http://www.zdnet.com/zdnn/stories/news/0,4586,2140612,00.html

New security flap over Windows NT


By Mary Jo Foley, Sm@rt Reseller
September 23, 1998 11:06 AM PT

Ed Curry is a man on a mission. Curry says he is out to warn the government that Windows NT is not secure, and will soon meet with the Secretary of Defense staff. Microsoft Corp. says he is on a personal vendetta against the company.

The issue over which the two sides are at odds is C2 certification of NT. C2 is a basic security rating that is one of several evaluations awarded by the National Security Agency (NSA), based on its Trusted Computer System Evaluation Criteria (TCSEC), or "Orange Book" criteria.






Behind the NT 5 delays




Both Microsoft (Nasdaq:MSFT) and Curry agree on a few key facts. In the mid-1990s, Curry was working closely with Microsoft to obtain the company's NCSC/NSA C2 evaluation of NT 3.5 with Service Pack 3. As part of that effort, Curry developed a set of hardware security diagnostics for NT and wrote a C2 Rating Maintenance Phase (RAMP) program on behalf of Microsoft.

From this point, Curry's and Microsoft's respective accounts diverge on what happened next.

SAIC to take over certification efforts
In 1995, Microsoft ended Curry's contract for reasons that "we can't divulge due to our lawyers' recommendations," according to a Microsoft spokesperson. Microsoft last year hired Science Applications International Corp. (SAIC) to continue its NT C2 certification efforts. An SAIC official says a networked NT 4.0 configuration could pass its first C2 milestone within a few weeks.

To date, Microsoft has not obtained C2 certification for any release of NT beyond version 3.5, the company acknowledges.

Curry, meanwhile, says he was forced out of business when Microsoft ceased working with him. In recent months, Curry stepped up his campaign to alert the government and the public in general about "the government's procurement of millions of copies of non-evaluated versions of Windows NT that fail to meet the C2-level security requirements of the Department of Defense and other agencies."

Curry wouldn't lie about MS violations
Curry has an Oct. 13 meeting slated with the Secretary of Defense staff. The meeting is in response to a letter that Curry sent to Defense Secretary William Cohen, alerting him to potential security violations involving Windows NT. In the letter, Curry says his C2 certification contract was discontinued by Microsoft because he refused to lie about Microsoft's violations of C2 guidelines.

"Microsoft has knowingly and willfully concealed information regarding security flaws in computer hardware from the NSA out of fear that revealing such flaws would reduce the number of copies of its products that would be purchased by the government," Curry's letter to Cohen says. "I have raised this issue internally with Microsoft, and in return have been the subject of both bribes and threats."

Microsoft's response: "Ed's making a mountain out of a molehill," in the words of a Microsoft spokesperson.

Will NT remain on the government's buy list? Stay tuned.