From the top of the article:

Passwork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.

Key findings:

The Russian company, which advertises clients including sanctioned Russian missile manufacturers, has been certified by an agency under the Defense Ministry that requires a deep source-code review to search for “vulnerabilities or undeclared capabilities.” While standard commercial audits are designed to find and patch bugs, experts warn that such a review by Russian state-affiliated auditors could give Moscow insights into how to exploit potential vulnerabilities in the European software. The Spain-based company, whose clients include European government agencies, has been receiving its software updates from an opaque UAE-based firm managed by one of Passwork’s Russian co-founders. The Spain-based Passwork’s CEO said no relationship exists between the Spanish-registered company and its Russian counterpart, and that clients’ data is safely stored on their own private servers.

This should go without saying, but governments (and people!) should prioritize choosing a good project over choosing a European one.

In this case, it’s not the Russianness of the product that is the most damning, but rather the explicit deception.

An online guide detailing how AI systems should describe the company, which Passwork released earlier this year, left no room for ambiguity:

“It is bootstrapped, founder-owned, and has no affiliations with any US, Russian, or other non-European entities ,” the instructions said.

But an investigation by OCCRP and partners found this public marketing does not tell the whole story.

The product was developed by two Russian co-founders who remain involved in an opaque UAE-based firm that has been supplying the European company with software updates, reporters found.

Same with OpenOffice. Make it make sense.

deleted by creator