomes insufficient on its own — the company must answer document demands aimed at its customers' networks, not just its product.
Third-order effects
- If the pattern holds through the House hearing and beyond, foreign security vendors could face a new standard in which exclusion from US systems precedes any adjudicated finding — a dynamic that later pushed Kaspersky to sue the administration over due process after a DHS ban.
- Government procurement of antivirus software may reorganize around national-origin risk assessments rather than purely technical evaluations, with contractor disclosure requirements becoming routine.
The trend: US oversight of foreign cybersecurity vendors is shifting from confidential intelligence warnings to formal congressional investigations, mandatory disclosures, and outright exclusion from government systems.