Sources: Russian security firm Kaspersky Lab helped the US government catch NSA contractor Harold Martin, who was accused of stealing a trove of classified data
The U.S. has accused Kaspersky Lab of working with Russian spies. But sources say the company exposed a massive breach that U.S. authorities missed.
Context & Ripple Effects
The Kaspersky story has run in one direction since late 2017: the theft of NSA hacking tools from a contractor's laptop was sourced to Kaspersky software, and Israel's hack of Kaspersky's network gave the NSA evidence that Russian spies were using the product to hunt for U.S. secrets. The company's response was a transparency play, offering its source code for independent review.
Politico's reporting flips the frame on the same episode: sources say Kaspersky spotted the Harold Martin breach itself and tipped off U.S. authorities who had missed it. That puts the company simultaneously in the role the U.S. government accused it of playing and the role of the informant — which is exactly why this matters for every buyer and regulator who treated the 2017 allegations as settled.
First-order effects
- The U.S. government's public case against Kaspersky now rests on a record where the company's own product surfaced the Martin breach — a contradiction its defenders can cite directly against the espionage accusations.
- Kaspersky gains a concrete counter-narrative for its transparency campaign, after having already put its source code up for third-party review to rebut the spying claims.
Second-order effects
- Governments and enterprise buyers weighing Kaspersky bans face dueling sourced accounts — the Israeli intelligence warning versus Kaspersky's tip on Martin — making procurement decisions turn on classified evidence most customers cannot inspect.
- Rival security vendors inherit a market where the deciding question is no longer detection quality but which nation's intelligence services a vendor's telemetry might reach.
Third-order effects
- If both accounts hold, antivirus software is confirmed as a dual-use intelligence surface: the same deep system access that lets a vendor catch a contractor like Martin lets a hostile state mine endpoints for secrets, pushing the industry toward jurisdictionally segmented products.
- Internal accounts of Kaspersky's power struggle between managers with and without intelligence ties suggest vendor trust will hinge on governance and ownership structure, not just technical audits — a precedent regulators in other countries can apply to any security firm operating across geopolitical lines.
The trend: Endpoint security vendors are being forced to operate as geopolitical actors, with their telemetry, ownership, and internal politics scrutinized as instruments of state intelligence rather than neutral infrastructure.