WASHINGTON/MOSCOW • Western technology companies, including Cisco, IBM and SAP, are acceding to demands by Moscow for access to closely guarded product security secrets, at a time when Russia has been accused of a growing number of cyber attacks on the West, a Reuters investigation has found.
The Russian authorities are asking Western tech companies to allow them to review source code for security products, such as firewalls, anti-virus applications and software containing encryption, before permitting the products to be imported and sold in the country.
The requests, which have increased since 2014, are ostensibly done to ensure foreign spy agencies have not hidden any "backdoors" that would allow them to burrow into Russian systems.
But those inspections also provide the Russians with an opportunity to find vulnerabilities in the products' source code - instructions that control the basic operations of computer equipment - current and former United States officials and security experts said.
While a number of US companies say they are playing ball to preserve their entree to Russia's huge tech market, at least one firm, Symantec, told Reuters it has stopped cooperating with the source code reviews over security concerns. That halt has not been previously reported.
Symantec said one of the labs inspecting its products was not independent enough from the Russian government.
US officials say they have warned firms about the risks of allowing the Russians to review their products' source code, because of fears it could be used in cyber attacks. But they say they have no legal authority to stop the practice unless the technology has restricted military applications or violates US sanctions.
The companies themselves say they are under pressure to acquiesce to the demands from Russian regulators or risk being shut out of a lucrative market. The companies also say they allow Russia to review their source code only in secure facilities that prevent the code from being copied or altered.
The demands are being made by Russia's Federal Security Service (FSB), which the US government says took part in the cyber attacks on Mrs Hillary Clinton's presidential campaign last year and the 2014 hack of 500 million Yahoo e-mail accounts. The FSB, which has denied involvement in both the election and Yahoo hacks, doubles as a regulator charged with approving the sale of sophisticated technology products in Russia.
The reviews are also conducted by the Federal Service for Technical and Export Control (FSTEC), a Russian defence agency tasked with countering cyber espionage and protecting state secrets.
Records published by FSTEC and reviewed by Reuters show that from 1996 to 2013, it conducted source code reviews as part of approvals for 13 technology products from Western companies. In the past three years alone it carried out 28 reviews.
A Kremlin spokesman referred all questions to the FSB. The FSB did not respond to requests for comment.
FSTEC said in a statement that its reviews were in line with international practice. The US State Department declined to comment.
Mr Roszel Thomsen, an attorney who helps US tech companies navigate Russia import laws, said the firms must balance the dangers of revealing source code to Russian security services against possible loss in sales. "Some companies do refuse," he said. "Others look at the potential market and take the risk."
If tech firms do decline the FSB's source code requests, then approval for their products can be indefinitely delayed or denied outright, US trade attorneys and officials said.
The Russian information technology market is expected to be worth US$18.4 billion ($25.5 billion) this year, according to market researcher International Data Corporation.
REUTERS
