Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies had dropped Kaspersky years earlier. The June 2024 Commerce determination reached counties, school districts, utilities and contractors with a fixed date, and showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 20, 2024, the Commerce Department’s Bureau of Industry and Security issued a Final Determination barring Kaspersky Lab, Inc. from providing its antivirus and cybersecurity products and services in the United States or to US persons. It was the first determination under Commerce’s information and communications technology and services (ICTS) authority. New agreements with US persons were barred from July 20, 2024. Software updates, including malware signature updates, were barred from September 29, 2024. Commerce also added three Kaspersky entities to the Entity List, and on June 21 the Treasury sanctioned twelve Kaspersky executives. Federal agencies were already out: a 2017 DHS binding operational directive had ordered Kaspersky products removed from federal systems, and the fiscal 2018 National Defense Authorization Act barred their use across the federal government.
The determination was a non-event in most federal agencies. They had removed Kaspersky products under the 2017 directive and the statute that followed. The new rule covered everyone else subject to US jurisdiction. That included counties, cities, school districts, public utilities, special districts, and the contractors and managed service providers that support them. None had been covered by the federal-only measures, and some had kept Kaspersky precisely because it was inexpensive and worked. They now faced a fixed date. After September 29, the product would stop receiving the updates that make antivirus useful, and every day after that it would get less effective. A dated removal of a security tool is a procurement project with three costs: the cost of finding it, the cost of replacing it, and the cost of a supplier-controlled exit. Most public budgets had estimated none of them.
The cost of finding it
Finding direct licenses sounds easy and often was not. Procurement systems record purchase orders and contracts above a threshold. They miss software bought on purchasing cards, licenses bundled into a reseller’s quote under a generic line item, and installs inherited from a grant-funded project that ended years ago. Endpoint management tools see the devices enrolled in them, which often excludes water and wastewater plant workstations, library machines, field office laptops and systems run by independently elected officials.
Indirect exposure was harder still. Some security and network products had licensed detection technology from other vendors. Managed service providers chose the endpoint tools they ran for small public clients, and a contract for managed IT might never name the product. Answering the question meant asking each supplier in writing what it ran on the entity’s behalf and what third-party engines its products contained, then keeping the answers.
That work has a cost in staff time, and it recurs. The next restricted supplier will require the same sweep. A one-time scramble buys an answer. A joined record of contracts, purchase card spend, endpoint inventory and supplier disclosures buys the ability to answer quickly every time. The usual owner is the procurement office, with IT supplying device data and finance supplying card spend.
The cost of replacing it
The fixed date compressed procurement. Competitive bidding, legal review, board approval and contract execution routinely take longer than three months in public bodies. Emergency procurement rules exist in most jurisdictions, but they differ, require written justification and draw audit attention. Cooperative purchasing contracts and state term contracts offered a faster path for entities that already used them.
The replacement also rarely cost the same as what it replaced. Low-cost antivirus suited a small public body’s budget line. Comparable modern endpoint protection usually costs more per device, and endpoint detection and response products generate alerts that someone must triage. For an entity without a security operations function, the honest comparison is a product plus a monitoring service against the risk of running an unmonitored tool. That is a recurring operating cost, and it belongs in the budget discussion with the governing board, not inside an emergency purchase order.
Then there is labor. Removing an agent cleanly, deploying the new one, tuning exclusions for line-of-business applications and proving coverage on every device takes time from a small IT team. Devices outside central management, such as plant workstations, may need on-site visits and coordination with operators. Sequencing matters as well. Two antivirus agents on one machine often conflict, so the old product usually has to come off before the new one goes on, leaving a short gap that should be scheduled, not discovered. A simple tracker by device class, with target dates and a named owner for each, lets the board see progress before September rather than after.
The cost of a supplier-controlled exit
The third cost was the least visible. When a supplier leaves a market under compulsion, it decides how it leaves. It can stop updates, offer migration, or transfer its customer base to someone else. Each choice changes software on the buyer’s devices, and the buyer may have little say.
Public bodies can limit this exposure in their contracts and their configuration. Contracts for security software and managed services can require advance notice of any assignment of the contract or transfer of customers. They can require the buyer’s consent before the supplier installs different software, and an orderly exit plan with a defined period of continued support. Technically, endpoint management that controls which software can install, and alerts on new agents, gives the buyer a way to see and stop unexpected changes. Organizations should check with counsel on how the determination applies to specific resale and integration arrangements.
Federal restrictions on technology suppliers have come in waves since 2017, and each one reached further down the public sector. Treating supplier exit as a planned scenario, with an owner and a budget, is cheaper than discovering it as a deadline.
With hindsight
The dates held. In September 2024, before the update cutoff, Kaspersky moved many US consumer customers to UltraAV, a product owned by the Pango Group. Customers reported that the new software was installed without their active consent, as TechCrunch and others documented. The arrangement covered consumer products, but it showed exactly how a supplier-controlled exit can change software on a device without the owner’s choice.
Commerce used the same ICTS authority again. In January 2025 it finalized a rule restricting connected-vehicle software and hardware linked to China and Russia. Other federal actions on foreign technology suppliers continued, each asking buyers the same question: where is this, and what depends on it. For state and local governments, the Kaspersky deadline was a rehearsal. Entities that came out of it with a joined inventory and supplier disclosure clauses were better placed for the next one.