How a digital Cold War with Russia could threaten the IT industry
For the last three years, all the world's eyes have been on Russia.
It began when the hopeful spirit of international peace and cooperation during the Sochi Winter Olympics turned to fear and uncertainty when Ukraine's government ousted its president, Viktor Yanukovych, a close ally of Russian president Vladimir Putin.
This was followed by a referendum and a vote in the Ukraine's Crimea region to secede from its parent country and to rejoin Russia, overturning the former Soviet Union's actions under Nikita Khrushchev to make it part of the Ukrainian Soviet Socialist Republic in 1954.
Russia followed by sending more and more troops into the region and confiscating Ukranian military bases and assets.
When we thought this had calmed down, concerns heightened when evidence of its breaching of systems run by the Democratic National Committee was brought to light after the election, as well as possible collusion by current and ex-Trump administration officials. Russia's active hacking of our government systems has very likely been going on much longer than that.
More recently, it appears that Russia has been attempting to sow conflict among different sectors of the US population and within our government's legislature by purchasing ten million unique pageviews of advertisements on Facebook. Google is also in the process of uncovering evidence that this has occurred on its online properties as well.
The reaction by the Western world has been a complete condemnation of Russia's activities. The United States has imposed numerous financial, economic, and travel sanctions on Russian officials, which include isolating key Russian financial institutions as well as freezing the US assets of Russian and Ukrainian individuals who were directly involved in the Crimean turmoil.
Russia has retaliated diplomatically with the United States by drastically reducing the size of our embassy in that county. The United States has confiscated Russian real estate assets and has returned the favor in kind.
While the European Union has imposed similar travel bans and asset freezes of key Russian individuals, political realities will likely stop them from imposing wider-range sanctions like those the US is continuing to impose, due to their heavy reliance on Russian natural gas.
While the United States, unlike Europe, is not a major consumer of Russian gas exports, it would be simplistic to say that Russia has no impact on US business at all.
A full-on Cold War with Russia and imposition of the kind of wide-ranging sanctions that we currently impose on Iran and other hostile states such as North Korea would actually have a real and costly impact on the technology industry, should the situation degrade further.
Let's start with Russian software companies themselves.
Many of these have significant market share and widespread use within US corporations. Some of these were founded in Russia, while others are headquartered elsewhere but maintain a significant amount of their development presence within Russia and other parts of Eastern Europe.
If you thought your Y2K mitigation was expensive, wait until your enterprise experiences the Russian Purge.
UK-incorporated Kaspersky Lab, for example, is a major and well-established player in the antivirus/antimalware space. It maintains its international headquarters, and has substantial research and development capabilities, in Russia.
It's also thought that Eugene Kaspersky, the company's founder, has strong personal ties to the Putin-controlled government. Kaspersky has repeatedly denied these allegations but questions about the man and his company remain and will be a subject of further scrutiny, particularly as US-Russia tensions escalate.
Recently evidence has emerged that Kaspersky's software was involved in compromising the security of a contract employee of the United States National Security Agency in 2015. Investigation as the company's actual involvement is still ongoing.
NGINX Inc., while less than ten years old, is the support and consulting arm of an open source reverse proxy web server project that is very popular with some of the most high-volume internet services on the planet. The company has offices in San Francisco, but it is based in Moscow.
Parallels, Inc., is a multinational corporation headquartered in Renton, Washington, that focuses extensively on virtualization technology as well as complex management stacks for billing and provisioning automation used by service providers and private clouds running on VMware's virtual infrastructure stack and Microsoft's Azure. However, their primary development labs are in Moscow and Novosibirsk, Russia.
Acronis, like Parallels, was founded in 2002 by Russian software developer and venture capitalist Serguei Beloussov. He left Parallels and became CEO of Acronis in May of 2013. The company specializes in bare metal systems backup, systems deployment and storage management software for Microsoft Windows and Linux and is headquartered in Woburn, MA, a suburb of Boston. However, it has substantial R&D operations in Moscow.
Veeam Software founded by Russian-born Ratmir Timashev, concentrates on enterprise backup solutions for VMware and Microsoft public and private cloud stacks. Like Parallels and Acronis, it is also multinational. The company maintains its US headquarters in Columbus, Ohio but much of its R&D is based in St. Petersburg, Russia.
These are only just a few examples. There are numerous Russian software firms generating billions of dollars of revenue which have products and services that have significant enterprise penetration in the United States, EMEA and Asia. There are also many smaller ones which perform niche or specialized services, such as subcontracting.
It should also be noted that many mobile apps, including entertainment software for iOS, Android and Windows also originate from Russia.
We aren't even counting the giant technology companies in the software and technology services industries that are household names in the United States and EMEA which due to the excellent reputation of Russian developers producing high-quality and value-priced work compared to their US and Western Europe-based counterparts, have invested hundreds of millions of dollars in having developer as well as reseller channel presence in Russia.
Contractor H-1Bs are almost certainly going to be cancelled en-masse or will not be renewed for Russian nationals performing work for US-based corporations. You can count on it.
The Trump administration does not need to levy Iran-style isolationist sanctions against Russia for a snowball effect to start within US corporations that use Russian software or services.
The cooling of relations has already made C-seats within corporate America extremely concerned about using software that originates from Russia or has been produced by Russian nationals. The most conservative of companies almost certainly will probably just "rip and replace" most off-the-shelf stuff and go with other solutions, preferably American ones.
The Russian mobile apps? BYOD blacklist MDM policies will wall them off from being installed on any device that can access a corporate network. And if sanctions are put in place by the current or next administration, we can expect them to actually disappear off the mobile device stores entirely.
Cut the Rope, which is made by Moscow-based Zeptolab, and countless games and apps originating from Russia could be no more if actual sanctions on that industry are put in place.
But America's C-seats aren't going to wait for the current administration to levy more sanctions. If there is any lack of confidence in a vendor's trustworthiness, or if there is any concern that their customer loyalty can be swapped out or influenced by the Putin regime and used to compromise their own systems you can be assured that software of Russian origin is going to disappear very quickly from US IT infrastructure.
Contractor H-1Bs are almost certainly going to be canceled en-masse or will not be renewed for Russian nationals performing work for US-based corporations. You can count on it.
As a Jewish American of mixed Russian, Belarussian, Polish and Ukrainian ethnicity it pains me to say all of these things and to subscribe to what could be classified as new-age McCarthyist paranoia, but I'm only saying out loud what many CEOs, CTOs and CIOs are thinking privately and in the sanctity of their own plush corporate offices.
Any vendor that is being considered for a large software contract with a US company is going to undergo significant scrutiny and will be asked if any of their product involved Russian developers. If it doesn't pass the most basic of audits and sniff tests they can just forget about doing business in this country, period.
So if a vendor does have prominent Russian developer headcount, they will have to pack up shop and move those labs back to the US or country that is better aligned with US interests. This goes especially for anybody wanting to do Federal contract work as well.
But then there is the issue of custom code produced by outsourced firms. That gets a lot trickier.
Obviously, there's the question of how recent the code is, and whether or not there are good methods in place to audit it. We can expect that there will be services products offered in the near future by US and Western European IT firms to pour through vast amounts of custom code so that they can be absolutely sure there are no backdoor compromises left behind by Russian nationals under the influence of the Putin regime.
If you thought your Y2K mitigation was expensive, wait until your enterprise experiences the Russian Purge.
I don't have to tell any of you just how expensive a proposition this is. The wealthiest corporations, sensing a huge risk to security and customer confidence will address this as quickly as they can and will swallow the bitter pill of costly audits.
But many companies may not have the immediate funds to do it and will try their best to mitigate the risk on their own, and compromised code may sit around for years until major system migrations occur and the old code gets (hopefully) flushed out.
We will be almost certainly be dealing with Russian cyberattacks from within the walls of our own companies for years to come, from software that was originally developed under the auspices of having access to relatively cheap and highly-skilled strategically outsourced programmer talent.
My greatest hope is that cooler heads will prevail and Vladimir Putin will step away from the brink of a new Cold War, one that will be not only destructive in terms of turning back over 30 years of partnership between our two nations since the fall of the Soviet Union, but also one which will yield tremendous amounts of economic damage for his country as well as ours.
Will Russian software and services become the first victim in a new Cold War? Talk Back and Let Me Know.
from Latest Topic for ZDNet in... http://ift.tt/2xu5Crb