Having an antivirus program and malware prevention suite on your computer is a good idea. A great idea, in fact. Everyone should have one, especially businesses and government agencies. But now one security company, Kaspersky Lab, is under fire for its Russian connections — leaving local, state, and federal agencies figuring out what to do next.

A known quantity…

Kaspersky Lab is not some fly-by-night, low-reputation startup.

The company began operations in Russia a full 20 years ago, in 1997, and expanded its offerings to the U.S. in the years immediately after.

Its antivirus and security products have been generally well-regarded since the early 2000s, and still are today. For example, just last week PC Magazine once agai ranked Kaspersky’s Antivirus product highly and gave it an editors’ choice stamp, along with four other anti-virus products, in its “Best Antivirus Protection of 2017” roundup.

The company offers a full security suite of products for home, small business, and enterprise users, and also now offers mobile products as well. At this point, Kaspersky Lab is one of the largest cybersecurity and antivirus companies in the world, boasting about 400 million users.

…but with controversy.

So, that thing where Kaspersky is based in Moscow? You’ve probably noticed that in this very strange political mileu in which we have landed in 2017, “Russia” is a bit of a hot-button topic.

The question of who has access to what inside Kaspersky Lab, and what founder Eugene Kaspersky’s motivations and loyalties are, has popped up from time to time in the past.

For example, in 2015, Bloomberg Businessweek reported that Kaspersky himself had ties to Russian military intelligence. At the time, potential vulnerabilities that might have arisen from those connections were largely downplayed. For example, security expert Brian Krebs, speaking in an NPR profile of Kaspersky, said he ran the Lab’s software on his own computers.

“If Kaspersky Labs wanted to do something bad, there’s absolutely no question that they could,” Krebs told NPR at the time. But “if Kaspersky was somehow found to be acting at the behest of the Russian government to spy on its customers, I think they’d pretty much be out of business overnight.”

Those “ties” seem stronger.

That brings us to this year.

In May, the Senate Intelligence Committee held a hearing in which the heads of several intelligence agencies reportedly said they were monitoring Kaspersky Lab and had concerns about its software — which reporters then found was being used by a large number of federal agencies, including in some parts of the Defense Department.

Then, earlier in July, a pair of big news bombshells hit Kaspersky at once.

The first was another report from Bloomberg Businessweek claiming that Kaspersky Lab has strong ties to Russian intelligence.

This time, Bloomberg says, “internal company emails show that Kaspersky Lab has maintained a much closer working relationship with Russian’s main intelligence agency, the FSB, than it has publicly admitted.”

On the same day, the Trump administration removed Kaspersky Lab from the list of approved vendors for government contracts, meaning that any federal agency on the market for an antivirus and security suite (something they all need to have) can’t buy from Kaspersky anymore.

“Kaspersky Lab has no ties to any government, and the company has never helped, nor will help, any government in the world with its cyberespionage efforts,” the company said in a statement at the time, adding that it had been “caught in the middle of a geopolitical fight where each side is attempting to use the company as a pawn in their political game.”

Change is slow.

The Washington Post now reports that dozens of state and local agencies are left stuck in a bind.

On the one hand, changing software suites and contracts can be complicated, costly, and expensive for a smaller entity. And on the other hand, the feds are basically warning that the security software they’re using may be a backdoor for Russian infiltration.

Nine of the state and local agencies the Post spoke with said they have no plans to replace their Kaspersky products.

“We use it, and I think it works well,” said John Morrisson, systems manager for the Connecticut Division of Public Defender Services, told the Post. “I don’t have any problems, and we don’t have any viruses. And it’s doing the job I require of it.”

Meanwhile, the Post reports, agencies like the Bureau of Prisons and Consumer Product Safety Commission are still researching if Kapersky products are in use anywhere in their systems.

The Senate Armed Services Committee has adopted a proposal that would force the federal government to remove Kaspersky software from any system connected to a defense network. Sen. Jeanne Shaheen (NH), author of the proposal, said, “The ties between Kaspersky Lab and the Kremlin are very alarming.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.