on Russia not being a safe third country for data transfers, this publication). If the principles developed in the Schrems II ruling are taken as a basis, then the very fact that the parent company is based in Moscow raises considerable concerns about its use (cf. Regarding the cloud services that Kaspersky mentions, it would have to be checked whether the headquarters in Russia can access the data. The BSI is also concerned about the possibilities of compromising the end devices on which installed instances of Kaspersky software are located. One cannot help but notice that Kaspersky's statement only partially addresses the concerns expressed by the BSI: The BSI is not only concerned about the data stored at Kaspersky. Kaspersky also criticizes this in its response to the BSI's warning: since 2020, the data sent in by customers has been processed in data centers outside Russia. The fact that Kaspersky says it has already outsourced its servers to Switzerland in 2020 is not mentioned in the BSI's statement. d BSIG, but the notification is explicitly labelled as a 'warning'. One could also think of 'information about security-relevant IT properties of products' according to Section 7 (1) Sentence 1 lit. a 'warning in the event of a loss of or unauthorized access to data'. According to the wording, only Section 7 (1) sentence 1 lit. It is unclear exactly which authorization basis was used. The warning, issued by the BSI on the basis of the recently amended Section 7 of the BSIG, is available on the BSI site ( Warning, Press release).

Attacks by manipulating the software or the data stored at Kaspersky could also be carried out against the manufacturer's will due to pressure from Russian authorities, so there were doubts about Kaspersky's reliability. Because of the far-reaching rights that the antivirus software distributed by the company has, the software could also be used for attacks, according to the BSI. The BSI's warning and Kaspersky's responseĮven without proof of a concrete threat from products of the manufacturer Kaspersky, the BSI advises against their use. What is not regulated, however, is how responsible parties should handle the information. The BSI is thus using the role recently assigned to it to warn and inform the public about the IT security of products. The German Federal Office for Information Security (BSI) has been warning against the use of software from Kaspersky (market share probably around 10%) since Mathe software originating from the company should be replaced. BSI: Warning against products from Kaspersky.