Liberal Democrats call on Cardiff Council to ditch Russian anti-virus software

Cardiff Council should immediately move to ditch its current usage of Russian-based Kaspersky anti-virus software, according to the city’s Liberal Democrat group of councillors.

Liberal Democrat spokesperson on finance, modernisation and performance, Councillor Rodney Berman, said that the council should not continue to use a Russian company following sanctions against Russia. He also warned that the virus software could be a security risk.

Germany’s cyber security agency on Tuesday warned that the anti-virus software developed by Moscow-based Kaspersky Lab could pose a risk.

The BSI agency said that the Russia-based cyber-security company could be coerced by Russian government agents to hack IT systems abroad or agents could clandestinely use its technology to launch cyberattacks without its knowledge.

Kaspersky said in a statement yesterday that it was a privately-managed company with no ties to the Russian government.  It also added that the warning by BSI was politically motivated.

But Councillor Rodney Berman said: “The council should take action immediately given this warning that continued use of the Kaspersky Anti-virus software could pose a risk.

“And not withstanding any threat to security, I believe we should also not be continuing to provide business to a Russian-owned company in the light of widespread sanctions against Russia.

“The actions of Putin’s Russian state against Ukraine are nothing short of abhorrent. Cardiff Council should play its part in taking a stand.”

‘Risks’

A Cardiff Council spokesperson said: “The Council – like other public organisations – is engaged in active dialogue with the National Cyber Security Centre (NCSC) about its use of Kaspersky. This is a well-known global cyber security company, which is used extensively by many organisations and businesses, and currently there is no warning being communicated to the public sector from the NCSC or other UK agencies about Kaspersky

“Removing Kaspersky, without due consideration, could place the council’s IT systems at greater risk of daily disruption and cyber attack. The system has been part of the council’s cyber-security system since 2008 and is widely used. The council is currently one-year into a three-year contract with Kaspersky. Monies for this specific contract were paid up front to secure the best price. As a consequence of that, ending this deal now would not effect a financial sanction on Kaspersky.

“Any decision we take on Kaspersky has to be fully informed of the consequences, aware of all the risks and have a clear pathway to a more secure system. It would also need to be supported by advice from the relevant national agencies.”