Eugene Kaspersky, co-founder and CEO, Kaspersky Lab, in Auckland in May.
While the US and UK intelligence communities are warning against the use of Kaspersky Lab security software, the New Zealand intelligence community is not following suit, at least not specifically.
Queried about its guidance, the Government Communications Security Bureau (GCSB) said it provides information security guidance in the form of the New Zealand Information Security Manual (NZISM) setting out "baseline controls and good practice for use by New Zealand Government agencies".
The baseline controls are minimum standards that are mandatory for government agencies, said Andrew Hampton, director general of the GCSB.
“The GCSB provides advice and other assistance to New Zealand government departments on matters relating to the security of classified information that is processed, stored or communicated by electronic or similar means," Hampton said.
"The GCSB (through the NZISM or other means) does not prescribe systems, software or hardware, to be used by government agencies. It provides security guidance and risk management frameworks to be applied to mitigate information security risk."
The NZISM does not appear to mention specific vendors and is complex. Asked if there was anything in its text that would guide agencies away from using Kaspersky, GCSB said agencies should consider the full range of risk factors when making security decisions.
"This could include taking into account current international commentary," it said.
US civilian government agencies were ordered to remove Kaspersky Lab from their networks over concerns the anti-virus software could be used by Russian intelligence to spy on the US. The order came after high-profile hacks ahead of the US election last year.
Kaspersky Lab has denied ties to any government and said it would not assist a government conduct cyber espionage.
A second member of the Five Eyes spying alliance, the UK, recently followed the US lead. In a letter to civil service leaders on Friday, Ciaran Martin, head of the GCHQ's National Cyber Security Centre, said Russia was acting against the UK’s national interest in cyberspace.
Russia was targeting UK central government and critical national infrastructure, he said, adding that a Russia-based provider should "never be used” for systems related to national security and information classified "secret" and above.
The remaining three Five Eyes, New Zealand, Australia and Canada, appear not to have followed suit - at least not specifically.
Anti-virus software that scans systems for rogue and malicious software have deep access to files on computer systems.
The dangers of such access were highlighted when a US National Security Agency staffer had files stolen from his personal PC. Government officials told the media they believed Kaspersky software was used by hackers directed from the Kremlin to steal the files.
Kaspersky Lab founder Eugene Kaspersky has railed against the accusations, saying the company was at the centre of a "designed and orchestrated attack".
He said Russian security agencies have never asked Kaspersky Lab to spy and if they did he would move the company out of Russia.
“We never helped the espionage agencies, the Russians or any other nation," he said at a London press confrence in late November.
