Microsoft Corp. will give governments and international organizations access to the programming code underlying several versions of its Windows operating system to allay security concerns, the company announced Tuesday.
Russia and the North Atlantic Treaty Organization (NATO) have already signed up for Microsoft’s new Government Security Program (GSP) and Microsoft is in talks with over 20 countries about the program, the Redmond, Wash., software maker said in a statement.
The program covers current versions, service packs and beta releases of Windows 2000, Windows XP, Windows Server 2003 and Windows CE and offers free access to the source code and other technical information governments need to conduct “robust security reviews” of Microsoft products, the company said.
Also, GSP access may include the CryptoAPI Software Development Kit, which provides source code for Microsoft’s cryptographic code implementations. Governments who want to develop their own cryptographic modules can do so with the Crypto Service Provider Development Kit, Microsoft said. Access to cryptography is subject to certain requirements, including U.S. export approval.
In addition, government IT professionals can visit Microsoft headquarters to review Windows development, testing and deployment processes and talk to Microsoft security staff, the software maker said. The program is open to national governments and international organizations only, not to state, provincial or local governments or their agencies, Microsoft said.
Governments signing up to the security program will be able to build systems that offer the high levels of security required for issues as large as national security, Microsoft said. However, government users will not be allowed to make modifications to the code or compile the source code into Windows programs themselves, Simon Conant, a Microsoft security specialist based in Munich, said.
“Governments under the GSP are allowed to view the code in a debugger, but not compile, redistribute or actually modify the code,” Conant, said. A debugger is a tool used to evaluate software code.
Changes in the code are possible, he said. Microsoft will work closely with governments to make sure that security concerns are handled, but modification and compiling of the code will remain at Microsoft, he said.
Not being able to compile the code makes Microsoft’s offer more air than substance, according to DK Matai, chief executive officer of mi2g Ltd., a security intelligence company in London.
“If the governments can’t compile the product, the GSP has more of a psychological assurance angle rather than offering the capability that comes through Linux or BSD-based solutions,” Matai said.
Laura Koetzle, an analyst with Forrester Research Inc. in Cambridge, Mass., said government users should “ideally be able to compile the code themselves and make changes themselves,” but that she understands why Microsoft is not allowing this. One major reason is liability, she said.
The announcement comes as Microsoft faces a growing battle against open-source software, primarily the Linux operating system, edging into government administration all around the globe. For governments on tight IT budgets, however, cost rather than security is the primary reason to switch to open-source software.
An open-source license allows users to access and modify the source code. Government users in Finland, Germany, France, Taiwan and the Philippines, among other countries, have adopted open-source software or are looking into doing that.
In a statement, Microsoft cites a Russian official who says the unavailability of source code and other technical information limited the desire of the Russian government to use Microsoft products. The GSP agreement is a significant step in addressing the Russian government’s IT security concerns, according to the official.
The GSP is a clear recognition on the part of Microsoft that open source is beginning to harm sales of its products to the public sector, according to mi2g’s Matai. “This decision is politically motivated to stop the faltering of sales to the government sector,” he said.
“GSP is a good bridge-builder with national governments,” said Forrester’s Koetzle. “Microsoft is not very happy with many national governments adopting policies favoring open-source software. This program is to solve that public relations problem to some degree.”
Microsoft already shares Windows code with governments and companies under different programs that are part of its Shared Source Initiative announced in 2001. The software maker last year announced the Trustworthy Computing Initiative, a focus on secure software of which the GSP is an important part, the company said.
Another Microsoft source-licensing scheme for government customers is the Government Source Licensing Program (GSLP). The GSLP is open to all government agencies with a set minimum number of Microsoft end-users in about 30 nations. Microsoft supports GSLP customers, but does not have a partnership with those and does not as a matter of course invite GSLP customers to its headquarters.
By contrast, Microsoft has identified over 60 nations that are currently eligible to participate in the GSP program, including countries such as China, Brazil and India. Eligibility depends largely on national intellectual property laws, the company said. Furthermore, a government does not have to be a Microsoft customer to qualify for the GSP program, which Microsoft sees as an interactive security partnership.
The GSP in itself does not make Microsoft’s products more secure, it provides disclosure, said Forrester’s Koetzle.
“This program is designed to provide national governments with access to the source code in order to look at the security features to make sure that they meet that government’s requirements. It does not make the products more secure,” she said.
Indirectly, through the feedback governments will give Microsoft, the program will help Microsoft make its products more secure, Koetzle said. However, governments won’t line up to look at Microsoft’s source code, she said.
“Countries will only ask to look at the code when they really need to. The Windows code is millions of lines. You will not look at it for fun. You will only look at this because of a specific security feature or because you are having a specific security problem,” she said.
Mark Litchfield, a security researcher with Next Generation Security Software Ltd. of Sutton, England, sees Microsoft’s GSP as a marketing move and wonders what functionality the debugger tool offered to look at the source code will have, but all in all offering GSP is a good move, Litchfield said.
“As a simple member of the general public, I feel happier that Microsoft offers the GSP, regardless of how restricted it may actually be,” he said.
The GSP may appease some foreign governments that, in these politically unstable times internationally, might have second thoughts about buying software from Microsoft, said mi2g’s Matai.
“There is a heightened concern among foreign governments that Microsoft is a U.S. company and that there may be a backdoor in the software that links computers back to some U.S. government agency that may be able to probe state secrets. The GSP program may allay such fears,” he said.
