Kaspersky Lab Helped US Nab NSA Data Thief: Report

Kaspersky Lab reportedly helped the National Security Agency catch a contractor who allegedly stole terabytes of classified data from the US government even as the security vendor itself was under mounting suspicion of spying for the Russians.

That's according to Politico, which this week published a report on what it described as Moscow-based Kaspersky Lab's unsung and unknown role in the August 2016 arrest of former NSA contractor Harold Martin. The report is based on input from unidentified sources and paints a picture of Kaspersky Lab that is somewhat at odds with the US government's own dour assessment of the vendor as a potential threat to national security.

"It's irony piled on irony that people who worked at Kaspersky, who were already in the sights of the US intelligence community, disclosed to them that they had this problem," Politico quoted former NSA general counsel Stewart Baker as saying.

In a brief statement, Kaspersky Lab said it had no comment to offer at this time on the contents of the Politico report.

Martin was arrested just days after a then unknown group calling itself Shadow Brokers began leaking highly classified NSA cyberattack tools and exploits in summer 2016. Shadow Brokers did not reveal the source of the classified NSA documents, but announced it had a whole larger tranche of NSA data that it was willing to auction off to the highest bidder.

A search of Martin's home near Baltimore showed him to be in possession of nearly 50 terabytes of misappropriated government data, including a large number of documents marked "Secret" and "Top Secret."  

Court documents released last month in connection with Martin's case—also first reported on by Politico—show that Martin was arrested shortly after he posted some Twitter messages hinting at his knowledge of the stolen NSA hacking tools. Two of the tweets were sent out literally minutes before the Shadow Brokers began dumping the NSA hacking tools, and led law enforcement to believe Martin was directly involved in the theft.

Last month's court documents do not make clear if the NSA hacking tools were part of the 50 terabytes of data that Martin is said to have misappropriated. Neither does it say whether he has been specifically charged in connection with the theft of the NSA hacking tools. 

Martin currently faces 20 counts of willfully retaining information of importance to national security. His trial is set to begin in June. He faces decades in jail if convicted on all counts.

According to Politico's sources, Martin's arrest did not result from the NSA's own investigations. Rather it was information from Kaspersky Lab that first pointed federal investigators in Martin's direction.

For reasons that are still unclear, Martin sent a total of five private Twitter messages to two security researchers at Kaspersky Lab shortly before the Shadow Brokers leaks began. The messages, all of which were obtained by Politico, were sent from an anonymous Twitter account with the handle 'HAL999999999'. 

Two of the messages suggested that Martin had valuable information on hand and wanted to meet with Kaspersky Lab's founder Eugene Kaspersky. The remaining three messages, sent a couple of days later to a second researcher, were more cryptic with allusions to a new Jason Bourne movie and a link to a YouTube video showing the final moments of the movie "Inception," Politico said.

When the researchers attempted to respond to Martin's messages he blocked them. However, by doing some basic online sleuthing the researchers were relatively easily able to tie the tweets back to Martin and discover he worked for the NSA.

Once Kaspersky Lab had the details, a company employee contacted an NSA employee and suggested the agency might want to investigate Martin. That tip and Kaspersky's evidence later led to Martin's arrest, Politico said.

The US government so far has not acknowledged Kaspersky Lab's reported role in Martin's arrest. Neither has the government softened its stance against the company.

Lingering Suspicions

In fact, since Martin's arrest, things have actually gotten worse for Kaspersky Lab as far as its relations with the US government are concerned. US federal agencies are currently banned from using Kaspersky Lab products and are under instructions to jettison any products of the company that they might have purchased previously.

The ban stems from suspicions that Kaspersky Lab is allowing Russian intelligence to spy on and scoop up data from computers running the company's anti-malware tools. Kaspersky Lab has vehemently denied the allegations against it and has said the ban has seriously hurt its reputation and its ability to sell to US customers. The company has even taken the extreme step of offering up its source code for inspection by third-parties to support its claims.

Some have suggested Kaspersky Lab is the unfortunate victim of the current geopolitical climate between the US and Russia.

John Pescatore, a former NSA analyst and currently director of emerging security trends at the SANS Institute ,says the new news does little one way or the other to clear Kaspersky Lab's reputation.

On the one hand, the US government has never released any actual evidence of wrongdoing by Kaspersky. And the company's rumored ties with Russia's intelligence agencies is probably no different from the involvement that many major US technology companies have with American intelligence agencies, Pescatore says.

"Pure speculation on my part but my guess is that Harold Martin believed that Kaspersky Lab could get him in touch with Russia," he notes.  

Instead of going to the press like Edward Snowden did, and eventually ending up in Russia anyway, Martin probably tried this route as a way of avoiding any surveillance on direct communication paths to Russian agencies, he says.  Kaspersky Lab did the right thing at that point in turning him in, Pescatore notes.

"However, that act of turning him in does not change the uncertainty about Kaspersky one way or the other," he says.

Kaspersky Lab had nothing to lose by turning Martin in; and some, in fact, could view the whole sequence of events as a clever play by Russian intelligence to take suspicion off the company, he says. "So, we are still where we were—no evidence Kaspersky Lab takes orders from Russian intelligence, but no real way to prove they don't."

Related Content: