Russian cyber security firm Kaspersky Lab is moving key parts of its business out of Moscow in a bid to address the risks arising from its exposure to the Russian intelligence services.
Last year, the US Department for Homeland Security (DHS) and the UK's National Cyber Security Centre (NCSC)
issued warnings regarding the use of Kaspersky software on critical government systems, citing legal powers in Russia, allowing the state to exert control over private companies.
The warnings left Kaspersky Lab needing to reassure customers that their data was handled properly in what it has called a global transparency initiative.
Crucial parts of its customer data processing and software production are being relocated to an automated data centre in a secured facility in the privacy haven of Zurich, where they will be open for inspection and audit by trusted third parties.
None of Kaspersky Lab's staff will be based in Switzerland however.
The company's vice president of public policy, Anton Shingarev, explained to Sky News that only certain automated parts of its infrastructure were being moved there – being managed by the NYSE-listed Interxtion.
Despite NCSC's statement that it was working with Kaspersky Lab to develop a plan to prevent any UK data being captured by the Russian state, the company has instead offered, Mr Shingarev said, "a framework which is suicidal for us in case of abuse".
"If anything happens, it's going to be found sooner or later. And we intentionally – by ourselves, with our hands –
[are creating] such a system."
This does not meet the standard of 100% proof that any transfers would be prevented, the VP acknowledged, but
he claimed it did meet the NCSC's standards for a risk-based approach towards the company's software.
At a launch event celebrating the beginning of European customers' data being processed in Zurich, Mr Shingarev denounced what he saw as growing "tech nationalism" around the world with products being banned because of their country of origin, but said Kaspersky Lab would have to find a way to overcome it regardless.
The company's infrastructure, which has been moved, was implicated in media reports alleging the firm's anti-virus product was used by the Kremlin to steal secret US hacking tools from the computer of a National Security Agency employee who had illegally taken them home.
By moving them to Zurich and keeping an audit record of all of Kaspersky Lab's Moscow-based staff's interactions with them, the company aims to preclude allegations that the Russian state could secretly interfere with its business.
Saying that the data cannot be accessed in secret is not same as saying it cannot be got at at all, and it is not clear how reassured the company's government customers will be by the proposed transparency facility.
Mr Shingarev told Sky News: "How can [the code review] guarantee that there is no GRU, GCHQ, CIA – name them –
spies in our company?
"It's almost impossible to have a 100% guarantee. Of course we've got all these checks, of course we've got audits, of course we've got all these matters, but there is no simple fast solution to remove the risk," he added.
More from Cyberattacks
"That's why in the risk-based paradigm we are trying to reduce the risk by a few measures. Reviewing the source code is one of the measures that helps, an independent audit another measure, data centre here another measure.
"Having all these measures we are trying to reduce the risk, reduce the window of opportunity for abusers, and to guarantee as much security as possible."
[contf] [contfnew] 
Sky News
[contfnewc] [contfnewc]
