Updated October 2026: This post has been expanded from its original December 2017 version with the full story behind the Barclays report, what the UK and U.S. governments actually did, and practical advice on choosing security software. It is a historical account; details describe the time it covers, not today.
In late November 2017, British newspapers reported that the UK's intelligence agencies were worried about an unusual target: the free antivirus software that Barclays gave its online banking customers. The software came from Kaspersky Lab, a Moscow-based security company. According to those reports, which relied on unnamed sources and were picked up by Business Insider, officials feared Russia could use the program to spy on around 2 million Barclays customers.
The claims were never confirmed on the record, and Kaspersky's founder, Eugene Kaspersky, dismissed them as rumour. But the story arrived in the middle of a much larger fight over whether Western governments could trust a Russian security company. This post looks back at what happened in the UK in late 2017, what the British government actually said, and how the dispute grew into a complete U.S. ban in 2024.
Why antivirus software worries intelligence agencies
Antivirus programs are among the most powerful software on any computer. To catch malware they need to see every file, run with the highest privileges, and send samples of suspicious files back to the vendor's cloud for analysis. They also update themselves automatically. That access is what makes them useful. It is also what makes them a concern if a government believes a foreign state could lean on the vendor.
The U.S. Treasury later put the concern plainly. It said Kaspersky's products have broad access to files and elevated privileges, which malicious cyber actors could exploit to compromise the computers it protects. None of this requires proof that a vendor has misbehaved. The worry is about what could be done, under the laws of the country where the vendor is based.
What was reported about Barclays
Barclays had offered Kaspersky's security software free to online banking customers since 2008. At the time, it was described as the first UK bank to give all its online customers a complete internet security package. The late-November reports said intelligence officials had concerns about the arrangement. Barclays was said to be reviewing the deal for commercial reasons, and the bank said it had never been advised by GCHQ, the UK's signals intelligence agency, against using Kaspersky products.
No official source ever confirmed that Russia had used the software to spy on Barclays customers. That claim came from anonymous sources, and it should be read that way.
What the UK government actually said
A few days later, the UK's National Cyber Security Centre (NCSC), part of GCHQ, made its position public. Its chief executive, Ciaran Martin, wrote to the permanent secretaries who run government departments about supply-chain risk in cloud-based products. He said Russia intended to target UK central government and critical national infrastructure. His advice was that Russian-made antivirus software should not be used on systems holding information that would harm national security if the Russian state got hold of it.
The guidance was narrower than many headlines suggested. It did not name Kaspersky. It was not a ban, since the NCSC said it is not a regulator. The NCSC's technical director said he saw no compelling case at that point to extend the advice to the wider public sector, businesses or individuals. The NCSC also said it was talking to Kaspersky about a framework that independent parties could verify, aimed at preventing UK data from reaching the Russian state.
Barclays acted on December 4, 2017. It made what it called a precautionary decision to stop offering Kaspersky to new users. It also told existing customers there was nothing to suggest they needed to stop using it, though it suggested they consider other suppliers if they were concerned.
- September 2017
U.S. Homeland Security orders federal agencies to stop buying Kaspersky products and remove them within 90 days. - Late November 2017
UK press reports say British intelligence is worried about Kaspersky software that Barclays gives its online banking customers. - December 1 to 4, 2017
NCSC head Ciaran Martin warns UK departments against Russian antivirus on sensitive systems. Barclays stops offering Kaspersky to new users. - December 2017
The U.S. defense authorization act for 2018 extends the ban to military computers. Lithuania bans the software on sensitive government computers. - May 2018
The Dutch government says it will phase out Kaspersky antivirus. - 2018 to 2020
Kaspersky opens transparency centers, starting in Zurich in November 2018, and moves core data processing for many customers to Switzerland. - March 2022
After Russia's invasion of Ukraine, the FCC adds Kaspersky to its list of national security threats. Kaspersky calls the decision political. - June 20 to 21, 2024
The U.S. Commerce Department bans Kaspersky sales in the U.S. from July 20 and updates from September 29. The Treasury sanctions 12 company leaders. - September 2024
Kaspersky leaves the U.S. market and replaces its software on U.S. customers' computers with UltraAV. - February 2025
Australia orders Kaspersky removed from government devices by April 1.
The bigger picture in 2017
The UK moves followed months of pressure in the United States. In September 2017, the Department of Homeland Security issued a binding directive requiring federal agencies to stop buying Kaspersky products and remove them from their systems within 90 days. In December, the National Defense Authorization Act for fiscal 2018 extended that ban to military computers. Lithuania restricted the software on sensitive government computers the same month, and the Netherlands announced a phase-out in May 2018.
Kaspersky denied any improper ties to the Russian government throughout. It also responded with what it called the Global Transparency Initiative. The company opened transparency centers where partners and regulators could review its source code, the first in Zurich in November 2018, and moved its core infrastructure for processing customer data from Russia to Switzerland.
What happened next
The transparency push slowed the pressure for a few years, but the war in Ukraine changed the picture. In March 2022, shortly after Russia's full-scale invasion, the U.S. Federal Communications Commission added Kaspersky to its list of equipment and services deemed a threat to national security. Kaspersky said the decision was political and offered to work with authorities.
The decisive step came in June 2024. The U.S. Commerce Department issued a final determination under an executive order on technology from foreign adversaries. It barred Kaspersky's U.S. arm and related companies from providing antivirus and cybersecurity products or services in the United States. New sales were banned from July 20, 2024, and software updates from September 29, 2024. On June 21, the Treasury sanctioned 12 Kaspersky executives and senior leaders. Commerce also added Kaspersky entities, including its UK company, to the Entity List, citing cooperation with Russian military and intelligence authorities.
Kaspersky closed its U.S. operation and laid off its staff there. In September 2024, it replaced its software on many U.S. customers' computers with UltraAV, a product from the U.S. company Pango. Some users were angry to find a different antivirus installed without a clear choice. Outside the U.S., Kaspersky still operates, and governments continue to take their own decisions. In February 2025, Australia ordered its removal from government devices, in line with the other Five Eyes intelligence partners.
| Country | Action | Scope |
|---|---|---|
| United States | 2017 directive and defense act; 2022 FCC listing; 2024 Commerce ban | Government at first, then all sales and updates to U.S. customers |
| United Kingdom | December 2017 NCSC guidance | Government systems holding national security information; not a ban, and not aimed at consumers |
| Lithuania | December 2017 restriction | Sensitive government computers |
| Netherlands | May 2018 phase-out | Government use |
| Australia | February 2025 directive | Government devices |
Kaspersky has denied the allegations of ties to Russian intelligence in every case.
What this means for you
For most home users, the lesson from the Kaspersky saga is not about one company. It is about how much trust you place in any program that has deep access to your computer.
- Start with what is built in. Windows includes Microsoft Defender, and macOS has its own built-in malware protection. For many people, these plus prompt updates are enough.
- If you still run Kaspersky in the U.S., it no longer receives updates, and outdated security software gives a false sense of safety. Check what is actually installed. If you have UltraAV and did not choose it, decide whether to keep it, switch to another product, or rely on the built-in protection.
- Outside the U.S., follow your own government's guidance. The UK's 2017 advice applied to sensitive government systems, not to the general public.
- Look at where a vendor is based and what laws it answers to. That was the core of the NCSC's argument, and it applies to every country.
- Be wary of free security software bundled with another service. Banks and retailers change partners, and you may end up with a product you never chose. Know what is on your machine and who updates it.
- Remove old security software cleanly using the vendor's uninstaller before installing a new product, so two programs do not conflict.
The 2017 Barclays story rested on anonymous claims that were never proven. What followed was real policy, built on a simple idea: antivirus software is trusted with everything, so who stands behind it matters as much as how well it catches malware.
Sources
- Computer Weekly: Barclays bank stops offering Kaspersky software to new users (2017)
- CyberScoop: UK's NCSC advises caution on Russian antivirus software (2017)
- U.S. Treasury: Treasury sanctions Kaspersky Lab leadership (June 21, 2024)
- Wikipedia: Kaspersky Lab
Top image: "Barclays Bank, West Kirby" by Rodhullandemu, CC BY-SA 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments