Kaspersky Lab reports that it is moving, “a number of core processes from Russia to Switzerland. This includes customer data storage and processing for most regions, as well as software assembly, including threat detection updates” and it is also opening its first Transparency Centre.
The company adds that to ensure full transparency and integrity, it is arranging for this activity to be supervised by an independent third party, also based in Switzerland.
The moves are part of what Kaspersky calls its Global Transparency Initiative, announced in October last year. The company has suffered commercially due to its Russian origins, being based in the country, and the education of its founder, Eugene Kaspersky, at a KGB college - most notably with the US government banning use of Kaspersky products and leaning on those who use them.
Despite the ‘guilt by association' label, with Russia ramping up its cyber-offensive activities and having an interventionist approach to domestic companies, no one has ever made public any credible evidence of wrong-doing by Kaspersky, but in an industry based on trust, casting aspersions due to what is possible has been enough to have an impact. And it has been noted that Russian intelligence has used the capabilities of Kaspersky products for spying - though the most publicised incident was primarily down to poor security practice by a US intelligence operative.
Consequently Kaspersky Lab is seeking to assure the market of the integrity and trustworthiness of its products and to “address the growing challenges of industry fragmentation and a breakdown of trust,” through increased transparency and accountability.
Commenting on the process move and opening of the transparency centre, Eugene Kaspersky, CEO of Kaspersky Lab, said; “In a rapidly changing industry such as ours we have to adapt to the evolving needs of our clients, stakeholders and partners. Transparency is one such need, and that is why we've decided to redesign our infrastructure and move our data processing facilities to Switzerland. We believe such action will become a global trend for cyber-security, and that a policy of trust will catch on across the industry as a key basic requirement.”
The company's Zurich data centre will be established by the end of 2019 and be used to store and process all information for users in Europe, North America, Singapore, Australia, Japan and South Korea, with more countries to follow. This information is shared voluntarily by users with the Kaspersky Security Network (KSN) (http://KSN.Kaspersky.com) an advanced, cloud-based system that automatically processes cyberthreat-related data.
Kaspersky Lab will also relocate its ‘software build conveyer' -- a set of programming tools used to assemble ready to use software out of source code. By the end of 2018, Kaspersky Lab products and threat detection rule databases (AV databases) will start to be assembled and signed with a digital signature in Switzerland, before being distributed to the endpoints of customers worldwide. The relocation will ensure that all newly assembled software can be verified by an independent organisation and show that software builds and updates received by customers match the source code provided for audit.
The source code of Kaspersky Lab products and software updates will be available for review “by responsible stakeholders” in a dedicated Transparency Center that will also be hosted in Switzerland and is expected to open this year.