UPDATE: Microsoft lets governments review Windows code

Microsoft Corp. will give governments and international organizations access to the programming code underlying several versions of its Windows operating system to allay security concerns, the company announced Tuesday.

Russia and the North Atlantic Treaty Organization (NATO) have already signed up for Microsoft's new Government Security Program (GSP) and Microsoft is in talks with over 20 countries about the program, the Redmond, Washington, software maker said in a statement.

The program covers current versions, service packs and beta releases of Windows 2000, Windows XP, Windows Server 2003 and Windows CE and offers free access to the source code and other technical information governments need to conduct "robust security reviews" of Microsoft products, the company said.

Also, GSP access may include the CryptoAPI Software Development Kit, which provides source code for Microsoft's cryptographic code implementations. Governments who want to develop their own cryptographic modules can do so with the Crypto Service Provider Development Kit, Microsoft said. Access to cryptography is subject to certain requirements, including U.S. export approval.

In addition, government IT professionals can visit Microsoft headquarters to review Windows development, testing and deployment processes and talk to Microsoft security staff, the software maker said. The program is open to national governments and international organizations only, not to state, provincial or local governments or their agencies, Microsoft said.

Governments signing up to the security program will be able to build systems that offer the high levels of security required for issues as large as national security, Microsoft said. However, government users will not be allowed to make modifications to the code or compile the source code into Windows programs themselves, Simon Conant, a Microsoft security specialist based in Munich, said.

"Governments under the GSP are allowed to view the code in a debugger, but not compile, redistribute or actually modify the code," Conant, said. A debugger is a tool used to evaluate software code.

Changes in the code are possible, he said. Microsoft will work closely with governments to make sure that security concerns are handled, but modification and compiling of the code will remain at Microsoft, he said.

Not being able to compile the code makes Microsoft's offer more air than substance, according to DK Matai, chief executive officer of mi2g Ltd., a security intelligence company in London.

"If the governments can't compile the product, the GSP has more of a psychological assurance angle rather than offering the capability that comes through Linux or BSD-based solutions," Matai said.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine