Summary
- Public procurement records show 131 purchases by 83 Romanian public institutions from March 2023 to September 2026.
- Romania adopted restrictions on Russian-origin cyber security products and blacklisted Kaspersky offerings.
- Purchase records do not establish that each product was installed or used; Kaspersky rejects security-risk allegations.
Romanian public institutions made 131 purchases of prohibited Kaspersky cybersecurity products after the government blacklisted the software, according to an investigation of public procurement records. Reporters at Public Record and the Organized Crime and Corruption Reporting Project identified 83 purchasing authorities between March 2023 and September 2026, including public bodies connected to healthcare, education, and research.
Romania adopted a law in 2022 restricting the acquisition of cybersecurity software originating from Russian individuals or entities. A government order published in March 2023 identified a broad set of Kaspersky products on a blacklist. The purchase records raise questions about enforcement of the procurement restrictions. The Romanian investigation also describes statutory exceptions for institutions responsible for national security, defence, and public order, which have separate safeguards; the legal position of an individual buyer must be assessed before assuming a violation.
The investigation included a Romanian research institution with links to defence-related work and NATO contracts. The National Institute for Laser, Plasma and Radiation Physics said it bought two-year licences for three devices, but told reporters the product had never been installed or used on its computers, servers, or other systems. That response illustrates the limit of procurement data: a recorded purchase does not itself prove deployment, access to sensitive information, or exposure of a protected network.
Kaspersky disputed the rationale for the restrictions. In a statement to the journalists, the company denied inappropriate government ties and argued that allegations about product risk reflected geopolitics rather than a demonstrated technical weakness. Those statements are the company’s position; they do not invalidate the Romanian legal restrictions or establish that the software was safe or unsafe in each purchasing environment.
A control failure at the purchasing stage
Procurement bans rely on several independent controls. Buyers need accurate rules, purchasing systems need to identify prohibited products, and administrators need to recognise software whose brand or reseller description may differ from the wording of a blacklist. A purchase can occur through a central contract, a small local procurement, or a reseller, making enforcement especially difficult across hundreds of autonomous public bodies.
The 131 transactions identified in procurement records do not establish how many devices actually ran Kaspersky software, or the total financial value of active licences. They also do not prove that officials intentionally evaded the prohibition. Determining responsibility requires knowing whether an institution renewed an existing contract, bought through an intermediary, failed to update specifications, or knowingly authorised a prohibited purchase after the law took effect.
Romanian law provides for administrative fines reported at between 50,000 and 200,000 lei for violations. The former minister associated with introducing the controls, Sebastian Burduja, attributed the continued purchases partly to limited enforcement capacity, according to the investigation. His remarks also included speculation about political sympathies within institutions; such speculation does not demonstrate intent in any particular procurement.
Cybersecurity products often require deep system permissions to inspect files, network activity, endpoints, and administrative events. Governments therefore treat supplier trust as a distinct category of risk alongside software quality. Restrictions can be imposed as national security policy without public evidence of malicious activity by the vendor in a particular customer’s environment. The Romanian investigation reports purchases against that policy rather than identifying a new technical exploit.
The purchases also create a challenge for transparency after a supplier is prohibited. Procurement records may show a contract award or licence renewal, but security inventories can record the installed product under a different name or through a managed service. A complete enforcement exercise would have to reconcile purchasing data, activation records, software inventories, and decommissioning evidence. OCCRP’s investigation establishes that the first of those sources contains transactions after the ban, while the detailed state of individual devices remains uncertain.
A definitive account of exposure would require inventories showing which products remained installed, whether licences were activated, where the software operated, and what remediation followed the purchases. The review establishes repeated transactions over more than three years, while the use and security consequences of those transactions remain institution-specific and, in several cases, unresolved.
