Interview: Eugene Kaspersky in Russia

After three hours in the Moscow evening traffic, our press party finally arrives at the Marriott Grand, a typical example of post-communist property speculation. Situated on Tverskaya Street, Moscow's central boulevard, it's just like any other international business hotel. You feel comfortable, cossetted and safe from the outside world, wherever that might be.

Outside, Tverskaya is full of streaking BMWs, Mercedes and Bentleys, plus the occasional old AvtoVaz, all hurtling to gain advantage on the hideous gridlocks that awaits them on Moscow's outer ring roads. The cars may now mark out the owner's status, but neither Lada nor Bentley can escape the uniform layers of filth that Moscow's weather dumps on every car and building. This is not a pretty city - in the gloom you are grateful for the neon and giant video screens placed incongruously on the top of apartment blocks.

Inside, you are back in the USA. The hotel is abuzz with Russian and overseas opportunists looking to make a few dollars in Putin's version of a free market economy. American, German, British, Russian: accents and languages coagulate in the atrium.

That evening Kaspersky Lab has laid on a drinks reception for the journalists it has invited to its annual press tour. As the vodka flows, I hear from successful Kaspersky executives of how it used to be, how you didn't need to worry, how everyday and everything was the same. The future would be the same; the state would look after you.

Now life is different. There is more opportunity, but also more uncertainty. Of course it's better to be able to make money but just like in the West, the new middle classes of Russia are finding it hard to maintain their status. Good schools, housing and medical care must all be paid for. It can be exhausting. Those who work for Kaspersky Lab are lucky - they get medical insurance, a nice place to work and a feeling of belonging.

A lot of that is down to the entrepreneurial drive and personality of its head of research and technology and joint founder, Eugene Kaspersky.

A native of Novorossiysk, a Black Sea port, Eugene graduated from the Institute of Cryptography, Telecommunications and Computer Science in Moscow, after which he worked on government projects.

Now in his forties, he has only recently abandoned the long hair and ponytail of the committed geek, but not the rock star persona and charisma that cling to him. For many, he is Kaspersky Lab.

His ten-year old company was born out of a project at the Kami Information Technology Centre, which saw Kaspersky lead a team to develop anti-virus software. That project eventually led to the creation of Kaspersky Lab in 1997.

It was while at Kami that he met his wife and co-founder, Natalya, and although now divorced, she has kept her name and position of CEO. Together they own around 80 percent of the company. In 2005 it made the Red Herring 100 Europe listing of private technology ventures worth watching. It is still worth watching.

I get to meet Kaspersky at one of the breakouts on the first day of the press tour. He may be more conventional in appearance than he used to be, but the beard, jeans and casual shirt remain. No suit here. He appears a little nervous but smiles as we sit down to talk in a Marriott bedroom converted into a meeting room.

His firm's business to date has been built on the existence of streams of viruses and effective means of killing them. Lately the industry seems to think that we should worry less about the virus threat. Kaspersky is not about to declare mission accomplished, however. Nor, according to him, is the world of cyber crime quite as easy to measure as some would have you believe.

"There are fewer traditional viruses, true," he said. "but I think the real reason is that kids are more interested in online gaming these days, plus the fact that it's getting harder to develop viruses for Windows. In the past, there were many underground internet magazines, where it was explained how to develop malicious code. Now there are far fewer."

So what about cyber crime? "Traditional criminal gangs are not yet connected with their IT counterparts. There are still two very different criminal businesses, two very different mentalities," he argues. "People who commit crime in the real world, you need ... well," he pauses, "a different attitude. Online, it's a virtual world, so it's easier to do it."

In other words, real crime needs real muscle and real guns, as opposed to wimpy geeks creaming bank details from unsuspecting web users. But this seems to contradict the intelligence emanating from the FBI and other agencies around the world that organised crime is moving into cyberspace and that criminal gangs are training young people, even putting them into college.

Kaspersky remains to be convinced. "We don't have exact information that these two worlds are connected. Maybe in the future they will be, but when, I don't know. And anyway, you don't need much technical training to socially engineer people to click a link or open their attachment," he claims. "It's more important to know how to enter the computer without user knowledge, without any notifications, without any questions, and sometimes they use very sophisticated tricks."

He gives as an example of how, in 2005, a ransomware Trojan worked not because of its technical mastery but thanks to the fallibility of human beings. The Trojan was developed in the Ukraine and encrypted data on a victim's PC, which could only be unlocked after the ransom had been paid to the developer.

"For a year we had no idea how the Trojan was downloaded and got into computers. Then, we discovered that the developer sent the Trojan to people registered on the Russian jobsite, job.ru. By exploiting the fact that these people didn't want the fact they were looking for a new job divulged to their current employer, they were easy prey," he said.

And social engineering can happen to the best of us, even graduates of one of Moscow's finest technical institutes. "I almost visited an infected web page after I got a message that told me to find out what people had written about me. So it's not just people who have no security awareness. It's possible to cheat anybody".

So if we are wrong, or at least overreacting to theories about what organised crime is doing in cyberspace, does Kaspersky think the hype should be exposed? After all, the activities of the bad guys is actually good for business.

"It's a double-edged sword. The hype helps us educate people and make them pay more attention to security but, on the other hand, we do have to explain that sometimes the news is wrong," he replies.

"Like the rumour that hackers were going to release 100,000 new viruses at the stroke of midnight on New Year's Eve 1999. There was a panic, and even some of the virus companies took on extra staff for the night to deal with the alleged threat. I always thought that it was just hype, and I was right," he said, folding his arms to make the point. He was probably right about Y2K too, but that's another story.

Kaspersky Lab has done well to get where it is, but it is a Russian company and, for better or worse, some in the West have certain views about doing business with Russians. A Russian anti-virus company may find it especially hard to pursue its ambitious targets for growth. However, Kaspersky has done it all.

"That was true five or seven years ago, when we started to enter the European market, and there was quite a lot of suspicion: 'It's a Russian IT company, worse; it's a Russian IT security company,"' Kaspersky said, seemingly enjoying recalling the scenario.

"I remember the first press tour in London, in 1999. Many journalists were implying the same thing; 'what the hell is a Russian company doing in Great Britain? Do you seriously think you can be successful here?' And now that's not a problem at all."

At least not for mainstream business, although Kaspersky would be surprised to land contracts with the Ministry of Defence or NHS anytime soon. And what about the US market? With relations between the United States and Putin's increasingly assertive Russia starting to creep back to Cold War levels of non-cooperation and mistrust, this might be more of a challenge than Western Europe has been.

"Yes, but it's not because we are Russian per se. It's just the same as in Russia," he claims. "The Russian government and military don't want to depend on technologies developed outside of their country, either."

But US business is patriotic too, and Kaspersky Lab will find itself up against the American giants on its home turf. "No problem," is the confident reply. "In the United States, we are focused on the SMB market. The customers are interested in the solution, and they don't pay too much attention to where it comes from."

Kaspersky's personal take on geopolitics is interesting. According to him, the Cold War is far behind us. Certainly the first one is, although some commentators may well be wondering into what kind of era the US missile defence system and Putin's willingness to use energy as a weapon against Russia's neighbours is taking us.

"Russia is being developed as a capitalistic country," Kaspersky said. "It's probably the most capitalistic country in Europe." With a Bentley showroom just outside Red Square, he may have a point. His views on other European countries is intriguing - Sweden: "mostly communist"; France: "socialistic"; and Great Britain: "partly socialist".

So in the rampant, regulation-free market that is modern Russia, Kaspersky Lab intends on expansion into the Middle East, India and Pacific countries, as well as Latin America. And it's the global corporate market the company is aiming for. To get there, it will follow the same path pioneered in its home market.

"In Russia we are very strong in the corporate market, but we started with a home product, moved on to SMEs, then to corporates," the firm's co-founder explains. "I think we'll have the same success in other countries. We are going to remain a technological leader, developing the highest-quality protection, and the BMW of the anti-virus market."

He breaks off at this point. Perhaps thinking of my British roots, or maybe even that symbolic Red Square. "Sorry, the Bentley of the anti-virus market," he smiles. I smile back, and then remember that Bentley is owned by the Volkswagen group.

Expansion is one thing, but you need to innovate to sustain that growth. Right now, innovation in IT is seen as emanating in California, India, Korea and Israel. Can Russia seriously be added to this list? Especially when many highly qualified people follow the IT dollars abroad.

"I hope that in a few years, Russia will be on the list of centres of innovation as well, because the government has finally understood that it's very good for business and profitable for the country," Kaspersky said. "The government has responded to the problem of Russians going abroad by developing our own centres of IT excellence, in Moscow and St Petersburg. I think they will be a success, and Russian developers who are working in Silicon Valley and elsewhere will come back."

He's confident too that those who are now abroad will bring back useful skills and invaluable experience of how western European or American companies work. "They know the standards, and they will help the new firms to educate staff on business procedures."

And Kaspersky believes that Russia, will gain an upper hand over the Chinese and Indians, who, he concedes, will achieve dominance in mainstream, mass- produced software. But when it comes to security and specialist high-end technologies, the story will be different.

"India and China will always be cheaper, but the facts are that they are not so successful at developing for the high-end. At the moment they are developing software for overseas companies, but not yet innovating software themselves," he said.

Curiously, he adds that there are several offshore programming companies in Russia and that Russian software developers, in Moscow, are better paid than in Spain or Italy and France.

Perhaps with an eye on the future and the industry shift towards risk management and less reliance on AV, Kaspersky has recently set up its InfoWatch division, currently only available in Russia. Without agreeing that this is some kind of long-term strategy, he admits that it is a departure in product and marketing strategy.

"InfoWatch is designed to deal with internal threats. Our main business until now has been to protect against external threats. Because this product is designed to protect confidential data, we customise this product for customers, because obviously they have different business procedures, different network structure, they have different databases etc," he explained.

"It isn't just to protect against malicious threats; it helps stop carelessness become a problem, such as employees sending confidential data home to work on. But it's effective against malicious insiders, too. For example, one client discovered that two of its employees were stealing the customer database."

InfoWatch is a behaviour management tool. It monitors what is going on in the system; the behaviour of data, file history, who accesses a file (and who tries to), who modified it, who was going to send it outside of the company or misuse it. It can also prevent basic functions such as printing or cut and paste.

"It is not a panacea. InfoWatch is designed to protect against the casual carelessness of employees and the more malicious insiders who look to steal data. But, it's not going to stop hard-core hacker attacks," he admited. "However, for the average employee, it makes it almost impossible to misuse the confidential data.

"It's a very interesting project, this," Kaspersky adds as an afterthought, as I ask whether he gets frustrated that even today organisations don't take information security seriously and, despite investing in technology, the car is often still left unlocked.

"Actually, businesses are more and more serious about security. Ten years ago, hardly anyone had anti-virus, now everyone does. I think businesses do understand now just how aggressive the threats are."

THE RUSSIAN APTITUDE FOR NUMBERS

Eugene Kaspersky is said to be a mathematical genius. But he's not the only one. For some reason, Russians are very good at maths. According to geek website TopCoder.com, Russia comes top in a ranking of 49 nations in programming expertise, before China and the US. The UK comes in at 27, just below Iran.

While that data might be disputed, there is no doubt that Russians are highly sought after for their scientific abilities, and many bright graduates have found willing employers in Silicon Valley and beyond.

Two years ago, Lieutenant General Boris Miroshnikov of the evocatively named Department K, a Russian anti-cybercrime agency, told a conference in London that: "Everyone knows that Russians are good at maths. Our software writers are the best in the world, that's why our hackers are the best in the world."

A slightly mixed message that perplexed his audience, but Miroshnikov was tapping into a national stereotype that has a basis in fact.

Russia has produced more world chess champions than any other nation - Boris Spassky,Anatoly Karpov and Garry Kasparov (pictured) are just three of the most famous. Part of this is attributed to the old Soviet regime's policy of promoting chess as a healthy pursuit for the masses, but the sheer brilliance of those champions said something about Russian aptitude for spatial as well as strategic thinking. The current world champion, Vladimir Kramnik, is also Russian.

And where would modern journalists be without the mathematical power of Google and the genius of one of its co-founders? One Sergey Brin, a Muscovite by birth and son of a mathematician.

eugeneinterviewkasperskysecurity