PARIS (AP) \u2014 Sometime in 2014, a group of analysts walked into the office of Eugene Kaspersky, the ebullient founder of Russian cybersecurity firm Kaspersky Lab, to deliver some sobering news.<\/p>\n\n\n\n
Kaspersky\u2019s anti-virus software had automatically scraped powerful digital surveillance tools off a computer in the United States and the analysts were worried: The data\u2019s headers clearly identified the files as classified.<\/p>\n\n\n\n
\u201cThey immediately came to my office,\u201d Kaspersky recalled, \u201cand they told me that they have a problem.\u201d<\/p>\n\n\n\n
He said there was no hesitation about what to do with the cache.<\/p>\n\n\n\n
\u201cIt must be deleted,\u201d Kaspersky says he told them.<\/p>\n\n\n\n
The incident, recounted by Kaspersky during a brief telephone interview on Tuesday and supplemented by a timeline and other information provided by company officials, could not immediately be corroborated. But it\u2019s the first public acknowledgement of a story that has been building for the past three weeks \u2014 that Kaspersky\u2019s popular anti-virus program uploaded powerful digital espionage tools belonging to the National Security Agency from a computer in the United States and sent them to servers in Moscow.<\/p>\n\n\n\n
The account provides new perspective on the U.S. government\u2019s recent move to blacklist Kaspersky from federal computer networks, even if it still leaves important questions unanswered.<\/p>\n\n\n\n
To hear Kaspersky tell it, the incident was an accident borne of carelessness.<\/p>\n\n\n\n
Analysts at his company were already on the trail of the Equation Group \u2014 a powerful group of hackers later exposed as an arm of the NSA \u2014 when a computer in the United States was flagged for further investigation. The machine\u2019s owner, identified in media reports as an NSA worker, had run anti-virus scans on their home computer after it was infected by a pirated copy of Microsoft Office, according to a Kaspersky timeline released Wednesday.<\/p>\n\n\n\n
The scan didn\u2019t just treat the infection. It also triggered an alert for Equation Group files the worker had left in a compressed archive which was then spirited to Moscow for analysis.<\/p>\n\n\n\n
Kaspersky\u2019s story at least partially matches accounts published in The New York Times, The Washington Post and The Wall Street Journal. All three publications recently reported that someone at the NSA\u2019s elite hacking unit lost control of some of the agency\u2019s powerful surveillance tools after they brought their work home with them, leaving what should have been closely guarded code on a personal computer running Kaspersky\u2019s anti-virus software.<\/p>\n\n\n\n
But information security experts puzzling over the hints dropped by anonymous government officials are still wondering at whether Kaspersky is suspected of deliberately hunting for confidential data or was merely doing its job by sniffing out suspicious files.<\/p>\n\n\n\n
Much of the ambiguity is down to the nature of modern anti-virus software, which routinely submits rogue files back to company servers for analysis. The software can easily be quietly tweaked to scoop up other files, too: perhaps classified documents belonging to a foreign rival\u2019s government, for example.<\/p>\n\n\n\n
Concerns have been fanned by increasingly explicit warnings from U.S. government officials after tensions with Russia escalated in the wake of the 2016 presidential election.<\/p>\n\n\n\n
Kaspersky denies any inappropriate link to the Russian government, and said in his interview that any classified documents inadvertently swept up by his software would be destroyed on discovery.<\/p>\n\n\n\n
\u201cIf we see confidential or classified information, it will be immediately deleted and that was exactly (what happened in) this case,\u201d he said, adding that the order had since been written into company policy.<\/p>\n\n\n\n
An AP request for a copy of that policy wasn\u2019t immediately granted.<\/p>\n\n\n\n
Kaspersky\u2019s account still has some gaps. For example, why not alert American authorities to what happened? The newspaper reports alleged that the U.S. learned that Kaspersky had acquired the NSA\u2019s tools via an Israeli spying operation.<\/p>\n\n\n\n
Kaspersky declined to say whether he had ever alerted U.S. authorities to the incident.<\/p>\n\n\n\n
\u201cDo you really think that I want to see in the news that I tried to contact the NSA to report this case?\u201d he said at one point. \u201cDefinitely I don\u2019t want to see that in the news.\u201d<\/p>\n\n\n\n
So did he alert the NSA to the incident or not?<\/p>\n\n\n\n
\u201cI\u2019m afraid I can\u2019t answer the question,\u201d he said.<\/p>\n\n\n\n
Even if some questions linger, Kaspersky\u2019s explanation sounds plausible, said Jake Williams, a former NSA analyst and the founder of Augusta, Georgia-based Rendition InfoSec. He noted that Kaspersky was pitching itself at the time to government clients in the United States and may not have wanted the risk of having classified documents on its network.<\/p>\n\n\n\n
\u201cIt makes sense that they pulled those up and looked at the classification marking and then deleted them,\u201d said Williams. \u201cI can see where it\u2019s so toxic you may not want it on your systems.\u201d<\/p>\n\n\n\n
As for the insinuation that someone at the NSA not only walked highly classified software out of the building but put it on a computer running a bootleg version of Office, Williams called it \u201cabsolutely wild.\u201d<\/p>\n\n\n\n
\u201cIt\u2019s hard to imagine a worse PR nightmare for the NSA,\u201d he said.<\/p>\n\n\n\n
Kaspersky\u2019s anti-virus software had automatically scraped powerful digital surveillance tools off a computer in the United States and the analysts were worried: The data\u2019s headers clearly identified the files as classified.<\/p>\n","protected":false},"author":7,"featured_media":55422,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":13,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,29,13,32],"tags":[],"coauthors":[1145],"class_list":["post-18336","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-industry","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"XNQXLSFQMZCGVGL6EWRJSABVBQ","arc_canonical_url":"\/industry\/2017\/10\/25\/kaspersky-we-uploaded-us-documents-but-quickly-deleted-them\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n