The Australian government has mandated the removal of all Kaspersky Lab software and web services from federal systems and devices, citing heightened risks of foreign interference, espionage, and sabotage.
Issued under the Protective Security Policy Framework (PSPF) Direction 002-2025, the directive requires non-corporate Commonwealth entities to identify and eliminate all instances of Kaspersky products by April 1, 2025, while prohibiting future installations.
Home Affairs Secretary Stephanie Foster emphasized the decision stemmed from concerns over Kaspersky’s “extensive collection of user data” and potential exposure to “extrajudicial directions from a foreign government that conflict with Australian law”.
The Ban’s Scope and Purpose
The PSPF Direction 002-2025 applies to all systems and devices governed by the Public Governance, Performance and Accountability Act 2013 (PGPA Act), including government-issued mobile devices, laptops, and authorized third-party hardware.
The directive explicitly covers Kaspersky’s information security products, threat intelligence platforms, and cloud-based services, though it excludes third-party software with embedded Kaspersky code.
Foster’s assessment highlighted systemic vulnerabilities tied to Kaspersky’s data analytics and telemetry features, which could expose sensitive government networks to “transnational threat actors seeking unauthorized access”
This aligns with global apprehensions about software supply chain integrity and data sovereignty. Australia’s ban follows similar measures by the U.S. in 2024, which barred Kaspersky from operating in North America due to alleged ties to Russian intelligence.
Canada and the U.K. have also restricted Kaspersky’s use in critical infrastructure, positioning Australia as the third Five Eyes nation to enact such prohibitions.
Exemptions and Mitigation Requirements
Limited exemptions are permitted for entities engaged in national security, law enforcement, or regulatory functions, provided they implement stringent risk mitigations.
These include network segmentation, continuous monitoring, and restrictions on data flows to Kaspersky’s servers.
Agencies seeking exemptions must submit detailed justifications to the Commonwealth Security Policy Branch by March 15, 2025, and undergo quarterly audits to ensure compliance.
The Department of Home Affairs has urged critical infrastructure operators and state governments to adopt analogous safeguards, framing the ban as a “policy signal” to bolster cybersecurity positions nationwide.
This advisory extends to private-sector contractors handling government data, reflecting heightened scrutiny of third-party vendor risks.
Kaspersky’s Response and Industry Implications
Kaspersky Lab has repeatedly denied allegations of state affiliation, asserting its operations remain independent of governmental influence.
In its 2023 Sustainability Report, the company emphasized its Cyber Immunity strategy, which prioritizes secure-by-design principles and transparency initiatives like third-party code audits.
Despite these assurances, Western governments continue to express skepticism, particularly regarding Russia’s Federal Law, which mandates data localization and access for security agencies.
The ban underscores broader shifts in cybersecurity policy, with nations increasingly prioritizing supply chain vetting and zero-trust architectures.
Analyst groups predict accelerated adoption of alternatives like CrowdStrike, Palo Alto Networks, and Microsoft Defender for Endpoint across Australian agencies.
Meanwhile, the directive’s emphasis on asset stocktakes and unmanaged device governance aligns with PSPF Direction 002-2024, which mandates rigorous IT inventory controls for internet-facing systems.
Australia’s prohibition of Kaspersky products reflects escalating geopolitical tensions and a paradigm shift toward proactive cyber defense.
The prohibition, according to supporters, reduces existential threats to public-sector infrastructure, while critics claim it may damage diplomatic ties and restrict access to affordable security measures. Either way, the era of unchecked software dependency appears to be over.
Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response and Threat Hunting – Register Here
