According to that Wikipedia page, The Equation Group refers to "a collection of tools used for hacking". Targeting hacking tools seems to me exactly what a security software company should be doing.

>Such an "innocent" company would have no reason to get involved in cyberwarfare between state-actors, while Kaspersky is heavily involved in such activities and pouring considerable resources into them.

Even if we assume these tools can only target governments and not businesses or individuals, perhaps Kaspersky wishes to obtain contracts with the governments targeted. I don't see how this is particularly sinister or illegitimate.

> This is especially damning since they are clearly targeting state-actors that are antagonistic to Russian interest, such as the US (Equation Group) and its allies (Israel)

Your Wikipedia link states: "The Shadow Brokers announced that it had stolen malware code from the Equation Group [...] Exploits against Cisco Adaptive Security Appliances and Fortinet's firewalls were featured in some malware samples released by The Shadow Brokers [...] Juniper also confirmed that its NetScreen firewalls were affected. The EternalBlue exploit was used to conduct the damaging worldwide WannaCry ransomware attack."

Three American companies and vast numbers of individual users and civil government institutions around the world (including the UK Health Service). Are they all Russian interests?

Are we reading the same Wikipedia page? Here's what mine says:

> The Equation Group, classified as an advanced persistent threat, is a highly sophisticated threat actor suspected of being tied to the United States National Security Agency (NSA). Kaspersky Labs describes them as one of the most sophisticated cyber attack groups in the world and "the most advanced ... we have seen", operating alongside but always from a position of superiority with the creators of Stuxnet and Flame. Most of their targets have been in Iran, Russia, Pakistan, Afghanistan, India, Syria, and Mali.

Kaspersky is preoccupied with this group, that by their own description, targets state actors that are hostile to the US. They've obsessively documented 500 of their alleged attacks worldwide, which would be negligible blip on the radar for any normal, purely commercial cyber-security company.

Doesn't it strike you as odd?

> Even if we assume these tools can only target governments and not businesses or individuals, perhaps Kaspersky wishes to obtain contracts with the governments targeted.

I'm going to take a wild guess that none of the targets of the Equation Group like Afghanistan or Syria will trust Kaspersky enough to hire them for a sensitive project. These countries are very busy with ground wars and have no attention or money to spend on cyber security.

The only government that may and probably does employ Kaspersky is the Russian one. Which of itself hints at heavy collusion between these two.

You keep saying this, and it is completely wrong which detracts from your point (which is right!).

All commercial cyber-security companies collect and report on hacking groups.

Here's the Mandiant/FireEye report on APT-1: https://www.fireeye.com/content/dam/fireeye-www/services/pdf... and here is the APT_28 one: https://www2.fireeye.com/apt28.html

Here's the report by a group of companies on the Chinese Axiom group: http://www.novetta.com/wp-content/uploads/2014/11/Executive_...

And finally, here's the FireEye one I linked to previously talking about the Equation Group: https://www.fireeye.com/content/dam/fireeye-www/company/even...

The only government that may and probably does employ Kaspersky is the Russian one.

That's not true either as a quick Google shows, eg: https://www.crn.com.au/news/kaspersky-to-protect-prime-minis...

No, not in the slightest. Of course a security company tracks security threats, especially when those security threats utilize multiple zero day vulnerabilities that could end up in the wild after they are finished with them. Use your head, man. I get it, "better dead than Red" and all, but let's not lose our shit purely because of the speculation of an "anonymous source close to the case."

I've always found it suspicious that Russia and China created their own social networks, email providers, and search engines. Almost like they know the power of a capable search engine or social network for intelligence gathering purposes.

Google and US anti-virus companies must work closely with the NSA too.

> Kuok repeatedly expressed fears that he might be dealing with an NSA, CIA or FBI agent, but continued to negotiate with the undercover officer, even cautioning him to avoid referencing the items by model number in e-mail, because "your country has this system to analyze" e-mail for keywords.

https://www.wired.com/2010/05/kuok

Also after the "theft" and premature release of Stuxnet by Israel, I wonder how strong the collaboration between the US and Israel is.

> A 43-year-old former Akamai employee has pleaded guilty to espionage charges after offering to hand over confidential information about the Web acceleration company to an agent posing as an Israeli consular official in Boston.

https://www.pcworld.com/article/239187/akamai_employee_tried...

> Facebook, for example, previously announced its DeepFace facial recognition system is capable of determining with 97 percent accuracy whether two images are of the same person. The company, which itself is accustomed to criticism that it views users as guinea pigs, is able is make such accurate identifications because of the network of images from which it draws, something that could take police agencies a decade or more to build up.

Snowden worked for Dell as a cover for his intelligence work. Russia told their military to move off Linkedin the moment it got acquired by Microsoft. Do Dell and Microsoft work closely with the DoD and should this concern non-US citizens that rely on their software and hardware?

https://techcrunch.com/2016/08/15/mapping-israels-marketing-...

Doubtful. Keep in mind that in Russia / China the state has a lot more leverage against commercial companies. It's very easy for the state to effectively shut any non-complying company, not to mention far worse (Russia and China have thrown businessowners into jail for no reason before).

> Almost like they know the power of a capable search engine or social network for intelligence gathering purposes.

Absolutely, the typical pattern is that some dominant foreign provider refuses to comply with say, Chinese Firewall rules, so the Chinese block it and instate a friendly domestic provider instead.

That is pretty disingenuous. Noncompliance with an NSL is a quick route to contempt charges. On top of that, the gag order prevents you from explaining your position to shareholders or customers.

This coercion makes it much more straightforward for most businesses to simply comply with US demands, unless you voluntarily shutter your company, e.g. Lavabit.

After a court issues an order, contempt of court is a possibility. Just clarifying that the route to contempt is not quick. It’s also largely untested. Writing an NSL is two pages in a Microsoft Word template, while arguing a federal case to get your way is a much bigger prospect; if the investigation is small enough, or they’re not totally legal in how they got intelligence, etc., etc., they might not wish to argue and calling the bluff might be smart.

The gagging facility of NSLs actually has a non-coercive purpose: as designed, an NSL basically invites an unknown third party into a sensitive intelligence or counterintelligence operation. Tipping off the target or anyone else could lead to a collapse of the investigation, burning other sources that were used before you got your NSL, diplomatic repercussions, and so on. That’s the thinking that went into it, and it’s actually understandable. Two problems are that (a) the gag is indefinite, with no circling back once the operation concludes and (b) NSL is horrifically abused for stuff it shouldn’t be, since FBI realized the gagging lets them mostly get away with it.

Source: Have held more than one and read the citations.

https://en.wikipedia.org/wiki/Lavabit

Seems like the Europeans are the only ones stupid enough not to.

Europe has been destroyed in WWII only to be liberated by the USA and the USSR (China is also among the winners). The USSR collapsed and withdrew from Eastern Europe, on condition that it remains a buffer zone (think about Ukraine in this context).

The EU is therefore essentially a peace project, subject to the peace treaties ending WWII (this hasn't happened in N. Korea, think about it in this context).

Those treaties are still in force today, including the stationing of liberating forces. This pretty much sets the boundaries, including the defense (read supervision) of strategic resources, such as gas pipelines, energy grids, and yes, communication lines and information technology. Obviously, these restrictions hardly reflect current German economic strength (just like after WWI), which inevitably leads to tensions (‘The Germans Are Bad, Very Bad’, as the POTUS puts it).

Once Facebook arrived with localised versions on the European market it destroyed all of the clones. Talk about network effects.

Or perhaps you meant mobile operating systems, in which case I would note that the most promising and well-known mobile OS after Android, iOS, and Windows phone (all American) is SailfishOS, which is... Finnish.

So the US is definitely on top, what with all the software tech giants being based there, but Europe seems pretty relevant.

Also FOSS software can't solely be attributed to the one guy who started it. I would say the Linux Kernel is global and it took a lot from Unix.

