Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered

The week

In the last week of June 2024, the federal government put an expiration date on antivirus software running in small counties, school districts and water utilities. For the IT managers looking after those computers, the product had been cheap, it worked, and nobody had given it much thought for years.

On June 20, 2024, the Commerce Department’s Bureau of Industry and Security issued a Final Determination barring Kaspersky Lab, Inc. from providing its antivirus and cybersecurity products and services in the United States or to US persons. Antivirus software sits on each computer and watches for malicious programs; it is the digital equivalent of a security guard checking everyone who comes through the door.

The decision had been a long time coming. The Justice Department referred Kaspersky’s provision of cybersecurity and antivirus software to Commerce in August 2021. Commerce issued an administrative subpoena to the company in May 2022 and served it with an initial determination in October 2023. Kaspersky answered in writing in January 2024, challenged the findings and proposed measures to reduce the risk. Commerce concluded that none of them, alone or together, did enough. Secretary Gina Raimondo signed the final determination on June 14, the department announced it on June 20, and it was published in the Federal Register on June 24.

It was the first determination under Commerce’s information and communications technology and services (ICTS) authority, the power that lets the department restrict technology transactions it judges to pose risks to US national security. The timetable was fixed. New agreements with US persons were barred from July 20, 2024. Software updates, including malware signature updates, were barred from September 29, 2024.

The authority behind it dated from May 2019, when Executive Order 13873 declared a national emergency over technology from foreign adversaries in US supply chains. Commerce issued rules to put it into effect in January 2021. Until the Kaspersky case, those rules had not been used to bar a supplier.

Commerce’s reasoning did not turn on whether the software worked. The determination said the concern was whether the products could be used strategically to harm the United States. It pointed to three features. Kaspersky’s core company was organized under Russian law and, Commerce concluded, had to comply with Russian government requests. Its software ran at the kernel level, the most privileged layer of the operating system, with broad access to data on each device. That access could be used to install malicious tools, or to delay or withhold the signature updates customers relied on.

The scope was wide. It covered Kaspersky’s antivirus and cybersecurity products, and Kaspersky software built into other companies’ products, including white-labeled products sold under another brand. From September 29, reselling the software or integrating it into other products was also barred, as was running Kaspersky’s cloud reputation service, the Kaspersky Security Network, for US users. Kaspersky’s threat intelligence, security training and consulting services were excluded. The prohibitions fell on Kaspersky and its successors rather than on customers. Commerce did not say that organizations still running the software would be penalized. The practical effect was much the same, because the software would stop being updated.

That second date was the one that mattered most. A malware signature is a kind of fingerprint for a known malicious program. Antivirus products receive new fingerprints constantly, often several times a day, so they can recognize the latest threats. Without updates, the guard at the door is working from an old book of mugshots, and it gets older every day.

Commerce also added three Kaspersky entities to the Entity List, a government list of foreign organizations that US companies need a license to do certain business with. On June 21 the Treasury sanctioned twelve Kaspersky executives, which restricts Americans from dealing with them.

Treasury acted under Executive Order 14024, which targets people operating in Russia’s technology sector. Those designated held senior roles, including chief operating officer and chief technology officer. Treasury noted that it had not designated Kaspersky Lab itself, its parent or subsidiaries, or its chief executive. The sanctions blocked the executives’ property under US jurisdiction and barred US persons from most dealings with them.

Federal agencies were already out. A 2017 DHS binding operational directive, a compulsory instruction to federal civilian agencies, had ordered Kaspersky products removed from federal systems. The fiscal 2018 National Defense Authorization Act, the annual defense spending law, then barred their use across the federal government.

That statutory ban also reached federal contractors, through a Federal Acquisition Regulation clause in force since 2018. It barred them from providing or using Kaspersky products in performing federal contracts. It said nothing about their other customers, or about suppliers that served only states and localities. In March 2022, the Federal Communications Commission had added Kaspersky to its Covered List of equipment and services judged to pose national security risks, which limits what federal communications subsidies can pay for. Each measure reached a defined group. None reached the computers of a county clerk or a rural water district.

So the news, for Washington, was old. For the many public bodies outside the federal government, and the contractors who serve them, it was brand new, and the clock had already started.

The determination was a non-event in most federal agencies. They had removed Kaspersky products under the 2017 directive and the statute that followed. The new rule covered everyone else subject to US jurisdiction. That included counties, cities, school districts, public utilities, special districts, and the contractors and managed service providers that support them. A managed service provider is a company that runs IT on a client’s behalf, often for small organizations that cannot afford a full IT department of their own.

None had been covered by the federal-only measures, and some had kept Kaspersky precisely because it was inexpensive and worked. They now faced a fixed date. After September 29, the product would stop receiving the updates that make antivirus useful, and every day after that it would get less effective.

A dated removal of a security tool is a procurement project with three costs: the cost of finding it, the cost of replacing it, and the cost of a supplier-controlled exit. Most public budgets had estimated none of them. First, what this kind of software actually does, and why removing it is harder than uninstalling an app on a phone.

What endpoint security is, and why it is hard to swap

In IT, an “endpoint” is any device at the edge of a network where people do their work: a laptop, a desktop, a server, a workstation in a treatment plant. Endpoint security is the software installed on each one to protect it. Traditional antivirus compares files against its book of signatures and blocks matches. Newer endpoint detection and response products, usually called EDR, go further: they record what programs are doing and flag suspicious behavior, such as a word processor suddenly trying to encrypt hundreds of files.

What a privileged agent can do

Commerce’s own reasoning is a useful description of the technology. An endpoint agent typically runs at the kernel level, the part of the operating system that controls memory, files and hardware. From there it can read almost anything on the device and stop almost any process. Most modern products also send information back to the supplier’s cloud: fingerprints of unfamiliar files, details of suspicious behavior, sometimes whole files for analysis. That cloud service lets the product recognize a new threat minutes after it first appears anywhere in the world.

Each of those features is a reason the product works. Each is also a channel the buyer does not control. A public body running such a product has, in effect, granted a supplier standing administrative access to every protected machine, plus a continuous flow of data about what happens on them. For most suppliers, in most years, that trade is sensible. The determination was a reminder that it is a trade, and that the terms depend on who stands behind the supplier.

The piece of software installed on each device is called an agent. It runs in the background with very high privileges, because it needs to see and stop anything on the machine. That privilege is exactly why the choice of supplier matters to governments. Whoever controls the agent’s updates can, in principle, change what runs on every device that has it.

It is also why swapping products is not trivial. The agent is woven into the operating system. Specialized business software, known in IT as line-of-business applications, may need “exclusions” configured so the security product does not mistake them for threats. A utility’s billing system or a public safety dispatch tool are typical examples. Each new product has to be tuned again. And most organizations run a central console, a management dashboard, to push settings and see which devices are protected. A replacement product means a new console, new reports and new habits for the staff who use them.

Suppose a county runs about a dozen departments, a small library system and a water treatment plant. Its two-person IT team bought low-cost antivirus years ago and installed it everywhere they could reach. The county’s contract register lists the product once. Nobody has looked at it since. This is a perfectly normal place to be, and it is where many public bodies found themselves in June 2024.

How a federal restriction travels down to a county

A decision aimed at one company reached a school district’s computers because of how it was built. The 2017 measures worked through the federal government’s own chain of command. A binding operational directive tells federal agencies what to do with their own systems. A defense authorization law sets rules for federal spending. Neither instructs a county or a city, which run their own IT and their own budgets.

The 2024 determination worked differently. It did not tell any buyer what to do. It told the supplier what it could no longer do: sign new agreements with US persons, and then send updates. Because the restriction sat on the supplier, it reached every US customer at once, from the largest company to the smallest special district, without any of them needing to be named.

The distinction matters to public leaders. Rules aimed at federal agencies can be watched from a distance, as something happening to someone else. Rules aimed at suppliers arrive directly in your own environment, on your own devices, on the supplier’s timetable. And because the restriction was on updates rather than on use, the product would keep running, apparently fine, while falling further behind the threats it was supposed to stop. A security tool that still shows a green tick but no longer knows about new threats is, in some ways, worse than no tool at all, because it invites false confidence.

Several federal tools, several different reaches

The Kaspersky episode used most of the federal toolkit for technology suppliers, and each tool reaches a different set of people. A binding operational directive binds federal civilian agencies and nobody else. A statute such as the 2018 defense authorization law binds federal agencies, and through procurement clauses, contractors when they perform federal work. The FCC’s Covered List governs what federal communications subsidies will pay for. The Entity List controls exports to named foreign organizations. Treasury sanctions block named people and the companies they own. Only the ICTS determination acted on the supplier’s relationship with every US customer at once.

For a state or local IT leader, the useful habit is to ask of each new federal action whom it binds, rather than whether it is about security. Most actions aimed at federal agencies are early warnings for everyone else. Actions aimed at suppliers are deadlines. The Kaspersky case contained both kinds: a 2017 warning that most public bodies outside Washington could treat as optional, followed seven years later by a deadline they could not.

The strongest objection, and why the costs stood anyway

A fair objection was raised at the time: the public record did not show the product being misused against US customers. Commerce’s detailed response to Kaspersky’s arguments sat in an appendix that was not made public, and the determination rested on capability and jurisdiction rather than on a disclosed incident. A county manager could reasonably ask why a cheap, effective tool had to go.

The objection matters for policy debates. It does not change what a public body had to do. The update cutoff was binding on the supplier, so the product would degrade whatever anyone thought of the reasoning. The costs of finding, replacing and exiting arrived on the same schedule either way. A procurement office can hold views about federal policy and still have to meet the date.

The cost of finding it

Finding direct licenses sounds easy and often was not. Procurement systems record purchase orders and contracts above a threshold. They miss:

• Software bought on purchasing cards, the government credit cards staff use for small purchases.
• Licenses bundled into a reseller’s quote under a generic line item, such as “security software.”
• Installs inherited from a grant-funded project that ended years ago.

Endpoint management tools, the systems IT uses to manage devices centrally, see the devices enrolled in them. That often excludes water and wastewater plant workstations, library machines, field office laptops and systems run by independently elected officials, such as a sheriff, clerk or assessor who controls their own office’s IT.

Indirect exposure was harder still. Some security and network products had licensed detection technology from other vendors, meaning a product with one brand on the box might contain another company’s engine inside. Managed service providers chose the endpoint tools they ran for small public clients, and a contract for managed IT might never name the product. Answering the question meant asking each supplier in writing what it ran on the entity’s behalf and what third-party engines its products contained, then keeping the answers.

Signals that find what the records miss

Records describe what was bought. The network shows what is running. Antivirus agents contact their supplier constantly for updates, and that traffic shows up in the logs of firewalls and of the domain name system, the service that turns web addresses into network locations. A search of those logs for a supplier’s update addresses will find machines that no inventory lists. So will a query of installed software and running services on every device the endpoint management tool can reach.

Finance data adds another view. Purchasing card statements carry merchant names, and renewal emails sent to individual staff often reveal subscriptions that never passed through procurement. Asking each department head to confirm, in writing, what security software their staff installed or renewed closes some of the remaining gap. No single source is complete. Together they usually are.

The supplier inside another supplier’s product

The determination explicitly covered Kaspersky software integrated into third-party products, including white-labeled products sold under another brand. Commerce observed that white-labeling makes it harder for users to know where code comes from. For a public body, that turns a question about one supplier into a question for every supplier of security and networking products: does anything you sell us contain this company’s code, engine or threat data?

A useful disclosure request is short and specific. It names the restricted company, asks whether any product or service supplied to the entity contains its software or depends on its services, and asks for a dated, signed answer. A supplier that cannot answer quickly is telling the buyer something about its own supply chain records. The answers belong in the procurement file next to the contract, where the next sweep can find them.

Where the hard cases are

The difficult devices differ by type of public body. In a water or wastewater utility, the workstations that run the control system are often supported by the system’s vendor, who may have qualified specific antivirus products. Changing the product can require the vendor’s approval, or risk the support agreement. In a school district, staff computers and administrative servers matter more than student devices, which may run operating systems with different protection models.

