IC Workforce & Counterintelligence — 2026-10-18

Over 80 Romanian Public Institutions Continued Purchasing Banned Kaspersky Software Including Defense-Connected Research Institute

BLUFRomania's Kaspersky ban remains effectively unenforced, with defense-linked institutions among dozens of violators, exposing a persistent gap between national security policy and procurement practice.

Public Record reported on October 16 that 83 Romanian public institutions made 131 purchases of Kaspersky products from domestic distributors between March 2023 and September 2026, after a March 2023 ministry order blacklisted the products 12. OCCRP and Buletin.de relayed the findings 23. Buyers included hospitals, schools, municipalities, and Bucharest's Politehnica University 13. The National Institute for Laser, Plasma and Radiation Physics bought licenses for three devices within two months of the order 1. Public Record and OCCRP say the institute's annual reports show classified work and ties to the Defense Ministry and NATO; the institute told them the software was never installed 12. Former digitalization minister Sebastian Burduja attributed the purchases to understaffed enforcement 2.

Analysis
The Romanian Senate is very unlikely to adopt the bill extending the Kaspersky ban to 2035 by December 31, 2026. Confidence is moderate, because the bill remains in the Senate with no reported committee schedule while the current bans expire at year-end. Enforcement is the weak point. The ministry and digitalization agency lack monitoring staff, no application of the 50,000 to 200,000 lei fines has been reported, and the product list has not been revised since March 2023 despite a semiannual requirement. The laser institute's purchase shows that classified, defense-linked work may fall outside the security-body exemption. The purchases may instead reflect distributor auto-renewals and procurement inertia rather than deliberate intent. Public Record is the only original source, so the institute's denial of installation remains unverified. If the bill lapses, institutions could lawfully buy Kaspersky again, and security agencies would need to plan for that.

3 sources