Free Newsletters
Technology & Business Daily

InfoWorld
Log-in | Register

NSA helped Microsoft make Vista secure

Revelations about NSA's involvement in Vista's development raise concerns about possible 'back-door' access to data by the spy agency


The U.S. agency best known for eavesdropping on telephone calls had a hand in the development of Microsoft's Vista operating system, Microsoft confirmed Tuesday.

The National Security Agency (NSA) stepped in to help Microsoft develop a configuration of its next-generation operating system that would meet U.S. Department of Defense (DOD) requirements, said NSA Spokesman Ken White.

[Talkback:  Are you concerned about NSA's involvement with Vista security?]

This is not the first time the secretive agency has been brought in to consult with private industry on operating system security, White said, but it is the first time the NSA has worked with a vendor prior to the release of an operating system.

By getting involved early in the process, the NSA helped Microsoft ensure that it was delivering a product that was both secure and compatible with existing government software, he said.

"This allows us to ensure that the off-the-shelf security configuration that the DOD customer receives is at a level that meets our standards," White said. "It just makes a lot more sense to be involved up-front, than it does to have the tail wag the dog."

The NSA's involvement in Vista was first reported Tuesday by The Washington Post .

The NSA has provided guidance on how best to secure Microsoft's Windows XP and Windows 2000 operating systems in the past. The agency is also credited with reviewing the Vista Security Guide published on Microsoft's Web site.

Microsoft declined to allow its executives to be interviewed for this story. But in a statement the company said that it asked a number of entities and government agencies to review Vista, including the NSA, the North Atlantic Treaty Organization (NATO), and the National Institute of Standards and Technology (NIST).

Still, the NSA's involvement in Vista raises red flags for some. "There could be some good reason for concern," said Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC). "Some bells are going to go off when the government's spy agency is working with the private sector's top developer of operating systems."

Part of this concern may stem from the NSA's reported historical interest in gaining "back-door" access to encrypted data produced by products from U.S. computer companies like Microsoft.

In 1999, U.S. Congressman Curt Weldon said that "high level deal-making on access to encrypted data had taken place between the NSA and IBM and Microsoft," according to EPIC's Web site.

With Vista expected to eventually power the majority of the world's personal computers, it would be tempting for the government agency to push for a way to gain access to data on these systems, privacy advocates say.

The NSA provided guidance on Vista's security configuration, but it did not open any back doors to Windows, White said. "This is not the development of code here. This is the assisting in the development of a security configuration," he said.

While the NSA is best known for its surveillance activities, the work with Microsoft is being done in accordance with the NSA's second mandate: to protect the nation's information system, White said. "This is the other half of the NSA mission that you never hear much about," he said. "All you ever hear about is foreign signal intelligence. The other half is information assurance."


Talkback:

commentPost a Comment

 

MOST COMMENTS

 
 





5 Things You Need to Know About Storage Virtualization
This Webcast feature insights from various InfoWorld articles, as well as primary research conducted by InfoWorld and sister company IDC to better understand demand drivers, challenges and opportunities provided by storage virtualization, as well as other flavors or approaches to virtualization Sponsor: HP

»  Click here to view this Webcast
  Zombie PCs Are Attacking Your LAN
A recent study showed that malware-infected zombie PCs are now a bigger threat to ISPs and Web infrastructure than DoS attacks. As this brand new IT Strategy Guide explains, an increased use of peer-to-peer techniques by the attackers has made it harder to fight back. Download now, compliments of Verio:

»  Click here to download now

- Special Advertising Partners -
WHITE PAPERS
 

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
INFOWORLD MARKETPLACE
 
» BUY A LINK NOW
 
 

Video

 
 
 

Podcasts

 
 
 

 

Columnists

 
 
 

Resource Center


Ads by techwords beta  [See your link here]
 




Sponsored Technology Links

 
 
 HOME  NEWS  BLOGS  PODCASTS  VIDEOS  TECHNOLOGIES  TEST CENTER  EVENTS  CAREERS   About | Advertise | Awards | RSS | Contact Us 

Copyright © 2008, Reprints, Permissions, Licensing, IDG Network, Privacy Policy, Terms of Service.
All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,
phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

CIO :: ComputerWorld :: CSO :: Demo :: GamePro :: Games.net :: IDG Connect :: IDG World Expo
Industry Standard :: IT World :: JavaWorld :: LinuxWorld :: MacUser :: Macworld :: Network World :: PC World :: Playlist