In a sheriff’s office or a court, systems that access criminal justice information fall under the FBI’s CJIS Security Policy, which requires protection against malicious code. Replacing the product there means keeping that control in place without a gap and documenting the change for the next CJIS audit. In a small special district with no IT staff, the managed service provider is the inventory, and the district depends entirely on its answer.

That work has a cost in staff time, and it recurs. The next restricted supplier will require the same sweep. A one-time scramble buys an answer. A joined record of contracts, purchase card spend, endpoint inventory and supplier disclosures buys the ability to answer quickly every time. The usual owner is the procurement office, with IT supplying device data and finance supplying card spend. For the county described above, that would mean one spreadsheet, or better, one simple database, that ties every security product to where it was bought, who supplies it and which devices run it.

The cost of replacing it

The fixed date compressed procurement. Competitive bidding, legal review, board approval and contract execution routinely take longer than three months in public bodies. Emergency procurement rules exist in most jurisdictions, but they differ, require written justification and draw audit attention. Cooperative purchasing contracts, pre-negotiated deals that many public bodies can buy from without running their own tender, and state term contracts offered a faster path for entities that already used them.

The procurement routes and what each one costs

Each route carried a different price in time and scrutiny. A full competitive solicitation is the cleanest for audit purposes and the slowest, and for many bodies it could not finish before September. Emergency procurement is fast but requires a written finding that the situation meets the jurisdiction’s definition of an emergency, and auditors will test that finding later. A cooperative contract is fast and defensible if the body is already a member and the product is on it. A small purchase under the local threshold may be possible for a very small entity, but splitting a larger need to stay under a threshold is exactly what auditors look for.

Governing boards add their own clock. Many county boards, school boards and utility commissions meet monthly. A purchase that needs board approval and misses the July agenda waits until August, which leaves September for deployment. Funding was another constraint. The State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, was one possible source, but grant cycles rarely move on a 90-day clock.

The replacement also rarely cost the same as what it replaced. Low-cost antivirus suited a small public body’s budget line. Comparable modern endpoint protection usually costs more per device, and endpoint detection and response products generate alerts that someone must triage. An alert is only useful if a person looks at it, decides whether it is real, and acts. Some entities have no security operations function, a team that watches for and responds to threats. For them, the honest comparison is a product plus a monitoring service against the risk of running an unmonitored tool. That is a recurring operating cost, and it belongs in the budget discussion with the governing board, not inside an emergency purchase order.

Three ways to replace it

Public bodies broadly had three options. The first was like-for-like: another conventional antivirus product at a similar price, with similar limits. The second was an endpoint detection and response product, managed by the entity’s own staff. The third was the same kind of product with a managed detection and response service, in which an outside team watches alerts around the clock and acts on them.

Each option traded money for capability. Like-for-like was cheapest and fastest, and left the body no better able to see an attack in progress. Detection and response without anyone watching produced alerts that went unread. The managed service cost the most and delivered the most, but it also meant giving another outside party privileged access, which is the very exposure the Kaspersky case had raised. Many organizations also had a capable antivirus product already present in their operating system, which could cover a gap while a longer procurement ran.

Whichever option a body chose, the new contract was the moment to fix the terms the old one lacked. Notice of assignment, consent before product changes, return or deletion of data on exit and a defined support period are easy to request in a competitive purchase. Under a cooperative contract the terms are mostly set in advance. A body may need an addendum, and counsel should confirm what the cooperative agreement allows members to add. Skipping this step leaves the next exit exactly as exposed as the last one.

A budget frame without guesswork

Boards approve better when the costs are sorted by kind. One-time costs include the first year’s licenses, staff hours for removal and deployment, site visits to plants and field offices, and any outside help to tune the new product. Recurring costs include annual licenses, the monitoring service if one is bought, and staff time to review what the monitoring service escalates. A third category is often left out: the work displaced. Every week a two-person IT team spends on an emergency replacement is a week not spent on patching, backups or the projects the board already approved.

Presenting all three lets a board see that the cheapest license is rarely the cheapest outcome. It also creates a record that the decision was made deliberately, which matters when an auditor or a newspaper later asks why the body spent what it did.

Then there is labor. Removing an agent cleanly, deploying the new one, tuning exclusions for line-of-business applications and proving coverage on every device takes time from a small IT team. Devices outside central management, such as plant workstations, may need on-site visits and coordination with operators, who will reasonably insist that nothing disrupts the systems that keep water clean.

Sequencing matters as well. Two antivirus agents on one machine often conflict, so the old product usually has to come off before the new one goes on, leaving a short gap that should be scheduled, not discovered. A simple tracker by device class, with target dates and a named owner for each, lets the board see progress before September rather than after. For that county, the tracker might have five rows: office desktops, laptops, servers, library machines and plant workstations, each with a percentage complete and a date.

Proving coverage is its own task. An auditor will want to see that the number of devices reporting to the new console matches the number in the asset inventory, and that every difference is explained: retired, offline, out of scope, or scheduled. The old product’s removal needs the same proof. A device that still runs the old agent after September is both a security gap and, depending on how it is used, a compliance question for counsel.

In practice, the sequence for such a county might run like this. In early July, the IT team confirms which devices run the product and finds that the plant workstations and two elected officials’ offices are not in the central console. Procurement checks whether a cooperative contract already covers an alternative product; it does, which saves weeks. Finance prices the new product and, separately, a monitoring service from an outside provider, and the county manager takes both numbers to the board in August as a recurring cost rather than a one-off. The IT team removes and replaces agents department by department, scheduling the brief gap on each machine for an off-peak hour. The plant goes last, after operators agree a maintenance window. By mid-September the tracker shows every row complete, and the board has seen it fill in month by month.

Nothing in that sequence is sophisticated. What makes it work is that someone owns it, it starts early, and the board sees the money before it is spent.

The cost of a supplier-controlled exit

The third cost was the least visible. When a supplier leaves a market under compulsion, it decides how it leaves. It can stop updates, offer migration, or transfer its customer base to someone else. Each choice changes software on the buyer’s devices, and the buyer may have little say. Remember that the agent runs with high privileges and receives updates automatically. That convenience in normal times becomes a vulnerability when the supplier’s interests and the customer’s diverge.

The data that leaves with the supplier

An exit also strands information. The old product’s console holds months or years of detection history, quarantine records and device logs. Those records may be needed to investigate an incident that started before the switch, and in many jurisdictions they may count as public records with retention rules of their own. Once the supplier’s service stops, the console may stop with it. Exporting that history before the cutoff, and deciding where it will be kept and for how long, is a step that is easy to skip and impossible to repeat.

Data flows in the other direction too. The supplier’s cloud service received information about files and activity on the body’s devices. A contract can require the supplier to delete or return that data on exit, and to confirm in writing that it has done so. Whether a given supplier will honor that clause in a compelled exit is uncertain, which argues for limiting what is sent in the first place.

Public bodies can limit this exposure in their contracts and their configuration. Contracts for security software and managed services can require:

• Advance notice of any assignment of the contract or transfer of customers to another company.
• The buyer’s consent before the supplier installs different software.
• An orderly exit plan with a defined period of continued support.

Technically, endpoint management that controls which software can install, and alerts on new agents, gives the buyer a way to see and stop unexpected changes. Whether the determination reaches a particular resale or integration arrangement is a question for lawyers.

Fast updates and buyer consent pull in opposite directions

There is a real tension here. Security software is valuable because it updates quickly, often several times a day, without anyone approving each change. A buyer that insists on approving every update would be safer from a supplier’s bad decisions and more exposed to new attacks. The workable line runs between content and product. Detection content, such as signatures and rules, flows automatically. Changes to the product itself, such as a new agent, a removal or a switch to a different supplier’s software, require notice and the buyer’s consent.

That line can be written into contracts and enforced in configuration. Endpoint management can block unapproved software installs and alert on new services. Staged rollouts, where updates reach a test group of machines before the rest, give the IT team a short window to catch a bad change. Neither control is perfect, and both cost some speed. They give the buyer a say over the changes that matter most.

Federal restrictions on technology suppliers have come in waves since 2017, and each one reached further down the public sector. Treating supplier exit as a planned scenario, with an owner and a budget, is cheaper than discovering it as a deadline.

Reading the next exit early

The Kaspersky case gave years of warning to anyone tracking it. The 2017 directive, the 2018 statute, the FCC’s 2022 listing and the steady rise of federal attention to Russian technology were all public. A body that kept a short supplier risk register, noting federal actions against any of its suppliers, would have seen the direction long before June 2024. The register does not need to be elaborate. It needs a named owner, a list of the suppliers whose software runs with high privilege, and a habit of checking federal actions against that list a few times a year.

The same register catches other kinds of exit. A supplier acquired by a company the body cannot contract with, a product line announced for retirement, or a supplier in financial trouble all start a clock. Each is easier to handle at the first signal than at the last.

Where antivirus costs show up for a public body

The bill for a missed antivirus deadline arrives as a new budget line, an audit finding or an unprotected workstation in a water plant. County commissioners, school board members and utility directors see each of them.

Money. A replacement that costs more per device, plus a monitoring service, is a new recurring line in the operating budget. Approving it openly is far better than discovering it buried in an emergency purchase.

Audit and compliance. Emergency procurement draws auditors’ attention, and rightly so. A public body that can show it inventoried its exposure, followed its rules and documented its choices is in a much stronger position than one that bought in a hurry.

Service to residents. The devices most likely to be missed, such as plant workstations, are often the ones running essential services. An unprotected computer in a water plant is not an abstract IT risk.

Staff. Small IT teams carry this work on top of everything else. A deadline with no plan means overtime, rushed changes and a higher chance of mistakes.

Trust. Residents expect their government to know what it runs and who controls it. Being unable to answer that question quickly, when a federal order makes it urgent, is a reputational risk in its own right.

Insurance. Cyber insurance applications commonly ask what endpoint protection is deployed and whether anyone monitors it. An unsupported product, or a replacement that nobody watches, can complicate renewal or a claim. Risk managers and insurance pools that serve local governments will want the same answers the board does.

Ready before the order arrived

A well-prepared public body would have met June 2024 calmly. Its procurement office could produce, within days, a list of every place the product ran, including plant and field devices, because contract, card, device and supplier records were already joined. Its managed service provider had disclosed in writing which tools and third-party engines it used, and refreshed that answer each year. It already held a cooperative contract for an alternative endpoint product, so replacement was a purchase, not a tender. Its board had seen a budget line for product plus monitoring, and approved it knowing it would recur. Its contracts required notice and consent before any supplier changed software on its machines.

The work also had clear owners. Procurement kept the joined record and ran the purchase. IT owned the device data, the deployment and the coverage evidence. Finance supplied card spend and priced the recurring cost. Counsel reviewed contract terms and any question about continued use. The governing board approved the budget and saw progress monthly. A small set of measures told the board where things stood: devices reconciled against inventory, supplier disclosures current, days needed to answer a named-supplier question, and devices remaining on the old product.

Who can require what

Preparation also depends on who has authority to act. A state chief information officer can usually direct executive branch agencies, but often not the courts, the legislature, independently elected officials or public universities. A county administrator may have no authority over the sheriff, the clerk or the assessor, each of whom may run separate IT. School districts often buy through regional education service agencies or state contracts, which can be quick but limits choice. Utilities and special districts answer to their own boards and depend on their vendors for control system support.

Those lines decide how a federal deadline is met. Where one office can mandate a change, a single plan works. Where authority is split, the plan has to be negotiated office by office, and the inventory must cover offices the central IT team does not run. A county that found in July that two elected offices ran their own antivirus would have had to persuade rather than instruct, and persuasion takes time a fixed deadline does not allow.

Less prepared bodies tended to fall into the opposite habits:

• Trusting the contract register. It shows what was formally bought, not what is installed.
• Forgetting the edges. Plant workstations, libraries and elected officials’ offices are the devices most likely to be missed.
• Not asking the managed service provider. If someone else chose your tools, you may not know what they are.
• Comparing license prices only. A modern product without anyone watching its alerts gives a false sense of security.
• Treating the deadline as an IT task. It is a procurement, budget and governance task with an IT component.
• Leaving automatic updates unchecked. If a supplier can change the software on every device without your consent, it eventually might.

Before the next supplier is named

• If a federal order named one of our software suppliers tomorrow, could we list every device running its product within a week?
• Do our records join contracts, purchasing card spend, device inventory and supplier disclosures, or would we be searching four places by hand?
• Has our managed service provider told us, in writing, which security tools and third-party engines it runs for us? When was that last updated?
• Is anyone actually watching the alerts our security tools produce? If not, what is our plan?
• Do our contracts require notice before a supplier transfers us to another company, and our consent before it installs different software?

These questions need no technical expertise to ask. They do need someone senior to insist on clear answers before the next deadline arrives.

The same questions apply to any supplier whose software runs with high privilege on public machines, whatever its country of origin. A restriction is one way a supplier can leave. Acquisition, insolvency, a product being discontinued or a faulty update are others, and the preparation is the same.

With hindsight

The dates held. In September 2024, before the update cutoff, Kaspersky moved many US consumer customers to UltraAV, a product owned by the Pango Group. Some customers told TechCrunch the switch happened without their knowledge or any choice. They found a different security product on their computers, put there by the departing supplier’s update mechanism.

The details matter. Kaspersky said it sent US customers an update on September 19 to make the switch, describing it on its forum as a way to avoid a gap in protection. Pango said customers had been notified in early September, but TechCrunch reported that it could not show where customers were told explicitly that their software would be replaced. Some users found Kaspersky removed and both UltraAV and a VPN product installed. Kaspersky had already said in July that it would wind down its US business.

The arrangement covered consumer products, but it showed exactly how a supplier-controlled exit can change software on a device without the owner’s choice. It was the risk described above, made real. The same automatic update channel that keeps security software current is also a channel through which a supplier can replace it. For a household, that is unsettling. For a public body, unknown software appearing on a computer that controls a pump or holds residents’ records would be a serious governance problem.

A month earlier, a different event had made the same point from another direction. On July 19, 2024, a faulty content update to CrowdStrike’s Falcon endpoint agent crashed Windows computers around the world; Microsoft estimated that about 8.5 million devices were affected. Airlines, hospitals and some emergency call centers were disrupted. No foreign adversary was involved. The same privileged, automatic update channel that the Kaspersky determination worried about had failed through an ordinary error.

The two events together sharpened the distinction between content and product. They gave buyers a pointed question for any supplier: how updates are tested and staged, and whether customers can control their timing. CrowdStrike said afterwards that it would stage its content updates and give customers more control over when they received them. The questions a county should ask of a departing supplier turned out to be largely the same questions it should ask of a trusted one.

Commerce used the same ICTS authority again. In January 2025 it finalized a rule restricting connected-vehicle software and hardware linked to China and Russia. Connected vehicles are cars and trucks that communicate over networks; public fleets are full of them. The same month, Commerce began a rulemaking on drones linked to China and Russia, another category many public agencies buy. Other federal actions on foreign technology suppliers continued, each asking buyers the same question: where is this, and what depends on it.

The determination itself carried no money for replacements, so the cost landed on local operating budgets and whatever grant funds each body could redirect. Federal decisions set the date; local budgets paid for the switch. Supplier restrictions did not stop with Kaspersky, and the ones that followed reached into ordinary public purchases, from fleet vehicles to drones.

For state and local governments, the Kaspersky deadline was a rehearsal. Entities that came out of it with a joined inventory and supplier disclosure clauses were better placed for the next one. Those that simply swapped one product for another, under pressure, without fixing the records, will face the same scramble each time a new restriction arrives.

Knowing what technology you run, who supplies it and how it can be changed is basic stewardship of public assets rather than a technical detail. That knowledge costs far less to build in an ordinary year than in the three months before a federal deadline.