US-based cyber firm McAfee said it will no longer permit foreign governments to scrutinise the source code of its products, halting a practice some security experts have warned could be leveraged by nation-states to carry out cyber attacks.
Reuters reported in June that McAfee was among several Western technology companies that had acceded in recent years to greater demands by Moscow for access to source code, the instructions that control basic operations of computer equipment.
The reviews, conducted in secure facilities known as "clean rooms" by Russian companies with expertise in technology testing, are required by Russian defence agencies for the stated purpose of ensuring no hidden "backdoors" exist in foreign-made software.
But security experts and former US officials have said those inspections provide Russia with opportunities to find vulnerabilities that could be exploited in offensive cyber operations.
McAfee ended the reviews earlier this year after spinning off from Intel in April as an independent company, a McAfee spokeswoman said in an e-mail to Reuters last week.
She added there had been no evidence of a security issue related to the reviews.
Reuters reported this month that Hewlett Packard Enterprise (HPE) allowed one such testing company, Echelon, to review on behalf of a Russian defence agency the source code of cyber defence software known as ArcSight, which is used by the Pentagon to guard its computer networks.
That arrangement has prompted questions from lawmakers in Washington amid broader concerns about Russia's use of digital means to sow discord and interference in elections in the US and other Western countries, allegations the Kremlin has repeatedly denied.
In a letter last week to Defence secretary James Mattis, Democratic senator Jeanne Shaheen, asked how the Pentagon manages risks when using software that has been scrutinised by foreign governments.
HPE has said in the past that such reviews have taken place for years at a research and development centre it operates outside of Russia.
ArcSight was sold to British tech company Micro Focus International in a deal completed in September.
McAfee also allowed Echelon to review its software source code, Reuters reported in June. Such tests were conducted in a secure environment at a McAfee facility in the US where the source code could not be copied, a spokeswoman said.