Global cyber security firm and anti-virus software provider Kaspersky Lab is planning to launch a number of data centers outside of Russia, starting with Switzerland, to soothe Western governments’ concerns of state-sponsored espionage, according to documents obtained by Reuters.

All data from European and US customers will be channeled to the facility, with the exception of anomalies requiring manual reviews that will continue being routed through Moscow. Work on the data center is set to begin imminently, and is expected to be completed in early 2020.

Turning a new leaf

The facility in Switzerland will allow the company to bring its data processing capabilities outside of the Kremlin’s reach, with the documents confirming that the US intelligence allegations were indeed “the trigger” which led it to the decision.

Kaspersky Labs claims the move is “not just a PR stunt”, but rather part of a wider plan to adapt to a changing world, where “there is more balkanization and protectionism.”

Additionally, the company will be moving its software development team to Switzerland.

Kaspersky Labs is said to enjoy the full support of the Swiss government, but at least one source claimed that Eugene Kaspersky, the company’s founder and CEO, is “upset.”

“He would rather spend the money elsewhere. But he knows this is necessary,” the individual said.

The recent years have not been kind to the company that is responsible for the world’s fourth most popular antivirus software brand.

In 2014, Kaspersky Labs was banned from the Chinese government procurement agency’s list of security software suppliers, along with US-based Symantec, as the state cracked down on the use of foreign software in China.

More suspicion emerged in the West in May last year, when six US intelligence chiefs warned the Senate that the company’s broad presence could pose a threat to national security, due to its alleged ties to Russian defense and intelligence bodies.

As it unravelled

At the time, the director of national intelligence, as well as the heads of the FBI, the CIA, the DIA, the NSA and the National Geospatial Intelligence Agency, all warned of a security risk linked to Kaspersky software, stating that they avoided using it as a rule of thumb, as did their private contractors. The concern was that the software might be connected to state-sponsored spying programs, and could allow foreign hackers to penetrate US systems.

Eugene Kaspersky served in the Russian military, and a number of the company’s employees have alleged links to Russian military and intelligence agencies.

The Department of Homeland Security (DHS) subsequently issued a directive across all US federal agencies and departments, requiring that they identify and remove all traces of Kaspersky software from their systems within 90 days, stating that Russian law may allow intelligence agencies to compel Kaspersky to hand over communications over networks under Russian jurisdiction.

The DHS warned that the Russian government could seek to capitalize on existing access to information systems. This claim was backed by Bloomberg, which unearthed emails seemingly linking the company, and its chief legal officer and former KGB member, Igor Chekunov, to the Federal Security Service of the Russian Federation (FSB).

The company denied the allegations, stating that the emails had been misconstrued to fit a false narrative, and that it was caught in the middle of a geopolitical fight between the two countries, despite having no verifiable ties to the Russian establishment.

The following month, The Wall Street Journal reported that an NSA agent had mistakingly stored highly classified documents on his home computer, on which Kaspersky Labs software was running, and that Russian government hackers had obtained this information.

The New York Times later reported that Israeli intelligence officers had inadvertently identified Russian government hackers’ attempts to track classified program codenames used by the American government, and it was the Israeli secret services that tipped off US intelligence about the intrusion in the first place.

It emerged that the software had been used as an improvised search tool to unearth sensitive information, since, like most antivirus applications, Kaspersky Lab’s software requires access to all of the data stored on a computer in order to effectively eliminate malware.

Of course, the intrusions may have happened unbeknown to Eugene Kaspersky - either, as he claims, through the infiltration of Russian intelligence members among its staff, or through the surreptitious exploitation of the software by external parties linked to the Russian government. Another theory is that the company could have been pressured to cooperate by the Kremlin, a threat not to be taken lightly.

Fixing broken trust 

Mirroring moves by the US, both the UK and Lithuanian governments banned the use of Kaspersky software on any computers managing key energy, finance and transport systems.

In response, in late October 2017, the company launched a “global transparency initiative,” opening up its systems to independent auditors with the ultimate goal of creating new data protection controls for the software, with third-party oversight.

Building a data center in Switzerland, and opening several so-called transparency centers in Asia, Europe and the United States, is the next step in the company’s plan to recover its reputation.