The Bosnian-Herzegovinian government, aspiring to join NATO, has signed an agreement with Russian Kaspersky

The Council of Ministers, which represents the Bosnian government, has decided to procure products from the Russian cyber security company Kaspersky Lab, despite the fact that Kaspersky has been banned in an increasing number of NATO and EU member states, in response to a cyber attack against the country in September last year. The decision has sparked serious controversy in Bosnia and Herzegovina, as it has come to light that the country’s key state institutions have been relying on Kaspersky products for their IT security for several years.

The entire country uses Kaspersky

In recent weeks, more details have emerged about a contract between the Council of Ministers (Vijeća Ministara), representing the Bosnian government, and the company Prointer based in Banja Luka, which has been involved in the procurement of Kaspersky Lab’s software.

In response to inquiries from the well-informed news portal Klix, the Secretariat of the Council of Ministers has officially confirmed that the Bosnian government has indeed decided to procure the Russian antivirus program.

A Kaspersky ötletes rajzfilmekkel népszerűsíti magát a YouTube-n

The program is currently in use in over 50 public institutions in Bosnia, including protected institutions such as the Bosnian Presidency, the military, the State Investigation and Protection Agency (SIPA) responsible for investigating serious crimes, and the protection of state officials.

At the end of 2022, there were approximately 1300 subscriptions to Kaspersky associated with state user accounts in Bosnia and Herzegovina.

According to a recent decision by the Council of Ministers, this will increase by an additional 200 units. The current contract with Prointer was initiated by the Secretariat of the Council of Ministers and its total value amounted to 18,000 euros.

In addition to the aforementioned government agencies, Kaspersky software is used in numerous municipal and public institutions in Bosnia and Herzegovina, including the postal service, tax office, Serbian entity railway company, and even on the computers of the Faculty of Law at the University of Sarajevo.

Bosnia was attacked in September

In September 2022, news emerged in the Bosnian media that several state institutions, including the Council of Ministers, were targeted by cyber attacks, resulting in the compromise of their IT equipment.

The severity of the IT security incident, which was treated with high confidentiality, is evident from the fact that the website of the Bosnian Parliament was inaccessible for over two weeks. Similarly, the websites of the Council of Ministers and SarajevoGas, the gas utility company of Sarajevo Canton, also became inoperable.

A Kaspersky reklámarca (Forrás: YouTube, Kaspersky)

Regarding the specific attacks, there has been no substantial information about the results of the investigation in the media, and the authorities have not disclosed which state institutions were affected, to what extent, and in what form the cyber attacks occurred.

Nevertheless, due to the September 2022 attack, the Council of Ministers deemed it necessary to contract additional services from Kaspersky. As part of the investment, it was confirmed that all computers connected to the Bosnian government network were equipped with this software, including desktop computers, laptops used by the government, and mobile devices requiring protection. Furthermore, it was revealed that the security services provided by Prointer also covered laptops and mobile devices used by the government, going above and beyond the original scope.

In an attempt to appease the discontented masses clamoring against Russian influence, the Secretariat of the Council of Ministers issued a brief statement in a journalistic style, stating that they have no knowledge of the potential for abuse of the software, but are aware that it is currently being used by numerous European businesses and state institutions.

When asked whether Kaspersky software could pose a security threat, the Secretariat responded that they monitor all traffic through public links and have not yet detected any such activity, implying that it may exist but they are unaware of it.

Kaspersky software is already banned in half of Europe

The CEO and co-owner of Kaspersky Lab, a Moscow-based company founded in 1997, Eugen (or Yevgeny) Kaspersky, has repeatedly faced allegations in previous years that he may have close ties with Russian intelligence agencies due to his professional background.

Although the Russian cyber security company consistently denies these allegations, the use of the Kaspersky software suite on government devices is not permitted in a significant number of NATO member states.

While the connection between the Moscow-based company and Russian intelligence agencies has not been proven, or rather it is perhaps more accurate to approach the question as lacking publicly available evidence to support it, publicly accessible data regarding the past of the CEO and his wife speak for themselves.

Eugen, or Yevgeny Kaspersky, obtained his qualifications as a mathematician and computer scientist at a college-level institution of the KGB. Following the acquisition of his diploma, he served in the field of information technology within the Soviet, now Russian, GRU.

For the sake of curiosity, it is worth mentioning that Kaspersky has played, and continues to play, an important role in the Soviet- Russian intelligence services, as he met his wife Natalija, who was also a Soviet intelligence officer at the time, in a KGB resort.

Kaspersky’s wife still plays a role in the company’s leadership today.

The discussion of the possible connection between Kaspersky Lab and the Kremlin has been a recurring topic in the international press for almost half a decade.

In 2017, the U.S. National Security Agency (NSA), responsible for cyber warfare, issued a report revealing that hackers associated with an unnamed Russian government entity had exploited vulnerabilities related to Kaspersky antivirus software to obtain sensitive data from the computer of one of their contracted external employees.

Following the incident, the use of the Russian company’s products was banned at all U.S. government agencies. The list of countries applying the ban quickly expanded, with the United Kingdom, Lithuania, and the Netherlands also prohibiting the use of Kaspersky products on government devices in 2017 and 2018.

In the aftermath of the Russian offensive against Ukraine that began in February 2022, NATO member states also decided to introduce trade restrictions on the company’s products, which they had not previously implemented.

The German Federal Office for Information Security (BSI) warned users about the possible risks associated with the use of the software in a statement. The Polish government and the Baltic states have also submitted a joint proposal to the European Commission to ban the sale of the Russian company’s products on the EU single market due to security concerns.

It should be noted, however, that none of the mentioned state governmental organizations have made public any concrete evidence indicating cooperation with Russian services against Kaspersky. The proposed Polish- Baltic trade ban would be more akin to economic sanctions, such as export restrictions, rather than a limitation based on the „national security interest” recognized by EU law.

Therefore, the fact that the use of the software suite is already banned in half of Europe could also imply that these countries are indirectly protecting the interests of their less financially strong domestic developers, in addition to securing their own IT systems.

The EU did not respond

After all this, it is not surprising that IT security experts interviewed by Bosnian online media outlets expressed confusion about the state order.

Most expert opinions agreed that the software package can provide functional and effective protection.

They also noted that while the specific procurement value and the exact services received for it are not known, based on the practices of other Western manufacturers, they usually accept the price offer provided by Kaspersky, meaning that it may not be the most cost-effective solution in most cases.

Regarding the possible Russian security threat, they emphasized that they do not have concrete evidence on this matter, but pointed out as significant indirect evidence that tech giants like Twitter and Facebook also ban the use of the company’s products.

Expert opinions also highlighted that, for example, Germany did not impose a trade ban on the affected products because the BSI had already classified them as „not recommended” in its previous circular.

The mentioned circular is considered a holy scripture in German IT security circles, so disciplined German system administrators are unlikely to use these software products even in the absence of a ban.

The Bosnian public is advocating for clarification of two questions regarding the mentioned procurement, namely, who found Kaspersky products applicable in Bosnia and Herzegovina, and what the „Western” allies think about this, especially considering that Bosnia and Herzegovina’s newly formed coalition government in January has designated EU accession as one of its top state-level objectives.

In conclusion, it is worth mentioning that there has been no official response from the EU and NATO leadership regarding this peculiar procurement.