Microsoft to let governments review Windows code

Microsoft Corp. will give governments and international organizations access to the programming code underlying several versions of its Windows operating system to allay security concerns, the company announced yesterday.

Russia and NATO have already signed up for Microsoft's new Government Security Program (GSP), and Microsoft is in talks with more than 20 countries about the program, the Redmond, Wash., software maker said.

The program covers current versions, service packs and beta releases of Windows 2000, Windows XP, Windows Server 2003 and Windows CE and offers free access to the source code and other technical information governments need to conduct "robust security reviews" of Microsoft products, the company said.

Also, GSP access may include the CryptoAPI Software Development Kit, which provides source code for Microsoft's cryptographic code implementations. Governments that want to develop their own cryptographic modules can do so with the Crypto Service Provider Development Kit, Microsoft said. Access to cryptography is subject to certain requirements, including U.S. export approval.

In addition, government IT professionals can visit Microsoft headquarters to review Windows development, testing and deployment processes and talk to Microsoft security staff, the company said. The program is open to national governments and international organizations only, not to state, provincial or local governments or their agencies, Microsoft said.

Governments that sign up for the security program will be able to build systems that offer the high levels of security required for matters as critical as national security, Microsoft said. However, government users won't be allowed to make modifications to the code or compile the source code into Windows programs themselves, said Simon Conant, a Microsoft security specialist in Munich, Germany.

"Governments under the GSP are allowed to view the code in a debugger, but not compile, redistribute or actually modify the code," Conant said. A debugger is a tool used to evaluate software code.

Changes in the code are possible, he said. Microsoft will work closely with governments to make sure that security concerns are handled, but modification and compiling of the code will remain at Microsoft, he said.

The announcement comes as Microsoft faces a growing battle against the open-source software -- primarily the Linux operating system -- that is edging into government administration all around the globe. For governments on tight IT budgets, however, cost rather than security is the primary reason to switch to open-source software.

An open-source license allows users to access and modify the source code. Government users in Finland, Germany, France, Taiwan and the Philippines have adopted open-source software or are looking into doing so.

In a statement, Microsoft cited a Russian official who said the unavailability of source code and other technical information limited the desire of the Russian government to use Microsoft products. The GSP agreement is a significant step toward addressing the Russian government's IT security concerns, according to the official.

Microsoft already shares Windows code with governments and companies under programs that are part of its Shared Source Initiative, which was announced in 2001. The company last year announced its Trustworthy Computing initiative, a focus on secure software of which the GSP is an important part, the company said.

Another Microsoft source-licensing scheme for government customers is the Government Source Licensing Program (GSLP). The GSLP is open to all government agencies with a set minimum number of Microsoft end users in about 30 nations. Microsoft supports GSLP customers but doesn't have a partnership with them and doesn't as a matter of course invite GSLP customers to its headquarters.

By contrast, Microsoft has identified more than 60 nations that are currently eligible to participate in the GSP program, including China, Brazil and India. Eligibility depends largely on national intellectual property laws, the company said. Furthermore, a government doesn't have to be a Microsoft customer to qualify for the GSP program, which Microsoft sees as an interactive security partnership.

Copyright © 2003 IDG Communications, Inc.

  
Shop Tech Products at Amazon