The US and the UK are Indefinite Optimists while many in US tech are Definite Optimists (such as Elon Musk.)

Cultural attitudes about the future of our world has a huge influence on the type and velocity of innovation.

Those are generalizations, but just compare investment philosophies of various countries. EU: with a few exceptions that prove the rule, very conservative, less likely to back 100x technology innovations, more likely to back 2x innovations that have low risk and low reward (but enough reward to make a return.)

Russia and China: more likely to invest in keep-up technology (me-too stuff) that promotes domestic stability — much more defensive investing to promote Juche ideas. North Korean “tech” is the extreme example.

US: willing to bet huge on low percentage, future changing tech (speaking of the Valley specifically,) while much of the rest of the US tends to be closer to the EU in terms of risk tolerance, with notable exceptions.

You won’t have an EU investor funding self-driving cars generally and you won’t have a Valley investor funding incremental 2x tech (generally.)

All countries have visionaries and innovators, but due to who controls the finances (and tax policy,) most of those future Elon Musk types are shot down before they even get off the runway.

Exceptions abound of course, but that’s my general take.

Being local ones, they didn't have the same network effects like the US ones. Some of them still live, though.

Is the Pope catholic?

Yandex search predates Google.

Not to mention that the quality of it's search in Russian had been much better than Google's until at least 2010, as a Russian when I needed to search for something in Russian I didn't bother with Google because their search results were visibly much worse.

However, that's a very old story, I doubt that there is much of a connection now.

We do know for a fact that US General James Cartwright pleaded guilty to leaking Stuxnet. And then got pardoned by Obama.

Now, whether or not he was guilty of more than that, I don't think we know, but that's often the nature of plea deals.

While your basic point might be correct, this part is absolutely false. All major security groups actively research all APT groups, no matter where they are from.

For example, here's a 2015 report from (US Company) FireEye[1]. Page 11 talks about the Equation Group (as well as the UK-based Regin group).

It is worth acknowledging that Kaspersky was the first company to identify and name the Equation Group. However, this is likely to be because of the geographical overlap of activities: Kaspersky provides defensive support in Russia and the Middle East where the Equation Group is most active.

This is exactly the same as how Mandiant/Fireeye identified ATP-1 and Cozy Bear/Fancy Bear: they get called in to investigate breaches in the US where those state-supported groups are most active.

[1] https://www.fireeye.com/content/dam/fireeye-www/company/even...

I would like to see some actual evidence of this, instead of just allegations.

https://en.wikipedia.org/wiki/Equation_Group

An ordinary anti-virus company would never get involved in state-vs-state cyber warfare, let alone pour tons of money into researching it. How does that support their business model?

Do you think it's normal for a commercial company to spend so much time, money, and effort researching areas that have nothing to do with their core business, and will likely get them in trouble with their customers and antagonistic governments?

It seems like American companies tend to find Russian state-sponsored malware and Russian ones keep finding US/US allies-sponsored malware.

“There’s a Balkanization of cyberspace that’s occurring, and companies need to choose which side they’re on,” said Dmitri Alperovich, co-founder of U.S. security firm CrowdStrike.

http://www.reuters.com/article/us-media-tech-summit-flame/so...

Sounds to me like they've "chosen a side", like you're implying Kaspersky has.

Having a lot of experience in this space, no loyalties to Russia, and all loyalties to the US, if anywhere, I strongly disagree that there has ever been any meaningful current or historical link between Kaspersky and the Russian government.

Posts like this do not seem to be informed by actual industry experience and those speculations are not even agreeable to those who are suspicious of Kaspersky. You're sharing a lot of FUD.

For most private citizens that aren't of particular interest to the Russian government (e.g. aren't politicians, activists, dissidents), Kaspersky seems like an excellent choice.

Every AV product will be defeated by a targeted attack anyway.

Kaspersky, Snowden, Positive Technologies(which are also russian) are doing great service to community. Cyber weapon is still weapon and people should know about it.